| Age | Commit message (Collapse) | Author |
|---|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
ci(mergify): upgrade configuration to current format
|
|
T8360: add XML preprocessor to allow overriding help element
|
|
T8764: add `inheritance: true` to .coderabbit.yaml (follow-up to #5191)
|
|
Follow-up to #5191 — the original PR landed without this flag, which
means the per-repo `.coderabbit.yaml` was REPLACING the central baseline
(`vyos/coderabbit:.coderabbit.yaml`) instead of merging with it.
Per https://docs.coderabbit.ai/configuration/configuration-inheritance:
> Inheritance is disabled by default. You must explicitly enable it
> by adding `inheritance: true`.
>
> Without inheritance, only the highest-priority source is used.
>
> Each level with `inheritance: true` merges with its parent. The
> chain stops at the first level where `inheritance: false` or unset.
Today, every PR review on this repo is using ONLY the contents of
`.coderabbit.yaml` (this file) — the central baseline's review profile,
tools, chat ACL, finishing-touches settings, etc. are all dropped.
Adding `inheritance: true` restores merging.
Caught by CodeRabbit's auto-review on the sibling per-repo PR
VyOS-Networks/next-js-cpd#1. Did not surface on the original #5191
because CodeRabbit's OSS-security policy ignores YAML config changes
from the PR itself on public repos — it reviews against the base
branch, which didn't have this file yet.
🤖 Generated by [robots](https://vyos.io)
|
|
T8764: add per-repo CodeRabbit config — Jira VD project scope
|
|
Add `.coderabbit.yaml` at repo root with the minimum override needed
to (a) opt the VyOS-Networks mirror into the central Jira integration
and (b) scope it to the VD (VyOS Dev) project.
Cross-org behavior using `usage: auto`:
* On `vyos/vyos-1x` (this repo, public): `auto` self-disables on
public repos, so no Jira context is fetched. The vyos-org
CodeRabbit install has no Atlassian OAuth grant anyway — CodeRabbit
allows one GitHub-org → Jira-tenant link per install, and that link
is attached to the `VyOS-Networks` org.
* On `VyOS-Networks/vyos-1x` (gen-1 mirror, private/internal): `auto`
activates the integration and `project_keys: [VD]` restricts the
context to VD tickets only — matching the project keys used in
release-train work tracked there.
Everything else (review profile, tools, chat ACL, path filters,
finishing-touches behavior, etc.) continues to inherit from the
respective central baseline:
- https://github.com/vyos/coderabbit/blob/production/.coderabbit.yaml
- https://github.com/VyOS-Networks/coderabbit/blob/production/.coderabbit.yaml
Pattern note: this is the canary for the source-of-truth-on-vyos
approach. Once it lands clean, the same file (with the same or
slightly different `project_keys`) should be mirrored to the other
vyos-org source repos that have VyOS-Networks mirrors.
🤖 Generated by [robots](https://vyos.io)
|
|
smoketest: T6847: probe for Intel I40E and IAVF Out-Of-Tree drivers
|
|
T8488: add support for generating and applying an exclude mask to configtree
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
|
|
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
|
|
T8612: upgrade frr to 10.6.1
|
|
bgp: T8607: Add CLI support for BGP update-delay and establish-wait
|
|
smoketests: T8845: missing base-class call to commit() in tearDownClass()
|
|
The smoketest framework heavily relies on deriving common code paths. The
tearDownClass() is called when a testcase finishes and testcases like protocols
BGP delete CLI nodes before calling the base class.
The base-class never calls commit() thus the deletions are discarded instead
of committed.
test_protocols_bgp.py
@classmethod
def tearDownClass(cls):
cls.cli_delete(cls, ['policy', 'route-map'])
cls.cli_delete(cls, ['policy', 'prefix-list'])
cls.cli_delete(cls, ['policy', 'prefix-list6'])
super(TestProtocolsBGP, cls).tearDownClass()
base class base_vyostest_shim.py
@classmethod
def tearDownClass(cls):
# discard any pending changes which might caused a messed up config
cls._session.discard()
|
|
|
|
|
|
|
|
A partial path is one that may or may not include intervening tag node
values. For unspecified tag node values, the matching subtree is
returned.
For example ['interfaces', 'ethernet', 'address'] will return the
subtree of the config for which ethernet tag values have defined
address.
|
|
|
|
|
|
|
|
|
|
|
|
build: T8834: remove SonarCloud integration
|
|
🤖 Generated by robots (https://vyos.io)
|
|
FRR commit 4257c1dc28e71234f9338f1623a8fe677445db7e introduced check
that virtual-link is allowed only for ABR router.
Update test accordingly.
|
|
kea: T8763: Fix vendor-encapsulated-options space
|
|
general: T8595: add AGENTS.md
|
|
|
|
|
|
|
|
|
|
T8463: Update GitHub actions to latest versions
|
|
|
|
|
|
|
|
|
|
T8467: fix obscured definition of completion help in XML
|
|
T8147: Update Linux Kernel to 6.18
|
|
|
|
This duplication did not cause any harm, but was found in the general
clean up related to element 'properties' collisions.
|
|
The include is unnecessary, as the element is fully defined in the
subsequent lines. As node.def files are only populated on the first
instance, this leads to loss of the proper value help entries hence
completions.
Without these changes, for example:
vyos@vyos# set system conntrack ignore ipv4 rule 137 protocol
will not list 'all', 'tcp_udp', etc. as intended.
|
|
|
|
Changes:
1. Change option space from 'ubnt' to 'vendor-encapsulated-options-space'.
2. Change option name from 'unifi-controller' to 'ubnt'.
3. Add 'vendor-encapsulated-options' option (in addition to adding unifi
controller IP address under the option name 'ubnt') if unifi-controller
is configured.
|
|
T8218: removed unqueue from mergify yaml as it is not supported
|
|
|
|
dhcp-relay: T7879: verify listen and upstream interfaces exist
|
