| Age | Commit message (Collapse) | Author |
|---|
|
strongSwan validation
Previously generated CRLs were missing the Authority Key Identifier and
CRL Number extensions required by strongSwan for certificate revocation
validation. Without these extensions, strongSwan silently ignores the CRL,
allowing revoked certificates to authenticate successfully.
The migration regenerates existing CRLs for all CAs that have a private
key available. CAs with passphrase-protected keys are skipped with a
warning, as the passphrase cannot be provided non-interactively
|
|
* wan: T8481: scope flush-connections to WLB connection marks
flush-connections runs conntrack --delete which destroys all conntrack
entries system-wide, including unrelated NAT translations and
established connections that have nothing to do with WLB.
WLB tags every connection it manages with a conntrack mark via the
wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope
the flush to these marks so only WLB-managed connections are affected.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
* wan: T8481: replace conntrack deletion from state changed block
---------
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
|
|
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
|
|
|
|
T8147: Update Linux Kernel to 6.18
|
|
|
|
option
|
|
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As
this was not available in the previous used LTS 6.6 Kernel it now is available
while we upgrade to Linux 6.18.
|
|
migration: T8280: Fix auth file read for interfaces on first boot of new image
|
|
FRR (#4994)
* sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR
---------
Co-authored-by: Cheeze_It <none@none.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
T8539: Unable to traceroute using hostname and ipv6 source address
|
|
utils: T8541: add write-config-file-value helper
|
|
During first boot after installing a new VyOS image, migrations are
executed before the filesystem is fully initialized.
At this point `/config` is not yet bind-mounted, causing auth files
(certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet
EAPoL interfaces under `/config/auth` to be inaccessible even though they
exist under the underlying `/opt/vyatta/etc/config/auth` path which is
available at all boot stages.
Add fallback logic to `read_auth_file()` to retry the file lookup under
`/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.
|
|
Setting a timeout allows VRRP health-check scripts to run longer than the set interval.
Without timeout, keepalived considers the script as failed after interval seconds.
With timeout set higher than interval, the script has more time to complete
before being marked as failed and transitioning VRRP to FAULT state.
|
|
Introduce src/helpers/write-config-file-value.py to patch a saved config.boot
from scripts by writing a quoted CLI path with an optional value (omit --value
to create a valueless node).
Extend vyos.utils.config.write_saved_value() to safely update saved configs:
create missing parent nodes before tagging (ConfigTree.set_tag requires nodes
to exist) and then write the requested value/valueless leaf back to disk.
Remove the legacy serial console activation script which is now replaced by the
helper-based approach. The helper is run once during ISO Image assembly and will
inject the approprate serial console defintiions into config.boot.default.
|
|
vpp: T8460: Use isolated cpus for VPP cpu-cores
|
|
VPP: T8495: fix issue with assigning acl on sub interfaces
|
|
T8534: refactor sysctl_(read|write) to accept key parts
|
|
|
|
|
|
T8532: merge unrelated histories of vyos-utils and vyos-1x repo
|
|
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
|
|
firewall: T8446: Prevent chain with offload rule on local zone
|
|
|
|
|
|
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which
conflicts with sysctl's dot-separated key syntax.
Change sysctl_read() and sysctl_write() to take key components as a list and
normalize each component by replacing . with / before invoking sysctl. This
fixes sysctl lookups/updates for VLAN subinterfaces.
Extend the SR-TE smoketest to cover a VLAN subinterface.
Previous error raising this issue:
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory
vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
|
|
T8445: T8335: Extend config activation system
|
|
|
|
|
|
|
|
* 'current' of github.com:vyos/vyos-utils: (65 commits)
T8269: add option to silence output of individual validators
T8306: update package version
vyos-op-run: T8306: add error messages for system exceptions
vyos-op-run: T8306: improve execution logic logging
vyos-op-run: T8301: improve the security of UID check and setuid logic
T8110: "list_interfaces --bondable" must not return VLAN subinterfaces
vyos-op-run: T7901: skip permission checks if the user is root
vyos-op-run: T8005: sanitize environment variables to prevent malicious variable injection
T7878: conflict check updated to use mergify
T7878: conflict check updated to use mergify
T7899: virtual-ethernet interfaces support broadcasts
Debian: T7899: bump dh compat version
T7758: add missing case to allow repeated option --type
T7758: allow repeated option --type in list_interfaces
vyos-op-run: T7745: add a command permission checking mechanism
op-mode: T7583: add a new operational command runner
T7644: mirror workflow refactoring rollout
T7579: fix of the run trigger for CLA
T7579: added workflow for CLA
validators: T6622: Radix-aware numeric validation
...
|
|
op-mode: T8483: fix /show_sensors.py: No such file or directory
|
|
serial: T8375: call update_serial_console() only once for default tty
|
|
Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is
arbitrary and can produce incorrect behavior. Sensors can be passed through to
virtual machines, so running in a VM should not be treated differently.
If no sensors are detected - whether on a hypervisor VM or on bare metal - the
command now reports: "No sensors found".
|
|
|
|
vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API call
|
|
serial: T8211: fix symlink collisions for multi-port USB serial adapters
|
|
|
|
|
|
Use refined activation tools for correct behavior on first installed
boot.
|
|
This is necessary for images produced from a raw_image build (qcow2),
which no longer make use of the image_installer script.
|
|
Add script to leave hint of first installed boot (as, say, distinguished
from first live boot, or subsequent); this is useful as pre/post
conditions and self-modification of activation scripts.
|
|
|
|
|
|
|
|
|
|
When there are multiple serial consoles defined; but either none or the
last used the 'kernel' CLI option to disply Kernel messages, the GRUB
code was called multiple times.
By moving the call to the GRUB helpers outside the for loop we gain a single
execution of the code path, not that it matters performance wise - but messing
with the bootloader should be reduced to a minimum.
|
|
serial: T8375: use boot activation script to define a serial console on the CLI
|
|
config-sync: T7784: Add command to diff configuration with secondary node
|
|
vyos-netlinkd: T8486: fix high-cpu utilisation due to excessive CLI calls
|
