vyos-1x.git/src/services, branch nos-task-id

vyos-netlinkd: T9143: seed operstate cache at startup

2026-07-30T03:58:13+00:00

The state tracker starts empty whenever vyos-netlinkd starts, so the first same-state RTM_NEWLINK UP notification is treated as a transition and unnecessarily restarts DHCP. Seed matching interface states from the kernel link dump after binding the rtnetlink socket. This preserves real DOWN-to-UP handling while suppressing the first redundant UP notification.

Merge pull request #5327 from BradKollmyer/T9076-remote-group-interval

2026-07-23T14:28:21+00:00

firewall: T9076: add per-remote-group update interval

utils: T9008: migrate remaining cmd() callers to cmdl() and remove cmd()

2026-07-17T16:10:08+00:00

Complete the safer-subprocess migration started by the cmdl()/ifconfig refactoring and convert every remaining vyos.utils.process.cmd() call site to the list-based cmdl(). Drop the vyos.utils.process.cmd() implementation as it is no longer in use.

firewall: T9076: add per-remote-group update interval

2026-07-10T23:31:18+00:00

Add 'set firewall group remote-group interval ' to control how often each remote group list is re-downloaded, independent of the global resolver-interval that also drives domain-group/FQDN resolution. The value accepts plain seconds or time-unit suffixes s/m/h/d/w (e.g. 4h), range 60 seconds to 4 weeks, enforced at commit time after conversion. When unset, the group keeps following 'firewall global-options resolver-interval', so existing configurations are unaffected. vyos-domain-resolver now tracks a last-update timestamp per remote group and sleeps until the next due update instead of a fixed resolver-interval tick, honoring per-group intervals both shorter and longer than the global one. A group is only stamped as updated after a successful download; failed downloads fall back to the cached list and are retried at the resolver cadence rather than after the full group interval. human_to_seconds() now treats a plain number as seconds instead of returning 0. Co-Authored-By: Claude Fable 5

T9068: refactor vyos-configd with config manager

2026-07-09T02:27:45+00:00

Merge pull request #5275 from BradKollmyer/remote-T8829-head-fallback

2026-07-07T13:42:21+00:00

remote: T8829: fall back to GET when HEAD is not supported

ci: T8490: fix typos in comments, strings, and local identifiers

2026-06-29T12:10:10+00:00

Reaches a clean typos baseline for the T8490 ruleset pilot. Categories: - Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError; "ned" -> "new" (migration comments). - Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is". - Local variables (all refs in-function): commited, formating, presistent; inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision). - Self-contained renames (definition + all references in-file): formated_stats, _get_formatted_output_conections -> ..._connections, expension_failure -> expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required. False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's "U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert the real upstream `vppctl` output). Verified: typos clean, py_compile of every edited .py, zero remaining old-identifier references. 🤖 Generated by [robots](https://vyos.io)

vyos-netlink: T7965: only re-apply QoS configuration to individual interface

2026-06-22T19:33:50+00:00

The previous vyos-netlinkd implementation for QoS policy re-apply was very heavy. It conducted a full CLI validation and re-apply on every interface. Instead we do not only re-apply the QoS configuration to the interface which has had an address change detected by vyos-netlinkd. This can be tested by checking "tc qdisc show" before disconnecting a PPPoE interface and during/after reconnect. There will be no qdisc until the dynamic interface has received an IP address - then the qdisc will be re-applied.

remote: T8829: fall back to GET when HEAD is not supported

2026-06-21T22:42:29+00:00

HttpC.download() always probed remote URLs with HEAD before GET to discover redirects and Content-Length. Some APIs (e.g. AbuseIPDB) reject HEAD with 405 Method Not Allowed, causing firewall remote-group downloads to fail and leave empty cached list files. Treat HEAD 405/501 as unsupported and proceed with GET using the original URL. When HEAD does not provide Content-Length, read it from the GET response headers instead. Validate available storage after determining file size and before opening the destination file. Log sanitized download errors in vyos-domain-resolver when a remote- group list-file fetch fails. Add unit tests with mock servers that return 405 or 501 on HEAD and 200 on GET.

vyos-netlink: T7965: re-apply QoS configuration on dynamic interfaces

2026-06-20T20:56:18+00:00

Re-apply QoS after dynamic interfaces get addresses after connect/disconnect. When PPPoE interfaces re-connect we need to re-do QoS settings.