| Age | Commit message (Collapse) | Author |
|---|
|
T9015: fix thread safety of configtree read/write_cache
|
|
geoip: T5746: Add GeoIP ASN support
|
|
|
|
The module previously had no tests. Cover the DB logic (add/remove,
multiple connections per interface, removeAllOtherInterfaces,
setPersistentInterfaces, seed-from-file) and assert each open_* helper
acquires the serialising lock, exercised with vyos.utils.locking.Lock
patched out.
|
|
concurrent rekey
The vti-up-down hook and vpn_ipsec.py modify a flat-file DB
(/tmp/ipsec_vti_interfaces) through three context managers that do an
unlocked read-modify-write. During a coordinated rekey, strongSwan fires
the hook for many VTIs concurrently, so the writers lost-update each
other: an interface whose up-client add is overwritten is left admin-down
while its CHILD_SA stays installed.
Serialise all DB access by reusing vyos.utils.locking.Lock. A new
_vti_updown_db_lock() context manager wraps the three public context
managers, and remove_vti_updown_db() holds the lock across both the DB
processing and the os.unlink() to close the create/delete race.
Make the helpers absence-safe under the lock so callers no longer compose
a separate existence check with a locked operation:
open_vti_updown_db_readonly() yields None when the DB does not exist and
remove_vti_updown_db() is a no-op when it is absent. Drop the
now-redundant unlocked vti_updown_db_exists() pre-checks in vti.py and
vpn_ipsec.py and handle the None yield.
|
|
haproxy: T8931: Improve WebSocket support for HAProxy
|
|
vpp: T8913: Skip bond teardown for non-structural config changes
|
|
pseudo-ethernet: T8540: Add anycast-gateway support for EVPN
|
|
qos: T7965: Fix qos fails to reapply on dynamic interfaces after reconnection
|
|
The previous vyos-netlinkd implementation for QoS policy re-apply was very heavy.
It conducted a full CLI validation and re-apply on every interface. Instead we
do not only re-apply the QoS configuration to the interface which has had an
address change detected by vyos-netlinkd.
This can be tested by checking "tc qdisc show" before disconnecting a PPPoE
interface and during/after reconnect. There will be no qdisc until the dynamic
interface has received an IP address - then the qdisc will be re-applied.
|
|
Introduce 'anycast-gateway' leafNode for pseudo-ethernet interfaces.
When set, a local FDB entry is installed on the parent bridge to
prevent the shared anycast MAC from leaking over the VXLAN overlay.
|
|
vpp: T8603: Expand ACL support to logical interfaces
|
|
Re-apply QoS after dynamic interfaces get addresses after connect/disconnect.
When PPPoE interfaces re-connect we need to re-do QoS settings.
|
|
|
|
dhcp: T8941: Support filter and sorting combination on DHCPv4/v6 server lease entries in op mode
|
|
dhcp-server: T8524: Validate DDNS key-name references defined tsig-key
|
|
password-reset: T8985: Fix unbounded `sed` ranges corrupting other user blocks
|
|
pki: T8994: add graceful error handling in case certbot fails
|
|
If ACME and certbot are used for PKI and e.g. haproxy it can become an issue if
certbot is blocked by the firewall. The renewal service will fail and tear-down
the production service - even if the certificate is yet not expired.
The production service was not restarted. This has been changed as every service
which is stopped prior to the renew is later restarted even upon failure of
renewing said certificate.
|
|
|
|
firewall: T8991: Fix IndexError with domain resolver mishandling blank lines
|
|
bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously
|
|
T8923: normalize "can not" to "cannot" and other typo fixes
|
|
|
|
|
|
|
|
|
|
|
|
Replace two-word "can not" / "Can not" with "cannot" across comments,
ConfigError messages, CLI help text, and op-mode output.
Standard SNMP MIB files under mibs/ are left unchanged.
|
|
|
|
pki: T8165: Add ability to show certificate full chain in pem format
|
|
`sed` ranges keyed on a field name (`plaintext-password`, `encrypted-password`,
`authentication {`) are not bounded to the target user's block. When the
field is absent the range stays open past the user's closing brace and
matches the first occurrence of that field in a later account.
|
|
|
|
This is no real need to have these in config_mgmt; moving to config_sync
will localize needed modifications to local/remote configs for exclusion
mask.
|
|
dhcpv6: T8953: Add validation for duplicate static-mapping address and prefix
|
|
|
|
T8976: explicitly remove 'kernel' entry in ttyS0 device setting on choice of 'tty' during image install
|
|
vpp: T8930: Block vif driver to prevent unhandled traceback on XCP-NG
|
|
salt: T8973: remove feature
|
|
|
|
Commit 35db941bcf30 ("serial: T8375: add CLI option to explicitly set kernel
console") added a migration script to alter the CLI for the kernel boot console.
The migrations script early exist check does not work, as the statement never
evaluates to true, thus the CLI Migration for Kernel console parameter is always
called, even if undesired.
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
simultaneously
FRR only allows one BGP instance to hold `advertise-all-vni` at a time
(FRR issue #9405). When a default BGP instance is present it is always
started before named VRF instances, so if a named VRF holds
the flag FRR silently rejects it on every boot (regardless of default
EVPN config), causing the running config to diverge from what is
stored in VyOS.
Enforce the following policy in verify():
- Default BGP instance may always hold `advertise-all-vni`.
- A named VRF may hold it only when no default BGP instance exists.
- Only one BGP instance (default or named VRF) may hold it at a time.
The default BGP verify path additionally scans dependent VRFs so that
adding or modifying the default BGP instance while a named VRF already
holds the flag is caught even when the VRF node is not part of the
current commit.
|
|
vrf: T8936: Specify `pref 1998` when deleting fwmark routing rules on VRF removal
|
|
When a key-name is set under dynamic-dns-update forward-domain or
reverse-domain, validate that the referenced TSIG key is defined under
dynamic-dns-update tsig-key. Previously the missing key was only caught
at runtime, causing kea-dhcp-ddns to fail to start with a fatal error.
Also fix a pre-existing bug in `verify_ddns_domain` (formerly
`verify_ddns_domain_servers`) where the function was called with the full
tagNode dict but iterated as if it received a single domain config,
causing the DNS server address check to never actually run.
|
|
removal
|
|
VPP bond teardown was triggered on every commit regardless of
what changed, dropping all subinterfaces and BGP sessions even
for trivial changes like descriptions or IP addresses.
Only mode, hash-policy and mac_address require full recreation
since VPP has no in-place update API for these; all other
changes are now applied incrementally.
|
|
Add op-mode command having ability to show certificate
full chain in pem format as part of PKI configuration.
The certificates are ordered beginning with the end
entity (leaf) certificate, followed by any intermediate
certificates and finally the private key if requested.
This allows users to easily export a certificate along
with its CA hierarchy for use in external applications,
that require the full chain to be provided in a single
file.
One can now run the following commands:
```
show pki ca NAME pem full-chain
show pki certificate NAME pem full-chain
show pki certificate NAME private pem full-chain
```
|
|
dhcp: T8933: Honor system timezone for timestamp display in op mode
|
|
password-reset: T8346: Fix password recovery when only `plaintext-password` is set
|
