| Age | Commit message (Collapse) | Author |
|---|
|
firewall: T8281: Normalize network prefixes in rule configuration
|
|
firewall: T8282: Normalize invalid network-group names during migration
|
|
Convert non-canonical IPv4 and IPv6 prefixes in 'source/destination address'
fields to proper network addresses (e.g. 10.10.10.1/30 -> 10.10.10.0/30).
This prevents invalid configurations and ensures consistent prefix handling.
|
|
vpp: T8438: Add bidirectional interface-in-use validation
|
|
nat64: T8456: add constraint for translation port range
|
|
Replace unsupported characters (e.g. `,`, `+`) with `_` when migrating
from 1.3.x and handle name collisions safely to prevent commit failures.
|
|
NAT64 requires dedicated transport address space for translation, similar to
exclusive port ownership during socket binding. If a local process and Jool
translation both use the same transport tuple (for example, 192.0.2.1:5000),
traffic conflicts can occur.
Jool does not prevent pool4 from overlapping with other port allocations, so
avoiding conflicts is an operator responsibility.
In addition to service ports already in use, account for Linux ephemeral
range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This
default is why, when pool4 is empty, Jool uses 61001-65535 on the node's
primary global addresses.
One can adjust the ephemeral range via sysctl, and Jools translation range via
pool4 add/remove.
vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768 60999
VyOS now uses verify() in NAT64 to check that the supplied tranlation port
range does not overlap with the Kernels ephemeral port range.
|
|
|
|
|
|
vyos-netlinkd: T8047: replacement of netplugd
|
|
Add bidirectional VPP interface reference validation: prevent assigning an interface used by a VPP feature (NAT/ACL/IPFIX/sFlow, etc.)
as a VPP member (bond/bridge/xconnect) and prevent using a VPP member interface in VPP features.
Block interface deletion when it is still referenced by any VPP feature/member.
Fix VLAN subinterface removal checks broken by the recent VPP config tree restructuring.
|
|
vpp: T8419: Disallow cross-membership between VPP and kernel bonding/bridge interfaces
|
|
Fix typos and mistakes
No functional changes
|
|
interfaces
|
|
|
|
vpp: T8416: Prevent interfaces from being assigned to xconnect and bridge/bonding at the same time
|
|
bridge/bonding at the same time
|
|
Fix AttributeError in `_is_device_allowed` by using
iface parameter for `persist_config` lookup.
|
|
T8379: PBR commit fail with traceback if non-existing VRF added
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
configuration option
Prevents attachments of unsupported NICs when the allow-unsupported-nics option is removed.
|
|
protocol 'all'
Updated the migration script to ensure that when migrating firewall rules,
if a `port-group` exists, the protocol will be set to 'tcp_udp' only
when its previous value is 'all'.
|
|
T8405: fix noipv6 emitted when dhcpv6-options configured without ipv6 node
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
vpp: T8355: Set MTU for vpp interfaces
|
|
T8188: Preserve static IPv4 addresses flushed by dhclient
|
|
login: T8415: show Warning() if default password is used when adding user
|
|
T8418: adjust permissions setting of config.boot for case of cloud-init
|
|
Group owner and write permission were set within a conditional block
that cloud-init does not see. Move settings outside of unneeded
conditional protection.
|
|
T8399: dhcpv6-server: move connectivity/overlap checks inside subnet loop
|
|
|
|
|
|
|
|
When a PPPoE interface has dhcpv6-options (e.g. prefix delegation)
configured but no explicit ipv6 node, the Jinja template writes
noipv6 into the PPP peer configuration. This prevents IPv6CP
negotiation, causing the ISP to silently ignore all DHCPv6 traffic.
Fix the peer template to also check for dhcpv6_options before emitting
noipv6, and add dhcpv6-options and ipv6 to the list of config nodes
that trigger a PPPoE session restart so the change takes effect
without manual disconnect/reconnect.
|
|
When performing an image installation and the user chooses vyos as the default
password, a warning is emitted.
The combination vyos/vyos is used in brute force lists and have been seen
multiple times in the wild. When adding the user via:
set system login user vyos authentication plaintext-password vyos
a warning should be shown!
|
|
validation
|
|
Implementing a daemon that listens for netlink messages in Python was discussed
for many years. This is a proof-of-concept implementation how we can listen for
netlink messages and process them in Python.
Python 3.10 minimum is required due to the use of case statements which mimics
C-style switch/case instructions.
Add example:
set interfaces ethernet eth1 vif 21 address dhcp
set interfaces ethernet eth1 vif 21 address dhcpv6
commit
If network cable is unplugged:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Stopping dhclient@eth3.10.service...
vyos-netlinkd[12681]: Stopping dhcp6c@eth3.10.service...
If cable is plugged back in:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=UP, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Restarting dhclient@eth3.10.service...
vyos-netlinkd[12681]: Restarting dhcp6c@eth3.10.service...
|
|
T8352: VPP add op-mode commands to show bonding interfaces
|
|
When dhclient renews/rebinds a lease, it calls "ip -4 addr flush dev
<interface>". This removes ALL IPv4 addresses, including static
addresses configured via VyOS (e.g., "set interfaces ethernet eth0
address 192.168.1.1/24").
The updated hook logic now intercepts the "ip -4 addr flush" command and replaces
it with a selective flush that only removes addresses marked as
"dynamic" by the kernel. DHCP-assigned addresses have the "dynamic" flag
set automatically.
|
|
op-mode: T8400: remove calls to tshark binary for PCAP files
|
|
T8396: VPP op-mode "show interfaces vpp" missing ipv6 address
|
|
|
|
|
|
|
|
vpp: T8315: Add support for configuring unsupported NICs and update compatible list
|
|
vpp: T8230: Add support for PPPoE on bonding interfaces
|
|
compatible list
Introduce `set vpp settings unsupported nics <pci-id>` and
`set vpp settings unsupported drivers <driver>` to permit VPP activation
on hardware not present in the validated NIC list. Update current compatible list.
|
|
The tshark binary might not be installed in every image, thus this command is
not only gambling if it will work or not, it will also bloat the image if
installed.
PCAP files should be properly revisited on a workstation and not on a NOS
(Network Operating System).
|
|
|
|
T8397: macsec: fix source-interface change
|
