| Age | Commit message (Collapse) | Author |
|---|
|
vyos-netlinkd: T9086: ignore stale link-DOWN; drain netlink during commit
|
|
Original bug: while a commit held the lock, the daemon called sleep(1)
without reading the netlink socket. The pending message stayed queued
in the kernel buffer, so once the commit ended, a stale event (e.g. a
DOWN from a disable that had already been re-enabled) got processed as
if it were fresh - stopping dhclient on an interface that was actually
back UP.
The applied fix keeps only the two pieces that are actually
load-bearing:
1. Drain instead of sleep - while commit_in_progress2() is true, still
call ipr.get() to read and discard any pending netlink messages, so
nothing stale survives to be processed after the commit ends.
2. Reconcile on commit end - once the commit finishes, walk all
matching interfaces, compare live sysfs operstate against the last
state the daemon acted on (_iface_prev_operstate), and run the
normal DHCP handler for any that disagree. This catches a real
transition that happened only inside the drain window and would
otherwise be silently lost.
Dropped from the original fix: an unconditional live-sysfs override
inside _handle_dhcp_events() that ran on every event, not just around
commits - redundant with reconcile, and risked discarding genuine fast
link flaps unrelated to any commit.
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
pki: T9135: derive ACME certificate chains from disk
|
|
dhcp: T9167: align Kea HA timer defaults with Kea ARM
|
|
op-mode: T7250: restore image/file path completion for show/copy/delete file
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
qos: T9134: Fix commit crash when classes match different protocols
|
|
firewall: T7552: Output rule in verify_rule() ConfigError messages
|
|
The imagefiles comptype dispatched to _vyatta_image_file_complete, a function
that was never ported when the legacy vyatta-op bash completion script was
imported in commit 72a704d2e2 ("T6527: add legacy Vyatta interpreter files
still in us"), causing "Invalid command: [_vyatta_image_file_complete]" on
tab-completion.
Port the original vyatta-image-complete interpreter so completion of works
again as it did on VyOS 1.4.x.
|
|
"show pki ca/certificate <name>" only ever offered PEM output, which isn't
practical for a human to actually read. Add a "text" form that runs the
certificate through OpenSSL's own "-text" formatter, the same human-readable
breakdown "openssl x509 -text" produces.
|
|
"import pki ca <name>" and "import pki certificate <name>" only ever offered
a literal "<name>" hint, never the names of CAs/certificates already present
in the running configuration - useful when re-importing an updated certificate
under its existing name, not just when adding a brand new one.
|
|
The local-file branch of CA certificate import recognized a file:// URL
by scheme but never actually decoded it - os.path.exists()/open() still
received the full "file://..." string rather than the path component, so
an explicit file:// URL always failed with "File not found" even when it
pointed at a real, readable file.
|
|
certbot_request() ultimately shells out via cmdl(), which can fail with
something other than ConfigError - e.g. FileNotFoundError if the certbot
binary itself is missing, or another OSError from the underlying process
call. The backup/restore wrapper around a certificate replacement only
caught ConfigError, so any other failure skipped restoration entirely and
left the certificate deleted with no way back, defeating the point of taking
a backup before requesting a replacement in the first place.
|
|
certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.
Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.
|
|
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
|
|
A failed certbot request or renewal only showed the CLI a raw dump of the
invoked command line and its exit code - not the actual reason (e.g. rate
limiting, failed domain validation), because certbot's own non-interactive
error reporting can itself crash on an unrelated internal bug while trying
to display the failure, masking it entirely from the captured output.
Read the real reason directly out of certbot's own debug log instead, scoped
to what the current invocation appended, and use it as the error message
shown to the user. Falls back to the previous generic message when no such
line is found.
|
|
An ACME-issued certificate's intermediate CA was previously imported into the
running configuration as a synthetic object, purely so consumers building a
full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could
find it. This leaked certbot's internal state into the CLI as a real, deletable
object that never needed to exist there: the intermediate is available on disk
the moment the certificate is issued, same as the leaf certificate and its key.
Read it live from disk instead, purely in memory, wherever a full chain is
resolved or displayed - never as a settable or deletable configuration object.
An already-configured CA that completes the chain on its own takes precedence
and nothing synthetic is added.
Adding, changing, or removing a CA now reloads only the services whose resolved
chain is actually affected, with no side effect on certificates whose own
content did not change.
|
|
The PKI testsuite's setUpClass() already clears out pki and service https so
it can run on a live system, but left an existing load-balancing haproxy
configuration in place, which could reference certificates the tests then
delete out from under it.
|
|
The path argument to the CA import command now also accepts a remote URL
(http, https, ftp, sftp, scp, tftp, ...), detected by scheme, in addition to
a local file path. Makes it convenient to pull a well-known public intermediate
directly by URL instead of downloading and pasting PEM content by hand.
|
|
container: T9184: add chown capability
|
|
|
|
container: T7736: fix smoketest failures caused by netavark/aardvark-dns IPv6 DAD race
|
|
flow-accounting: T9122: bind NetFlow export to the configured VRF
|
|
T9107: Fix integration workflow after recent GitHub security updates
|
|
Change the branch reference in the smoketest workflow to always rely on our main repo branch to get the vyos-1x sources into the build/vyos-1x directory for the ISO build script.
|
|
On a live system, prevent that the smoketest default route overwrites
any other dynamically learned route by defining a higher distance.
|
|
VyOSUnitTestSHIM.tearDownClass() restores the pre-test configuration from
/tmp/vyos-smoketest-save but never removed the file afterwards. Since it
is a fixed, shared path, whichever user ran a smoketest last ends up
owning it with no group/other write permission - the next user to run
any smoketest on the same box gets a hard "Permission denied" writing to
that path, even though nothing else is actually wrong.
|
|
netavark assigns the IPv6 gateway address to a container "pod-*" bridge
and immediately invokes aardvark-dns to bind its DNS listener to it. While
the address is "tentative" during Duplicate Address Detection, that bind()
fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled
network.
The kernel only skips DAD for an address if both "all" and the specific
interface's own accept_dad are disabled at the moment the interface is
created. A per-interface override is always either too late for a network's
first-ever container - as the network can only be created in-time and not
explicitly before starting the first container.
|
|
qos: T8996: Implement set-dscp packet remarking for shaper policy
|
|
sflow: T9065: Always set psample group even when egress sampling is disabled
|
|
T9163: Fix typos in the completion help for the service conntrack-sync
|
|
Stock kea_high_availability_json set max-response-delay equal to
heartbeat-delay (both 10000 ms) and max-unacked-clients to 0. The Kea
ARM documents max-response-delay default 60000 ms (must be greater than
heartbeat-delay, typically a multiple) and max-unacked-clients default
10 (0 disables client failure-detection and partner-downs immediately).
Equal 10s/10s timers false-fire communication-interrupted every
heartbeat cycle on healthy pairs.
https://vyos.dev/T9167
|
|
container: T7736: give container veths a deterministic host_interface_name
|
|
T9164: coderabbit: surface NOS Jira project alongside legacy VD
|
|
VD tracker project renamed to NOS (2026-07). Pins NOS ahead of the retained
legacy VD in knowledge_base.jira.project_keys so CodeRabbit resolves the new
keys in review summaries. Companion to the mergify task-id regex sweep
(canary vyos/vyos-1x#5379).
🤖 Generated by [robots](https://vyos.io)
|
|
T9164: mergify: accept NOS- and legacy VD- Jira keys in task-id check
|
|
The engineering Jira project was renamed VD -> NOS (native key rename,
numbering continues; old VD-N keys redirect). Extend the invalid-task-id
title + commit regexes to accept NOS-<digits> and legacy VD-<digits>
alongside T<digits>. Canary for the operator-approved fleet sweep (T9164).
🤖 Generated by [robots](https://vyos.io)
|
|
aardvark-dns ships in lockstep with netavark (both 1.14.0 on the box this
was verified against), so pin it to the same >=1.14.0 minimum required for
Podman's "host_interface_name" network option to actually take effect.
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
|
|
Cosmetic bug
|
|
|
|
|
|
|
|
configsession: T9156: add consistent use of finalizers
|
|
|
|
nhrp: T9128: fix duplicate nftables meter name for multiple redirect tunnels
|
|
vpp: T8468: Apply MAC address changes on VPP interfaces
|
|
vpp: T9139: Check interface not referenced by a feature before removal
|
|
vyos-netlinkd: T9143: seed operstate cache at startup
|
