| Age | Commit message (Collapse) | Author |
|---|
|
Replace the free-form 'commit-archive location <url>' leafNode with a
structured, per-destination tagNode:
`set system config-management commit-archive location <name> <protocol> \
authentication { username | password } | server | port | path`
Each location selects exactly one transport protocol (scp, sftp, ssh, ftp,
ftps, http, https, git, tftp). 'git' additionally accepts a 'transport'
(https/http/ssh, default https). 'source-address' and 'vrf' stay under
'commit-archive' and apply to every location, as before.
|
|
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
|
|
Raw options are appended after --config and therefore override what the CLI
rendered, so they have to face the same checks. A single cipher the Kernel
module does not implement makes OpenVPN fall back to the userspace data path;
"ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and
pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an
AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop
the offload just the same.
"DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers
alone before it weighs the offload, and the migration drops the offload from
whatever stays rejected.
|
|
The CLI renders "keepalive <interval> <interval * failure-count>" while its
two ranges are independent, so it can produce parameters the daemon refuses
to start on: a timeout below twice the interval, or one beyond the 12 hours
OpenVPN is about to cap ping and keepalive at.
A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks
and simply runs without keepalive, so leave that combination alone.
Migrate what stays rejected, or an upgrade would leave a configuration the
router can no longer commit at boot.
|
|
"offload dco" was accepted next to tap, static keys, compression, CBC
ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the
module altogether. Those combinations now fail verify(), which would break
config load on upgrade, so drop the request instead.
The migration has to mirror verify_dco() exactly: anything it keeps that
verify() turns away leaves a router unable to commit its own configuration.
|
|
Commit bc0b4178b already covers a missing GRUB configuration, where
vars_read() returns an empty dict.
A non-empty dict without console_type still raises KeyError: vars_read()
drops variables written with an empty value, which
grub.set_serial_console() produces for a flavor carrying no console data.
|
|
The configuration tests hardcoded "system console device ttyS0 speed 115200",
which only holds for amd64, whereas arm64 images expose the UART as ttyAMA0, so
loading these configs produced a diff against the assert data and the tests
failed.
Replace the hardcoded values in all config test inputs and their assert
counterparts with the @SERIAL_DEVICE@ and @SERIAL_SPEED@ placeholders. The
vyos-1x-smoketest postinst queries the image flavor and implants the real
values once at install time, so the test runner needs no runtime patching.
Migration script 31-to-32 now derives the serial device from the flavor, too,
instead of assuming ttyS0.
This can be observed during vyos-1x package installation while building the
ISO image
Setting up vyos-1x-smoketest (999.0-14834-g16f1cf457-dirty) ...
...
I: Implanted serial console ttyS0,115200 into /usr/libexec/vyos/tests/configs
|
|
ddclient: T6981: Upgrade ddclient to v4.0.0
|
|
IID secret enforcement across PPPoE, L2TP, PPTP, and SSTP (BP 2188)
(cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed)
|
|
Since woima (woima.fi) has been shut down, we need
to remove any configuration path that refers to woima.
Apply migration to remove woima from dynamic DNS
service configurations.
|
|
Since googledomains (domains.google.com) has been
shut down, we need to remove any configuration path
that refers to googledomains.
1. Remove 'googledomains' as the default web resolver
in ddclient.conf.j2
2. Apply migration to remove googledomains from
dynamic DNS service configurations. The migration
is also necessary to undo a previous migration
where we added 'googledomains' as default web
resolver to work around lack of tls (ssl) support
with default web resolver 'dyndns' (checkip.dyndns.org)
in ddclient v3.x.
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
`advertise-all-vni` is globally active
When `advertise-all-vni` is configured in the global/default BGP instance,
VyOS generated a `vni <id>` sub-block under each VRF BGP `address-family
l2vpn evpn` context. This conflicts with advertise-all-vni: FRR already
owns all kernel VNIs and returns `% Failed to create VNI` when frr-reload.py
attempts to apply the VRF-level vni sub-block. FRR then performs an early
exit from config processing, silently dropping the entire l2vpn evpn
address-family for all subsequent VRF BGP instances.
|
|
bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously
|
|
Replace two-word "can not" / "Can not" with "cannot" across comments,
ConfigError messages, CLI help text, and op-mode output.
Standard SNMP MIB files under mibs/ are left unchanged.
|
|
salt: T8973: remove feature
|
|
Commit 35db941bcf30 ("serial: T8375: add CLI option to explicitly set kernel
console") added a migration script to alter the CLI for the kernel boot console.
The migrations script early exist check does not work, as the statement never
evaluates to true, thus the CLI Migration for Kernel console parameter is always
called, even if undesired.
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
simultaneously
FRR only allows one BGP instance to hold `advertise-all-vni` at a time
(FRR issue #9405). When a default BGP instance is present it is always
started before named VRF instances, so if a named VRF holds
the flag FRR silently rejects it on every boot (regardless of default
EVPN config), causing the running config to diverge from what is
stored in VyOS.
Enforce the following policy in verify():
- Default BGP instance may always hold `advertise-all-vni`.
- A named VRF may hold it only when no default BGP instance exists.
- Only one BGP instance (default or named VRF) may hold it at a time.
The default BGP verify path additionally scans dependent VRFs so that
adding or modifying the default BGP instance while a named VRF already
holds the flag is caught even when the VRF node is not part of the
current commit.
|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
During first boot after installing a new VyOS image, migrations are
executed before the filesystem is fully initialized.
At this point `/config` is not yet bind-mounted, causing auth files
(certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet
EAPoL interfaces under `/config/auth` to be inaccessible even though they
exist under the underlying `/opt/vyatta/etc/config/auth` path which is
available at all boot stages.
Add fallback logic to `read_auth_file()` to retry the file lookup under
`/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
firewall: T8281: Normalize network prefixes in rule configuration
|
|
Convert non-canonical IPv4 and IPv6 prefixes in 'source/destination address'
fields to proper network addresses (e.g. 10.10.10.1/30 -> 10.10.10.0/30).
This prevents invalid configurations and ensures consistent prefix handling.
|
|
Replace unsupported characters (e.g. `,`, `+`) with `_` when migrating
from 1.3.x and handle name collisions safely to prevent commit failures.
|
|
Fix typos and mistakes
No functional changes
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
protocol 'all'
Updated the migration script to ensure that when migrating firewall rules,
if a `port-group` exists, the protocol will be set to 'tcp_udp' only
when its previous value is 'all'.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
|
|
openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead
|
|
This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634:
Remove support for insecure DES and Blowfish ciphers") by not only deleting
insecure DES and Blowfish ciphers, but providing an alternative (3DES).
If no cipher is defined, this will result in OpenVPN service not starting at
all, as the implicit defined BF-CBC cipher is no longer supported by
OpenSSL 3.0.0.
|
|
section
|
|
|
|
|
|
|
|
Disabled "point-to-multipoint" mode for GRE interfaces, along with related "mode" node.
This mode relies on the 'teib' feature, which is not implemented yet.
|
|
|
|
|
|
|
|
|
|
(target version 6)
|
|
|
|
|
|
Remove `dpdk-options` under `set vpp settings interface <ethN>`
and move its child options to the interface level:
- `num-rx-desc`
- `num-rx-queues`
- `num-tx-desc`
- `num-tx-queues`
Also remove `set vpp settings interface <ethN> dpdk-options promisc`.
|
|
commands
Add `set vpp settings interfaces-rx-mode <polling|interrupt|adaptive>`
to configure RX mode for all interfaces. Raise error if any interface
does not support the selected mode.
Also remove per-interface rx-mode commands:
- `set vpp settings interface <name> rx-mode`
- `set vpp kernel-interfaces <name> rx-mode`
|
|
'resource-allocation'
Replace legacy VPP CPU settings (main-core, skip-cores, workers, corelist-workers) with a single resource-allocation cpu-cores option.
CPU assignment is now handled automatically: two cores are reserved for the system, the VPP main thread is placed on the first available core, and the remaining allocated cores are used as workers.
This simplifies configuration and ensures consistent CPU allocation.
|
|
Instead of `vpp settings unix poll-sleep-usec`
use `vpp settings poll-sleep-usec`.
|
|
|
