vyos-1x.git/src/tests, branch rolling

openvpn: T9370: add chacha20poly1305 data cipher

2026-10-01T13:41:53+00:00

Offer chacha20poly1305 in "encryption data-ciphers" and "encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and allowed with DCO.

openvpn: T9364: default the MTU to 1420 when DCO is enabled

2026-09-29T21:33:24+00:00

The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU full sized packets get fragmented on the underlay. Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is present. Reject "mtu" together with such an option, below 100, and below 1280 when IPv6 runs inside the tunnel.

openvpn: T9363: multiply the site-to-site keepalive timeout

2026-09-29T18:40:44+00:00

"failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults.

Merge pull request #5266 from MPStudyly/T8977_fix_haproxy_rebind

2026-09-28T09:27:15+00:00

T8977: Fix regression with is_addr_assigned and is_listen_port_bind_service

configverify: T8859: remove dead code for verify_diffie_hellman_length()

2026-09-26T19:06:10+00:00

Commit a9e9c4acfa ("pki: openvpn: T3642: Migrate OpenVPN to PKI and refactor") was the last caller of verify_diffie_hellman_length() despite the build time testcases. Unused code is dead code, drop it.

python: T8859: fail loudly on an invalid Diffie-Hellman keysize argument

2026-09-26T17:09:05+00:00

The Diffie-Hellman length check stringified the requested minimum keysize into a variable it never used, then converted the original argument again for the comparison. A non-numeric value therefore escaped as an uncaught ValueError from the comparison rather than being reported where it was passed in. The argument is now typed and validated up front: a non-integer raises TypeError, booleans included, and a non-positive integer raises ValueError. Both indicate a logic error in the calling script and should fail loudly instead of silently reporting an undersized key. The only callers today are the unit tests, so the contract is free to change. A file that exists but holds no readable parameters is user input rather than a logic error, and now fails the check instead of propagating the error from openssl. The bit-count pattern becomes a raw string, and the tests pass integer keysizes and cover the new paths.

vyos.utils: T8977: fix regressions in address and port validation

2026-09-26T07:46:27+00:00

Whether an interface belongs to a VRF was only established when a VRF was named explicitly. A lookup for the default VRF - what most callers ask for - thus reported an address living in an arbitrary VRF, or on a VRF device itself, as locally assigned, and accepted a configuration the daemon cannot bind later on. Naming the VRF device remains the way to ask for the addresses it carries. Probing the next address family after a failed bind was unreachable, as the argument is validated as a literal beforehand and then resolves to exactly one family. The early return is restored. An interface address carries host bits and must stay valid, but the range variants classify untrusted input handed over to nftables, which only accepts a prefix in canonical form. Those reject host bits again. All of it is covered by tests.

vyos.utils: T8977: let a caller accept a non-local address as assigned

2026-09-26T07:46:08+00:00

Whether an address may be bound is not the same question as whether it is currently configured somewhere: the kernel permits binding a foreign address once the non-local bind sysctl is set, which is how a failover address is commonly handed over after the commit. Callers can now opt into that, the default is unchanged. A lookup no longer skips the VRF device itself, which carries the addresses of its own L3 domain, and an interface name can be retrieved for an address without the caller asking a yes/no question in the first place. Address and range validation is split into separate checks, so a caller no longer has to accept ranges where only an address is meaningful. The two duplicated version checks are dropped in favour of the existing ones. Co-authored-by: Christian Breunig

Merge pull request #5466 from rnavarro/fix/configtree-serialize-libvyosconfig

2026-09-22T14:18:00+00:00

configtree: T9307: serialize libvyosconfig calls across threads

Merge pull request #5429 from rockfish-vyos/T9254-ike-esn

2026-09-15T12:48:01+00:00

ipsec: T9254: do not emit ESN transforms in IKE proposals