| Age | Commit message (Collapse) | Author |
|---|
|
pipe_wait() reads at most 500 bytes per iteration and keeps no residual
buffer between them. A VRRP transition involving enough instances emits
more than that in a single burst, so a read lands mid-line: the tail of
one chunk is queued as an incomplete fragment and the head of the next
chunk as another.
The dispatcher then fails to match the notify regex on both halves and
silently runs no transition script. Observed on a pair with 14 instances
in one sync group, where "GROUP" arrived as "ROUP" because the leading
character ended the previous read.
Hold the incomplete trailing line and prepend it to the next read, so
only whole lines reach the queue. Only signal the processing thread when
at least one complete line was queued.
|
|
Container interfaces are veth pairs created by the runtime. They have no
backing bus device in sysfs, so discover_physical_interfaces() never
considers them, and their MAC is assigned by the host and regenerated on
every start.
A pending node could thus never be resolved. The pass only spent both
bounded hardware waits and then asked for an hw-id that would not
survive a restart:
interface 'eth0' still has no hw-id configured after this boot's
naming pass - bind it manually, e.g. ...
Returning before write_status() leaves no status file behind, so
warn_missing_interface_hardware() in vyos-router stays quiet by itself.
setUpModule() pins the detection off for the test module - the build
container would otherwise short-circuit every existing main() test.
|
|
vyos-system-update-check.py was using data from untrusted source to pass
to shell without escaping.
Change to list in call to `call` to fix this.
|
|
pipe_wait() reads at most 500 bytes per iteration and keeps no residual
buffer between them. A VRRP transition involving enough instances emits
more than that in a single burst, so a read lands mid-line: the tail of
one chunk is queued as an incomplete fragment and the head of the next
chunk as another.
The dispatcher then fails to match the notify regex on both halves and
silently runs no transition script. Observed on a pair with 14 instances
in one sync group, where "GROUP" arrived as "ROUP" because the leading
character ended the previous read.
Hold the incomplete trailing line and prepend it to the next read, so
only whole lines reach the queue. Only signal the processing thread when
at least one complete line was queued.
|
|
T8329: Fix interface naming for Azure VF interfaces with Accelerated Networking enabled
|
|
Reported against the previous PCIe/MAC-sorted replacement fill: on a
real, already-provisioned box (hw-id from historical probe-order
rescan, unrelated to any PCIe/MAC sort), a configured node's address
ended up silently applied to a different physical NIC. Deleting one
interface's hw-id (keeping its settings) while a different, unrelated
interface's config was fully removed in the same boot was enough - the
two freed candidates' MAC order didn't match their old name order, so
the deterministic sort swapped them. Once written back by the rescan
helper, the wrong binding became permanent and self-reinforcing on
every later boot.
There's no way to verify, from MAC and PCIe position alone, which of
several unconfigured candidates is genuinely a given node's own
hardware once its hw-id is gone. Restore strict matching: a node only
recovers its hw-id automatically when it's the sole pending node of its
type this boot and exactly one candidate exists - any other count
leaves it pending and reported rather than guessed. A candidate that
isn't matched this way is not otherwise held back - it still gets an
ordinary, settings-free bootstrap name instead of being lost, just
never inherits another node's configuration.
This necessarily changes what a combined "delete one interface fully,
clear a different one's hw-id" reboot can auto-resolve; the accompanying
test-harness change acknowledges that trade-off explicitly.
|
|
interfaces during hw-id naming
These interfaces include the Azure VF interfaces which share the same mac address with their master synthetic interface
|
|
Multi-vendor PCIe NIC systems could lose or rename Ethernet/wireless
interfaces on boot, because naming was decided from a single per-device
udev event before all hardware had a chance to enumerate.
Replace that with one authoritative pass, run once configuration is
available during router startup: wait for configured hardware, apply
every hw-id binding, and name whatever has none yet by PCIe distance
from the root complex and MAC address - the same result every boot.
A node with its hw-id deleted (NIC replacement) or its whole
configuration removed is treated as an ordinary open slot, filled the
same way - recovering its original hardware whenever the interfaces
that vacated slots this boot also show up as candidates.
Boot now reports any interface still unresolved, and the pass is covered
by a new test suite in vyos-build named: make testifname
Assisted-by: Claude:claude-sonnet-5
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
|
|
`sed` ranges keyed on a field name (`plaintext-password`, `encrypted-password`,
`authentication {`) are not bounded to the target user's block. When the
field is absent the range stays open past the user's closing brace and
matches the first occurrence of that field in a later account.
|
|
is set
When a user account was provisioned with only `plaintext-password` (e.g.
via cloud-init), the password recovery tool failed to persist the new
password across reboots. On the next boot, VyOS would re-apply the
`plaintext-password` from config.boot, silently overwriting the recovered
encrypted password.
|
|
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
|
|
Fix typos and mistakes
No functional changes
|
|
During early boot not all resources are ready for HTTP request, so
`vyos.version.get_remote_version` may fail once and the update check is then
delayed for 12 hours, leaving the router unaware of updates.
Fix by adding retries/backoff and improved error handling so transient startup
network failures don't suppress update checks for the next interval.
|
|
|
|
T7852: Switch to yescrypt password encryption
|
|
|
|
Accidentally slipped in 2 whitespace corrections
|
|
kea: T6211: add VRF support for KEA dhcp server
|
|
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
Keep DHCP server leases in sync with vyos-hostd records
via helper script invoked with `ExecStartPost` directive
in kea-dhcp4-server.service.
The helper script updates VyOS hostd records from
DHCP server leases. This ensures that hostd records
with the DHCP server leases are kept in sync with
VyOS hostd records right after DHCP server is started.
This is similar to the capability exposed via kea hook
`libdhcp_run_script.so` which is invoked internally
by kea when a single lease changes state.
Since the kea hook is currently implemented for DHCPv4
only, this helper script is implemented for DHCPv4
only as well.
|
|
found using "git ls-files *.py | xargs pylint | grep W0611"
|
|
To iterate files on ext* file systems GRUB reads their inodes one by one,
ignoring names. This breaks our configuration logic that relies on proper
loading order.
This commit adds a helper `sort_inodes()` that needs to be used whenever GRUB
configuration files are created. It recreates files, changing their inodes in a
way where inodes order matches alphabetical order.
|
|
|
|
* Fix route deletion errors when interface is missing. Clarify variable names.
|
|
|
|
|
|
|
|
|
|
Add util function to set serial console speed in accordance with revised
GRUB file structure; in keeping with the intentions of the config_mode
script, adjust the GRUB var 'console_speed' to only modify ttyS0.
|
|
GRUB defaults to 9600 in case of serial console; explicitly set to
115200.
|
|
|
|
|
|
We will use _ as CLI level divider. The XML definition filename and also
the Python helper should match the CLI node.
Example:
set interfaces ethernet -> interfaces_ethernet.xml.in
set interfaces bond -> interfaces_bond.xml.in
set service dhcp-server -> service_dhcp-server-xml.in
|
|
The hook arguments passed to `on-dhcp-event.sh` have changed in Kea.
Adjust the script to align with the new arguments.
Additionally, remove FQDN mangling from the script. No need to extract
the domain name from `LEASE4_HOSTNAME` only to append it again.
See: https://kea.readthedocs.io/en/latest/arm/hooks.html#hooks-run-script
|
|
|
|
|
|
|
|
Note that this was updated for the fix in T5739.
|
|
This commit allows management of system images with either new or legacy
tools: 'add/delete/rename system image' and 'set default' are translated
appropriately on booting between images with the old and new tools.
Consequently, the warning of the initial commit of T4516 is dropped.
|
|
|
|
This commit adds the whole set of system image tools written from the scratch in
Python that allows performing all the operations on images:
* check information
* perform installation and deletion
* versions management
Also, it contains a new service that will update the GRUB menu and keep tracking
its version in the future.
WARNING: The commit contains non-reversible changes. Because of boot menu
changes, it will not be possible to manage images from older VyOS versions after
an update.
|
|
This fixes sending packets to uacctd using a socket.
|
|
pmacct daemons have one very important specific - they handle control signals in
the same loop as packets. And packets waiting is blocking operation.
Because of this, when systemctl sends SIGTERM to uacctd, this signal has no
effect until uacct receives at least one packet via nflog. In some cases, this
leads to a 90-second timeout, sending SIGKILL, and improperly finished tasks.
As a result, a working folder is not cleaned properly.
This commit contains several changes to fix service issues:
- add a new nftables table for pmacct with a single rule to get the ability to
send a packet to nflog and unlock uacctd
- remove PID file options from the uacctd and a systemd service file. Systemd
can detect proper PID, and PIDfile is created by uacctd too late, which leads
to extra errors in systemd logs
- KillMode changed to mixed. Without this, SIGTERM is sent to all plugins and
the core process exits with status 1 because it loses connection to plugins too
early. As a result, we have errors in logs, and the systemd service is in a
failed state.
- added logging to uacctd
- systemctl service modified to send packets to specific address during a service
stop which unlocks uacctd and allows systemctl to finish its work properly
|
|
* T5195: move run, cmd, call, rc_cmd helper to vyos.utils.process
* T5195: use read_file and write_file implementation from vyos.utils.file
Changed code automatically using:
find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import read_file$/from vyos.utils.file import read_file/g' {} +
find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import write_file$/from vyos.utils.file import write_file/g' {} +
* T5195: move chmod* helpers to vyos.utils.permission
* T5195: use colon_separated_to_dict from vyos.utils.dict
* T5195: move is_systemd_service_* to vyos.utils.process
* T5195: fix boot issues with missing imports
* T5195: move dict_search_* helpers to vyos.utils.dict
* T5195: move network helpers to vyos.utils.network
* T5195: move commit_* helpers to vyos.utils.commit
* T5195: move user I/O helpers to vyos.utils.io
|
|
Added a new service that starts before Cloud-init, waits for all network
interfaces initialization, and if requested by config, checks which interfaces
can get configuration via DHCP server and creates a corresponding Cloud-init
network configuration.
This protects from two situations:
* when Cloud-init tries to get meta-data via eth0 (default and fallback variant
for any data source which depends on network), but the real network is connected
to another interface
* when Cloud-init starts simultaneously with udev and initializes the first
interface to get meta-data before it is renamed to eth0 by udev
|
|
progress
|
|
Ability to autocheck available new images
Parse remote URL JSON image-version.json file and compare version
VyOS with a local current version, if find diff sent wall
message that the new image is available
Also, add op-mode command to check images "show system image"
With option "auto-check" check will be once per 12 hours
set system update-check auto-check
set system update-check url 'http://example.com/image-version.json'
If new version is available shows it per login (MOTD)
|
