vyos-1x.git/src/migration-scripts, branch fix/T8859-dh-keysize-validation

openvpn: T8264: reject the raw options DCO cannot serve

2026-09-13T19:06:12+00:00

Raw options are appended after --config and therefore override what the CLI rendered, so they have to face the same checks. A single cipher the Kernel module does not implement makes OpenVPN fall back to the userspace data path; "ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop the offload just the same. "DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers alone before it weighs the offload, and the migration drops the offload from whatever stays rejected.

openvpn: T8264: keep the keepalive within what OpenVPN accepts

2026-09-13T19:06:12+00:00

The CLI renders "keepalive " while its two ranges are independent, so it can produce parameters the daemon refuses to start on: a timeout below twice the interval, or one beyond the 12 hours OpenVPN is about to cap ping and keepalive at. A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks and simply runs without keepalive, so leave that combination alone. Migrate what stays rejected, or an upgrade would leave a configuration the router can no longer commit at boot.

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.

serial: T9269: test migration system 31 -> 32 for the console_type key

2026-09-09T19:29:03+00:00

Commit bc0b4178b already covers a missing GRUB configuration, where vars_read() returns an empty dict. A non-empty dict without console_type still raises KeyError: vars_read() drops variables written with an empty value, which grub.set_serial_console() produces for a flavor carrying no console data.

smoketest: T9014: make configtest serial console image flavor agnostic

2026-09-07T16:35:55+00:00

The configuration tests hardcoded "system console device ttyS0 speed 115200", which only holds for amd64, whereas arm64 images expose the UART as ttyAMA0, so loading these configs produced a diff against the assert data and the tests failed. Replace the hardcoded values in all config test inputs and their assert counterparts with the @SERIAL_DEVICE@ and @SERIAL_SPEED@ placeholders. The vyos-1x-smoketest postinst queries the image flavor and implants the real values once at install time, so the test runner needs no runtime patching. Migration script 31-to-32 now derives the serial device from the flavor, too, instead of assuming ttyS0. This can be observed during vyos-1x package installation while building the ISO image Setting up vyos-1x-smoketest (999.0-14834-g16f1cf457-dirty) ... ... I: Implanted serial console ttyS0,115200 into /usr/libexec/vyos/tests/configs

Merge pull request #5123 from indrajitr/ddclient-v4

2026-08-14T13:00:14+00:00

ddclient: T6981: Upgrade ddclient to v4.0.0

T8598: Accel-PPP: Add upgrade-safe migration support for calling-sid peer IID secret enforcement across PPPoE, L2TP, PPTP, and SSTP (BP 2188)

2026-08-12T21:50:20+00:00

(cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed)

ddclient: T6981: Remove defunct woima

2026-07-24T17:15:25+00:00

Since woima (woima.fi) has been shut down, we need to remove any configuration path that refers to woima. Apply migration to remove woima from dynamic DNS service configurations.

ddclient: T6981: Remove defunct googledomains

2026-07-24T17:12:18+00:00

Since googledomains (domains.google.com) has been shut down, we need to remove any configuration path that refers to googledomains. 1. Remove 'googledomains' as the default web resolver in ddclient.conf.j2 2. Apply migration to remove googledomains from dynamic DNS service configurations. The migration is also necessary to undo a previous migration where we added 'googledomains' as default web resolver to work around lack of tls (ssl) support with default web resolver 'dyndns' (checkip.dyndns.org) in ddclient v3.x.

utils: T9008: migrate remaining cmd() callers to cmdl() and remove cmd()

2026-07-17T16:10:08+00:00

Complete the safer-subprocess migration started by the cmdl()/ifconfig refactoring and convert every remaining vyos.utils.process.cmd() call site to the list-based cmdl(). Drop the vyos.utils.process.cmd() implementation as it is no longer in use.