| Age | Commit message (Collapse) | Author |
|---|
|
VyOS 1.4 already had a migrator for interfaces 20 -> 21, but this is a different
one compared to the one in VyOS 1.3 - thus we bump every migration scripts
version by one to have the same 20-to-21 converter in both VyOS 1.3 and 1.4.
This is possible as VyOS 1.4 (sagitta) is still a highly experimental version
and expected to break from time to time :(.
|
|
level
Getting rid of "set firewall options" and move it from:
set firewall options interface ethX adjust-mss 1400
set firewall options interface ethX adjust-mss6 1400
to:
set interfaces ethernet ethX ip adjust-mss 1400
set interfaces ethernet ethX ipv6 adjust-mss 1400
In addition add an extra option called clamp-mss-to-pmtu instead of a value.
|
|
default behavior
|
|
Rename quagga migration scripts for correct sequences
between 1.3 and 1.4 branches
7-to-8 in 1.3 uses the same migration as 8-to-9 in 1.4
This PR fix it
|
|
The migrator from 20-to-21 is required as 19-to-20 on VyOS 1.3 - thus simply
rename/reorder the two migrators to not break things the hard way when
upgrading from 1.3 -> 1.4.
|
|
Update/refresh of DNS records is now handled internally by Strongswan.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Also renames peer pubkey to public-key for consistency
|
|
VRF: T3655: proper connection tracking for VRFs
|
|
Currently, all VRFs share the same connection tracking table, which can
lead to problems:
- traffic leaks to a wrong VRF
- improper NAT rules handling when multiple VRFs contain the same IP
networks
- stateful firewall rules issues
The commit implements connection tracking zones support. Each VRF
utilizes its own zone, so connections will never mix up.
It also adds some restrictions to VRF names and assigned table numbers,
because of nftables and conntrack requirements:
- VRF name should always start from a letter (interfaces that start from
numbers are not supported in nftables rules)
- table number must be in the 100-65535 range because conntrack supports
only 65535 zones
|
|
|
|
update to use PKI.
|
|
Previously during migration if one had used interface routes, the VRF based
ones got not migrated.
The following "old" VyOS 1.3 configuration did not get migrated:
set protocols static interface-route 10.20.0.0/24 next-hop-interface eth2 next-hop-vrf 'blue'
set protocols static interface-route 10.30.0.0/24 next-hop-interface br10 next-hop-vrf 'red'
set protocols vrf blue static interface-route 10.0.0.0/24 next-hop-interface eth1 next-hop-vrf 'default'
set protocols vrf red static interface-route 10.0.0.0/24 next-hop-interface eth1 next-hop-vrf 'default'
set vrf name blue table '3000'
set vrf name mgmt table '1000'
set vrf name red table '2000'
It must get migrated to:
set protocols static route 10.20.0.0/24 interface eth2 vrf 'blue'
set protocols static route 10.30.0.0/24 interface br10 vrf 'red'
set vrf name blue protocols static route 10.0.0.0/24 interface eth1 vrf 'default'
set vrf name blue table '3000'
set vrf name mgmt table '1000'
set vrf name red protocols static route 10.0.0.0/24 interface eth1 vrf 'default'
set vrf name red table '2000'
|
|
|
|
Renamed CLI from "logging log-modes" to "log subsystem" and "logging log-level"
to "log level". THat is more human firendly.
|
|
|
|
|
|
migrate "set extcommunity-rt" and "set extcommunity-soo" to "set extcommunity
rt|soo" to match FRR syntax. This also makes it easier to implement the
"bandwidth" extended community.
|
|
As the new WWAN interface style is backported to VyOS 1.3 we also need to shift
the order of the interface migration scripts. so the same order from VyOS 1.4
also applies to VyOS 1.3.
In short, 21-to-22 is renamed to 18-to-19 and all other migrators are shifted
up one version.
|
|
|
|
|
|
|
|
A VTI interface also requires an IPSec configuration - VyOS 1.2 supported
having a VTI interface in the CLI but no IPSec configuration - drop VTI
configuration if this is the case for VyOS 1.4.
|
|
|
|
- set vpn ipsec nat-traversal
- set vpn ipsec nat-networks allowed-network
|
|
|
|
Commit c17f259d ("router-advert: T3561: add support for specific routes") used
tabs over spaces in the Migration script which triggered a TabError (inconsistent
use of tabs and spaces in indentation").
|
|
Co-authored-by: Mark Royds <mark.royds@vitaminit.co.uk>
|
|
migrate from old vyatta-cfg-system / Perl implementation.
|
|
|
|
|
|
|
|
|
|
Every time when set configuration bgp, you need set AS number. There is very
less benefit in this system so the AS number is moved from a tagNode level down
to a leafNode with the name "local-as", same as on the neighbor or peer-group
level.
This changes the CLI configuration from:
set protocols bgp 100 neighbor 10.10.1.2 remote-as 200
to
set protocols bgp local-as 100
set protocols bgp neighbor 10.10.1.2 remote-as 200
|
|
|
|
As we and FRR do not support multiple FRR process instances, there is no need
to make this configurable for a user. We rather rely on a solid default "VyOS".
|
|
As there can only be one running IS-IS process (FRR limitation) there is no need
in having a tagNode here. This adds artifical restrictions/limitations when
moving on to support VRFs for IS-IS protocol.
|
|
Instead of having the dynamic routing protocols OSPF and BGP residing under
the "protocols vrf <name> [ospf|bgp]" nodes, rather move them directly under
the "vrf name <name> protocols [ospf|bgp]" node. Now all VRF related parts
are placed under the same root node.
This eases the verify steps tremendously, as we do not need to check wheter a
VRF eists or not, it will always exist as we operate under a child node.
|
|
nptv6: T2518: Support IPv6 address translation
|
|
|
|
|
|
|
|
Rename CLI options local-ip to source-address and remote-ip to remote to
get a consistent CLI experience for the user.
|
|
Streamline the CLI configuration where we try to use remote on other interfaces
like vxlan, geneve.
|
|
Streamline the CLI configuration where we try to use source-address when
creating connections which are especially sourced from a discrete address.
|
