| Age | Commit message (Collapse) | Author |
|---|
|
|
|
(#5193)
Recently (commit 35db941bcf "serial: T8375: add CLI option to explicitly set
kernel console") we added the CLI knob to enable the Kernel and GRUB serial
console on a given device.
Currently this is supported for serial console interfaces starting with ttyS
and ttyAMA only. Main limitation is that these interfaces are wired to the CPU
and bootloader infos can be displayed.
|
|
|
|
WLB per-interface routing tables only contain a default route. When
LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes
it to these tables where internal destinations (BGP, connected, DNAT)
have no matching route and incorrectly exit via WAN.
Add ip rule with table main suppress_prefixlength 0 before each
per-interface table rule. This checks the main routing table first
for specific routes but suppresses the default route, so only
internet-bound traffic falls through to WLB per-interface tables.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
|
|
When a WireGuard interface has both fwmark and VRF configured, outgoing
tunnel packets marked with the fwmark were not routed into the correct
VRF routing table, causing them to hit the l3mdev unreachable rule instead.
Add an ip rule at priority 1998 (after l3mdev at 1000 and before l3mdev
unreachable at 2000) to route fwmark-tagged packets into the correct
VRF routing table.
|
|
|
|
T8147: Update Linux Kernel to 6.18
|
|
|
|
option
|
|
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As
this was not available in the previous used LTS 6.6 Kernel it now is available
while we upgrade to Linux 6.18.
|
|
migration: T8280: Fix auth file read for interfaces on first boot of new image
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
T8539: Unable to traceroute using hostname and ipv6 source address
|
|
utils: T8541: add write-config-file-value helper
|
|
During first boot after installing a new VyOS image, migrations are
executed before the filesystem is fully initialized.
At this point `/config` is not yet bind-mounted, causing auth files
(certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet
EAPoL interfaces under `/config/auth` to be inaccessible even though they
exist under the underlying `/opt/vyatta/etc/config/auth` path which is
available at all boot stages.
Add fallback logic to `read_auth_file()` to retry the file lookup under
`/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
Introduce src/helpers/write-config-file-value.py to patch a saved config.boot
from scripts by writing a quoted CLI path with an optional value (omit --value
to create a valueless node).
Extend vyos.utils.config.write_saved_value() to safely update saved configs:
create missing parent nodes before tagging (ConfigTree.set_tag requires nodes
to exist) and then write the requested value/valueless leaf back to disk.
Remove the legacy serial console activation script which is now replaced by the
helper-based approach. The helper is run once during ISO Image assembly and will
inject the approprate serial console defintiions into config.boot.default.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP: T8495: fix issue with assigning acl on sub interfaces
|
|
T8534: refactor sysctl_(read|write) to accept key parts
|
|
|
|
|
|
T8532: merge unrelated histories of vyos-utils and vyos-1x repo
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
firewall: T8446: Prevent chain with offload rule on local zone
|
|
|
|
|
|
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which
conflicts with sysctl's dot-separated key syntax.
Change sysctl_read() and sysctl_write() to take key components as a list and
normalize each component by replacing . with / before invoking sysctl. This
fixes sysctl lookups/updates for VLAN subinterfaces.
Extend the SR-TE smoketest to cover a VLAN subinterface.
Previous error raising this issue:
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
|
|
T8445: T8335: Extend config activation system
|
|
|
|
|
|
|
|
* 'current' of github.com:vyos/vyos-utils: (65 commits)
T8269: add option to silence output of individual validators
T8306: update package version
vyos-op-run: T8306: add error messages for system exceptions
vyos-op-run: T8306: improve execution logic logging
vyos-op-run: T8301: improve the security of UID check and setuid logic
T8110: "list_interfaces --bondable" must not return VLAN subinterfaces
vyos-op-run: T7901: skip permission checks if the user is root
vyos-op-run: T8005: sanitize environment variables to prevent malicious variable injection
T7878: conflict check updated to use mergify
T7878: conflict check updated to use mergify
T7899: virtual-ethernet interfaces support broadcasts
Debian: T7899: bump dh compat version
T7758: add missing case to allow repeated option --type
T7758: allow repeated option --type in list_interfaces
vyos-op-run: T7745: add a command permission checking mechanism
op-mode: T7583: add a new operational command runner
T7644: mirror workflow refactoring rollout
T7579: fix of the run trigger for CLA
T7579: added workflow for CLA
validators: T6622: Radix-aware numeric validation
...
|
|
op-mode: T8483: fix /show_sensors.py: No such file or directory
|
|
serial: T8375: call update_serial_console() only once for default tty
|
|
Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is
arbitrary and can produce incorrect behavior. Sensors can be passed through to
virtual machines, so running in a VM should not be treated differently.
If no sensors are detected - whether on a hypervisor VM or on bare metal - the
command now reports: "No sensors found".
|
|
|
|
vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API call
|
|
serial: T8211: fix symlink collisions for multi-port USB serial adapters
|
|
|
|
|
|
Use refined activation tools for correct behavior on first installed
boot.
|
|
This is necessary for images produced from a raw_image build (qcow2),
which no longer make use of the image_installer script.
|
|
Add script to leave hint of first installed boot (as, say, distinguished
from first live boot, or subsequent); this is useful as pre/post
conditions and self-modification of activation scripts.
|
|
|
|
|
|
|
|
|
