| Age | Commit message (Collapse) | Author |
|---|
|
|
|
If SNAT source address in not exists use 'any'
Add check if 'port' exists in dictionary
|
|
|
|
It makes no sense to enslave an interface to a bond or a bridge device if it is
bound to a given VRF. If VRFs should be used - the encapuslating/master
interface should be part of the VRF.
Error out if the member interface is part of a VRF.
|
|
VRF names: "add, all, broadcast, default, delete, dev, get, inet,
mtu, link, type, vrf" are reserved and cannot be used for vrf name
|
|
When is_member() is inspecting the bridge/Bond member interfaces it must work
with the real interface (e.g. eth1) under the "ethernet" node and not work on
the "member interface eth1" CLI tree, that makes no sense at all.
|
|
We must change dictionary if we get only onle flow entry
I.e one NAT record
With single entry we get:
OrderedDict([('meta', xxx]))
We expect:
[OrderedDict([('meta', xxx]))]
|
|
disable-directed-broadcast-forwarding"
|
|
Directed broadcast is described in rfc1812#section-5.3.5.2 and rfc2644.
By default Linux kernel doesn't forward directed broadcast
packets unless both of `/proc/sys/net/ipv4/conf/all/bc_forwarding`
and `/proc/sys/net/ipv4/conf/$iface/bc_forwarding` are set to 1.
|
|
After firewall rewriting, we lost the ability to show conntrack
table as it used old code
Rewrite and add it to XML/Python
|
|
monitoring: T4411: Migrate influxdb options to influxdb node
|
|
op-mode: T4503: Prevent restart service if commit in progress
|
|
As we have specific configuration for each plugin:
set service monitoring telegraf xxx
- azure-data-explorer
- prometheus-client
- splunk
We should to move configuration that related to influxdb under
influxdb node
Replace:
set service monitoring telegraf
- authentication xxx
- bucket xxx
- port xxx
- url
To:
set service monitoring telegraf influxdb xxx
|
|
Prevent op-mode scripts from restarting services if commit in
progress
|
|
|
|
After discussion with @zsdc this was decided the better long term fix
* Removes hourly logrotate cron in favour of systemd timer override
|
|
|
|
|
|
dns: T4509: Add dns64-prefix option
|
|
|
|
|
|
rfc6147: DNS Extensions for Network Address Translation
from IPv6 Clients to IPv4 Servers
set service dns forwarding dns64-prefix 2001:db8:aabb::/96
|
|
It makes no sense to test against a VRF that might not exist at all.
|
|
Commit 19789463 ("dhclient: T2393: introduce 20 seconds stop timeout - required
for smoketesting on Qemu") assigned a string to a boolean field. This has been
fixed.
|
|
When clients only use DHCP for interface addressing we can not bind NTPd to
an address - as it will fail if the address changes. This commit adds support
to bind ntpd to a given interface in addition to a given address.
set system ntp interface <name>
|
|
dns: T4378: Allow wildcard A AAAA record with option all
|
|
Fixed usage of environment variables - made an individual environment variable
for an event a true copy, instead of a reference to a single environ dictionary.
Also, reorganized imports according to PEP8.
|
|
Ability to set wildcard record for authoritative-domain
set authoritative-domain example.com records a any address 192.0.2.11
cat /run/powerdns/zone.example.com.conf
* 300 A 192.0.2.11
|
|
Add rate-limit options: attribute, muptiplier and vendor
set service ipoe-server auth radius rate-limit attribute 'Mikrotik-Rate-Limit'
set service ipoe-server auth radius rate-limit enable
set service ipoe-server auth radius rate-limit multiplier '0.001'
set service ipoe-server auth radius rate-limit vendor 'Miktorik'
|
|
|
|
In dictionary we get "syslog-identifier" with dash
But we try to parse option with underscore "syslog_identifier"
Fix it
|
|
|
|
* 'T4490' of https://github.com/sever-sever/vyos-1x:
bgp: T4490: Add informational message for peer withour AFI
|
|
openvpn: T4485: Accept multiple tls ca-certificate values
|
|
set service router-advert interface eth0 name-server-lifetime <value>
|
|
* Also determines and maps to correct CA for migrated CRL
|
|
|
|
containers: T4473: Fix create container with not exist network
|
|
Fix correct path for removing containers and container networks
Reduce timoute from 10 (default) to 3 seconds for stopping
containers
|
|
Fix for setting container without or wrong network decalaration
|
|
As we don't use addresss-family ipv4-unicast by default we
should to send informational message about AFI for peer is required
|
|
|
|
op-mode: T1375: Allow to clear dhcp-server lease
|
|
firewall: T4435: Verify parent config applied successfully
|
|
smoketesting on Qemu
|
|
Allow to reset dhcp-leases per ip
Parse file '/config/dhcpd.leases' find match section 'lease x.x.x.x {}'
And remove this section
clear dhcp-server lease 192.0.2.21
|
|
|
|
|
|
* Refactor nftables clean-up code
* Adds policy route test for using firewall groups
|
|
|
