| Age | Commit message (Collapse) | Author |
|---|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
Introduce src/helpers/write-config-file-value.py to patch a saved config.boot
from scripts by writing a quoted CLI path with an optional value (omit --value
to create a valueless node).
Extend vyos.utils.config.write_saved_value() to safely update saved configs:
create missing parent nodes before tagging (ConfigTree.set_tag requires nodes
to exist) and then write the requested value/valueless leaf back to disk.
Remove the legacy serial console activation script which is now replaced by the
helper-based approach. The helper is run once during ISO Image assembly and will
inject the approprate serial console defintiions into config.boot.default.
|
|
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
|
|
geoip: T7926: T8049: Refactor geoip code and add MaxMind support
|
|
Large config commits (`service config-sync`) can block the REST API request
path and sometimes must be deferred (e.g., when changing `service https`).
This commit introduces an in-memory background operation manager
that queues (FIFO) full configure operations (commands + commit/commit-confirm)
as single jobs, tracks status/result, and exposes active operations
via `/retrieve/background-operations`.
|
|
|
|
* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
|
|
T8146: Confirm the key when config encryption is configured without TPM
|
|
|
|
|
|
|
|
The standalone script teardown-config-session.py is called on CLI
config-mode exit, to close the persistent vyconf config session. Instead
of injecting the config-mode env var into the external script to
indicate a non-ephemeral session, add keyword 'extant' to find existing
session.
|
|
wlb: T7966: Restore default route when interface disconnects/reconnects
|
|
|
|
PrivateTmp needs to be disabled, otherwise we can not load the current
VyOS configuration to reconfigure the service automatically when certbot
runs.
|
|
|
|
Solves the problem that vyos-configs in FRRender caches configuation and
DHCP changes are ignored.
* Add src/helpers/vyos-request-configd-update.py that requests vyos-configd
to update FRR configuration.
* Make dhclient hooks use it instead of calling protocols_static.py
* Make FRRender cache not only configuration but also DHCP gateways so
that is any of them changes, FRR configuration is updated
|
|
* Refactor XML a little: move common dhcp-interface properties to
separate include file
* Add failover support for dhcp-interface
* Add test for DHCP in failover protocol
|
|
* Added 'protocol failover' to 'set vrf name':
set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2
* Added vrf and interface to target:
set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue
set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1
Last two are needed when check VRF is not same as route VRF.
In this case icmp can use any/both options, tcp requires `vrf` and
arp requires `interface`
|
|
As T7885 turns out to be a config load related bug the user will only be
informed when entering conf mode that something is off.
vyos@vyos:~$ configure
WARNING: There was a config error on boot: saving the configuration now could overwrite data.
You may want to check and reload the boot config
More information is displayed on tty0 of the router - but not everyone has
access to tty0. This change is about copying the message displayed on tty0 to
the MOTD system.
|
|
T7709: Add file sync and atomic write to config save script
|
|
Config save is provided by the helper script in both CLI and
configsession (hence also in the http api).
Use utilities write_file_sync and write_file_atomic, in accordance with
permissions and location:
If the target is in /opt/vyatta/etc/config or /config, use
write_file_sync; if, moreover, the caller has permissions, use
write_file_atomic. Otherwise, fall back to util write_file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Move encrypted volume check before key input
Unmount any conflicting config bind mounts
|
|
The mount point /opt/vyatta/etc/config is considered the source of truth
whereas /config is simply a bind mount of convenience. As the latter is
no longer defined at boot, all operations should use the former.
|
|
wlb: T114: Add firewall group support for WAN load balancer
|
|
anywhere
Fix this build warning by placing the vyos_net_name script in it's own udev
folder to not accidently be copied to a wrong location.
|
|
|
|
The utility write_file_atomic does not correctly update the file in the
bind mount directory /config. Revert for investigation.
This reverts commit c140f827f3117609908a3a18034027d3d78149ac.
|
|
T7718: expose validate_tree* methods and add validate-config script
|
|
|
|
|
|
|
|
T7651: VPP use pid not ppid as default in vpp-failure-handler.service script
|
|
The reset_section.py script is used in a limited case for both (1)
recovery from an apply error in a config mode script and (2) recovery by
a service crash in a failure handler service. In the latter case, the
default pid must be os.getpid, not os.getppid, so as not to be called by
pid 1.
|
|
T7628: Fix non-TPM backed config encryption
|
|
T7625: load-balancing: prune limit key if not configured
|
|
|
|
|
|
|
|
|
