| Age | Commit message (Collapse) | Author |
|---|
|
T8418: adjust permissions setting of config.boot for case of cloud-init
|
|
Group owner and write permission were set within a conditional block
that cloud-init does not see. Move settings outside of unneeded
conditional protection.
|
|
T8399: dhcpv6-server: move connectivity/overlap checks inside subnet loop
|
|
|
|
|
|
|
|
When a PPPoE interface has dhcpv6-options (e.g. prefix delegation)
configured but no explicit ipv6 node, the Jinja template writes
noipv6 into the PPP peer configuration. This prevents IPv6CP
negotiation, causing the ISP to silently ignore all DHCPv6 traffic.
Fix the peer template to also check for dhcpv6_options before emitting
noipv6, and add dhcpv6-options and ipv6 to the list of config nodes
that trigger a PPPoE session restart so the change takes effect
without manual disconnect/reconnect.
|
|
When performing an image installation and the user chooses vyos as the default
password, a warning is emitted.
The combination vyos/vyos is used in brute force lists and have been seen
multiple times in the wild. When adding the user via:
set system login user vyos authentication plaintext-password vyos
a warning should be shown!
|
|
validation
|
|
Implementing a daemon that listens for netlink messages in Python was discussed
for many years. This is a proof-of-concept implementation how we can listen for
netlink messages and process them in Python.
Python 3.10 minimum is required due to the use of case statements which mimics
C-style switch/case instructions.
Add example:
set interfaces ethernet eth1 vif 21 address dhcp
set interfaces ethernet eth1 vif 21 address dhcpv6
commit
If network cable is unplugged:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Stopping dhclient@eth3.10.service...
vyos-netlinkd[12681]: Stopping dhcp6c@eth3.10.service...
If cable is plugged back in:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=UP, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Restarting dhclient@eth3.10.service...
vyos-netlinkd[12681]: Restarting dhcp6c@eth3.10.service...
|
|
T8352: VPP add op-mode commands to show bonding interfaces
|
|
When dhclient renews/rebinds a lease, it calls "ip -4 addr flush dev
<interface>". This removes ALL IPv4 addresses, including static
addresses configured via VyOS (e.g., "set interfaces ethernet eth0
address 192.168.1.1/24").
The updated hook logic now intercepts the "ip -4 addr flush" command and replaces
it with a selective flush that only removes addresses marked as
"dynamic" by the kernel. DHCP-assigned addresses have the "dynamic" flag
set automatically.
|
|
op-mode: T8400: remove calls to tshark binary for PCAP files
|
|
T8396: VPP op-mode "show interfaces vpp" missing ipv6 address
|
|
|
|
|
|
|
|
vpp: T8315: Add support for configuring unsupported NICs and update compatible list
|
|
vpp: T8230: Add support for PPPoE on bonding interfaces
|
|
compatible list
Introduce `set vpp settings unsupported nics <pci-id>` and
`set vpp settings unsupported drivers <driver>` to permit VPP activation
on hardware not present in the validated NIC list. Update current compatible list.
|
|
The tshark binary might not be installed in every image, thus this command is
not only gambling if it will work or not, it will also bloat the image if
installed.
PCAP files should be properly revisited on a workstation and not on a NOS
(Network Operating System).
|
|
|
|
T8397: macsec: fix source-interface change
|
|
|
|
|
|
|
|
T8353: Raise DataUnavailable if no VPP LACP interfaces are configured
|
|
vpp: T8368: Features nat44 and cgnat should not use the same interfaces
|
|
|
|
geoip: T5405: T6768: Add VRF support and `system name-server` check
|
|
|
|
|
|
openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead
|
|
vpp: T8342: Add verification of members for bond and bridge interfaces
|
|
T8186: netflow: disable IPv6 for netflow protocol version 5
|
|
vpp: T8276: Add verification for virtual interfaces in PPPoE server configuration
|
|
configuration
- Implemented `verify_virtual_interface_exists` function to check for existing interfaces.
- Enhanced error handling for non-existent virtual interfaces in VPP mapping.
- Modified test cases to validate changes regarding PPPoE with subinterfaces.
|
|
|
|
|
|
Switch `verify()` to validate the real config tree (`interface -> prefix`) instead of non-existent `rule` nodes.
This enforces:
- `mode interface` requires `prefix ... interface`
- non-`interface` modes must not set `prefix ... interface`
- referenced interface exists when `mode` is `interface`
|
|
|
|
|
|
This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634:
Remove support for insecure DES and Blowfish ciphers") by not only deleting
insecure DES and Blowfish ciphers, but providing an alternative (3DES).
If no cipher is defined, this will result in OpenVPN service not starting at
all, as the implicit defined BF-CBC cipher is no longer supported by
OpenSSL 3.0.0.
|
|
section
|
|
opmode: T8343: implement common verify_cli_exists() helper
|
|
|
|
Instead of re-defining a per module helper which verifies that a given CLI path
exists during execution, rather create a generic representation which takes a
CLI path (list) as argument with an optional error message to display on the
CLI.
This is the initial implementation of the generic helper with some migrations
for VPP, WireGuard and Wireless interfaces. More opmode scripts should follow.
|
|
tech-support: T8215: Extend tech-support archive and report generation
|
|
|
|
vpp: T8339: Cleanup vpp interfaces and kernel-interfaces after migration
|
