VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling 2026-10-07T18:04:21+00:00 2026-10-07T18:04:21+00:00 Christian Breunig christian@breunig.cc 2026-10-07T18:04:21+00:00 urn:sha1:58ccdee2d255f4e952322467902f7d69b4f828fa openvpn: T9370: add chacha20poly1305 data cipher 2026-10-05T20:41:37+00:00 Christian Breunig christian@breunig.cc 2026-10-05T20:41:37+00:00 urn:sha1:da6941e2a80697e31c0f62c0f62c52f570ebb7e9 "show secure-boot" only reported whether Secure Boot is enabled, not who signed the running Linux Kernel. An image signed by the VyOS CA could not be told apart from one signed with a custom Machine Owner Key. "show secure-boot detail" now lists issuer and subject of the Kernel image signature certificates. The same information is added to the raw "show version" data as "secure_boot_detail", issuer and subject delimited by ",". The key is only present when Secure Boot is enabled and a signature could be read. 2026-10-01T13:41:53+00:00 Antonio Quartulli antonio@mandelbit.com 2026-10-01T13:41:53+00:00 urn:sha1:8d99a2f6f81b225014d246dcf6c7bb03c641d4da Offer chacha20poly1305 in "encryption data-ciphers" and "encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and allowed with DCO. 2026-09-29T13:41:40+00:00 Adam Smith adamsmith@yzguy.io 2026-09-29T13:41:40+00:00 urn:sha1:a272bffcf16c6c5ced83fb19a35aa3c78bbf7bff modem_index() in python/vyos/utils/wwan.py derived the ModemManager modem index straight from the interface name (wwan0 -> 0). The kernel-assigned WWAN interface number and ModemManager's own modem index are two independently enumerated values and are not guaranteed to match - on a box with more than one modem, they can enumerate in different orders, so modem index 0 does not necessarily own wwan0. Every function in this module funnels through modem_index() (start_modem_manager, modem_disconnect, modem_connect, and both admin-disconnect marker helpers), and is_wwan_connected() in vyos.utils.network had its own separate copy of the same assumption - so a single reversed enumeration order silently commands the wrong physical modem for every one of them. modem_index() now lists every modem ModemManager currently knows about and returns whichever one actually has ifname in its own port list, instead of assuming the correspondence. A modem that has not shown up on the bus yet looks the same as one that will never exist, so this waits up to the same modem_wait_timeout budget start_modem_manager() already gives a modem to become dialable, then returns None if nothing claimed the interface. is_wwan_connected() now calls the same resolver instead of keeping its own copy of the old assumption. None is a real, expected return now, not just a theoretical one - the three callers that previously assumed modem_index() always produced *a* string (right or wrong) are updated: start_modem_manager() bails out early (matching the tolerance its own caller's w.exists() check already has for hardware that isn't detected yet), modem_disconnect() and modem_connect() treat it as nothing to disconnect / a failed dial, matching each function's own existing return contract. show_wwan.py's modem_info() raises a clear, specific error instead, which its own top-level exception handler already reports cleanly. set_admin_disconnected()/clear_admin_disconnected() only ever used modem_index() to validate the interface name looks like a WWAN interface in the first place, so they're unaffected. 2026-09-29T04:42:46+00:00 Christian Breunig christian@breunig.cc 2026-09-29T04:42:46+00:00 urn:sha1:4f2ac698227c3c4970a3b21d5e4d540f9fb24c80 wwan: T9350: possible dead interface after boot, disconnect does not stick 2026-09-28T19:18:12+00:00 Christian Breunig christian@breunig.cc 2026-09-28T19:18:12+00:00 urn:sha1:504c97e7c661de8ea771a8daa7a3c7d6c8e5d86b op-mode: T9354: replace "reset connection" with "reconnect interface" 2026-09-27T18:02:14+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-15T09:15:59+00:00 urn:sha1:609b8d4d8008729af2478029b8e25ae4359ad56b create_private_key() took one "size" for every key type, but the number means entirely different things per type: for RSA and DSA it is a modulus size, for EC it selects a curve. CodeQL is not path sensitive across the key_type comparison, so it follows the 256 an EC caller passes into the RSA and DSA branches that caller can never reach, and reports pki.py as generating 256 bit RSA and DSA keys. Build elliptic curve keys in create_ec_private_key() instead and route the op mode generator and the OpenVPN smoketest there, so no curve size ever enters the function that also builds RSA and DSA keys. create_private_key() now refuses a key type it does not build rather than returning None, so a caller cannot drift back into the old shape unnoticed. 2026-09-26T20:06:34+00:00 Christian Breunig christian@breunig.cc 2026-09-26T20:06:34+00:00 urn:sha1:ecd3a01a9563f77d9d9e5a9ef5d9b1b9aacc2fda firewall: T9205: fix ruff findings in conf_mode/op_mode firewall.py 2026-09-25T19:02:00+00:00 Christian Breunig christian@breunig.cc 2026-09-25T19:02:00+00:00 urn:sha1:ce4f4c98f13dc039875bd23c51e081a5381917e0 A reconnect is usually issued via the very interface being reconnected. Once the link drops, the calling session dies and the reconnect was killed by SIGHUP - or by SIGPIPE on the next write to the dead terminal - before the interface could be dialed again, leaving the system unreachable. The reconnect now runs in a transient systemd unit and survives the loss of the session. Progress is logged to the journal. PPPoE and SSTP restart the ppp service in a single operation instead of stopping and starting it, so there is no window in which an interrupted command leaves the link down. WWAN still disconnects the modem before dialing again. 2026-09-25T18:53:02+00:00 Ruben Herold ruben@puettmann.net 2026-08-13T12:57:03+00:00 urn:sha1:de934a295f177428969b95474aff717d95f02401 cmdl() decodes subprocess output as utf-8 and can raise UnicodeDecodeError (not an OSError subclass) if that fails, in addition to OSError on command failure. Catch both, closing a gap left by the exact-exception narrowing in the previous commit.