| Age | Commit message (Collapse) | Author |
|---|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
`advertise-all-vni` is globally active
When `advertise-all-vni` is configured in the global/default BGP instance,
VyOS generated a `vni <id>` sub-block under each VRF BGP `address-family
l2vpn evpn` context. This conflicts with advertise-all-vni: FRR already
owns all kernel VNIs and returns `% Failed to create VNI` when frr-reload.py
attempts to apply the VRF-level vni sub-block. FRR then performs an early
exit from config processing, silently dropping the entire l2vpn evpn
address-family for all subsequent VRF BGP instances.
|
|
bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously
|
|
Replace two-word "can not" / "Can not" with "cannot" across comments,
ConfigError messages, CLI help text, and op-mode output.
Standard SNMP MIB files under mibs/ are left unchanged.
|
|
salt: T8973: remove feature
|
|
Commit 35db941bcf30 ("serial: T8375: add CLI option to explicitly set kernel
console") added a migration script to alter the CLI for the kernel boot console.
The migrations script early exist check does not work, as the statement never
evaluates to true, thus the CLI Migration for Kernel console parameter is always
called, even if undesired.
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
simultaneously
FRR only allows one BGP instance to hold `advertise-all-vni` at a time
(FRR issue #9405). When a default BGP instance is present it is always
started before named VRF instances, so if a named VRF holds
the flag FRR silently rejects it on every boot (regardless of default
EVPN config), causing the running config to diverge from what is
stored in VyOS.
Enforce the following policy in verify():
- Default BGP instance may always hold `advertise-all-vni`.
- A named VRF may hold it only when no default BGP instance exists.
- Only one BGP instance (default or named VRF) may hold it at a time.
The default BGP verify path additionally scans dependent VRFs so that
adding or modifying the default BGP instance while a named VRF already
holds the flag is caught even when the VRF node is not part of the
current commit.
|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
During first boot after installing a new VyOS image, migrations are
executed before the filesystem is fully initialized.
At this point `/config` is not yet bind-mounted, causing auth files
(certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet
EAPoL interfaces under `/config/auth` to be inaccessible even though they
exist under the underlying `/opt/vyatta/etc/config/auth` path which is
available at all boot stages.
Add fallback logic to `read_auth_file()` to retry the file lookup under
`/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
firewall: T8281: Normalize network prefixes in rule configuration
|
|
Convert non-canonical IPv4 and IPv6 prefixes in 'source/destination address'
fields to proper network addresses (e.g. 10.10.10.1/30 -> 10.10.10.0/30).
This prevents invalid configurations and ensures consistent prefix handling.
|
|
Replace unsupported characters (e.g. `,`, `+`) with `_` when migrating
from 1.3.x and handle name collisions safely to prevent commit failures.
|
|
Fix typos and mistakes
No functional changes
|
|
T8410: Fix typos and mistakes for operational and configuration commands
|
|
protocol 'all'
Updated the migration script to ensure that when migrating firewall rules,
if a `port-group` exists, the protocol will be set to 'tcp_udp' only
when its previous value is 'all'.
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
|
|
openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead
|
|
This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634:
Remove support for insecure DES and Blowfish ciphers") by not only deleting
insecure DES and Blowfish ciphers, but providing an alternative (3DES).
If no cipher is defined, this will result in OpenVPN service not starting at
all, as the implicit defined BF-CBC cipher is no longer supported by
OpenSSL 3.0.0.
|
|
section
|
|
|
|
|
|
|
|
Disabled "point-to-multipoint" mode for GRE interfaces, along with related "mode" node.
This mode relies on the 'teib' feature, which is not implemented yet.
|
|
|
|
|
|
|
|
|
|
(target version 6)
|
|
|
|
|
|
Remove `dpdk-options` under `set vpp settings interface <ethN>`
and move its child options to the interface level:
- `num-rx-desc`
- `num-rx-queues`
- `num-tx-desc`
- `num-tx-queues`
Also remove `set vpp settings interface <ethN> dpdk-options promisc`.
|
|
commands
Add `set vpp settings interfaces-rx-mode <polling|interrupt|adaptive>`
to configure RX mode for all interfaces. Raise error if any interface
does not support the selected mode.
Also remove per-interface rx-mode commands:
- `set vpp settings interface <name> rx-mode`
- `set vpp kernel-interfaces <name> rx-mode`
|
|
'resource-allocation'
Replace legacy VPP CPU settings (main-core, skip-cores, workers, corelist-workers) with a single resource-allocation cpu-cores option.
CPU assignment is now handled automatically: two cores are reserved for the system, the VPP main thread is placed on the first available core, and the remaining allocated cores are used as workers.
This simplifies configuration and ensures consistent CPU allocation.
|
|
Instead of `vpp settings unix poll-sleep-usec`
use `vpp settings poll-sleep-usec`.
|
|
|
|
|
|
This commit changes logging settings naming:
- before: `set vpp settings logging default-log-level <alert>`
- after: `set vpp settings logging default-level <alert>`
|
|
|
|
vpp: T8250: Rewrite the CLI for ACL tcp-flags
|
|
|
|
Handle absent `service dns dynamic address <iface> service` nodes
during 1-to-2 migration to prevent ConfigTreeError.
|
|
- Migration script removes 'driver' and 'xdp-options' nodes.
- XDP logic is commented out in config verification and CLI tests, preserving code for future use.
- The rest of XDP-related code remains untouched
|
|
pppoe-server: T8143: Set 'vpp-cp' option automatically if interface is in VPP
|
|
T7664: support FRR 10.5
|
|
|
|
In FRR 10.5 ip protocols
* connected
* kernel
* local
* table
* table-direct
are removed. First three in fb8e399e4f66d09780f176fbecb99168089e64eb,
table* in 7fd030504be060387694e8a2af7f19ddd7dee39d.
In `ip protocols`, `ipv6 protocols` and `vrf` VyOS supports
* connected
* kernel
* table
Remove these from CLI, add migration scripts, update tests.
|
|
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
(used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
|
