vyos-1x.git/src/conf_mode, branch rolling

Merge pull request #5388 from c-po/remove-acme-autocert

2026-08-11T18:02:14+00:00

pki: T9135: derive ACME certificate chains from disk

Merge pull request #5377 from l0crian1/better-fw-error-output

2026-08-10T20:13:11+00:00

firewall: T7552: Output rule in verify_rule() ConfigError messages

pki: T9135: restore an ACME certificate backup on any request failure

2026-08-10T19:06:00+00:00

certbot_request() ultimately shells out via cmdl(), which can fail with something other than ConfigError - e.g. FileNotFoundError if the certbot binary itself is missing, or another OSError from the underlying process call. The backup/restore wrapper around a certificate replacement only caught ConfigError, so any other failure skipped restoration entirely and left the certificate deleted with no way back, defeating the point of taking a backup before requesting a replacement in the first place.

pki: T9135: surface the real ACME error reason on certbot failure

2026-08-10T19:04:07+00:00

A failed certbot request or renewal only showed the CLI a raw dump of the invoked command line and its exit code - not the actual reason (e.g. rate limiting, failed domain validation), because certbot's own non-interactive error reporting can itself crash on an unrelated internal bug while trying to display the failure, masking it entirely from the captured output. Read the real reason directly out of certbot's own debug log instead, scoped to what the current invocation appended, and use it as the error message shown to the user. Falls back to the previous generic message when no such line is found.

pki: T9135: derive ACME certificate chains from disk

2026-08-10T19:04:07+00:00

An ACME-issued certificate's intermediate CA was previously imported into the running configuration as a synthetic object, purely so consumers building a full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could find it. This leaked certbot's internal state into the CLI as a real, deletable object that never needed to exist there: the intermediate is available on disk the moment the certificate is issued, same as the leaf certificate and its key. Read it live from disk instead, purely in memory, wherever a full chain is resolved or displayed - never as a settable or deletable configuration object. An already-configured CA that completes the chain on its own takes precedence and nothing synthetic is added. Adding, changing, or removing a CA now reloads only the services whose resolved chain is actually affected, with no side effect on certificates whose own content did not change.

Merge pull request #5384 from c-po/container-fix

2026-08-10T13:43:08+00:00

container: T7736: fix smoketest failures caused by netavark/aardvark-dns IPv6 DAD race

Merge pull request #5347 from statio/T9122-flow-accounting-netflow-vrf

2026-08-08T16:46:36+00:00

flow-accounting: T9122: bind NetFlow export to the configured VRF

container: T7736: disable IPv6 DAD for netavark bridges to fix aardvark-dns race

2026-08-07T21:17:28+00:00

netavark assigns the IPv6 gateway address to a container "pod-*" bridge and immediately invokes aardvark-dns to bind its DNS listener to it. While the address is "tentative" during Duplicate Address Detection, that bind() fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled network. The kernel only skips DAD for an address if both "all" and the specific interface's own accept_dad are disabled at the moment the interface is created. A per-interface override is always either too late for a network's first-ever container - as the network can only be created in-time and not explicitly before starting the first container.

container: T7736: give container veths a deterministic host_interface_name

2026-08-04T18:36:28+00:00

Podman's default "vethN" auto-naming for a container's host-side veth can collide with VyOS's own "virtual-ethernet vethN" interfaces. Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name" network connect option) and use it to name every non-macvlan container network attachment "veth-" instead, eliminating the collision by construction. Container names too long to fit are shortened to a recognizable prefix plus a short hash of the full name; verify() rejects the rare case where two containers still generate the same interface name. Add "show container interface" to display the resulting name-to-container mapping.

T7552: Added more detail to error messages

2026-08-04T17:17:54+00:00