VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8859-dh-keysize-validation 2026-09-26T17:09:05+00:00 2026-09-26T17:09:05+00:00 Yuriy Andamasov yuriy@vyos.io 2026-09-26T16:58:39+00:00 urn:sha1:d497c3b7a7504bb578874cc706dc75849ad84c2d The Diffie-Hellman length check stringified the requested minimum keysize into a variable it never used, then converted the original argument again for the comparison. A non-numeric value therefore escaped as an uncaught ValueError from the comparison rather than being reported where it was passed in. The argument is now typed and validated up front: a non-integer raises TypeError, booleans included, and a non-positive integer raises ValueError. Both indicate a logic error in the calling script and should fail loudly instead of silently reporting an undersized key. The only callers today are the unit tests, so the contract is free to change. A file that exists but holds no readable parameters is user input rather than a logic error, and now fails the check instead of propagating the error from openssl. The bit-count pattern becomes a raw string, and the tests pass integer keysizes and cover the new paths. 2026-09-25T14:55:23+00:00 Daniil Baturin daniil@vyos.io 2026-09-25T14:55:23+00:00 urn:sha1:430dda1e170576239d3580c1b7a6381525a05cbc vpp: T9146: Enable DPDK no-multi-seg when a full frame fits the buffer 2026-09-25T13:54:17+00:00 Christian Breunig christian@breunig.cc 2026-09-25T13:54:17+00:00 urn:sha1:3de407dff80b19a40e6722d9e71aca5fc2767f2f ppp: T9060: do not derive a link-local address from a synthetic MAC 2026-09-24T19:01:00+00:00 Christian Breunig christian@breunig.cc 2026-09-24T19:01:00+00:00 urn:sha1:53b661d60e50edd1079a2f55e0cb3e44e76553e2 A PPP link has no hardware address. RFC 5072 defines the IPv6 interface identifier of such a link as the one negotiated via IPV6CP, and that negotiation is also what guarantees its uniqueness - which is why duplicate address detection is skipped for the link-local address on PPP links. VyOS additionally derived an EUI-64 link-local address from a synthetic MAC address and assigned it to PPPoE and SSTP client interfaces. The peer knows nothing about that address and its uniqueness was never verified. With two link-local addresses present, RFC 6724 source address selection falls through to rule 8 and may pick the synthetic one, so DHCPv6 prefix delegation and router solicitations leave from an address the BRAS never negotiated. ISPs validating the source address silently drop them and delegation stalls. Both interface types now carry only the address negotiated via IPV6CP. A leftover address on an established session is removed on commit. 2026-09-24T17:06:31+00:00 Christian Breunig christian@breunig.cc 2026-09-24T17:06:31+00:00 urn:sha1:990fa1569d3087842d8ff407d8c2ba4ead1d847e vxlan: T9319: add VXLAN-GBP support 2026-09-22T23:13:09+00:00 Haakon Nore haakon@nore.cloud 2026-09-15T08:28:01+00:00 urn:sha1:4fd9ad0ac3a79aba079b10f58ec897847eb271d5 Expose the Group Policy extension as a valueless gbp CLI node and pass it to iproute2 when creating VXLAN links. Recreate links when GBP changes and reject configurations combining GBP with GPE. Reject conflicting GBP settings on a shared UDP port, accounting for address families and underlay VRF socket bindings. Warn that external mode carries GBP in tunnel metadata instead of the packet mark. Add smoketest coverage for GBP creation, removal and re-enabling, retained interface settings, rejection without changing the running tunnel, shared ports, separate address families, and external mode. 2026-09-22T14:18:00+00:00 Christian Breunig christian@breunig.cc 2026-09-22T14:18:00+00:00 urn:sha1:2b06da194c61091511a6eaf995b5186a919a4a7b configtree: T9307: serialize libvyosconfig calls across threads 2026-09-16T21:50:12+00:00 Christian Breunig christian@breunig.cc 2026-09-16T21:50:12+00:00 urn:sha1:f6102c545e8587acb747af3dca5633143a59c781 test_dhcp_vrf and test_dhcpv6_vrf resolved the DHCP client's PID, then read the VRF's process list and asserted the PID appeared in it. The client re-executes itself at moments of its own choosing, so between those two steps it can come back with a new PID - the process is in the VRF, it simply is not the process we asked about: AssertionError: '13502' not found in '14322 dhclient\n 14324 dhclient-script\n 14485 dhclient...' Observed failing and passing on the same image, so it costs a rerun rather than telling anyone anything. get_process_cmdline() already fights the same race for the /proc read. Resolve the PID and read the VRF's list as one step and retry, so a restart costs a retry instead of a failure. The probe itself was also loose: substring-matching the raw output of "ip vrf pids <name>" lets a PID check be satisfied by the process name column or by a longer PID containing ours. Add vyos.utils.network.get_vrf_pids(), which parses the command's "<pid> <name>" lines into (pid, process_name) tuples and returns an empty list for an unknown VRF, and compare the PID field as an int. 2026-09-16T18:48:14+00:00 Christian Breunig christian@breunig.cc 2026-09-16T18:48:14+00:00 urn:sha1:7943d798dcb4c860610d3e1b2869175a9147c083 T8264: openvpn dco lifecycle 2026-09-15T12:48:01+00:00 Daniil Baturin daniil@vyos.io 2026-09-15T12:48:01+00:00 urn:sha1:f5aec62f3d48f091b07c61d4666d824748a27c96 ipsec: T9254: do not emit ESN transforms in IKE proposals