| Age | Commit message (Collapse) | Author |
|---|
|
geoip: T8590: fix initialization failure and set clobbering on boot and commit
|
|
ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers
|
|
openvpn: T6478: Skip restart service when only client config changed
|
|
Policy: T8823: validation of GE and LE according FRR instructions
|
|
wwan: T8412: Fix commit failure when modem is absent or not connected
|
|
OpenVPN server reads per-client files from `--client-config-dir` at connect
time. When only `interfaces openvpn vtunN server client <client>`
entries are modified there is no need to send SIGHUP or restart
the service - the new CCD files written by `generate()` will
be picked up automatically on the next client connection.
|
|
T8883: Fix restart PPPoE-server service when RADIUS settings change
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
`mmcli --simple-disconnect` can be called when the modem bearer is not active.
This causes cmd() to raise a `PermissionError` and abort the commit.
Handle the case gracefully so the configuration can be committed before the modem
is physically present or fully connected.
|
|
dhcpv6: T8862: Allow multiple addresses and prefixes for reservations
|
|
|
|
wireguard: T8509: Add fwmark ip rules for VRF-bound interfaces
|
|
Restart the PPPoE server when RADIUS configuration is modified.
Previously, changes to settings such as `priority` and `backup`
were not applied until the service was restarted manually.
|
|
Generation of the firmware configuration file can be made contitional only if
the card is present/driver is loaded. The firmware configuration file itself
must not be explicitly set to be owned as root as the default is user root and
group vyattacfg.
|
|
|
|
(#5186)
The port availability check in `verify()` was using `front_config.get('address')`
which always resolved to `None`, causing the validator to treat any process
holding a given port number as a conflict regardless of which IP it was
bound to.
|
|
Add a check to determine whether the NIC supports hardware
timestamp receive filters required for NTP timestamping.
Implement the query in a new python/vyos/netlink/timestamp.py module
using pyroute2 generic netlink ETHTOOL_MSG_TSINFO_GET,
avoiding ethtool output parsing.
|
|
firewall (#5206)
sysctl values written by firewall global-options are overwritten when using
"system option performance" configuration on VyOS CLI. This is caused by a
missing dependency fall from system_option.py to the firewall CLI helper script.
|
|
IKEv2 reauthentication was configurable via CLI but never translated
into `swanctl.conf`. Add `reauth_time` to the peer connection template,
driven by the `ikev2-reauth` flag on the ike-group and the per-peer
override (yes/no/inherit).
|
|
Three related bugs prevented GeoIP nftables sets from being populated
correctly at boot and when incrementally modifying firewall or policy
route rules.
1. geoip_updated() always returned False
The previous implementation called node_changed() and then searched
the result with dict_search_recursive(changes, 'geoip'). This could
never match: node_changed() is annotated `-> list` and returns a flat
list of the immediate top-level child names whose subtree changed
(e.g. ['ipv4'] for the firewall path, or route names for policy
route). The 'geoip' key sits several levels deeper than those names,
so dict_search_recursive — which only walks dicts and lists for a
matching dict key — never yielded a hit, and geoip_updated() always
returned False. As a consequence, geoip_update() was never triggered
by an incremental add or change of a GeoIP rule; the only path that
ever populated /run/nftables-geoip.conf was the explicit \"update
geoip\" command or the fallback when geoip_refresh() failed.
Fix: bypass node_changed() and call get_config_diff() /
get_child_nodes_diff() directly with expand_nodes=Diff.ADD|Diff.DELETE
and recursive=True. In that mode, the 'add' and 'delete' values in
the returned dict are full nested subtrees of the config diff, so
dict_search_recursive correctly finds 'geoip' wherever it appears in
the change set.
2. GeoIP block executed unconditionally, breaking the boot sequence
geoip_sets() always returns {'name': [], 'ipv6_name': []}. A
non-empty dict is truthy in Python regardless of whether its values
are empty lists, so the guards \"if geoip_sets:\" and
\"if 'name' in geoip_sets:\" were always True.
On boot, when policy_route.py is invoked as a dependent of
firewall.py (triggered by group_resync), it entered the GeoIP block
even with no policy route GeoIP rules configured. Because
/run/nftables-geoip.conf did not yet exist, geoip_refresh() returned
False and geoip_update(policy=policy) was called with an empty
policy. This created /run/nftables-geoip.conf containing only empty
table stubs. When firewall.py subsequently called geoip_refresh(),
the file existed and nft loaded it successfully — so the
geoip_update(firewall) call was never reached and the firewall GeoIP
sets stayed empty for the entire uptime of the router.
Fix: check the actual list contents instead of the container dict:
if geoip_sets['name'] or geoip_sets['ipv6_name'].
3. geoip_update() clobbered the other caller's sets
geoip_update() renders /run/nftables-geoip.conf from both
firewall_sets and policy_sets in a single pass. When called with
only one argument (as firewall.py and policy_route.py each do), the
other argument defaulted to None and that half of the file was
rendered empty, erasing whatever the other script had written. The
geoip-update helper used by \"update geoip\" and the weekly cron was
unaffected because it always passes both arguments, which masked
this bug in normal manual operation.
Fix: when either argument is absent, read the missing config from
the live Config session before building the set tables, so every
invocation writes the complete combined firewall + policy file.
|
|
|
|
Add support for allowing DHCPv6 to assign reservations for multiple
addresses and prefixes to a single client simultaneously.
|
|
|
|
|
|
|
|
|
|
scripts
Bare except: catches everything derived from BaseException, including
SystemExit and KeyboardInterrupt. Config scripts must not silently
continue past sys.exit(), so replace bare except: with except Exception:
in the three config-mode scripts that contained one.
Library code (python/vyos/configverify.py, python/vyos/config.py) and
op-mode scripts are intentionally out of scope: those cases require
case-by-case design review (e.g. MTU lookups should accept defaults as
arguments rather than rely on exception handling; reset-style op-mode
scripts may legitimately want to ignore KeyboardInterrupt).
Sites changed:
- src/conf_mode/interfaces_ethernet.py (MTU adapter lookup)
- src/conf_mode/vpp_interfaces_bonding.py (MAC validation)
- src/conf_mode/container.py x2 (IPv4 / IPv6 prefix lookup)
|
|
|
|
(#5193)
Recently (commit 35db941bcf "serial: T8375: add CLI option to explicitly set
kernel console") we added the CLI knob to enable the Kernel and GRUB serial
console on a given device.
Currently this is supported for serial console interfaces starting with ttyS
and ttyAMA only. Main limitation is that these interfaces are wired to the CPU
and bootloader infos can be displayed.
|
|
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
|
|
When a WireGuard interface has both fwmark and VRF configured, outgoing
tunnel packets marked with the fwmark were not routed into the correct
VRF routing table, causing them to hit the l3mdev unreachable rule instead.
Add an ip rule at priority 1998 (after l3mdev at 1000 and before l3mdev
unreachable at 2000) to route fwmark-tagged packets into the correct
VRF routing table.
|
|
|
|
T8147: Update Linux Kernel to 6.18
|
|
|
|
option
|
|
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As
this was not available in the previous used LTS 6.6 Kernel it now is available
while we upgrade to Linux 6.18.
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP: T8495: fix issue with assigning acl on sub interfaces
|
|
T8534: refactor sysctl_(read|write) to accept key parts
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
firewall: T8446: Prevent chain with offload rule on local zone
|
|
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which
conflicts with sysctl's dot-separated key syntax.
Change sysctl_read() and sysctl_write() to take key components as a list and
normalize each component by replacing . with / before invoking sysctl. This
fixes sysctl lookups/updates for VLAN subinterfaces.
Extend the SR-TE smoketest to cover a VLAN subinterface.
Previous error raising this issue:
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
|
|
|
|
|
|
serial: T8375: call update_serial_console() only once for default tty
|
|
|
|
When there are multiple serial consoles defined; but either none or the
last used the 'kernel' CLI option to disply Kernel messages, the GRUB
code was called multiple times.
By moving the call to the GRUB helpers outside the for loop we gain a single
execution of the code path, not that it matters performance wise - but messing
with the bootloader should be reduced to a minimum.
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
