| Age | Commit message (Collapse) | Author |
|---|
|
Add missed system kernel options to the image_installer do not
lose configured kernel options per an image upgrade.
|
|
Show state of passthrough tunnels as always up.
Passthrough children of connection have PASS mode but have no
sa and are not shown in vici list_sas.
Fix by passing mode from vici list_connections to _get_child_sa_state
and always return 'up' for child with PASS mode.
|
|
************* Module storage
src/op_mode/storage.py:32:11: E0602: Undefined variable '_get_system_storage' (undefined-variable)
src/op_mode/storage.py:52:11: E0602: Undefined variable 'output' (undefined-variable)
|
|
************* Module pki
src/op_mode/pki.py:459:8: E1128: Assigning result of a function call, where
the function returns None (assignment-from-none)
|
|
|
|
ipsec: T7545: Fix show vpn debug peer
|
|
|
|
Fix re for searching of peers in /etc/swanctl/swanctl.conf
```
search = rf'^[\s]*(peer_{peer}_(tunnel_[\d]+|vti)).*'
```
Changed to
```
search = rf'^[\s]*({peer}-(tunnel-[\d]+|vti))[\s]*{{'
```
Added message
```
print(f'\n### {command} ###')
```
so that output is not empty when `/usr/sbin/ipsec statusall`
shows nothing
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
Write the health-status on the very first run of the script,
without waiting for any change in status, to show the current
state to the show command. In show command use the same api
to get the now timestamp as used in state change timestamp.
|
|
Certbot renewal command in op-mode "renew certbot" only works if any of the
certificates is up for renewal. There is no CLI option to forcefully renew a
certificate. This is about adding a force option to the CLI and with this
addition move the entire certbot renew handling to new-style op-mode commands.
vyos@vyos:~$ renew certbot force
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /config/auth/letsencrypt/renewal/vyos.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for vyos.io
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded:
/config/auth/letsencrypt/live/vyos/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Hook 'post-hook' ran with output:
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
|
|
|
|
journald
|
|
|
|
If any part of the system boot fails, we set overall_status=1 in the vyos-router
startup script. When an error during the image upgrade is detected, the system
will automatically revert the default boot image to the previously used version,
if the CLI option "system option reboot-on-upgrade-failure" is set.
The user is informed via console messages:
Booting failed, reverting to previous image
Automatic reboot in 5 minutes
Use "reboot cancel" to cancel
The user has time to log in and run reboot cancel to remain in the faulty image
for troubleshooting. Reboot timeout is defined by CLI: "system option
reboot-on-upgrade-failure"
Once the system boots into the previous image, the MOTD will display a
persistent warning message - cleared during next reboot.
WARNING: Image update to "VyOS 1.5.xxxx" failed
Please check the logs:
/usr/lib/live/mount/persistence/boot/NAME/rw/var/log
Message is cleared on next reboot!
Upgrade failure can be synthetically injected by booting with Kernel command
line option: vyos-fail-migration
|
|
When performing an image upgrade we will create a file named /config/first_boot
with JSON data inside the new images persistent storage. The content of the file
will look like: {"previous_image": "1.5-stream-2025-Q3"}
The previous image name can be easily queried using "jq -r '.previous_image'".
This is the base work required for an adjusted version of the vyos-router init
script to support an automatic rollback to a previous image if things go
sideways.
|
|
CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>
set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>
set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface
show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```
|
|
large output
|
|
remote groups
|
|
interfaces: T7268: Add op-mode command for show all interfaces on system
|
|
installer: T7049: Fix GRUB boot with RAID1
|
|
CLI:
```
set vpp nat cgnat interface outside <interface> # multi
set vpp nat cgnat interface inside <interface> # multi
set vpp nat cgnat rule <rule> outside-prefix <prefix>
set vpp nat cgnat rule <rule> inside-prefix <prefix>
set vpp nat cgnat timeout udp <sec> # default 300
set vpp nat cgnat timeout tcp-established <sec> # default 7440
set vpp nat cgnat timeout tcp-transitory <sec> # default 240
set vpp nat cgnat timeout icmp <sec> # default 60
```
OP mode:
```
show vpp nat cgnat interfaces
show vpp nat cgnat mappings
show vpp nat cgnat sessions
clear vpp cgnat inside-address <address> port <port> external-address <address> port <port>
```
|
|
rather than in the command line
|
|
tech-support: T7410: handle possible errors when executing lsusb
|
|
Commiting suggestions from dmbaturin
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
T7397: add "system kernel option quiet" to suppress boot messages
|
|
because it exits with a non-zero code on machines
without USB controllers
|
|
Add option to limit the number of messages that are displayed on the console
during the boot process and to persist this setting with image upgrades.
set system option kernel quiet
|
|
New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface> # multi
set vpp nat44 interface inside <interface> # multi
set vpp nat44 address-pool translation interface <interface> # multi
set vpp nat44 address-pool translation address <address> # multi
set vpp nat44 address-pool twice-nat interface <interface> # multi
set vpp nat44 address-pool twice-nat address <address> # multi
set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>
set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit> # default 64512
set vpp settings nat44 timeout udp <sec> # default 300
set vpp settings nat44 timeout tcp-established <sec> # default 7440
set vpp settings nat44 timeout tcp-transitory <sec> # default 240
set vpp settings nat44 timeout icmp <sec> # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```
|
|
'NoneType' is not iterable"
|
|
|
|
lo address was an edge case and needed to be handled.
|
|
Created op-mode script per request
Commands added:
show interfaces kernel
show interfaces kernel detail
show interfaces kernel json
show interfaces kernel <interface>
show interfaces kernel <interface> detail
show interfaces kernel <interface> json
|
|
When performing an image upgrade and Linux Kernel command-line option that
should be passed via GRUB to the Linux Kernel are missing on the first boot.
This is because when generating the GRUB command-line via the op-mode scripts
the CLI nodes defining the options are not honored.
This commit re-implements the code-path in op-mode which generates the strings
passed via GRUB to the Linux Kernel command-line.
NOTE: If (for a yet unknown reason) a Kernel command-line option string changes
during a major - or minor - upgrade of the Linux Kernel, we will need to adapt
that logic and possibly call a helper from within the NEW updated image rootfs.
Thus we can ship future information back into the past like the "Grays Sports
Almanac" from Back to the Future Part II.
|
|
An attempt to reuse the name of an existing installed image should
prompt the user to re-enter a name, rather than allowing the
installation to fail.
|
|
T7254: op-mode: Add spanning-tree op-mode commands
|
|
New CLI
```
set vpp nat44 static rule 10 outside-interface 'eth0'
set vpp nat44 static rule 10 inside-interface 'eth1'
set vpp nat44 static rule 10 external address 192.168.122.10
set vpp nat44 static rule 10 external port 6545 # optional
set vpp nat44 static rule 10 protocol tcp|udp|icmp|all # optional, defaults to "all"
set vpp nat44 static rule 10 local address 100.64.0.10
set vpp nat44 static rule 10 local port 64010 # optional
```
|
|
group members
|
|
* T7283: VPP add static NAT support
Add static mapping NAT implementation
```
set vpp nat44 static rule 10 outbound-interface 'eth0'
set vpp nat44 static rule 10 inbound-interface 'eth1'
set vpp nat44 static rule 10 destination address 192.168.122.10 # optional, if not set outbound interface ip address is used
set vpp nat44 static rule 10 destination port 6545 # optional
set vpp nat44 static rule 10 protocol tcp|udp|icmp|all # optional, defaults to "all"
set vpp nat44 static rule 10 translation address 100.64.0.10
set vpp nat44 static rule 10 translation port 64010 # optional
```
* Improve help strings (Daniil Baturin)
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
|
|
Updated language of "VLANs are enabled/disabled" to "VLANs enabled/disabled"
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Updated language of amRoot to " (This bridge is the root)"
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
The service certbot expects symbolic links for
/config/auth/letsencrypt/live/<cert_name>/*.pem
however, the default behavior of copytree copies the linked files during
image upgrade. Set copytree argument to preserve symlinks.
|
|
Created stp.py to create output for spanning-tree info
Modified show-bridge.xml.in to add:
show bridge spanning-tree
show bridge spanning-tree detail
show bridge <interface> spanning-tree
show bridge <interface> spanning-tree detail
|
|
T7278: Remove cracklib hack from postconfig script template
|
|
firewall: T5493: Implement remote-group
|
|
|
|
|
|
T7138: Fix show qos
|
|
|
