vyos-1x.git/src, branch fix/T8859-dh-keysize-validation

python: T8859: raise TypeError/ValueError on invalid min_keysize

2026-07-03T13:01:19+00:00

Per dmbaturin's review on https://github.com/vyos/vyos-1x/pull/5194: the only callers of verify_diffie_hellman_length() are its own unit tests, so the contract can change freely. An invalid min_keysize indicates a logic error in the calling script and should fail loudly instead of silently returning False: - signature is now verify_diffie_hellman_length(file: str, min_keysize: int) - non-integer min_keysize raises TypeError (bool explicitly rejected) - non-positive min_keysize raises ValueError - regex pattern converted to a raw string (invalid escape sequence) - openssl invoked with list arguments instead of an interpolated command string, so the file path never hits a shell (CodeRabbit) Tests updated to pass integer keysizes and extended to cover both exception paths. 🤖 Generated by [robots](https://vyos.io)

T8600: Add option to change logging verbosity in Kea (#5178)

2026-05-13T11:50:43+00:00

serial: T8853: limit "kernel" CLI option to ttyS and ttyAMA interfaces only (#5193)

2026-05-13T11:40:07+00:00

Recently (commit 35db941bcf "serial: T8375: add CLI option to explicitly set kernel console") we added the CLI knob to enable the Kernel and GRUB serial console on a given device. Currently this is supported for serial console interfaces starting with ttyS and ttyAMA only. Main limitation is that these interfaces are wired to the CPU and bootloader infos can be displayed.

wan: T8481: scope flush-connections to WLB connection marks (#5163)

2026-05-12T13:58:51+00:00

* wan: T8481: scope flush-connections to WLB connection marks flush-connections runs conntrack --delete which destroys all conntrack entries system-wide, including unrelated NAT translations and established connections that have nothing to do with WLB. WLB tags every connection it manages with a conntrack mark via the wlb_mangle_isp_ chain (ct mark set 0xc9, 0xca, etc.). Scope the flush to these marks so only WLB-managed connections are affected. Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> * wan: T8481: replace conntrack deletion from state changed block --------- Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>

Merge pull request #5162 from natali-rs1985/T8760

2026-05-11T19:12:58+00:00

dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option

bgp: T8607: Add CLI support for BGP update-delay and establish-wait

2026-05-11T09:24:43+00:00

Merge pull request #5159 from c-po/kernel-6.18

2026-05-06T18:30:05+00:00

T8147: Update Linux Kernel to 6.18

dhcp-relay: T7879: verify listen and upstream interfaces exist

2026-05-04T19:43:43+00:00

dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option

2026-05-04T15:12:21+00:00

Debian: T8147: remove out-of-tree OpenVPN DCO module - incl. in Kernel 6.18

2026-05-02T18:35:01+00:00

Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As this was not available in the previous used LTS 6.6 Kernel it now is available while we upgrade to Linux 6.18.