summaryrefslogtreecommitdiff
path: root/python
AgeCommit message (Collapse)Author
2026-02-24T8313: add protobuf messages for copy/renameJohn Estabrook
2026-02-22igmp-proxy: T8295: provide native systemd unit to enable restart/backoffChristian Breunig
The igmpproxy service was started via a SysV init script, causing systemd-sysv-generator to create a transient unit without restart policies. When igmpproxy failed on first start, systemd did not retry, leading to intermittent service availability. This change replaces the auto‑generated unit with a native systemd service file that defines proper restart settings.
2026-02-19vpp: T8261: Refactor resource settings into 'resource-allocation' sectionNataliia Solomko
2026-02-18vpp: T8274: Remove dpdk-options section for num-* parametersOleksandr Kuchmystyi
Remove `dpdk-options` under `set vpp settings interface <ethN>` and move its child options to the interface level: - `num-rx-desc` - `num-rx-queues` - `num-tx-desc` - `num-tx-queues` Also remove `set vpp settings interface <ethN> dpdk-options promisc`.
2026-02-17vpp: T8268: Unify CPU settings into a single 'cpu-cores' node under ↵Nataliia Solomko
'resource-allocation' Replace legacy VPP CPU settings (main-core, skip-cores, workers, corelist-workers) with a single resource-allocation cpu-cores option. CPU assignment is now handled automatically: two cores are reserved for the system, the VPP main thread is placed on the first available core, and the remaining allocated cores are used as workers. This simplifies configuration and ensures consistent CPU allocation.
2026-02-13vpp: T8254: Move 'nat44' and 'settings nat44' sections to 'nat nat44'Nataliia Solomko
2026-02-12T8232: add config_dict wrapperJohn Estabrook
2026-02-12T8232: add reference tree classJohn Estabrook
As a needed argument to the internal config_dict function, reify for caching under vyos-configd or other running process.
2026-02-12T8232: add default reference tree cache file locationJohn Estabrook
2026-02-12T8232: internal name change for consistency with ReferenceTree classJohn Estabrook
2026-02-11Merge pull request #4979 from natali-rs1985/T7811Christian Breunig
vpp: T7811: Add rebind_gve_driver function for correct gve device handling
2026-02-11vpp: T8252: Change ACL node 'macip' to 'mac'Nataliia Solomko
2026-02-10update-check: T7945: Improve reliability during early boot and error handlingOleksandr Kuchmystyi
During early boot not all resources are ready for HTTP request, so `vyos.version.get_remote_version` may fail once and the update check is then delayed for 12 hours, leaving the router unaware of updates. Fix by adding retries/backoff and improved error handling so transient startup network failures don't suppress update checks for the next interval.
2026-02-10vpp: T7811: Add rebind_gve_driver function for correct gve device handlingNataliia Solomko
2026-02-05Merge pull request #4949 from sarthurdev/geoip_refactorDaniil Baturin
geoip: T7926: T8049: Refactor geoip code and add MaxMind support
2026-02-03Merge pull request #4919 from alexandr-san4ez/T7730-currentDaniil Baturin
interfaces: T7730: Add interrupt coalescing settings for Ethernet interfaces
2026-02-03Merge pull request #4965 from natali-rs1985/T8207Nataliia S.
vpp: T8207: Enable ip6-icmp-ra-punt feature on interfaces with DHCPv6 address configured
2026-02-03vpp: T8207: Enable ip6-icmp-ra-punt feature on interfaces with DHCPv6 ↵Nataliia Solomko
address configured
2026-02-02utils: T8018: add unbuffered output support to popen()Christian Breunig
Instead of executing the command passed to popen() and waiting for it to finish before printing its output, add a function argument to disable buffered mode. When buffered mode (the default) is turned off, each line emitted by the process is flushed immediately to the calling TTY.
2026-01-30Merge pull request #4955 from natali-rs1985/T8202Viacheslav Hletenko
vpp: T8202: Remove XDP driver and options from CLI and config
2026-01-29Merge pull request #4951 from c-po/broken-pipeJohn Estabrook
op-mode: T8154: fix tcpdump KeyboardInterrupt on Ctrl+C
2026-01-28vpp: T8202: Remove XDP driver and options from CLI and configNataliia Solomko
- Migration script removes 'driver' and 'xdp-options' nodes. - XDP logic is commented out in config verification and CLI tests, preserving code for future use. - The rest of XDP-related code remains untouched
2026-01-22Merge pull request #4942 from natali-rs1985/T8125Daniil Baturin
vpp: T8125: Enable ip4-dhcp-client-detect feature if interface address is configured as DHCP
2026-01-22T8154: make catch_broken_pipe decorator to common vyos.utils.io functionChristian Breunig
This adds the capability to make it re-usable in other code paths.
2026-01-22ethtool: T7730: Add configuration coalesce for interfaceOleksandr Kuchmystyi
This change introduces CLI support for configuring network interface interrupt coalescing parameters via `netlink`. Note: Not all NIC drivers support interrupt coalescing. On unsupported interfaces, `netlink` returns an error and the VyOS commit will fail.
2026-01-21vpp: T8125: Enable ip4-dhcp-client-detect feature if interface address is ↵Nataliia Solomko
configured as DHCP DHCP address cannot be assigned on VPP interfaces without enabling the 'ip4-dhcp-client-detect' feature
2026-01-21geoip: T8049: Add MaxMind database supportsarthurdev
2026-01-21geoip: T7926: Refactor geoip handlingsarthurdev
* Move core logic to separate vyos.geoip module * Use a sqlite database for storing and querying address ranges by country * Remove downloaded geoip ranges once loaded into sqlite db * No longer rebuild geoip sets on each commit unless necessary * Allows for extensibility using other geoip data vendors
2026-01-17Merge pull request #4852 from scj643/ssh-fido2-optionsChristian Breunig
ssh: T7483: Add fido2 PubkeyAuthOptions
2026-01-15Merge pull request #4843 from Firefishy/T7101Daniil Baturin
T7101: Add hardware watchdog support via systemd
2026-01-15ssh: T7483: Add fido2 PubkeyAuthOptionsChloe Surett
2026-01-14T7101: Add support for hardware watchdog support via systemdGrant Slater
2026-01-12openvpn: T7633: Add support for 'data-ciphers-fallback' in site-to-site tunnelsOleksandr Kuchmystyi
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces (used as fallback cipher in site-to-site mode) - Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
2026-01-09Merge pull request #4912 from hedrok/T8046-add-link-params-cliViacheslav Hletenko
T8046: traffic-engineering: support link-params
2026-01-09T8046: traffic-engineering: support link-paramsKyrylo Yatsenko
Add 'traffic-engineering' commands under 'protocols'. set protocols traffic-engineering admin-group ADMINGROUP bit-position 1 set protocols traffic-engineering interface INTERFACE admin-group ADMINGROUP set protocols traffic-engineering interface INTERFACE max-bandwidth 1280 set protocols traffic-engineering interface INTERFACE max-reservable-bandwidth 1280 Also add set protocols isis traffic-engineering export
2026-01-06T8153: pppoe: send RS for IPv6 autoconf on link-upMiaosen Wang
Co-authored-by: Christian Breunig <christian@breunig.cc>
2025-12-30Merge pull request #4918 from c-po/no-pki-default-nodeDaniil Baturin
config: T8124: make get_config_dict() pki={} node purely optional
2025-12-29Merge pull request #4917 from c-po/bond-no-always-remove-memberChristian Breunig
bond: T2416: support hot-add/remove of bond member interfaces
2025-12-26config: T8124: make get_config_dict() pki={} node purely optionalChristian Breunig
Automatic parsing and integration of the PKI subsystem into the resulting config dict is now enabled by passing with_pki=True to get_config_dict(). However, when no PKI configuration is present, the resulting dictionary still includes an empty PKI key. This is undesirable; we should only include keys in the dictionary when they contain relevant data.
2025-12-26bond: T2416: support hot-add/remove of bond member interfacesChristian Breunig
Previously, adding or removing a bond member interface would force the entire bond into an admin-down state, removing and re-adding all member interfaces. This caused unnecessary link up/down events and excessive log noise on partner devices. This change refactors the code to allow hot-adding and removal of bond member interfaces without disrupting existing members, minimizing link state changes and log entries.
2025-12-26bond: T2416: rename bond slave terminology to member interfacesChristian Breunig
2025-12-26bond: T2416: simplify collection of bond member interfacesChristian Breunig
2025-12-23Merge pull request #4904 from natali-rs1985/T8080Daniil Baturin
vpp: T8080: Fix handling of configuration system lock after vpp commit failure
2025-12-23Merge pull request #4911 from c-po/bond-enaDaniil Baturin
bond: T8084: disallow bond members that do not support MAC changes
2025-12-23vpp: T8080: Fix handling of configuration system lock after vpp commit failureNataliia Solomko
2025-12-19bond: T8084: disallow bond members that do not support MAC changesChristian Breunig
Building on commit ba60266ab1896 (“ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2)”), add safeguards to prevent interfaces from being used as bond members if they: * do not support MAC address changes, or * appear on a denylist of interfaces invalid for bonding (currently empty)
2025-12-19ethernet: T8084: prevent MAC changes on ENA interfaces (AWS EC2)Christian Breunig
Add a safeguard to block MAC address changes when the underlying driver is ENA (used on AWS EC2), and display a clear error message instead of raising "OSError: [Errno 95] Operation not supported."
2025-12-17T8061: add protobuf messages related to getCompletionEnvJohn Estabrook
Add requests reference_tree_exists, get_path_type, get_completion_env.
2025-12-17login: T8086: replace getpwnam()/getpwuid() with get_local_passwd_entries()Christian Breunig
Switch to our custom implementation to avoid NSS/TACACS timeouts as explained in commit 4c9eaaa96e06 ("login: replace getpwall() user enumeration to avoid NSS/TACACS timeouts").
2025-12-17login: T8086: replace getpwall() user enumeration to avoid NSS/TACACS timeoutsChristian Breunig
The previous implementation of "system login" relied on Python's pwd.getpwall() to enumerate user accounts. This forces a full walk through the NSS stack, which is acceptable in general but problematic for our use-case. VyOS only needs information about locally created accounts and not remote accounts provided via AAA backends such as TACACS or RADIUS. When TACACS servers are unreachable, NSS lookups become extremely slow due to repeated timeouts. As a result, any operation triggering pwd.getpwall() (including configuration commits) can stall for several minutes. This change introduces a dedicated helper, get_local_passwd_entries(), which reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are relevant, this provides all required data with no external dependencies. Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers: # set system login tacacs server 192.168.1.50 key test123 # set system login tacacs server 192.168.1.51 key test123 # time commit Before: real 3m29.825s user 0m0.329s sys 0m0.246s After: real 0m1.464s user 0m0.337s sys 0m0.195s This significantly improves commit performance and removes sensitivity to AAA server outages.
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-15 21:16:18 +0000