vyos-1x.git/src/conf_mode, branch fix/T8955-http-api-verify-tlsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls2026-10-01T16:06:45+00:00policy: T9379: prefix-list duplicate check in linear time2026-10-01T16:06:45+00:00Alex Kudentsov43482574+alexk37@users.noreply.github.com2026-10-01T16:06:45+00:00urn:sha1:6a7cc74c48f0ce021b4c84cb7412683a9c0e9ae8
verify() looked up each prefix-list rule in a list of the rules seen
so far, which is quadratic in the size of the list and runs on every
policy commit. verify() alone, run from the source on a workstation,
took 41.8 s for a 40,000-rule list; on a 1.5.1 VM the check cost 0.08 s
at 2,000 rules.
Keep a set of the rules' sorted items instead. Every value under a
prefix-list rule is a single leaf, so the key is hashable, and two keys
are equal exactly when the rule dicts are: the same rules are flagged,
with the same message. The workstation benchmark took 0.11 s.
openvpn: T9364: default the MTU to 1420 when DCO is enabled2026-09-29T21:33:24+00:00Antonio Quartulliantonio@mandelbit.com2026-09-28T14:02:20+00:00urn:sha1:12d3aa212f35b8cdd9a0ccd849b45beea46ed94d
The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU
full sized packets get fragmented on the underlay.
Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it
defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is
present. Reject "mtu" together with such an option, below 100, and
below 1280 when IPv6 runs inside the tunnel.
Merge pull request #5491 from omnom62/T8989-hotfix-oidc_aud_validation2026-09-29T19:07:04+00:00John Estabrookjestabro@vyos.io2026-09-29T19:07:04+00:00urn:sha1:541c7f90c5c45e7e51a9978ad0cbfb8e8ab942ca
http-api: T8989: Hotfix to enforce audience validation if OIDC is configuredopenvpn: T9363: multiply the site-to-site keepalive timeout2026-09-29T18:40:44+00:00Antonio Quartulliantonio@mandelbit.com2026-09-24T14:32:15+00:00urn:sha1:b6abe23ba2d2a5d5055afd203bc3e60ee20bf757
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
Merge pull request #5397 from jeleel-muibi/t8999-openvpn-shared-secret-errors2026-09-29T18:39:27+00:00Christian Breunigchristian@breunig.cc2026-09-29T18:39:27+00:00urn:sha1:46d5702af546ce2f1d97d4cc145292a895e620fd
openvpn: T8999: improve shared-secret reference errorsMerge pull request #5499 from c-po/wwan-improvements2026-09-29T04:42:46+00:00Christian Breunigchristian@breunig.cc2026-09-29T04:42:46+00:00urn:sha1:4f2ac698227c3c4970a3b21d5e4d540f9fb24c80
wwan: T9350: possible dead interface after boot, disconnect does not stickhttps: T8989: Hotfix to enforce audience settings with OIDC is configured2026-09-28T20:58:05+00:00omnom62omnom62@outlook.com2026-09-21T20:37:12+00:00urn:sha1:f75c7b74dc4c2f38ad9e61e08dfe9fd1fc0686f9Merge pull request #5509 from c-po/pim-delete2026-09-28T19:16:04+00:00John Estabrookjestabro@vyos.io2026-09-28T19:16:04+00:00urn:sha1:39528a2d74fd1f18433cc4cbec301f869181e5ec
pim: T9362: prevent killing an already dead/non-existing PIDopenvpn: T8999: improve shared-secret reference errors2026-09-28T14:09:22+00:00Jeleel Muibijeleel-muibi@users.noreply.github.com2026-09-02T11:24:07+00:00urn:sha1:9bb198be628b3cfaa3f36c87412f5b735ef9e2e0Merge pull request #5266 from MPStudyly/T8977_fix_haproxy_rebind2026-09-28T09:27:15+00:00Daniil Baturindaniil@vyos.io2026-09-28T09:27:15+00:00urn:sha1:ff5982314a58926c68da9d7a898c9fdf0bd653fe
T8977: Fix regression with is_addr_assigned and is_listen_port_bind_service