| Age | Commit message (Collapse) | Author |
|---|
|
T9146: add initial set/call_dependents as exempt from possible cycle
|
|
The introduction of util get_kernel_boot_arg() has many uses, however,
it is not appropriate for use in get_kernel_serial_console: since it
searches right to left, it picks up an incorrect and incomplete entry;
consequently get_kernel_serial_console returns a None tuple, which voids
selection of console type on install.
Restore original implementation of get_kernel_serial_console.
|
|
The category of initial set/call_dependents only apply when the script
is called natively, and not as a dependency. This allows an exemption
from a possible dependency cycle.
|
|
firewall: T9242: Add mac-address-mask support
|
|
http-api: T9223: add VRF option to traceroute REST API endpoint
|
|
|
|
http-api: T9224: add ping endpoint to REST API
|
|
- Add mac-address-mask support to firewall rules
- Add smoketest for mac-address-mask
|
|
kdump: T8868: Implement kernel crash dump support
|
|
- Replaced direct file reads from `/proc/cmdline` with `get_kernel_boot_arg()`
for fetching kernel command-line arguments in multiple modules.
- Improved memory information retrieval by utilizing `get_memory_info()`.
|
|
Add new CLI subtree 'system option kdump' with memory reservation and
local dump path configuration. Also add 'show system kdump' and
'show system kdump dumps' operation mode commands to get
status of the configuration and list of dumps.
Extend 'show tech-support report' and 'generate tech-support archive' with
kdump service status, active config files and the recently kernel dump file.
|
|
detach_member() never disabled promiscuous mode when a member left a
VPP bond or the bond was deleted, unlike add_member() which always
enabled it. Disable it on detach, except for members that still have
their own vif/vif-s sub-interfaces configured, since VPP requires
promiscuous mode to pass their VLAN-tagged traffic.
|
|
interfaces: T9158: add option to enable/disable rx offload
|
|
|
|
Commit 4d621da33 ("firewall: T9210: fix ruff findings in python/vyos/firewall.py")
narrowed fqdn_resolve() exception handling in from a bare except: statement to
except gaierror:, claiming "no behavior change." That let non-gaierror OSErrors
(e.g. transient network errors right after commit) escape uncaught, crashing
the unguarded main loop of the vyos-domain-resolver daemon, the process that
fills in D_* (domain-group) nftables sets.
Change except clause back to OSError, as gaierror is a subclass.
|
|
T9169: update for vyos1x-config refactor
|
|
boot: T3871: rework interface renaming and ordering
|
|
non-tty stdin
|
|
Split out of #5372 (T9157) at sarthurdev's request: that PR bundled
unrelated ruff findings with the fib-type-match feature because it
happened to touch this file.
- fqdn_resolve(): bare except -> except gaierror (E722)
- geoip inverse-match check: != None -> is not None (E711)
- 3x extraneous f prefix on string literals without placeholders
(F541): hook_name, pkttype, last
No behavior change.
|
|
utils: T9177: fix _are_same_ip() using wrong address family
|
|
utils: T9185: fix ask_yes_no() busy-looping forever on non-tty stdin
|
|
jestabro (and dmbaturin previously, on #5362) pointed out that silently
returning `default` on a non-TTY stdin still violates ask_yes_no()'s
interactive-only contract, even though it stops the CPU-spin. Per T9185,
sageframe's original incident confirms why: a caller that forgets an
explicit non-interactive guard gets no error and no visible hang, just
a process quietly pegging a core for days.
Raise EOFError immediately instead, so a missing guard fails loudly and
fast rather than either spinning or silently succeeding. Existing callers
that are meant to run non-interactively already check no_prompt/-y before
calling this (config_mgmt.py, backend.py) and are unaffected.
|
|
|
|
|
|
Add support for receive checksum offload on ethernet interfaces.
|
|
The docstring said the function always prompts via input(), but the
non-TTY fast-path added in this branch returns default without
prompting. Document that.
Flagged by Copilot review on PR #5390.
|
|
The ValueError for a non-existent VRF was always immediately
swallowed by the surrounding bare except, so the raise never
propagated and only obscured the actual behavior (returning an
empty list). Check existence up front and return early instead.
Flagged by Copilot review on PR #5383.
|
|
pki: T9135: derive ACME certificate chains from disk
|
|
dhcp: T9167: align Kea HA timer defaults with Kea ARM
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
qos: T9134: Fix commit crash when classes match different protocols
|
|
firewall: T7552: Output rule in verify_rule() ConfigError messages
|
|
certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.
Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.
|
|
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
|
|
An ACME-issued certificate's intermediate CA was previously imported into the
running configuration as a synthetic object, purely so consumers building a
full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could
find it. This leaked certbot's internal state into the CLI as a real, deletable
object that never needed to exist there: the intermediate is available on disk
the moment the certificate is issued, same as the leaf certificate and its key.
Read it live from disk instead, purely in memory, wherever a full chain is
resolved or displayed - never as a settable or deletable configuration object.
An already-configured CA that completes the chain on its own takes precedence
and nothing synthetic is added.
Adding, changing, or removing a CA now reloads only the services whose resolved
chain is actually affected, with no side effect on certificates whose own
content did not change.
|
|
commit-confirm (and ~40 other call sites) hang and burn a full CPU core
indefinitely when invoked with stdin that isn't a TTY, e.g. a
non-interactive vbash session (vbash -c "... commit-confirm 10; exit").
input() raises EOFError immediately and repeatedly in that case, and the
except handler in ask_yes_no() looped straight back to input() with no
backoff or exit condition.
Check stdin.isatty() up front and return the default immediately when
it's not a TTY, matching what a user pressing Enter (accepting the
default) would already do interactively.
|
|
Flow-control commits failed intermittently on virtio_net and similar
paravirtualized drivers: they support reading pause parameters but not
setting them, and that mismatch varies across kernel/QEMU versions.
The existing denylist for this already covered speed/duplex changes and its
name implied flow-control too, but nothing actually consulted it there - the
check relied solely on a live probe. The paired smoketest branched on that same
raw probe instead of the fixed capability check, so it missed the same drivers.
Assisted-by: Claude:claude-sonnet-5
|
|
Same class of pre-existing whole-file ruff findings as vyos-1x#5374's
477dd4d6b: bare except:, one unused except-clause variable, one
multi-statement if, and one unused loop variable in
python/vyos/utils/network.py.
Also renames a duplicate test_is_ipv6_link_local() in
test_utils_network.py to test_is_loopback_addr() (its actual
subject) - the duplicate name silently shadowed the first test
method, so is_ipv6_link_local() was never actually exercised.
No behavior changes to application code.
|
|
_are_same_ip() computed the address family of both arguments but
only ever passed the first one's family to inet_pton() for both,
via a computed-but-unused "s_two" local. Comparing addresses of
different families (e.g. one IPv4, one IPv6) raised instead of
returning False. Found via ruff flagging s_two as an unused local;
the function currently has no callers.
|
|
qos: T8996: Implement set-dscp packet remarking for shaper policy
|
|
Stock kea_high_availability_json set max-response-delay equal to
heartbeat-delay (both 10000 ms) and max-unacked-clients to 0. The Kea
ARM documents max-response-delay default 60000 ms (must be greater than
heartbeat-delay, typically a multiple) and max-unacked-clients default
10 (0 disables client failure-detection and partner-downs immediately).
Equal 10s/10s timers false-fire communication-interrupted every
heartbeat cycle on healthy pairs.
https://vyos.dev/T9167
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
|
|
|
|
Every class match is installed as its own tc filter, and tc binds a
filter priority ("prio"/"pref") to a single protocol. Two filters with
the same priority but different protocols are rejected by the kernel, so
the commit crashes - e.g. one class matching "ether protocol arp" and
another matching IP. The filter priority came from the class id, the
class "priority" (which the limiter defaults to 20 for every class),
or the per-class match index - none of which is unique across classes.
Assign every match a unique tc filter priority by ranking the matches in
evaluation order (class id, an explicit or default class "priority", or
the per-class match index) and numbering them 1, 2, 3, ... This keeps the
match evaluation order unchanged across all class-based policies (shaper,
shaper-hfsc, limiter, round-robin, priority-queue). The class "priority"
still drives the HTB class scheduling priority on the shaper; the tc
filter priority is an internal evaluation-order rank, not the CLI
"priority" value.
Add smoketests for mixed-protocol classes (shaper and limiter) and for
match evaluation order.
|
|
- Add last-used option to firewall rules
- Updated output of show firewall to include last-used
- Added smoketest for last-used option
|
|
The interface config filter stripped the "mac" node, so a MAC address
configured on a VPP interface never reached the dataplane. Allow "mac"
through the filter; VPP applies it to the hardware interface via lcp-sync.
Some DPDK drivers (e.g. vmxnet3) cannot change the MAC and would fail to
bring the interface up. Reject such a change at verify time - both when
setting the MAC and when adding an interface that already has one to VPP.
|
|
The set-dscp option was defined in XML but never implemented in
Python — no tc commands were generated to rewrite DSCP on egress.
Add tc pedit actions to shaper filter commands. The pedit target
is chosen per-match: IPv4 uses "ip dsfield", IPv6 uses
"ip6 traffic_class". Ether matches with protocol ip or ipv6 also
get the corresponding pedit; other non-IP match types skip pedit
to avoid corrupting packets like ARP. The retain 0xfc mask
preserves ECN bits. For IPv4, a csum ip4h action recalculates
the header checksum after pedit. For the default class, separate
catch-all filters (prio 255/256) are added per protocol.
|
|
vpp: T8367: Fix identical default MAC on bridged loopback interfaces
|
|
firewall: T9076: add per-remote-group update interval
|
