| Age | Commit message (Collapse) | Author |
|---|
|
While producing all configtest assert files for VyOS 1.4 it was noted that
the the isis-small testcase from fails. This config fragment is not properly
migrated when updating from VyOS 1.3.0-rc1 -> 1.4 and using IS-IS.
protocols {
isis FOO {
interface eth1 {
bfd
}
net 49.0001.1921.6800.1002.00
redistribute {
ipv4 {
connected {
level-2 {
route-map EXPORT-ISIS
}
}
}
}
}
}
and results in loosing IS-IS connectivity. This is due the fact that
config.rename() does not work when only using the base tagNode.
|
|
vpp: T7972: Make `nat44 no-forwarding` feature automatically configurable
|
|
T8078: dhcpv6: allow lease renew for pd & parameters
|
|
The upstream VPP code already writes the ena device ID to new_id
So we can remove `ena` from `override_driver()`
The kernel does not provide a reliable way to check whether an ID has already been
registered, so we simply attempt the write and ignore the FileExistsError.
Any other failure is treated as a warning.
Fixes this case:
Traceback (most recent call last):
File "/usr/libexec/vyos/services/vyos-configd", line 156, in run_script
script.apply(c)
File "/usr/libexec/vyos/conf_mode/vpp.py", line 613, in apply
control_host.override_driver(
File "/usr/lib/python3/dist-packages/vyos/vpp/control_host.py", line 138, in override_driver
Path('/sys/module/vfio_pci/drivers/pci:vfio-pci/new_id').write_text(
File "/usr/lib/python3.11/pathlib.py", line 1079, in write_text
with self.open(mode='w', encoding=encoding, errors=errors, newline=newline) as f:
FileExistsError: [Errno 17] File exists
|
|
The renew command will refuse to restart the dhcp6c process for an
interface unless it is configured to request an address, but the
client may also be running to manage parameters and/or prefix
delegations.
|
|
This enhances diagnostic capabilities by providing hardware topology
visuals within support archives.
|
|
salt: T8056: add a deprecation warning
|
|
op-mode: T7810: fix broken 'reset connection' command
|
|
T7982: container: generate run arguments once
|
|
ipsec: T8001: Commit fails removing VTI interface in IPsec config
|
|
ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`
|
|
syslog: T8059: migrate host:port node names to the new syntax with a dedicated port option
|
|
The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.
|
|
If any dynamic rule is configured forwarding should be disabled because each
packet must be processed through the NAT session table to apply proper
translations
|
|
|
|
|
|
openvpn: T7738: avoid duplicate certs during 1.3 -> 1.4 migration
|
|
|
|
with a dedicated port option
|
|
T8030: VPP: Check support for changed driver too
|
|
When migrating from VyOS 1.3 to 1.4, OpenVPN interfaces sharing the same
certificate (chain) end up getting duplicated certificate entries, one per
interface — instead of reusing a single cert if applicable.
This change makes the migration logic detect shared certificates and reuse a
single CA and server certificate objects, preventing redundant certificate
entries in the config.
|
|
addresses
|
|
|
|
Fix cases where commit or IPsec up/down hooks fail if the VTI interface
has already been deleted or the `/tmp/ipsec_vti_interfaces` file does not
exist.
Changes:
- Return empty dict from `get_interface_config()` if it returns None to
avoid TypeError when accessing 'operstate' (vti_updown_db.py).
- Use `open_vti_updown_db_for_create_or_update()` in `vti‑up‑down` script so
the temporary interface tracking file is created automatically when
missing.
|
|
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
|
|
vpp: T8036: Commit fails removing nat44 static rule
|
|
frr: T8034: use dict_search() for routing protocols to check if VRF is used
|
|
T7319: check for unsaved commits before proceeding with 'add system image'
|
|
|
|
dict_search() is save when passing in keys that do not exist in the dict
we are working on.
|
|
kea: T7913: Fixes for ping-check handling
|
|
|
|
firewall: T7739: Default ruleset for firewall zones
|
|
bond: T8023: validate member interface min/max MTU
|
|
It is impossible to set the bond interface MTU to be larger or lower then the
limits of the underlaying interface MTU. Add proper commit validation and
smoketest.
|
|
- Kea docs state multi-threaded mode is required for ping checking.
- Parent scope needs enabling if shared-network/subnet has ping-check enabled.
|
|
Add a commit-time check and warning to the user if the TACACS source-address is
not configured on the system or the given VRF.
|
|
Add a commit-time check and warning to the user if the RADIUS source-address
(IPv4 or IPv6) is not configured on the system or the given VRF.
|
|
|
|
veth: T8017: bugfix KeyError: 'peer_name'
|
|
T8012: Add user vpp to user groups
|
|
To allow call VPP api without sudo
- Get op-mode commands without sudo
- Use API call in smoke-tests
|
|
T7556: VPP add IPFIX collector configuration
|
|
Use safe dict_search() function to locate veth peer interface name. If no peer
is defined an error will be displayed.
|
|
|
|
Add VPP IPFIX configuration commands:
```
set vpp ipfix active-timeout '8'
set vpp ipfix collector 192.0.2.2 port '2055'
set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1'
set vpp ipfix flowprobe-record 'l2'
set vpp ipfix flowprobe-record 'l3'
set vpp ipfix flowprobe-record 'l4'
set vpp ipfix inactive-timeout '32'
set vpp ipfix interface eth0
set vpp ipfix interface eth1 direction 'both'
set vpp ipfix interface eth1 flow-variant 'ipv4'
```
|
|
After T7836: move bind mount of /config to vyos-1x, the bind mount is
configured at boot, not within the initrd. On image install, one needs
to check for previous installations in the resident directory
/opt/vyatta/etc/config of the mounted disk.
|
|
removed from vif
Do not allow to delete subinterface if it is in use in VPP features
|
|
T7731: Static ARP entries are missing after an interface status change
|
|
|
