| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Add support for receive checksum offload on ethernet interfaces.
|
|
The docstring said the function always prompts via input(), but the
non-TTY fast-path added in this branch returns default without
prompting. Document that.
Flagged by Copilot review on PR #5390.
|
|
The ValueError for a non-existent VRF was always immediately
swallowed by the surrounding bare except, so the raise never
propagated and only obscured the actual behavior (returning an
empty list). Check existence up front and return early instead.
Flagged by Copilot review on PR #5383.
|
|
pki: T9135: derive ACME certificate chains from disk
|
|
dhcp: T9167: align Kea HA timer defaults with Kea ARM
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
qos: T9134: Fix commit crash when classes match different protocols
|
|
firewall: T7552: Output rule in verify_rule() ConfigError messages
|
|
certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.
Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.
|
|
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
|
|
An ACME-issued certificate's intermediate CA was previously imported into the
running configuration as a synthetic object, purely so consumers building a
full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could
find it. This leaked certbot's internal state into the CLI as a real, deletable
object that never needed to exist there: the intermediate is available on disk
the moment the certificate is issued, same as the leaf certificate and its key.
Read it live from disk instead, purely in memory, wherever a full chain is
resolved or displayed - never as a settable or deletable configuration object.
An already-configured CA that completes the chain on its own takes precedence
and nothing synthetic is added.
Adding, changing, or removing a CA now reloads only the services whose resolved
chain is actually affected, with no side effect on certificates whose own
content did not change.
|
|
commit-confirm (and ~40 other call sites) hang and burn a full CPU core
indefinitely when invoked with stdin that isn't a TTY, e.g. a
non-interactive vbash session (vbash -c "... commit-confirm 10; exit").
input() raises EOFError immediately and repeatedly in that case, and the
except handler in ask_yes_no() looped straight back to input() with no
backoff or exit condition.
Check stdin.isatty() up front and return the default immediately when
it's not a TTY, matching what a user pressing Enter (accepting the
default) would already do interactively.
|
|
Flow-control commits failed intermittently on virtio_net and similar
paravirtualized drivers: they support reading pause parameters but not
setting them, and that mismatch varies across kernel/QEMU versions.
The existing denylist for this already covered speed/duplex changes and its
name implied flow-control too, but nothing actually consulted it there - the
check relied solely on a live probe. The paired smoketest branched on that same
raw probe instead of the fixed capability check, so it missed the same drivers.
Assisted-by: Claude:claude-sonnet-5
|
|
Same class of pre-existing whole-file ruff findings as vyos-1x#5374's
477dd4d6b: bare except:, one unused except-clause variable, one
multi-statement if, and one unused loop variable in
python/vyos/utils/network.py.
Also renames a duplicate test_is_ipv6_link_local() in
test_utils_network.py to test_is_loopback_addr() (its actual
subject) - the duplicate name silently shadowed the first test
method, so is_ipv6_link_local() was never actually exercised.
No behavior changes to application code.
|
|
_are_same_ip() computed the address family of both arguments but
only ever passed the first one's family to inet_pton() for both,
via a computed-but-unused "s_two" local. Comparing addresses of
different families (e.g. one IPv4, one IPv6) raised instead of
returning False. Found via ruff flagging s_two as an unused local;
the function currently has no callers.
|
|
qos: T8996: Implement set-dscp packet remarking for shaper policy
|
|
Stock kea_high_availability_json set max-response-delay equal to
heartbeat-delay (both 10000 ms) and max-unacked-clients to 0. The Kea
ARM documents max-response-delay default 60000 ms (must be greater than
heartbeat-delay, typically a multiple) and max-unacked-clients default
10 (0 disables client failure-detection and partner-downs immediately).
Equal 10s/10s timers false-fire communication-interrupted every
heartbeat cycle on healthy pairs.
https://vyos.dev/T9167
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
|
|
|
|
Every class match is installed as its own tc filter, and tc binds a
filter priority ("prio"/"pref") to a single protocol. Two filters with
the same priority but different protocols are rejected by the kernel, so
the commit crashes - e.g. one class matching "ether protocol arp" and
another matching IP. The filter priority came from the class id, the
class "priority" (which the limiter defaults to 20 for every class),
or the per-class match index - none of which is unique across classes.
Assign every match a unique tc filter priority by ranking the matches in
evaluation order (class id, an explicit or default class "priority", or
the per-class match index) and numbering them 1, 2, 3, ... This keeps the
match evaluation order unchanged across all class-based policies (shaper,
shaper-hfsc, limiter, round-robin, priority-queue). The class "priority"
still drives the HTB class scheduling priority on the shaper; the tc
filter priority is an internal evaluation-order rank, not the CLI
"priority" value.
Add smoketests for mixed-protocol classes (shaper and limiter) and for
match evaluation order.
|
|
- Add last-used option to firewall rules
- Updated output of show firewall to include last-used
- Added smoketest for last-used option
|
|
The interface config filter stripped the "mac" node, so a MAC address
configured on a VPP interface never reached the dataplane. Allow "mac"
through the filter; VPP applies it to the hardware interface via lcp-sync.
Some DPDK drivers (e.g. vmxnet3) cannot change the MAC and would fail to
bring the interface up. Reject such a change at verify time - both when
setting the MAC and when adding an interface that already has one to VPP.
|
|
The set-dscp option was defined in XML but never implemented in
Python — no tc commands were generated to rewrite DSCP on egress.
Add tc pedit actions to shaper filter commands. The pedit target
is chosen per-match: IPv4 uses "ip dsfield", IPv6 uses
"ip6 traffic_class". Ether matches with protocol ip or ipv6 also
get the corresponding pedit; other non-IP match types skip pedit
to avoid corrupting packets like ARP. The retain 0xfc mask
preserves ECN bits. For IPv4, a csum ip4h action recalculates
the header checksum after pedit. For the default class, separate
catch-all filters (prio 255/256) are added per protocol.
|
|
vpp: T8367: Fix identical default MAC on bridged loopback interfaces
|
|
firewall: T9076: add per-remote-group update interval
|
|
The vyos-configd list of config mode files available for loading is
generated at build time, however, this can be a superset of files
present on the running system; confirm existence before load.
An example of the above discrepancy is apparent in case supplementary
*.deb packages are not required. Recent refactoring of vyos-configd
dropped a legacy construction independent of the build-time list,
introducing the regression.
|
|
VPP assigns loopback interfaces a default MAC address derived only from
the interface instance number (de:ad:00:00:00:<instance>), with no
host-specific entropy. Two independent VPP nodes configuring the same
loopback instance (e.g. as a bridge BVI over VXLAN) therefore end up with
an identical MAC address.
When that MAC arrives from a peer over the shared L2 segment, VPP's L2
learning logic rejects it as a `mac move violation` - it's statically
pinned to the local BVI and cannot legitimately appear on another port.
This silently drops ARP traffic between the loopbacks while ordinary
bridged client traffic (unique MACs) is unaffected, breaking
loopback-to-loopback connectivity.
Add a mac-address option to the VPP loopback interface, and fall back to
a deterministic, host-unique MAC (derived from host UUID/hostname, same
scheme already used for container interfaces) whenever none is
configured, so the collision can no longer occur by default.
Also fix a related bug found while reproducing the above: a loopback is
fully deleted and recreated in VPP on every apply, receiving a new
`sw_if_index` each time. The loopback conf_mode script never registered
the bridge it's a BVI member of as a dependent, so the bridge kept its
L2 membership bound to the stale, deleted index instead of reattaching
the current one. Register the bridge dependency and reuse the existing
`verify_vpp_remove_bridge_interface()` check to block deleting a
loopback still in use as a BVI.
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
T9068: Add config manager module and refactor vyos-configd
|
|
Add 'set firewall group remote-group <name> interval <value>' to
control how often each remote group list is re-downloaded,
independent of the global resolver-interval that also drives
domain-group/FQDN resolution.
The value accepts plain seconds or time-unit suffixes s/m/h/d/w
(e.g. 4h), range 60 seconds to 4 weeks, enforced at commit time
after conversion. When unset, the group keeps following
'firewall global-options resolver-interval', so existing
configurations are unaffected.
vyos-domain-resolver now tracks a last-update timestamp per
remote group and sleeps until the next due update instead of a
fixed resolver-interval tick, honoring per-group intervals both
shorter and longer than the global one. A group is only stamped
as updated after a successful download; failed downloads fall
back to the cached list and are retried at the resolver cadence
rather than after the full group interval.
human_to_seconds() now treats a plain number as seconds instead
of returning 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
vpp: T9018: Auto-enable promiscuous mode for interfaces with VLANs
|
|
|
|
remote: T8829: fall back to GET when HEAD is not supported
|
|
VPP drops VLAN-tagged frames unless the parent interface has promiscuous
mode enabled, causing VLAN sub-interfaces to lose connectivity.
Automatically enable promiscuous mode on VPP interfaces that have VLAN
sub-interfaces (vif/vif-s) configured.
|
|
deleted
Deleting "protocols static" set config_dict['static'] to a dict object shared
by reference across every deleted protocol. Merging the PPPoE/DHCP default-route
data into it left the "deleted" marker in place, so the entire staticd section -
including the just-merged default route - was skipped during FRR rendering,
dropping the default route from the RIB/FIB.
Copy the shared deleted-protocol marker before mutating it, and clear the marker
once DHCP/PPPoE content has been merged in so the section is still rendered.
|
|
This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.
Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
**kwargs)
"show system commit diff <rev>" produces no output (exit 0) for any revision,
regardless of how much the revisions differ. The revision store and diff engine
are intact - "show system commit file <rev>" works, and so does
ConfigMgmt().compare(rev1=0, rev2=1) which returns the correct diff when called
directly.
Commit a29d73d00 ("op-mode: T8362: "compare" command lacks catch_broken_pipe
decorator") added @catch_broken_pipe to ConfigMgmt.show_commit_diff to suppress
BrokenPipeError tracebacks when piping output, but the decorator calls the
wrapped function without returning its value. Thus the op-mode framework will
receive None and prints nothing.
|
|
ifconfig: T9008: refactor vyos.ifconfig to use cmdl() for safer subprocess execution
|
|
ci: T8490: fix typos in comments, strings, and local identifiers
|
|
utils: T9003: add list-argument variant of cmd() for safer subprocess execution
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
geoip: T8987: Support updates via source-address/vrf
|
|
T8097: strongswan: add CLI for ESN
|
|
|
|
T9015: fix thread safety of configtree read/write_cache
|
|
T8993: initialize ReferenceTree module from string not file
|
|
geoip: T5746: Add GeoIP ASN support
|
|
For thread-safe calls, move file operations to the Python side, leaving
only string operations for calls to ctypes bindings.
|
