| Age | Commit message (Collapse) | Author |
|---|
|
The list calculation of in-use but deprecated SSH hostkey algorithms was wrong.
This was implemented in commit 6deda171e ("ssh: T7839: add deprecation warning
for DSA hostkey-algorithm usage"). It always returned the content of the list
of deprecated algorithms, but not the list of deprecated algorithms actually -
in use - by the configuration. This has been corrected.
Before:
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following hostkey-algorithms are in
use: ssh-dss, ssh-dss-cert-v01@openssh.com
After:
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following hostkey-algorithms are in
use: ssh-dss
The generation of the MOTD was not affected!
|
|
kea: T7821: Update Kea to 3.0
|
|
container: T7681: fix multiple name servers
|
|
T7787: add deprecation warning for ssh-dss keys
|
|
T7796: PPPoE-server add mapping in vpp if vpp-cp is enabled
|
|
wlb: T114: Add firewall group support for WAN load balancer
|
|
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will
prevent users with such keys from logging in after upgrade. To avoid lockouts,
add a loud deprecation warning when users log in using a DSA key. This warning
advises affected users to replace their keys with a supported algorithm (e.g.,
ed25519 or RSA) before the upgrade.
Deprecation warning will be displayed during "commit" but also as MOTD to inform
on this issue during every login.
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following hostkey-algorithms are in
use: ssh-dss, ssh-dss-cert-v01@openssh.com
|
|
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will
prevent users with such keys from logging in after upgrade. To avoid lockouts,
add a loud deprecation warning when users log in using a DSA key. This warning
advises affected users to replace their keys with a supported algorithm (e.g.,
ed25519 or RSA) before the upgrade.
Deprecation warning will be displayed during "commit" but also as MOTD to inform
on this issue during every login.
DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will
be removed in VyOS 1.6. Please update affected keys to a supported
algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication
failures after the upgrade. The following users are using SSH-DSS keys
for authentication.
User "vyos" with deprecated public-key named: foo
|
|
|
|
- Fixed error with multiple name servers missing space between --dns options
|
|
|
|
T7783: T7786: VPP clarify error messages for CPU requirements
|
|
|
|
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW
is iptales plugin
* Remove specific and non-relevant pmacct options
* Add ipt_NETFLOW options
* Move 'interfaces' to 'netflow' tree
* Support more flexible 'source-address' and 'source-interface' for
each server instead of one source
* Add migration script
* Update op mode command 'show flow-accounting'
* Update op mode command 'restart flow-accounting'
|
|
container: T7186: Add macvlan network type for containers
|
|
|
|
|
|
T7757: VPP Verify buffers for rx/tx queues
|
|
VyOS 1.5 and onwards will no longer have the following CLI node available:
set vrf name <name> protocols bgp system-as <asn>
|
|
Originating from the bug in T7665. To avoid potential issues down the line - and
given that there's no compelling technical reason to retain the system-as CLI
node under per-VRF BGP configuration, which cannot be achieved through
alternative means - the maintainers have collectively decided to deprecate the
following command:
set vrf name <name> protocols bgp system-as <asn>
Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While
it will still be accepted, it will no longer have any operational effect. A
deprecation warning will be displayed at commit time, indicating that the BGP
ASN from the global BGP configuration is now used instead.
A migration script will handle the transition and perform the following actions:
* Ensure a global BGP configuration exists; if not, initialize one.
* Iterate over all configured VRFs to determine whether a BGP instance exists
* For any insance, update the configuration to use the global system-as
and apply the local-as ASN no-prepend replace-as option on all affected
neighbors to preserve existing behavior.
* If a neighbor is already configured with a local-as directive, that neighbor
will be excluded from the migration process, as it already follows a custom
configuration.
* Add allowas-in per neighbor option. Required to not deny prefix received
updates due to as-path contains our own global ASN.
|
|
isis: T7722: Added interface fast-reroute configuration commands
|
|
|
|
- Added command to disable conntrack per firewall chain
- Added test_disable_conntrack_per_chain function to smoketest
|
|
|
|
Added checks in the verify_rule() function of firewall.py for empty nodes.
Added migration script 19-to-20 to remove empty nodes from the config.
|
|
- Moved gen_mac function outside of 'for network' loop
- Cached result of get_host_identity() to prevent multiple calls
- Other minor improvements per Copilot suggestions
|
|
Modified:
- interface-definitions/container.xml.in:
- Add macvlan network type
- Add gateway option
- python/vyos/utils/network.py:
- Add gen_mac function to generate mac address
- smoketest/scripts/cli/test_container.py:
- Add test for container network types
- src/conf_mode/container.py:
- Add support for macvlan network type
- Add gateway option
|
|
op-mode: T7745: add a CLI for operator user command permissions
|
|
bgp: T7708: correct logic for route-reflector-client peer_as check
|
|
Added interface fast-reroute configuration commands
|
|
T7670: VPP: Rely on all types of memory to verify memory resources
|
|
|
|
T7732: VPP add modprobe vfio modules
|
|
VPP can use 2M hugepages and 1G hugepages at the same time
|
|
Add vfio modules before VPP starting and remove modules after
the VPP configuration deleted
modules:
- vfio
- vfio_iommu_type1
- vfio_pci
|
|
T7678: Move "vpp settings host-resources" to "system option resource-limits"
|
|
|
|
kea: T6211: add VRF support for KEA dhcp server
|
|
|
|
|
|
|
|
current configuration
|
|
It will be configured in section "system option host-resources"
|
|
|
|
T7697: Merge vyos-vpp repo into vyos-1x
|
|
Ignore import vpp_api to skip pylint check.
The `python3-vpp-api` depends on `vpp` and we should not use VPP
in the container.
Use this workaround to skip pylint check.
|
|
The pylint does not like the IProute import (though it works fine)
************* Module vpp
src/conf_mode/vpp.py:21:0: E0611: No name 'IPRoute' in module 'pyroute2' (no-name-in-module)
Do this change only for pylint
|
|
|
|
|
|
Added check for None value from leaf_node_changed when changing VLAN-to-VNI description.
|
