| Age | Commit message (Collapse) | Author |
|---|
|
pki: T9135: derive ACME certificate chains from disk
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
"show pki ca/certificate <name>" only ever offered PEM output, which isn't
practical for a human to actually read. Add a "text" form that runs the
certificate through OpenSSL's own "-text" formatter, the same human-readable
breakdown "openssl x509 -text" produces.
|
|
The local-file branch of CA certificate import recognized a file:// URL
by scheme but never actually decoded it - os.path.exists()/open() still
received the full "file://..." string rather than the path component, so
an explicit file:// URL always failed with "File not found" even when it
pointed at a real, readable file.
|
|
certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.
Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.
|
|
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
|
|
An ACME-issued certificate's intermediate CA was previously imported into the
running configuration as a synthetic object, purely so consumers building a
full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could
find it. This leaked certbot's internal state into the CLI as a real, deletable
object that never needed to exist there: the intermediate is available on disk
the moment the certificate is issued, same as the leaf certificate and its key.
Read it live from disk instead, purely in memory, wherever a full chain is
resolved or displayed - never as a settable or deletable configuration object.
An already-configured CA that completes the chain on its own takes precedence
and nothing synthetic is added.
Adding, changing, or removing a CA now reloads only the services whose resolved
chain is actually affected, with no side effect on certificates whose own
content did not change.
|
|
The path argument to the CA import command now also accepts a remote URL
(http, https, ftp, sftp, scp, tftp, ...), detected by scheme, in addition to
a local file path. Makes it convenient to pull a well-known public intermediate
directly by URL instead of downloading and pasting PEM content by hand.
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
- Add last-used option to firewall rules
- Updated output of show firewall to include last-used
- Added smoketest for last-used option
|
|
This fixes just the case for the Bash project added via commit b12a8c5ae
("image: T9021: Save bash history during image upgrade")
|
|
Previously, bash history was silently lost on every image upgrade,
forcing operators to start with an empty history each time.
Extend the image upgrade script to detect and migrate bash history
files from the currently running image to the newly installed one.
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
Re-apply QoS after dynamic interfaces get addresses after connect/disconnect.
When PPPoE interfaces re-connect we need to re-do QoS settings.
|
|
dhcp: T8941: Support filter and sorting combination on DHCPv4/v6 server lease entries in op mode
|
|
|
|
|
|
|
|
Replace two-word "can not" / "Can not" with "cannot" across comments,
ConfigError messages, CLI help text, and op-mode output.
Standard SNMP MIB files under mibs/ are left unchanged.
|
|
pki: T8165: Add ability to show certificate full chain in pem format
|
|
|
|
This is no real need to have these in config_mgmt; moving to config_sync
will localize needed modifications to local/remote configs for exclusion
mask.
|
|
|
|
Add op-mode command having ability to show certificate
full chain in pem format as part of PKI configuration.
The certificates are ordered beginning with the end
entity (leaf) certificate, followed by any intermediate
certificates and finally the private key if requested.
This allows users to easily export a certificate along
with its CA hierarchy for use in external applications,
that require the full chain to be provided in a single
file.
One can now run the following commands:
```
show pki ca NAME pem full-chain
show pki certificate NAME pem full-chain
show pki certificate NAME private pem full-chain
```
|
|
dhcp: T8933: Honor system timezone for timestamp display in op mode
|
|
|
|
Add `hostname` as a valid sort key for both DHCPv4
and DHCPv6 leases and static mappings.
|
|
The time displayed in DHCP v4/v6 server lease op-mode
commands should honor system timezone and not force
UTC timezone.
This would keep the timestamps in the output of
`show log dhcp server` or `show log dhcpv6 server`
consistent with the timestamps in the output of
`show dhcp server leases` or `show dhcpv6 server leases`
commands.
|
|
Add two enhancements to the `show conntrack table` op-mode command:
- Display per-flow packet and byte counters (original and reply
direction).
- Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`
that maps VRF name to its conntrack table ID and
passes `--orig-zone` to the underlying conntrack call.
|
|
pki: T8877: Add ability to show private key in pem format
|
|
This cleanup enhances readability and aligns the output
with the actual data being displayed.
|
|
Add op-mode command having ability to show private
key in pem format as part of PKI configuration.
This is needed for users who want to render the
certificate and its private key.
|
|
|
|
|
|
|
|
T8445: T8335: Extend config activation system
|
|
op-mode: T8483: fix /show_sensors.py: No such file or directory
|
|
Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is
arbitrary and can produce incorrect behavior. Sensors can be passed through to
virtual machines, so running in a VM should not be treated differently.
If no sensors are detected - whether on a hypervisor VM or on bare metal - the
command now reports: "No sensors found".
|
|
|
|
|
|
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
|
config-sync: T7784: Add command to diff configuration with secondary node
|
|
After rewriting the op-mode handlind code and introducing virtualTagNodes for
op-mode, also all <command> statements will be executed by a runner. Executing
"bash -c ''" code within that runner lacks the proper environment.
This can be verified by adding "env" into the bash -c '' executions string.
Solve this issue by moving the hypervisor detection code to show_sensors.py.
|
|
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).
This commit adds a new CLI node:
system console device <name> kernel
When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.
|
|
Required during first-boot of a system. We have images form amd64 and arm64
CPUs which also tend to have different serial interfaces (ttyS vs. ttyAMA).
The images which are installed have the correct serial setting for GRUB (ttyS0
or ttyAMA0) and the activation script will probe the Kernel command-line. If a
serial interface is defined, we will include it in the VyOS CLI configuration.
|
|
For the sake of nice grep lines and refactoring we have an unspoken - unwritten
rule considered as folklore to have imports one per line. This helped in the
past with refactorings.
|
|
Add a new operational command to compare configuration between
nodes participating in config synchronization.
New command:
- `show configuration secondary sync [commands] [running|candidate|saved] [config-node-path]`.
This allows operators to view configuration differences across secondary peer
before applying or syncing changes.
Supports:
- displaying using raw diff and 'commands' format;
- optional section filtering (subtree comparison);
- selectable config source (running, candidate, saved).
|
|
Fix typos and mistakes
No functional changes
|
