| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
WLB per-interface routing tables only contain a default route. When
LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes
it to these tables where internal destinations (BGP, connected, DNAT)
have no matching route and incorrectly exit via WAN.
Add ip rule with table main suppress_prefixlength 0 before each
per-interface table rule. This checks the main routing table first
for specific routes but suppresses the default route, so only
internet-bound traffic falls through to WLB per-interface tables.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
Introduce src/helpers/write-config-file-value.py to patch a saved config.boot
from scripts by writing a quoted CLI path with an optional value (omit --value
to create a valueless node).
Extend vyos.utils.config.write_saved_value() to safely update saved configs:
create missing parent nodes before tagging (ConfigTree.set_tag requires nodes
to exist) and then write the requested value/valueless leaf back to disk.
Remove the legacy serial console activation script which is now replaced by the
helper-based approach. The helper is run once during ISO Image assembly and will
inject the approprate serial console defintiions into config.boot.default.
|
|
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
|
|
geoip: T7926: T8049: Refactor geoip code and add MaxMind support
|
|
Large config commits (`service config-sync`) can block the REST API request
path and sometimes must be deferred (e.g., when changing `service https`).
This commit introduces an in-memory background operation manager
that queues (FIFO) full configure operations (commands + commit/commit-confirm)
as single jobs, tracks status/result, and exposes active operations
via `/retrieve/background-operations`.
|
|
|
|
* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
|
|
T8146: Confirm the key when config encryption is configured without TPM
|
|
|
|
|
|
|
|
The standalone script teardown-config-session.py is called on CLI
config-mode exit, to close the persistent vyconf config session. Instead
of injecting the config-mode env var into the external script to
indicate a non-ephemeral session, add keyword 'extant' to find existing
session.
|
|
wlb: T7966: Restore default route when interface disconnects/reconnects
|
|
|
|
PrivateTmp needs to be disabled, otherwise we can not load the current
VyOS configuration to reconfigure the service automatically when certbot
runs.
|
|
|
|
Solves the problem that vyos-configs in FRRender caches configuation and
DHCP changes are ignored.
* Add src/helpers/vyos-request-configd-update.py that requests vyos-configd
to update FRR configuration.
* Make dhclient hooks use it instead of calling protocols_static.py
* Make FRRender cache not only configuration but also DHCP gateways so
that is any of them changes, FRR configuration is updated
|
|
* Refactor XML a little: move common dhcp-interface properties to
separate include file
* Add failover support for dhcp-interface
* Add test for DHCP in failover protocol
|
|
* Added 'protocol failover' to 'set vrf name':
set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2
* Added vrf and interface to target:
set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue
set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1
Last two are needed when check VRF is not same as route VRF.
In this case icmp can use any/both options, tcp requires `vrf` and
arp requires `interface`
|
|
As T7885 turns out to be a config load related bug the user will only be
informed when entering conf mode that something is off.
vyos@vyos:~$ configure
WARNING: There was a config error on boot: saving the configuration now could overwrite data.
You may want to check and reload the boot config
More information is displayed on tty0 of the router - but not everyone has
access to tty0. This change is about copying the message displayed on tty0 to
the MOTD system.
|
|
T7709: Add file sync and atomic write to config save script
|
|
Config save is provided by the helper script in both CLI and
configsession (hence also in the http api).
Use utilities write_file_sync and write_file_atomic, in accordance with
permissions and location:
If the target is in /opt/vyatta/etc/config or /config, use
write_file_sync; if, moreover, the caller has permissions, use
write_file_atomic. Otherwise, fall back to util write_file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Move encrypted volume check before key input
Unmount any conflicting config bind mounts
|
|
The mount point /opt/vyatta/etc/config is considered the source of truth
whereas /config is simply a bind mount of convenience. As the latter is
no longer defined at boot, all operations should use the former.
|
|
wlb: T114: Add firewall group support for WAN load balancer
|
|
anywhere
Fix this build warning by placing the vyos_net_name script in it's own udev
folder to not accidently be copied to a wrong location.
|
|
|
|
The utility write_file_atomic does not correctly update the file in the
bind mount directory /config. Revert for investigation.
This reverts commit c140f827f3117609908a3a18034027d3d78149ac.
|
|
T7718: expose validate_tree* methods and add validate-config script
|
|
|
|
|
|
|
|
T7651: VPP use pid not ppid as default in vpp-failure-handler.service script
|
|
The reset_section.py script is used in a limited case for both (1)
recovery from an apply error in a config mode script and (2) recovery by
a service crash in a failure handler service. In the latter case, the
default pid must be os.getpid, not os.getppid, so as not to be called by
pid 1.
|
|
T7628: Fix non-TPM backed config encryption
|
|
T7625: load-balancing: prune limit key if not configured
|
|
|
