| Age | Commit message (Collapse) | Author |
|---|
|
The VyOS kernel ships the native exFAT driver (CONFIG_EXFAT_FS=m), so the
userspace FUSE implementation is no longer needed. The exfatprogs tools for
creating and checking filesystems are kept.
The kernel options smoketest now verifies CONFIG_EXFAT_FS is enabled.
|
|
show_wwan.py drove qmicli against /dev/cdc-wdmN, which assumes the modem
exposes a QMI control port. An MBIM modem does not, so every subcommand of
"show interfaces wwan wwanN" failed on one - after waiting out a five second
transaction timeout, twice over for "signal":
$ show interfaces wwan wwan0 signal
Command not supported by Modem (10.6s)
$ qmicli --device=/dev/cdc-wdm0 --device-open-proxy --nas-get-signal-info
error: couldn't create client for the 'nas' service: CID allocation failed
in the CTL client: Transaction timed out
ports: cdc-wdm0 (mbim), ttyUSB0 (at), wwan0 (net)
ModemManager has already probed the modem and speaks whichever protocol it
exposes - QMI, MBIM or plain AT. It is a hard dependency of "interfaces wwan"
anyway, as conf_mode cannot dial without it, and it answers from its own cache
over D-Bus without touching the device:
$ show interfaces wwan wwan0 signal
Access technology: lte (0.2s)
Signal quality: 58%
Operator: Telekom.de
Registration: home
Packet service: attached
State: connected
|
|
Only 2.7 and later can drive the in-tree "ovpn" module. Without a bound,
a mirror carrying 2.6 silently reinstates a build where "offload dco"
loads the module but nothing uses it.
|
|
The configuration tests hardcoded "system console device ttyS0 speed 115200",
which only holds for amd64, whereas arm64 images expose the UART as ttyAMA0, so
loading these configs produced a diff against the assert data and the tests
failed.
Replace the hardcoded values in all config test inputs and their assert
counterparts with the @SERIAL_DEVICE@ and @SERIAL_SPEED@ placeholders. The
vyos-1x-smoketest postinst queries the image flavor and implants the real
values once at install time, so the test runner needs no runtime patching.
Migration script 31-to-32 now derives the serial device from the flavor, too,
instead of assuming ttyS0.
This can be observed during vyos-1x package installation while building the
ISO image
Setting up vyos-1x-smoketest (999.0-14834-g16f1cf457-dirty) ...
...
I: Implanted serial console ttyS0,115200 into /usr/libexec/vyos/tests/configs
|
|
The compileall call for the XML reference cache ended in '|| true', so a real
failure left no trace at all. Report it on stderr instead, and give py3compile
the same treatment so the two adjacent calls behave alike.
Deliberately not fatal. Bytecode is an optimisation: if it cannot be built the
CLI is slower but entirely correct, so aborting the installation - and with it
any image build - would be a worse outcome than a slow shell. This postinst has
no 'set -e' and contains no exit statements, so a failing command here has never
been treated as fatal; adding one now would make byte-compilation the single
exception in the file.
Note that compileall exits 0 for a missing directory and only returns nonzero on
an actual compilation error, so the warning fires on the case worth knowing
about and stays quiet otherwise.
|
|
The package ships 188 .py files and zero .pyc. dh_python3 runs and its py3clean
counterpart is present in the generated prerm, but the postinst half is silently
dropped: debhelper only injects autoscripts where its substitution token
appears, and debian/vyos-1x.postinst does not carry one. The package therefore
cleans up bytecode that nothing ever creates.
Call py3compile directly rather than adding the token, which would also inject
the dh_installsystemd enable/start snippets for vyos-router.service and
vyos.target and change service enablement at install time.
vyos/xml_ref/cache.py needs a second pass. It is generated by update_cache.py
from the postinst itself, so it does not exist yet when py3compile walks the
package. It is a multi-megabyte dict literal and by far the most expensive
single file in the tree to parse.
Measured on a fast build host, per interpreter start:
vyos/xml_ref/cache.py 216.1 -> 32.1 ms (-85%)
import vyos.ifconfig 66.8 -> 29.0 ms (-57%)
import vyos.config 31.0 -> 20.4 ms (-34%)
Since dist-packages is writable on an installed image, a root-run script would
eventually populate __pycache__ by itself; this makes it deterministic and
covers live boot, where the overlay is tmpfs and the cost is paid every boot.
|
|
Add new CLI subtree 'system option kdump' with memory reservation and
local dump path configuration. Also add 'show system kdump' and
'show system kdump dumps' operation mode commands to get
status of the configuration and list of dumps.
Extend 'show tech-support report' and 'generate tech-support archive' with
kdump service status, active config files and the recently kernel dump file.
|
|
python3-vici was installed from the VyOS binary repository and the build time
dependency. The sole purpose was only to satisfy the pylint runs - no more,
no less.
WWith an updated pyproject.toml, the vici import can be ignored from pylint
runs - removing a circilar dependency for the Docker image.
|
|
aardvark-dns ships in lockstep with netavark (both 1.14.0 on the box this
was verified against), so pin it to the same >=1.14.0 minimum required for
Podman's "host_interface_name" network option to actually take effect.
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
T8099: strongswan: 6.0.6 + Post quantum options
|
|
Drop third party binary grc for showing the log output in fancy colors.
Solely rely on what journalctl brings to the table.
|
|
|
|
T8971: upgrade from bgpq3 package to bgpq4
|
|
Add symlink from bgpq3 to bgpq4 to keep backwards compatible behavior.
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
is set
When a user account was provisioned with only `plaintext-password` (e.g.
via cloud-init), the password recovery tool failed to persist the new
password across reboots. On the next boot, VyOS would re-apply the
`plaintext-password` from config.boot, silently overwriting the recovered
encrypted password.
|
|
When strongSwan package is not available on `packages.vyos.net`,
it causes the Debain 5.9.8 package version to be used, which fails the tests.
|
|
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As
this was not available in the previous used LTS 6.6 Kernel it now is available
while we upgrade to Linux 6.18.
|
|
Fix install location for validate-value which must be in $(VYOS_LIBEXEC_DIR)
instead of $(VYOS_LIBEXEC_DIR)/validators.
Co-authored-by: John Estabrook <jestabro@vyos.io>
|
|
* 'current' of github.com:vyos/vyos-utils: (65 commits)
T8269: add option to silence output of individual validators
T8306: update package version
vyos-op-run: T8306: add error messages for system exceptions
vyos-op-run: T8306: improve execution logic logging
vyos-op-run: T8301: improve the security of UID check and setuid logic
T8110: "list_interfaces --bondable" must not return VLAN subinterfaces
vyos-op-run: T7901: skip permission checks if the user is root
vyos-op-run: T8005: sanitize environment variables to prevent malicious variable injection
T7878: conflict check updated to use mergify
T7878: conflict check updated to use mergify
T7899: virtual-ethernet interfaces support broadcasts
Debian: T7899: bump dh compat version
T7758: add missing case to allow repeated option --type
T7758: allow repeated option --type in list_interfaces
vyos-op-run: T7745: add a command permission checking mechanism
op-mode: T7583: add a new operational command runner
T7644: mirror workflow refactoring rollout
T7579: fix of the run trigger for CLA
T7579: added workflow for CLA
validators: T6622: Radix-aware numeric validation
...
|
|
T8380: Add sbsigntool for ARM64 debian control for vyos-1x
|
|
T8449: Merge vyos-user-utils package into vyos-1x
|
|
vyos-netlinkd: T8047: replacement of netplugd
|
|
|
|
dependencies
|
|
|
|
into user-utils
* 'current' of https://github.com/vyos/vyos-user-utils: (24 commits)
T7644: mirror workflow refactoring rollout
T7579: fix of the run trigger for CLA
T7579: added workflow for CLA
T7334: pr mirror trigger workflow added with label creation permission for default github token
T7373: remove irqtop to avoid the overhead of having a Ruby runtims (30+ MB) in the image for a single, rarely-used program
T7330: mirror workflows added
T6804: Add ipmitool to user utils
T6763: Delete Jenkins file
T6674: Action add trigger workflow to rebuild package
T5984: Add user util numactl
T5222: Remove haproxy from user-utils as it added to vyos-1x
T5632: Add user-util jq to parse JSON files from sh
T5028: Add exfat-fuse package
T5028: Add package exfatprogs
T4841: Add fancontrol user-utils package
T4426: add arpwatch to the image
user-pkgs: T4023: Add user pkg grepcidr and sorting the pkgs
Add dnsdist to the image
Include haproxy in the image
Import dependencies from the former vyos-utils package list.
...
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
Implementing a daemon that listens for netlink messages in Python was discussed
for many years. This is a proof-of-concept implementation how we can listen for
netlink messages and process them in Python.
Python 3.10 minimum is required due to the use of case statements which mimics
C-style switch/case instructions.
Add example:
set interfaces ethernet eth1 vif 21 address dhcp
set interfaces ethernet eth1 vif 21 address dhcpv6
commit
If network cable is unplugged:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Stopping dhclient@eth3.10.service...
vyos-netlinkd[12681]: Stopping dhcp6c@eth3.10.service...
If cable is plugged back in:
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=UP, mac=00:50:56:b3:9d:8e
vyos-netlinkd[12681]: Restarting dhclient@eth3.10.service...
vyos-netlinkd[12681]: Restarting dhcp6c@eth3.10.service...
|
|
Install TACACS dependencies for vyos-1x package for both platforms.
|
|
geoip: T8326: Resolve permission issue on database paths
|
|
Restore required sudo on geoip op-mode
Ensures group/permission set on geoip nftables config
|
|
|
|
|
|
|
|
Previously we have had an implicit dependency on python3-systemd by
salt-minion. As several code paths rely on python3-systemd we need to add an
explicit dependency.
|
|
Kernel command-line change detection and automatic system reboot via
kexec during initial deployment
|
|
Configuration files for config tests gathered from lab installations, customers
or our own networks were placed in multiple directories - all related to
the same thing.
We have had config-tests, configs and config.no-load. This commit re-arranges
all the files and places a proper README for the users.
|
|
This enhances diagnostic capabilities by providing hardware topology
visuals within support archives.
|
|
For integration with CLI completion and shell internal functions, use
vyconf_cli_compat for replacing needed calls of cli-shell-api.
|
|
To allow call VPP api without sudo
- Get op-mode commands without sudo
- Use API call in smoke-tests
|
|
|
|
to prevent malicious variable injection
|
|
CRON is not used for certbot as pki starts the certbot timer.
|
|
Compatibility levels before 10 are deprecated
|
|
Add TLS support for remote syslog by extending the CLI and backend to support configuration of CA certificates, client certificates, keys, and authentication modes.
This update integrates with the PKI subsystem for certificate management, ensures proper validation of protocol settings when TLS is enabled, and generates secure rsyslog configuration for forwarding logs over TLS.
|
|
Check that write_file_sync reaches disk, by using util vmtouch to evict
cache.
|
|
|
|
kea: T7821: Update Kea to 3.0
|
