vyos-1x.git/src/tests, branch fix/T8859-dh-keysize-validation

python: T8859: fail loudly on an invalid Diffie-Hellman keysize argument

2026-09-26T17:09:05+00:00

The Diffie-Hellman length check stringified the requested minimum keysize into a variable it never used, then converted the original argument again for the comparison. A non-numeric value therefore escaped as an uncaught ValueError from the comparison rather than being reported where it was passed in. The argument is now typed and validated up front: a non-integer raises TypeError, booleans included, and a non-positive integer raises ValueError. Both indicate a logic error in the calling script and should fail loudly instead of silently reporting an undersized key. The only callers today are the unit tests, so the contract is free to change. A file that exists but holds no readable parameters is user input rather than a logic error, and now fails the check instead of propagating the error from openssl. The bit-count pattern becomes a raw string, and the tests pass integer keysizes and cover the new paths.

Merge pull request #5466 from rnavarro/fix/configtree-serialize-libvyosconfig

2026-09-22T14:18:00+00:00

configtree: T9307: serialize libvyosconfig calls across threads

Merge pull request #5429 from rockfish-vyos/T9254-ike-esn

2026-09-15T12:48:01+00:00

ipsec: T9254: do not emit ESN transforms in IKE proposals

ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher()

2026-09-14T08:19:12+00:00

get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA semantics), and every IKE_SA call site had to remember to pass esn=False. Nothing enforced that, so a future call site could reintroduce the ESN-in-IKE bug this task fixed. Following review feedback from hedrok, split it into two public filters: get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True get_ike_cipher(group_config) IKE_SA, esn=False always The shared implementation moves to _get_esp_ike_cipher() (no register_filter), so a template can no longer call it directly and skip picking one of the two entry points. Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2 (proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and test_template.py.

openvpn: T8264: reject the raw options DCO cannot serve

2026-09-13T19:06:12+00:00

Raw options are appended after --config and therefore override what the CLI rendered, so they have to face the same checks. A single cipher the Kernel module does not implement makes OpenVPN fall back to the userspace data path; "ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop the offload just the same. "DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers alone before it weighs the offload, and the migration drops the offload from whatever stays rejected.

openvpn: T8264: keep the keepalive within what OpenVPN accepts

2026-09-13T19:06:12+00:00

The CLI renders "keepalive " while its two ranges are independent, so it can produce parameters the daemon refuses to start on: a timeout below twice the interval, or one beyond the 12 hours OpenVPN is about to cap ping and keepalive at. A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks and simply runs without keepalive, so leave that combination alone. Migrate what stays rejected, or an upgrade would leave a configuration the router can no longer commit at boot.

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.

configtree: T9307: serialize libvyosconfig calls across threads

2026-09-13T03:40:37+00:00

libvyosconfig is not safe for concurrent entry. ctypes releases the GIL for each foreign call, so threads in one process can be inside the library at the same time; two concurrent from_string calls, or from_string racing destroy, corrupt the shared parser state and crash the process with SIGSEGV. vyos-http-api reaches this when a configure operation runs in the threadpool while a retrieve is served on the event loop. Serialize every entry point on one process-wide RLock in the _Lib wrapper. For the entry points that report through the library's global error buffer, read the buffer while the lock is held and keep it per thread, so get_error() returns the caller's own error; destroy, which can run from __del__ between a failed call and get_error(), leaves it untouched.

Merge pull request #5454 from c-po/bond-fix-add-member

2026-09-10T15:26:11+00:00

bond: T9269: keep the bond MAC when appending a member interface

configdict: T9269: no phantom removal when a multi node gains a value

2026-09-10T15:23:50+00:00

A multi node with a single value is a plain string in the JSON rendering of the config tree, and only becomes a list once it holds several values. leaf_node_changed() tested for a string before diffing the lists, so appending a value reported the already configured one as gone. Adding a second bond member thus produced an "interface_remove" entry for the first, and BondIf.update() released it right after enslaving the new one, leaving the bond with the new member only. Normalize to a list and reuse list_diff(). Only the string to list append changes, from [old] to []. interface.py was immune as it re-applies list_diff() to address_old, protocols_static_arp.py was not.