| Age | Commit message (Collapse) | Author |
|---|
|
|
|
vrf: T8936: Specify `pref 1998` when deleting fwmark routing rules on VRF removal
|
|
When a key-name is set under dynamic-dns-update forward-domain or
reverse-domain, validate that the referenced TSIG key is defined under
dynamic-dns-update tsig-key. Previously the missing key was only caught
at runtime, causing kea-dhcp-ddns to fail to start with a fatal error.
Also fix a pre-existing bug in `verify_ddns_domain` (formerly
`verify_ddns_domain_servers`) where the function was called with the full
tagNode dict but iterated as if it received a single domain config,
causing the DNS server address check to never actually run.
|
|
T8503: clean up linting errors, reformatting, and minor refactoring
|
|
remote: T8956: stop leaking URL credentials in TftpC.upload()
|
|
removal
|
|
VPP bond teardown was triggered on every commit regardless of
what changed, dropping all subinterfaces and BGP sessions even
for trivial changes like descriptions or IP addresses.
Only mode, hash-policy and mac_address require full recreation
since VPP has no in-place update API for these; all other
changes are now applied incrementally.
|
|
Add op-mode command having ability to show certificate
full chain in pem format as part of PKI configuration.
The certificates are ordered beginning with the end
entity (leaf) certificate, followed by any intermediate
certificates and finally the private key if requested.
This allows users to easily export a certificate along
with its CA hierarchy for use in external applications,
that require the full chain to be provided in a single
file.
One can now run the following commands:
```
show pki ca NAME pem full-chain
show pki certificate NAME pem full-chain
show pki certificate NAME private pem full-chain
```
|
|
dhcp: T8933: Honor system timezone for timestamp display in op mode
|
|
TftpC.upload() printed `{command} "{urlstring}"` to stdout before running the
command. This was debug code from the time where VRF support was added. As TFTP
has no authentication - no credentials got leaked.
|
|
password-reset: T8346: Fix password recovery when only `plaintext-password` is set
|
|
frr: T7931: Do not restart FRR on unrelated config changes when VRF protocols are configured
|
|
T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation
|
|
|
|
The `vif` driver is fundamentally incompatible with VPP — no DPDK poll-mode
driver exists for Xen paravirtual interfaces and no PCI address is exposed,
so `allow-unsupported-nics` cannot rescue it either.
|
|
protocols are configured
FRR was restarted on every commit when VRF protocols were configured, even when no
routing-related configuration changed. Root cause: the rendering loop mutated `config_dict`
in-place by injecting a `vrf` key into each VRF protocol sub-dict, polluting `cached_config_dict`
which holds a reference to the same object, causing the equality check to always fail on the
next commit.
|
|
|
|
is set
When a user account was provisioned with only `plaintext-password` (e.g.
via cloud-init), the password recovery tool failed to persist the new
password across reboots. On the next boot, VyOS would re-apply the
`plaintext-password` from config.boot, silently overwriting the recovered
encrypted password.
|
|
vyos-netlinkd: T8950: track per-interface operstate to suppress UP-to-UP DHCP restarts
|
|
DHCP restarts
_handle_dhcp_events() restarts dhclient/dhcp6c on every RTM_NEWLINK
that carries operstate=UP, regardless of whether the interface was
already UP. Normal kernel events that re-notify UP without a preceding
DOWN (e.g. post-migration gratuitous-ARP, promiscuous-mode toggles)
trigger unnecessary DHCP restarts. Each restart also creates a feedback
loop: dhclient-script runs "ip link set dev <if> up" during PREINIT,
which emits another RTM_NEWLINK(UP), which triggers another restart.
One seed event becomes 10+ restarts in 15 seconds.
Add a module-level dict tracking the last observed operstate per
interface. Only proceed with the DHCP restart when the transition is
DOWN-to-UP or when no previous state is recorded (first boot / service
restart). UP-to-UP re-notifications are suppressed with a LOG_DEBUG
message.
Validated on a production VyOS 2026.05.26-1327-rolling router: a
controlled KVM live migration after the patch produced zero DHCP
restarts (all UP-to-UP events suppressed), with no impact on normal
DOWN-to-UP DHCP recovery.
|
|
conntrack: T8308: Add per-flow counters and VRF filter to conntrack table
|
|
ipsec: T8954: Bump strongSwan deps to version 5.9.11
|
|
When strongSwan package is not available on `packages.vyos.net`,
it causes the Debain 5.9.8 package version to be used, which fails the tests.
|
|
ci: T8943: complete current->rolling branch-ref migration (rollout 1c follow-up)
|
|
Rollout 1c PR #5241 renamed the default branch current->rolling and updated
the 7 workflow files, but missed two files that still referenced the old
branch name:
- .github/config/smoketest-branches.json: the branch config is keyed by
github.ref_name. package-smoketest.yml already triggers on `rolling`, then
looks up `.branches["rolling"]`, which returned null -> the workflow errored
out ("No smoketest configuration found for branch 'rolling'") on every push
and PR to the rolling branch. Rename the key current->rolling. The entry's
vyos_mirror and container_image are also moved to the now-canonical `rolling`
release stream (packages.vyos.net/repositories/rolling/, vyos/vyos-build:rolling
-- both live; the rolling docker tag is actively rebuilt while `current` froze
at 2026-03-27), matching the self-consistent circinus/sagitta entries where
key == mirror == image == branch name.
- .github/PULL_REQUEST_TEMPLATE.md: two github.com/vyos/vyos-1x/{blob,tree}/current/
links repointed to /rolling/ (the default branch).
A full-repo scan confirmed no other current->rolling git-branch references
remain; all other "current" occurrences are the VyOS release-stream/version/
config vocabulary and are intentionally left unchanged.
🤖 Generated by [robots](https://vyos.io)
|
|
nat: T8939: fix KeyError: 'group' exception
|
|
Mergify ignore_conflicts:true already creates the backport workspace PR +
resolves toward theirs + applies backport-conflict for path-drift conflicts
(verified by canary VyOS-Networks/ipaddrcheck#26/#27). force_workspace's
'No backport have been created' trigger never fires under that config.
T8943 / IS-510.
|
|
Source-side wrapper (mirrored to the VyOS-Networks twin) for the public
vyos/.github force_workspace reusable. Inert on this public source (owner
guard); active on the mirror. force_workspace_enabled per-consumer (default false).
🤖 Generated by [robots](https://vyos.io)
|
|
T8943: ci: add lts-name-check advisory caller
|
|
Adds the source-side LTS-name advisory caller (mirror-pipeline). Non-blocking;
posts a generic advisory if a PR title/body references a release-train branch name.
🤖 Generated by [robots](https://vyos.io)
|
|
|
|
Mirror Pipeline Rollout 2 Task 6. Uniform canonical wrapper:
trigger branches [rolling, production], permissions: contents: read,
drop redundant wrapper-level MIRROR_ENABLED guard (now central).
🤖 Generated by [robots](https://vyos.io)
|
|
Tracking: T8943
|
|
Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github,
vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their
old default branch to the new production compat branch staged in Task 1.
No functional change; pin-ref rewrite only.
Tracking: T8943
|
|
(#5239)
Replace PAT-based caller with uniform App-ready stub that passes
secrets: inherit and checks vars.MIRROR_ENABLED opt-out flag.
Plan: ~/.claude/plans/2026-05-26-mirror-rollout-1b-revised.md Task 5
🤖 Generated by [robots](https://vyos.io)
|
|
Also add `hostname` as sort key for DHCPv6 leases,
and fix a typo in the completion help for DHCPv6 leases
sorting.
|
|
|
|
|
|
Add `hostname` as a valid sort key for both DHCPv4
and DHCPv6 leases and static mappings.
|
|
The time displayed in DHCP v4/v6 server lease op-mode
commands should honor system timezone and not force
UTC timezone.
This would keep the timestamps in the output of
`show log dhcp server` or `show log dhcpv6 server`
consistent with the timestamps in the output of
`show dhcp server leases` or `show dhcpv6 server leases`
commands.
|
|
docs: T8937: fix typo in CONTRIBUTING.md
|
|
Prevent access to missing dictionary key by probing for availability. On removal
of inbound-interface or outbound-interface name CLI node, there was a guard
missing when accessing the CLI dictionary containing the config data.
|
|
chore: T8937: retire Mergify-replaceable GHA caller workflows
|
|
|
|
"wan't" → "want"
Phase A smoke for Mergify-replaceable GHA migration (T8937).
Confirms central Mergify rules fire on a real consumer repo.
Advances: T8937
🤖 Generated by [robots](https://vyos.io)
|
|
T8454: fix VRF-bind port availability check in service_https
|
|
T8502: Add exclusion mask to config-sync
|
|
|
|
For use in nosetests or other, allow passing ReferenceTree from an
internal cache in a non-standard location.
|
|
|
