| Age | Commit message (Collapse) | Author |
|---|
|
Instead of re-defining a per module helper which verifies that a given CLI path
exists during execution, rather create a generic representation which takes a
CLI path (list) as argument with an optional error message to display on the
CLI.
This is the initial implementation of the generic helper with some migrations
for VPP, WireGuard and Wireless interfaces. More opmode scripts should follow.
|
|
tech-support: T8215: Extend tech-support archive and report generation
|
|
vpp: T8339: Cleanup vpp interfaces and kernel-interfaces after migration
|
|
T7513: vyos-1x: CGNAT Exclude Rule CLI support
|
|
|
|
ipsec: T8136: IPSEC PPK support
|
|
|
|
|
|
- Exclude .iso files from `/config` and `/home/*` to avoid large images
- Exclude previous debug-archived from new archives
- Include `/run` directory contents
- Add kernel modules information (`lsmod`)
- Add PCI details (`lspci -knnv`)
- Include full `/config` directory
- Add FRR memory usage (`vtysh "show memory"`)
- Add VPP info (`vppctl`)
- Add NUMA details (`numactl --hardware`, `numastat -cm`)
Full list of commands here: https://vyos.dev/T8215
|
|
|
|
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
|
|
T8257: image install search previous needs to consider legacy bind mount
|
|
|
|
For those images created with the legacy bind mount, the resident
config.boot at {mounted_image}/opt/vyatta/etc/config is the baseline,
not the saved config (which is then restored at boot). Image install
needs to search the legacy path at {mounted_image}/config as well as the
normalized path.
|
|
|
|
|
|
op-mode: T8154: fix tcpdump KeyboardInterrupt on Ctrl+C
|
|
Not all platrorms have the `Model` key in the output of the
/proc/cpuinfo
Use `unknown` if we cannot detect it
|
|
|
|
This adds the capability to make it re-usable in other code paths.
|
|
Fix the VPP op-mode commands traceback errror for the IPFIX feature
if VPP is not configured
|
|
bond: T2416: support hot-add/remove of bond member interfaces
|
|
|
|
|
|
vpp: T7954: Add op-mode commands to show LACP
|
|
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained
in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid
NSS/TACACS timeouts").
|
|
The previous implementation of "system login" relied on Python's pwd.getpwall()
to enumerate user accounts. This forces a full walk through the NSS stack,
which is acceptable in general but problematic for our use-case. VyOS only
needs information about locally created accounts and not remote accounts
provided via AAA backends such as TACACS or RADIUS.
When TACACS servers are unreachable, NSS lookups become extremely slow due to
repeated timeouts. As a result, any operation triggering pwd.getpwall()
(including configuration commits) can stall for several minutes.
This change introduces a dedicated helper, get_local_passwd_entries(), which
reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are
relevant, this provides all required data with no external dependencies.
Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers:
# set system login tacacs server 192.168.1.50 key test123
# set system login tacacs server 192.168.1.51 key test123
# time commit
Before:
real 3m29.825s
user 0m0.329s
sys 0m0.246s
After:
real 0m1.464s
user 0m0.337s
sys 0m0.195s
This significantly improves commit performance and removes sensitivity to AAA
server outages.
|
|
|
|
T8078: dhcpv6: allow lease renew for pd & parameters
|
|
The renew command will refuse to restart the dhcp6c process for an
interface unless it is configured to request an address, but the
client may also be running to manage parameters and/or prefix
delegations.
|
|
This enhances diagnostic capabilities by providing hardware topology
visuals within support archives.
|
|
|
|
|
|
T7556: VPP add IPFIX collector configuration
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
After T7836: move bind mount of /config to vyos-1x, the bind mount is
configured at boot, not within the initrd. On image install, one needs
to check for previous installations in the resident directory
/opt/vyatta/etc/config of the mounted disk.
|
|
|
|
Container networks are only started when there is at least one active consumer.
If a network is created without any attached containers, it does not need to be
assigned to a VRF yet.
When the last container in a pod is stopped, its associated container network
is removed. Upon container restart, the kernel recreates the network, but the
VRF assignment may be lost in the process.
This change ensures that all container networks are correctly reattached to
their designated VRFs when a pod restarts.
|
|
|
|
The call to rc_cmd('podman inspect ...') determines whether a container image
scheduled for deletion has any ancestor containers still using it. Previously,
if the podman command wrote output to stderr, rc_cmd() would return that error
message alongside or instead of the ancestor container ID.
This caused subsequent podman calls to fail, as the error string was incorrectly
treated as a valid command argument. This change ensures only valid ancestor
IDs are returned.
This is a fix for commit a99ca6d11b5 ("op-mode: T7403: add option for forcefully
remove a container image")
|
|
image: T5455: Add migration of SSH `known_hosts` files during upgrade
|
|
The call of get_cli_kernel_options is made conditional to resolve T7818;
remove later addition of unconditional calls causing regression.
|
|
Assume someone deleted the certbot_config folder, "renew certbot force" alone
will not work as there are no configuration files left to know what to renew.
Re-run CLI PKI helper to initially request certificates via ACME again. This
"should" (famous last words) never be the case - but sometimes the universe has
a bad time.
|
|
vyos-dhcp: T7895: rename "DHCP Server" column to "Lease Time"
|
|
|
|
(cherry picked from commit e7c8867b75f6855e93792ddd255bf0ad2b2464b1)
|
|
During upgrade, the script now checks if any `known_hosts` files exist.
If so, it prompts the user to save these SSH fingerprints, and upon
confirmation, copies the files to the new image persistence directory.
|
|
|
