Merge branch 'vyos:current' into current

9 files changed, 136 insertions, 50 deletions

diff --git a/debian/changelog b/debian/changelog
index d64c66818..68aeecac3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-vyos-1x (1.5dev0) unstable; urgency=medium
+vyos-1x (999.0) unstable; urgency=medium
 
   * Dummy changelog entry for vyos-1x repository
     This is a internal VyOS package and the VyOS package process does not use
diff --git a/debian/control b/debian/control
index 76fe5c331..1d152c18b 100644
--- a/debian/control
+++ b/debian/control
@@ -8,14 +8,24 @@ Build-Depends:
   fakeroot,
   gcc,
   iproute2,
-  libvyosconfig0 (>= 0.0.7),
   libzmq3-dev,
   python3 (>= 3.10),
-# For QA
+# For QA/Lint
   pylint,
+  python3-vici (>= 5.7.2),
+  python3-fastapi,
+  python3-pyudev,
+  python3-systemd,
+  python3-certbot-nginx,
+  python3-pam,
+  python3-dbus,
+  python3-pyroute2,
+  python3-voluptuous,
 # For generating command definitions
   python3-lxml,
   python3-xmltodict,
+# For generating serialization functions
+  protobuf-compiler,
 # For running tests
   python3-coverage,
   python3-hurry.filesize,
@@ -40,8 +50,9 @@ Pre-Depends:
   libpam-runtime [amd64],
   libnss-tacplus [amd64],
   libpam-tacplus [amd64],
-  libpam-radius-auth (= 1.5.0-cl3u7) [amd64],
-  libnss-mapuser (= 1.1.0-cl3u3) [amd64]
+  vyos-libpam-radius-auth,
+  vyos-libnss-mapuser,
+  tzdata (>= 2025b)
 Depends:
 ## Fundamentals
   ${python3:Depends} (>= 3.10),
@@ -71,6 +82,7 @@ Depends:
   python3-netifaces,
   python3-paramiko,
   python3-passlib,
+  python3-protobuf,
   python3-pyroute2,
   python3-psutil,
   python3-pyhumps,
@@ -78,6 +90,7 @@ Depends:
   python3-pyudev,
   python3-six,
   python3-tabulate,
+  python3-tomli,
   python3-voluptuous,
   python3-xmltodict,
   python3-zmq,
@@ -116,7 +129,7 @@ Depends:
   dosfstools,
   grub-efi-amd64-signed [amd64],
   grub-efi-arm64-bin [arm64],
-  mokutil [amd64],
+  mokutil,
   shim-signed [amd64],
   sbsigntool [amd64],
 # Image signature verification tool
@@ -124,13 +137,15 @@ Depends:
 # Live filesystem tools
   squashfs-tools,
   fuse-overlayfs,
+# Tools for checking password strength
+  python3-cracklib,
 ## End installer
   auditd,
   iputils-arping,
   iputils-ping,
   isc-dhcp-client,
 # For "vpn pptp", "vpn l2tp", "vpn sstp", "service ipoe-server"
-  accel-ppp,
+  accel-ppp-ng,
 # End "vpn pptp", "vpn l2tp", "vpn sstp", "service ipoe-server"
   avahi-daemon,
   conntrack,
@@ -184,13 +199,10 @@ Depends:
   console-data,
   dropbear,
 # End "service console-server"
-# For "service aws glb"
-  aws-gwlbtun,
 # For "service dns dynamic"
   ddclient (>= 3.11.1),
 # End "service dns dynamic"
 # # For "service ids"
-  fastnetmon [amd64],
   suricata,
   suricata-update,
 # End "service ids"
@@ -198,14 +210,11 @@ Depends:
   ndppd,
 # End "service ndp-proxy"
 # For "service router-advert"
-  radvd,
+  radvd (>= 2.20),
 # End "service route-advert"
 # For "load-balancing haproxy"
   haproxy,
 # End "load-balancing haproxy"
-# For "load-balancing wan"
-  vyatta-wanloadbalance,
-# End "load-balancing wan"
 # For "service dhcp-relay"
   isc-dhcp-relay,
 # For "service dhcp-server"
@@ -325,6 +334,15 @@ Depends:
 # iptables is only used for containers now, not the the firewall CLI
   iptables,
 # End container
+# For "vpp"
+  libvppinfra,
+  python3-vpp-api,
+  vpp,
+  vpp-crypto-engines,
+  vpp-dev,
+  vpp-plugin-core,
+  vpp-plugin-dpdk,
+# End "vpp"
 ## End Configuration mode
 ## Operational mode
 # Used for hypervisor model in "run show version"
@@ -374,13 +392,15 @@ Depends:
 Description: VyOS configuration scripts and data
  VyOS configuration scripts, interface definitions, and everything
 
-Package: vyos-1x-vmware
-Architecture: amd64
+Package: vyos-1x-aws
+Architecture: all
 Depends:
  vyos-1x,
- open-vm-tools
-Description: VyOS configuration scripts and data for VMware
- Adds configuration files required for VyOS running on VMware hosts.
+# For "service aws glb"
+ aws-gwlbtun,
+Description: VyOS configuration scripts and data for AWS Gateway Load Balancer
+ Adds configuration files required for AWS Gateway Load Balancer service
+ running on top of VyOS.
 
 Package: vyos-1x-smoketest
 Architecture: all
@@ -389,3 +409,11 @@ Depends:
  snmp,
  vyos-1x
 Description: VyOS build sanity checking toolkit
+
+Package: vyos-1x-vmware
+Architecture: all
+Depends:
+ vyos-1x,
+ open-vm-tools
+Description: VyOS configuration scripts and data for VMware
+ Adds configuration files required for VyOS running on VMware hosts.
diff --git a/debian/copyright b/debian/copyright
index 20704c47c..33b963f86 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -3,33 +3,57 @@ Thu, 17 Aug 2017 20:17:04 -0400
 
 It's original content from the GIT repository <http://github.com/vyos/vyos-1x>
 
-Upstream Author: 
-
+Upstream Author:
     <maintainers@vyos.net>
 
-Copyright: 
-
-    Copyright (C) 2017 VyOS maintainers and contributors
+Copyright:
+    Copyright VyOS Networks <maintainers@vyos.io>
     All Rights Reserved.
 
-License:
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2, or (at your option)
-any later version.
-
-This program is distributed in the hope that it will be useful, but
-WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-General Public License for more details.
-
-A copy of the GNU General Public License is available as
-`/usr/share/common-licenses/GPL' in the Debian GNU/Linux distribution
-or on the World Wide Web at `http://www.gnu.org/copyleft/gpl.html'.
-You can also obtain it by writing to the Free Software Foundation,
-Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
-MA 02110-1301, USA.
-
-The Debian packaging is (C) 2017, Daniil Baturin <daniil@baturin.org> and
-is licensed under the GPL, see above.
+Files: *
+Copyright: VyOS Networks
+License: GPL-2+
+
+Files: python/vyos/config.py
+       python/vyos/configsession.py
+       python/vyos/configtree.py
+       python/vyos/opmode.py
+Copyright: VyOS Networks
+License: LGPL-2.1+
+
+
+License: GPL-2+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2, or (at your option)
+ any later version.
+
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ General Public License for more details.
+
+ A copy of the GNU General Public License is available as
+ `/usr/share/common-licenses/GPL' in the Debian GNU/Linux distribution
+ or on the World Wide Web at `http://www.gnu.org/copyleft/gpl.html'.
+ You can also obtain it by writing to the Free Software Foundation,
+ Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+ MA 02110-1301, USA.
+
+License: LGPL-2.1+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1, or (at your option)
+ any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Lesser General Public License for more details.
+ .
+ You should have received a copy of the GNU Lesser General Public License along
+ with this program; if not, write to the Free Software Foundation,
+ Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ .
+ On Debian systems, the complete text of the GNU Lesser General Public
+ License version 2.1 can be found in ‘/usr/share/common-licenses/LGPL-2.1’.
diff --git a/debian/rules b/debian/rules
index f579ffec9..69483e5fd 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,6 +1,7 @@
 #!/usr/bin/make -f
 
 DIR := debian/tmp
+DIR_AWS := $(DIR)/vyos-1x-aws
 VYOS_SBIN_DIR := usr/sbin
 VYOS_BIN_DIR := usr/bin
 VYOS_LIBEXEC_DIR := usr/libexec/vyos
@@ -18,6 +19,11 @@ SERVICES_DIR := usr/libexec/vyos/services
 
 DEB_TARGET_ARCH := $(shell dpkg-architecture -qDEB_TARGET_ARCH)
 
+# Base version prefix from debian/changelog
+BASE_VERSION := 999.0
+COMMIT_ID := $(shell echo -n g && git rev-parse --short HEAD)
+DIRTY_FLAG := $(shell ! git diff --quiet || ! git diff --cached --quiet && echo -dirty || echo)
+
 %:
 	dh $@ --with python3, --with quilt
 
@@ -26,7 +32,7 @@ DEB_TARGET_ARCH := $(shell dpkg-architecture -qDEB_TARGET_ARCH)
 override_dh_strip_nondeterminism:
 
 override_dh_gencontrol:
-	dh_gencontrol -- -v$(shell (git describe --tags --long --match 'vyos/*' --match '1.4.*' --dirty 2>/dev/null || echo 0.0-no.git.tag) | sed -E 's%vyos/%%' | sed -E 's%-dirty%+dirty%')
+	dh_gencontrol -- -v$(BASE_VERSION)-$(COMMIT_ID)$(DIRTY_FLAG)
 
 override_dh_auto_build:
 	make all
@@ -36,6 +42,9 @@ override_dh_auto_install:
 
 	cd python; python3 setup.py install --install-layout=deb --root ../$(DIR); cd ..
 
+	# Remove all __pycache__ directories before installing
+	find . -type d -name '__pycache__' -exec rm -rf {} +
+
 	# Install scripts
 	mkdir -p $(DIR)/$(VYOS_SBIN_DIR)
 	mkdir -p $(DIR)/$(VYOS_BIN_DIR)
@@ -143,6 +152,21 @@ override_dh_auto_install:
 	mkdir -p $(DIR)/usr/lib/udev
 	cp src/helpers/vyos_net_name $(DIR)/usr/lib/udev
 
+	# vyos-1x-aws package
+	# Move some files to dedicated DEB packages
+	#
+	mkdir -p $(DIR_AWS)/lib/systemd/system
+	mv $(DIR)/lib/systemd/system/aws-gwlbtun.service $(DIR_AWS)/lib/systemd/system
+
+	mkdir -p $(DIR_AWS)/opt/vyatta/share/vyatta-cfg/templates/service
+	mv $(DIR)/opt/vyatta/share/vyatta-cfg/templates/service/aws $(DIR_AWS)/opt/vyatta/share/vyatta-cfg/templates/service
+
+	mkdir -p $(DIR_AWS)/usr/libexec/vyos/conf_mode
+	mv $(DIR)/usr/libexec/vyos/conf_mode/service_aws_glb.py $(DIR_AWS)/usr/libexec/vyos/conf_mode
+
+	mkdir -p $(DIR_AWS)/usr/share/vyos/templates
+	mv $(DIR)/usr/share/vyos/templates/aws/ $(DIR_AWS)/usr/share/vyos/templates
+
 override_dh_installsystemd:
 	dh_installsystemd -pvyos-1x --name vyos-router vyos-router.service
 	dh_installsystemd -pvyos-1x --name vyos vyos.target
diff --git a/debian/vyos-1x-aws.install b/debian/vyos-1x-aws.install
new file mode 100644
index 000000000..57a9d29f9
--- /dev/null
+++ b/debian/vyos-1x-aws.install
@@ -0,0 +1,3 @@
+vyos-1x-aws/lib/* /lib
+vyos-1x-aws/opt/* /opt
+vyos-1x-aws/usr/* /usr
diff --git a/debian/vyos-1x.install b/debian/vyos-1x.install
index 5fcff959a..0fd5e3395 100644
--- a/debian/vyos-1x.install
+++ b/debian/vyos-1x.install
@@ -6,10 +6,8 @@ etc/dhcp
 etc/ipsec.d
 etc/logrotate.d
 etc/netplug
-etc/opennhrp
 etc/modprobe.d
 etc/ppp
-etc/rsyslog.conf
 etc/securetty
 etc/security
 etc/skel
diff --git a/debian/vyos-1x.links b/debian/vyos-1x.links
index 402c91306..aef22555c 100644
--- a/debian/vyos-1x.links
+++ b/debian/vyos-1x.links
@@ -1,2 +1,4 @@
 /etc/netplug/linkup.d/vyos-python-helper /etc/netplug/linkdown.d/vyos-python-helper
 /usr/libexec/vyos/system/standalone_root_pw_reset /opt/vyatta/sbin/standalone_root_pw_reset
+/usr/libexec/vyos/vyconf_cli.py /usr/libexec/vyos/vyconf/bin/vy_commit
+/usr/libexec/vyos/vyconf_cli.py /usr/libexec/vyos/vyconf/bin/vy_in_session
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst
index ff5a91e09..9dd06d5e2 100644
--- a/debian/vyos-1x.postinst
+++ b/debian/vyos-1x.postinst
@@ -50,6 +50,10 @@ if [[ -e /usr/share/pam-configs/tacplus ]]; then
     rm /usr/share/pam-configs/tacplus
 fi
 
+# Disable pam_nologin.so behavior for regular users
+sed -i '/^auth[[:space:]]\+requisite[[:space:]]\+pam_nologin\.so$/s/^/#/' /etc/pam.d/login
+sed -i '/^account[[:space:]]\+required[[:space:]]\+pam_nologin\.so$/s/^/#/' /etc/pam.d/sshd
+
 # Add TACACS system users required for TACACS based system authentication
 if ! grep -q '^tacacs' /etc/passwd; then
     # Add the tacacs group and all 16 possible tacacs privilege-level users to
@@ -221,11 +225,9 @@ fi
 # Remove unwanted daemon files from /etc
 # conntackd
 # pmacct
-# fastnetmon
 # ntp
 DELETE="/etc/logrotate.d/conntrackd.distrib /etc/init.d/conntrackd /etc/default/conntrackd
         /etc/default/pmacctd /etc/pmacct
-        /etc/networks_list /etc/networks_whitelist /etc/fastnetmon.conf
         /etc/ntp.conf /etc/default/ssh /etc/avahi/avahi-daemon.conf /etc/avahi/hosts
         /etc/powerdns /etc/default/pdns-recursor
         /etc/ppp/ip-up.d/0000usepeerdns /etc/ppp/ip-down.d/0000usepeerdns"
@@ -272,3 +274,7 @@ update-alternatives --set regulatory.db /lib/firmware/regulatory.db-upstream
 if systemctl is-active --quiet vyos-configd; then
     systemctl restart vyos-configd
 fi
+# Restart vyos-domain-resolver if running
+if systemctl is-active --quiet vyos-domain-resolver; then
+    systemctl restart vyos-domain-resolver
+fi
diff --git a/debian/vyos-1x.preinst b/debian/vyos-1x.preinst
index fbfc85566..08f48cac2 100644
--- a/debian/vyos-1x.preinst
+++ b/debian/vyos-1x.preinst
@@ -5,6 +5,7 @@ dpkg-divert --package vyos-1x --add --no-rename /etc/logrotate.d/conntrackd
 dpkg-divert --package vyos-1x --add --no-rename /etc/rsyslog.conf
 dpkg-divert --package vyos-1x --add --no-rename /etc/skel/.bashrc
 dpkg-divert --package vyos-1x --add --no-rename /etc/skel/.profile
+dpkg-divert --package vyos-1x --add --no-rename /etc/sysctl.d/80-vpp.conf
 dpkg-divert --package vyos-1x --add --no-rename /etc/netplug/netplugd.conf
 dpkg-divert --package vyos-1x --add --no-rename /etc/netplug/netplug
 dpkg-divert --package vyos-1x --add --no-rename /etc/rsyslog.d/45-frr.conf