summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-01T8138: add nat66 as dependent of firewall groupsMarius Lindvall
Add nat66 as a dependency of firewall groups, because nat66 may reference firewall groups via source-destination-group-ipv6.xml.i. The dependency is necessary to ensure a fresh nft ruleset is built when dependent groups are updated, so that the changes actually take effect in nat66 on commit. Add a smoketest to cover nft rulesets failing to update as a result of changes to dependent firewall groups. Original commit adding support for groups in nat66 is commit f96733dd.
2026-01-01Merge pull request #4926 from kumvijaya/currentChristian Breunig
T8100: smoke test workflow fixed whitespace handling with json
2026-01-01T8100: smoke test workflow fixed whitespace handling with jsonkumvijaya
2025-12-31Merge pull request #4914 from kumvijaya/currentVijayakumar A
T8100: Refactor smoke test workflows for GitHub's pull_request_target policy change`
2025-12-30Merge pull request #4922 from sever-sever/T8133Christian Breunig
T8133: BGP add local-rib feature for BMP
2025-12-30Merge pull request #48 from vyos/list-interfaces-bondDaniil Baturin
T8110: "list_interfaces --bondable" must not return VLAN subinterfaces
2025-12-30T8100: Refactor smoke test workflows for GitHub's pull_request_target policy ↵kumvijaya
change T8100: refactored smoke test workflow T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: condolidated smoke test workflow to handle the branch specific handlings T8100: fixed review comments on smoke test refactoring T8100: smoketest refactoring syntax errors fixed T8100: fixed review comments on smoke test refactoring T8100: smoketest refactoring review comments fixed T8100: smoketest workflofw fixed copilot review comments T8100: smoketest workflofw fixed copilot review comments
2025-12-30Update src/conf_mode/vpn_openconnect.pyDaniil Baturin
2025-12-30Update interface-definitions/vpn_openconnect.xml.inDaniil Baturin
2025-12-30Update interface-definitions/vpn_openconnect.xml.inDaniil Baturin
2025-12-30Merge pull request #4918 from c-po/no-pki-default-nodeDaniil Baturin
config: T8124: make get_config_dict() pki={} node purely optional
2025-12-30T8133: BGP add local-rib feature for BMPViacheslav Hletenko
2025-12-30tests: T7664: segment-routing, remove defaultsKyrylo Yatsenko
In FRR 10.5 block-len, node-len and func-bits are not shown if they have default values. Fix test smoketest/scripts/cli/test_protocols_segment-routing.py accordingly (update expected + change func-bits 16 -> 12 so that they are shown). Relevant commits in FRR: 44e67d2d3dabdc1492448e6a3c7024bd0309c244 84c807a3b300f4c9fcda55bccd93dcb64716f5d7
2025-12-30bgp: T7664: add 'no bgp reject-as-sets'Kyrylo Yatsenko
In FRR 10.5 'bgp reject-as-sets' became default (https://frrouting.org/release/10.5.0/): > BGP rejects AS_SET by default > Until 10.5.0, it was disabled by default, and since RFC 9774 was > published, we switched this on by default (to reject). Add 'no bgp reject-as-sets' when VyOS option reject_as_sets is not set.
2025-12-29Merge pull request #4917 from c-po/bond-no-always-remove-memberChristian Breunig
bond: T2416: support hot-add/remove of bond member interfaces
2025-12-29T7635: OpenConnect Certificate AuthenticationGiga Murphy
2025-12-26config: T8124: make get_config_dict() pki={} node purely optionalChristian Breunig
Automatic parsing and integration of the PKI subsystem into the resulting config dict is now enabled by passing with_pki=True to get_config_dict(). However, when no PKI configuration is present, the resulting dictionary still includes an empty PKI key. This is undesirable; we should only include keys in the dictionary when they contain relevant data.
2025-12-26bond: T2416: support hot-add/remove of bond member interfacesChristian Breunig
Previously, adding or removing a bond member interface would force the entire bond into an admin-down state, removing and re-adding all member interfaces. This caused unnecessary link up/down events and excessive log noise on partner devices. This change refactors the code to allow hot-adding and removal of bond member interfaces without disrupting existing members, minimizing link state changes and log entries.
2025-12-26bond: T2416: rename bond slave terminology to member interfacesChristian Breunig
2025-12-26bond: T2416: simplify collection of bond member interfacesChristian Breunig
2025-12-23Merge pull request #4910 from AndriiFullroot/ACCEL_PPPD_SESSIONDaniil Baturin
T8010: Added the vyos_vpp plugin to the accel-pppd's template
2025-12-23Merge pull request #4913 from natali-rs1985/T7203Daniil Baturin
vpp: T7203: Add op-mode to show bridge-domain
2025-12-23Merge pull request #4904 from natali-rs1985/T8080Daniil Baturin
vpp: T8080: Fix handling of configuration system lock after vpp commit failure
2025-12-23vpp: T7203: Add op-mode to show bridge-domainNataliia Solomko
2025-12-23Merge pull request #4911 from c-po/bond-enaDaniil Baturin
bond: T8084: disallow bond members that do not support MAC changes
2025-12-23vpp: T8080: Fix handling of configuration system lock after vpp commit failureNataliia Solomko
2025-12-22Merge pull request #4905 from jestabro/vyconf-completion-envJohn Estabrook
T8061: add protobuf messages related to getCompletionEnv
2025-12-22T8061: T8109: T8113: T8114: update for completion and bug fixesJohn Estabrook
2025-12-22Merge pull request #4908 from sever-sever/T8108Viacheslav Hletenko
T8108: Add smoketest for Kernel kexec and arm64 options
2025-12-20Merge pull request #4902 from Firefishy/patch-1Christian Breunig
T8107: Fix help text for WWAN interface information
2025-12-19bond: T8084: disallow bond members that do not support MAC changesChristian Breunig
Building on commit ba60266ab1896 (“ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2)”), add safeguards to prevent interfaces from being used as bond members if they: * do not support MAC address changes, or * appear on a denylist of interfaces invalid for bonding (currently empty)
2025-12-19ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2)Christian Breunig
Add a safeguard to block MAC address changes when the underlying driver is ENA (used on AWS EC2), and display a clear error message instead of raising "OSError: [Errno 95] Operation not supported."
2025-12-19bond: T8084: refactor verify() to remove duplicationChristian Breunig
Consolidate repeated helper function calls used for both bonded and non-bonded Ethernet interfaces, resulting in cleaner and more maintainable code.
2025-12-19bond: T8084: remove dynamic interface type detection via vyos.ifconfig.SectionChristian Breunig
Aggregated / bonded interfaces do only work with ethernet interfaces as underlaying link. There is no need to "dynamically" detect that eth0, eth1 or any other interface starting with eth is an ethernet interface. Remove calls to vyos.ifconfig.Section().
2025-12-19T8110: "list_interfaces --bondable" must not return VLAN subinterfacesChristian Breunig
Inspired by the regex used for "set interfaces ethernet" adjust the regex to match for interfaces acting as a bond member interface. This has been changed to also include (in addition to eth) lan, eno, ens prefixed physical interfaces.
2025-12-19T8010: Added the vyos_vpp plugin to the accel-pppd's templateAndrii Melnychenko
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-12-19T8108: Add smoketest for Kernel kexec and arm64 optionsViacheslav Hletenko
Check the Kernel `kexec` and additional arm64 modules
2025-12-19Merge pull request #4909 from natali-rs1985/T7995-fixDaniil Baturin
T7995: Fix UnboundLocalError for key in parse_cmdline
2025-12-19T7995: Fix UnboundLocalError for key in parse_cmdlineNataliia Solomko
2025-12-18Merge pull request #4895 from natali-rs1985/T8082Viacheslav Hletenko
T8082: VPP fails to start with buffers page-size 1G
2025-12-18Merge pull request #4903 from c-po/ssh-migrate-aes256-cbcDaniil Baturin
ssh: T8098: migrate "rijndael-cbc@lysator.liu.se" to "aes256-cbc" cipher
2025-12-18Merge pull request #4875 from natali-rs1985/T7995Daniil Baturin
T7995: Add capability to start VPP dataplane during system deployment
2025-12-18Merge pull request #4890 from natali-rs1985/T7954Daniil Baturin
vpp: T7954: Add op-mode commands to show LACP
2025-12-18T7995: Add capability to start VPP dataplane during system deploymentNataliia Solomko
Kernel command-line change detection and automatic system reboot via kexec during initial deployment
2025-12-18Merge pull request #4899 from xTITUSMAXIMUSX/currentJohn Estabrook
T8026: Fixed session commit for the generate router
2025-12-17T8061: add protobuf messages related to getCompletionEnvJohn Estabrook
Add requests reference_tree_exists, get_path_type, get_completion_env.
2025-12-17Merge pull request #4892 from c-po/getpwallChristian Breunig
login: T8086: replace getpwall() based user enumeration to avoid NSS/TACACS timeouts
2025-12-17login: T8086: replace getpwnam()/getpwuid() with get_local_passwd_entries()Christian Breunig
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid NSS/TACACS timeouts").
2025-12-17login: T8086: replace getpwall() occurances with get_local_passwd_entries()Christian Breunig
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid NSS/TACACS timeouts").
2025-12-17login: T8086: replace getpwall() user enumeration to avoid NSS/TACACS timeoutsChristian Breunig
The previous implementation of "system login" relied on Python's pwd.getpwall() to enumerate user accounts. This forces a full walk through the NSS stack, which is acceptable in general but problematic for our use-case. VyOS only needs information about locally created accounts and not remote accounts provided via AAA backends such as TACACS or RADIUS. When TACACS servers are unreachable, NSS lookups become extremely slow due to repeated timeouts. As a result, any operation triggering pwd.getpwall() (including configuration commits) can stall for several minutes. This change introduces a dedicated helper, get_local_passwd_entries(), which reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are relevant, this provides all required data with no external dependencies. Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers: # set system login tacacs server 192.168.1.50 key test123 # set system login tacacs server 192.168.1.51 key test123 # time commit Before: real 3m29.825s user 0m0.329s sys 0m0.246s After: real 0m1.464s user 0m0.337s sys 0m0.195s This significantly improves commit performance and removes sensitivity to AAA server outages.
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-30 10:10:11 +0000