| Age | Commit message (Collapse) | Author |
|---|
|
T7982: container: generate run arguments once
|
|
ipsec: T8001: Commit fails removing VTI interface in IPsec config
|
|
ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`
|
|
syslog: T8059: migrate host:port node names to the new syntax with a dedicated port option
|
|
The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.
|
|
If any dynamic rule is configured forwarding should be disabled because each
packet must be processed through the NAT session table to apply proper
translations
|
|
|
|
|
|
openvpn: T7738: avoid duplicate certs during 1.3 -> 1.4 migration
|
|
|
|
with a dedicated port option
|
|
T8030: VPP: Check support for changed driver too
|
|
When migrating from VyOS 1.3 to 1.4, OpenVPN interfaces sharing the same
certificate (chain) end up getting duplicated certificate entries, one per
interface — instead of reusing a single cert if applicable.
This change makes the migration logic detect shared certificates and reuse a
single CA and server certificate objects, preventing redundant certificate
entries in the config.
|
|
addresses
|
|
|
|
Fix cases where commit or IPsec up/down hooks fail if the VTI interface
has already been deleted or the `/tmp/ipsec_vti_interfaces` file does not
exist.
Changes:
- Return empty dict from `get_interface_config()` if it returns None to
avoid TypeError when accessing 'operstate' (vti_updown_db.py).
- Use `open_vti_updown_db_for_create_or_update()` in `vti‑up‑down` script so
the temporary interface tracking file is created automatically when
missing.
|
|
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
|
|
vpp: T8036: Commit fails removing nat44 static rule
|
|
frr: T8034: use dict_search() for routing protocols to check if VRF is used
|
|
T7319: check for unsaved commits before proceeding with 'add system image'
|
|
|
|
dict_search() is save when passing in keys that do not exist in the dict
we are working on.
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
firewall: T7739: Default ruleset for firewall zones
|
|
bond: T8023: validate member interface min/max MTU
|
|
It is impossible to set the bond interface MTU to be larger or lower then the
limits of the underlaying interface MTU. Add proper commit validation and
smoketest.
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
Add a commit-time check and warning to the user if the TACACS source-address is
not configured on the system or the given VRF.
|
|
Add a commit-time check and warning to the user if the RADIUS source-address
(IPv4 or IPv6) is not configured on the system or the given VRF.
|
|
|
|
veth: T8017: bugfix KeyError: 'peer_name'
|
|
T8012: Add user vpp to user groups
|
|
To allow call VPP api without sudo
- Get op-mode commands without sudo
- Use API call in smoke-tests
|
|
T7556: VPP add IPFIX collector configuration
|
|
Use safe dict_search() function to locate veth peer interface name. If no peer
is defined an error will be displayed.
|
|
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
After T7836: move bind mount of /config to vyos-1x, the bind mount is
configured at boot, not within the initrd. On image install, one needs
to check for previous installations in the resident directory
/opt/vyatta/etc/config of the mounted disk.
|
|
removed from vif
Do not allow to delete subinterface if it is in use in VPP features
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
|
|
|
|
to prevent malicious variable injection
|
|
|
|
|
|
firewall: T7112: Default action drop fails
|
|
The standalone script teardown-config-session.py is called on CLI
config-mode exit, to close the persistent vyconf config session. Instead
of injecting the config-mode env var into the external script to
indicate a non-ephemeral session, add keyword 'extant' to find existing
session.
|
|
Prevent `KeyError` by safely handling missing 'member' dict in zone config.
Add smoketest to verify commit fails gracefully when zone has no interfaces.
|
|
container: T7305: fix VRF loss when restarting pods
|
