vyos-1x.git, branch rolling

Merge pull request #5333 from BradKollmyer/T9086-netlinkd-stale-linkdown

2026-08-11T19:32:09+00:00

vyos-netlinkd: T9086: ignore stale link-DOWN; drain netlink during commit

vyos-netlinkd: T9086: drain netlink during commit to avoid stale link-DOWN

2026-08-11T19:30:35+00:00

Original bug: while a commit held the lock, the daemon called sleep(1) without reading the netlink socket. The pending message stayed queued in the kernel buffer, so once the commit ended, a stale event (e.g. a DOWN from a disable that had already been re-enabled) got processed as if it were fresh - stopping dhclient on an interface that was actually back UP. The applied fix keeps only the two pieces that are actually load-bearing: 1. Drain instead of sleep - while commit_in_progress2() is true, still call ipr.get() to read and discard any pending netlink messages, so nothing stale survives to be processed after the commit ends. 2. Reconcile on commit end - once the commit finishes, walk all matching interfaces, compare live sysfs operstate against the last state the daemon acted on (_iface_prev_operstate), and run the normal DHCP handler for any that disagree. This catches a real transition that happened only inside the drain window and would otherwise be silently lost. Dropped from the original fix: an unconditional live-sysfs override inside _handle_dhcp_events() that ran on every event, not just around commits - redundant with reconcile, and risked discarding genuine fast link flaps unrelated to any commit. Co-authored-by: Christian Breunig

Merge pull request #5388 from c-po/remove-acme-autocert

2026-08-11T18:02:14+00:00

pki: T9135: derive ACME certificate chains from disk

Merge pull request #5382 from BradKollmyer/T9167-kea-ha-timer-defaults

2026-08-11T15:56:27+00:00

dhcp: T9167: align Kea HA timer defaults with Kea ARM

Merge pull request #5391 from c-po/comp-file-fix

2026-08-11T15:54:25+00:00

op-mode: T7250: restore image/file path completion for show/copy/delete file

Merge pull request #5365 from l0crian1/last-used

2026-08-11T15:53:51+00:00

firewall: T8221: Add last-used option to firewall rules

Merge pull request #5363 from natali-rs1985/T9134

2026-08-11T07:22:11+00:00

qos: T9134: Fix commit crash when classes match different protocols

Merge pull request #5377 from l0crian1/better-fw-error-output

2026-08-10T20:13:11+00:00

firewall: T7552: Output rule in verify_rule() ConfigError messages

op-mode: T7250: restore image/file path completion for show/copy/delete file

2026-08-10T20:02:50+00:00

The imagefiles comptype dispatched to _vyatta_image_file_complete, a function that was never ported when the legacy vyatta-op bash completion script was imported in commit 72a704d2e2 ("T6527: add legacy Vyatta interpreter files still in us"), causing "Invalid command: [_vyatta_image_file_complete]" on tab-completion. Port the original vyatta-image-complete interpreter so completion of works again as it did on VyOS 1.4.x.

pki: T9135: add "show pki ca/certificate text" command

2026-08-10T19:34:19+00:00

"show pki ca/certificate " only ever offered PEM output, which isn't practical for a human to actually read. Add a "text" form that runs the certificate through OpenSSL's own "-text" formatter, the same human-readable breakdown "openssl x509 -text" produces.