| Age | Commit message (Collapse) | Author |
|---|
|
The testcases have been written in a a way which would make CI fail - as there
was no dynamic check if an mt7915e card was installed or not. There should be
a dedicated, conditional check if a mt7915e card is present or not, and the
test code should only be run if such a card is detected.
|
|
Generation of the firmware configuration file can be made contitional only if
the card is present/driver is loaded. The firmware configuration file itself
must not be explicitly set to be owned as root as the default is user root and
group vyattacfg.
|
|
|
|
(#5186)
The port availability check in `verify()` was using `front_config.get('address')`
which always resolved to `None`, causing the validator to treat any process
holding a given port number as a conflict regardless of which IP it was
bound to.
|
|
Add a check to determine whether the NIC supports hardware
timestamp receive filters required for NTP timestamping.
Implement the query in a new python/vyos/netlink/timestamp.py module
using pyroute2 generic netlink ETHTOOL_MSG_TSINFO_GET,
avoiding ethtool output parsing.
|
|
firewall (#5206)
sysctl values written by firewall global-options are overwritten when using
"system option performance" configuration on VyOS CLI. This is caused by a
missing dependency fall from system_option.py to the firewall CLI helper script.
|
|
IKEv2 reauthentication was configurable via CLI but never translated
into `swanctl.conf`. Add `reauth_time` to the peer connection template,
driven by the `ikev2-reauth` flag on the ike-group and the per-peer
override (yes/no/inherit).
|
|
|
|
Three related bugs prevented GeoIP nftables sets from being populated
correctly at boot and when incrementally modifying firewall or policy
route rules.
1. geoip_updated() always returned False
The previous implementation called node_changed() and then searched
the result with dict_search_recursive(changes, 'geoip'). This could
never match: node_changed() is annotated `-> list` and returns a flat
list of the immediate top-level child names whose subtree changed
(e.g. ['ipv4'] for the firewall path, or route names for policy
route). The 'geoip' key sits several levels deeper than those names,
so dict_search_recursive — which only walks dicts and lists for a
matching dict key — never yielded a hit, and geoip_updated() always
returned False. As a consequence, geoip_update() was never triggered
by an incremental add or change of a GeoIP rule; the only path that
ever populated /run/nftables-geoip.conf was the explicit \"update
geoip\" command or the fallback when geoip_refresh() failed.
Fix: bypass node_changed() and call get_config_diff() /
get_child_nodes_diff() directly with expand_nodes=Diff.ADD|Diff.DELETE
and recursive=True. In that mode, the 'add' and 'delete' values in
the returned dict are full nested subtrees of the config diff, so
dict_search_recursive correctly finds 'geoip' wherever it appears in
the change set.
2. GeoIP block executed unconditionally, breaking the boot sequence
geoip_sets() always returns {'name': [], 'ipv6_name': []}. A
non-empty dict is truthy in Python regardless of whether its values
are empty lists, so the guards \"if geoip_sets:\" and
\"if 'name' in geoip_sets:\" were always True.
On boot, when policy_route.py is invoked as a dependent of
firewall.py (triggered by group_resync), it entered the GeoIP block
even with no policy route GeoIP rules configured. Because
/run/nftables-geoip.conf did not yet exist, geoip_refresh() returned
False and geoip_update(policy=policy) was called with an empty
policy. This created /run/nftables-geoip.conf containing only empty
table stubs. When firewall.py subsequently called geoip_refresh(),
the file existed and nft loaded it successfully — so the
geoip_update(firewall) call was never reached and the firewall GeoIP
sets stayed empty for the entire uptime of the router.
Fix: check the actual list contents instead of the container dict:
if geoip_sets['name'] or geoip_sets['ipv6_name'].
3. geoip_update() clobbered the other caller's sets
geoip_update() renders /run/nftables-geoip.conf from both
firewall_sets and policy_sets in a single pass. When called with
only one argument (as firewall.py and policy_route.py each do), the
other argument defaulted to None and that half of the file was
rendered empty, erasing whatever the other script had written. The
geoip-update helper used by \"update geoip\" and the weekly cron was
unaffected because it always passes both arguments, which masked
this bug in normal manual operation.
Fix: when either argument is absent, read the missing config from
the live Config session before building the set tables, so every
invocation writes the complete combined firewall + policy file.
|
|
virtual-server (#5205)
|
|
Add op-mode command having ability to show private
key in pem format as part of PKI configuration.
This is needed for users who want to render the
certificate and its private key.
|
|
Not all pyroute2 versions which ship IPRoute() support subscribing to RTNL
multicast groups. If subscribing fails, fallback to all messages.
|
|
vyos.commit: T8781: move from O(n) to O(1) for commit_in_progress() checks
|
|
(#5203)
Add checks for common used Hypervisor platforms where we know VyOS runs on.
Check that Linux Kernel is build with proper drivers for Hyper-V, VirtIO
and VMware.
|
|
|
|
Add support for allowing DHCPv6 to assign reservations for multiple
addresses and prefixes to a single client simultaneously.
|
|
Move to the re-implementation of the commit in progress check added in
commit 002d45b70efd ("vyos.commit: T8781: move from O(n) to O(1) for
commit_in_progress() checks").
|
|
Historically, commit_in_progress() used psutil.process_iter() to enumerate every
process on the system and inspect open file descriptors under /proc in order to
determine whether the configuration commit lock was held. That approach scales
linearly with process count and incurs substantial overhead under load.
Replace it with the shared lock-file utilities: attempt to acquire the commit
lock using a non-blocking exclusive lock. If acquisition fails, another holder
retains the lock and a commit is considered in progress; if it succeeds, no
commit was active and the lock acquired for the probe is released immediately.
|
|
message (#5199)
* vyos-netlinkd: T8781: do not call commit_in_progress() for EVERY netlink message
Signed-off-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one>
* vyos-netlinkd: T8781: restrict netlink subscription to link multicast group
Bind IPRoute with RTMGRP_LINK only so route/rule/neighbour/address updates
(e.g. full-table BGP) are not delivered to this socket.
Add a match wildcard so unexpected message types do not raise MatchError and
get logged as generic errors.
---------
Signed-off-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one>
Co-authored-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one>
|
|
* dhcpv6: T8849: Add time-zone support for Kea DHCPv6
Add DHCPv6 option support for time zone (RFC4833 options
41 and 42). This includes both the POSIX-style TZ string
(`new-posix-timezone`) and the IANA time zone name
(`new-tzdb-timezone`).
* dhcpv6: T8849: Refactor per code-review suggestion
* dhcpv6: T8849: Reformat for compliance
|
|
T8831: smoketests: irregular PermissionError caused by systemctl stop
|
|
T8824: Add XML properties collision check to build
|
|
T8852: migrate .github/mergify.yml to extends: mergify
|
|
Failures appear during PPPoEIf.remove() -> flush_addrs() -> set_dhcpv6(False),
where disable uses self._cmd(f'systemctl stop ...'), which raises on any
non-zero exit code of cmd().
PermissionError: [Errno 1] is misleading: cmd() raises OSError(exit_code,
feedback); exit code 1 maps to PermissionError in Python 3, so logs point at
"permissions" while the real signal is systemctl stop returned 1 (job failure,
timeout, restart contention with Restart=always on dhcp6c@.service.
Add a small systemd teardown helper stop_systemd_unit() validating the return
codes from the "systemctl stop" calls.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
|
|
According to Kea documentation:
When a data field is a string and that string contains
the comma (`,`; U+002C) character, the comma must be escaped
with two backslashes (`\\,`; U+005C) because both the routine
splitting of CSV data into fields and JSON use the same
escape character. A single escape (`\,`) would make the JSON
invalid.
Accordingly, the pcode generated for time-zone should have
the `,` double escaped. For example, `"GMT0BST,M3.5.0/1,M10.5.0"`
should be rendered as `"GMT0BST\\,M3.5.0/1\\,M10.5.0"`.
See: https://kea.readthedocs.io/en/stable/arm/dhcp4-srv.html#standard-dhcpv4-options
|
|
|
|
|
|
Four Config class methods used `default=[]` as a parameter default. The
empty list is created once at function-definition time and shared across
all calls; any mutation of the default leaks across callers. This is
mitigated in practice by `_make_path` returning `(self._level + path)`
(which creates a fresh list via `+` rather than mutating via `.append()`),
but the defensive `default=None` + explicit guard is preserved as an
additional safeguard.
Methods touched:
- return_values
- list_nodes
- return_effective_values
- list_effective_nodes
Also document the `default` parameter in each method's docstring `Args:`
section and the corresponding `Returns:` clarifications.
|
|
scripts
Bare except: catches everything derived from BaseException, including
SystemExit and KeyboardInterrupt. Config scripts must not silently
continue past sys.exit(), so replace bare except: with except Exception:
in the three config-mode scripts that contained one.
Library code (python/vyos/configverify.py, python/vyos/config.py) and
op-mode scripts are intentionally out of scope: those cases require
case-by-case design review (e.g. MTU lookups should accept defaults as
arguments rather than rely on exception handling; reset-style op-mode
scripts may legitimately want to ignore KeyboardInterrupt).
Sites changed:
- src/conf_mode/interfaces_ethernet.py (MTU adapter lookup)
- src/conf_mode/vpp_interfaces_bonding.py (MAC validation)
- src/conf_mode/container.py x2 (IPv4 / IPv6 prefix lookup)
|
|
|
|
(#5193)
Recently (commit 35db941bcf "serial: T8375: add CLI option to explicitly set
kernel console") we added the CLI knob to enable the Kernel and GRUB serial
console on a given device.
Currently this is supported for serial console interfaces starting with ttyS
and ttyAMA only. Main limitation is that these interfaces are wired to the CPU
and bootloader infos can be displayed.
|
|
|
|
WLB per-interface routing tables only contain a default route. When
LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes
it to these tables where internal destinations (BGP, connected, DNAT)
have no matching route and incorrectly exit via WAN.
Add ip rule with table main suppress_prefixlength 0 before each
per-interface table rule. This checks the main routing table first
for specific routes but suppresses the default route, so only
internet-bound traffic falls through to WLB per-interface tables.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
ci(mergify): upgrade configuration to current format
|
|
T8360: add XML preprocessor to allow overriding help element
|
|
T8764: add `inheritance: true` to .coderabbit.yaml (follow-up to #5191)
|
|
Follow-up to #5191 — the original PR landed without this flag, which
means the per-repo `.coderabbit.yaml` was REPLACING the central baseline
(`vyos/coderabbit:.coderabbit.yaml`) instead of merging with it.
Per https://docs.coderabbit.ai/configuration/configuration-inheritance:
> Inheritance is disabled by default. You must explicitly enable it
> by adding `inheritance: true`.
>
> Without inheritance, only the highest-priority source is used.
>
> Each level with `inheritance: true` merges with its parent. The
> chain stops at the first level where `inheritance: false` or unset.
Today, every PR review on this repo is using ONLY the contents of
`.coderabbit.yaml` (this file) — the central baseline's review profile,
tools, chat ACL, finishing-touches settings, etc. are all dropped.
Adding `inheritance: true` restores merging.
Caught by CodeRabbit's auto-review on the sibling per-repo PR
VyOS-Networks/next-js-cpd#1. Did not surface on the original #5191
because CodeRabbit's OSS-security policy ignores YAML config changes
from the PR itself on public repos — it reviews against the base
branch, which didn't have this file yet.
🤖 Generated by [robots](https://vyos.io)
|
|
T8764: add per-repo CodeRabbit config — Jira VD project scope
|
|
Add `.coderabbit.yaml` at repo root with the minimum override needed
to (a) opt the VyOS-Networks mirror into the central Jira integration
and (b) scope it to the VD (VyOS Dev) project.
Cross-org behavior using `usage: auto`:
* On `vyos/vyos-1x` (this repo, public): `auto` self-disables on
public repos, so no Jira context is fetched. The vyos-org
CodeRabbit install has no Atlassian OAuth grant anyway — CodeRabbit
allows one GitHub-org → Jira-tenant link per install, and that link
is attached to the `VyOS-Networks` org.
* On `VyOS-Networks/vyos-1x` (gen-1 mirror, private/internal): `auto`
activates the integration and `project_keys: [VD]` restricts the
context to VD tickets only — matching the project keys used in
release-train work tracked there.
Everything else (review profile, tools, chat ACL, path filters,
finishing-touches behavior, etc.) continues to inherit from the
respective central baseline:
- https://github.com/vyos/coderabbit/blob/production/.coderabbit.yaml
- https://github.com/VyOS-Networks/coderabbit/blob/production/.coderabbit.yaml
Pattern note: this is the canary for the source-of-truth-on-vyos
approach. Once it lands clean, the same file (with the same or
slightly different `project_keys`) should be mirrored to the other
vyos-org source repos that have VyOS-Networks mirrors.
🤖 Generated by [robots](https://vyos.io)
|
|
smoketest: T6847: probe for Intel I40E and IAVF Out-Of-Tree drivers
|
