summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2026-04-21Merge pull request #5136 from c-po/vyos-utils-mergeViacheslav Hletenko
T8532: merge unrelated histories of vyos-utils and vyos-1x repo
2026-04-21Merge pull request #5100 from sarthurdev/T8446Daniil Baturin
firewall: T8446: Prevent chain with offload rule on local zone
2026-04-21Merge branch 'current' into vyos-utils-mergeDaniil Baturin
2026-04-20Merge pull request #5096 from jestabro/extend-activation-systemJohn Estabrook
T8445: T8335: Extend config activation system
2026-04-19T8532: update URL and bump version of OCaml toolsChristian Breunig
2026-04-19Merge branch 'current' of github.com:vyos/vyos-utils into vyos-utils-mergeChristian Breunig
* 'current' of github.com:vyos/vyos-utils: (65 commits) T8269: add option to silence output of individual validators T8306: update package version vyos-op-run: T8306: add error messages for system exceptions vyos-op-run: T8306: improve execution logic logging vyos-op-run: T8301: improve the security of UID check and setuid logic T8110: "list_interfaces --bondable" must not return VLAN subinterfaces vyos-op-run: T7901: skip permission checks if the user is root vyos-op-run: T8005: sanitize environment variables to prevent malicious variable injection T7878: conflict check updated to use mergify T7878: conflict check updated to use mergify T7899: virtual-ethernet interfaces support broadcasts Debian: T7899: bump dh compat version T7758: add missing case to allow repeated option --type T7758: allow repeated option --type in list_interfaces vyos-op-run: T7745: add a command permission checking mechanism op-mode: T7583: add a new operational command runner T7644: mirror workflow refactoring rollout T7579: fix of the run trigger for CLA T7579: added workflow for CLA validators: T6622: Radix-aware numeric validation ...
2026-04-17Merge pull request #5122 from c-po/op-mode-sensorsViacheslav Hletenko
op-mode: T8483: fix /show_sensors.py: No such file or directory
2026-04-16Merge pull request #5133 from c-po/serial-console-for-loopChristian Breunig
serial: T8375: call update_serial_console() only once for default tty
2026-04-16op-mode: T8483: remove hypervisor checks from sensors detectionChristian Breunig
Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is arbitrary and can produce incorrect behavior. Sensors can be passed through to virtual machines, so running in a VM should not be treated differently. If no sensors are detected - whether on a hypervisor VM or on bare metal - the command now reports: "No sensors found".
2026-04-16op-mode: T8483: fix whitespace format issues for show_sensors.pyChristian Breunig
2026-04-16Merge pull request #5132 from natali-rs1985/T8505Daniil Baturin
vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API call
2026-04-16Merge pull request #5113 from srnoth/T8211-multiport-serial-symlinksDaniil Baturin
serial: T8211: fix symlink collisions for multi-port USB serial adapters
2026-04-16vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API callNataliia Solomko
2026-04-15T8445: set activation hint during install imageJohn Estabrook
2026-04-15T8445: update ethernet offload support activation scriptJohn Estabrook
Use refined activation tools for correct behavior on first installed boot.
2026-04-15T8335: use activation script for installation of config path hintJohn Estabrook
This is necessary for images produced from a raw_image build (qcow2), which no longer make use of the image_installer script.
2026-04-15T8445: add activation script to indicate first installed bootJohn Estabrook
Add script to leave hint of first installed boot (as, say, distinguished from first live boot, or subsequent); this is useful as pre/post conditions and self-modification of activation scripts.
2026-04-15T8445: add example activation scriptJohn Estabrook
2026-04-15T8445: add activation op-mode scriptJohn Estabrook
2026-04-15T8445: catch script runner error in vyos-routerJohn Estabrook
2026-04-15T8445: add revised boot activation script runnerJohn Estabrook
2026-04-15serial: T8375: call update_serial_console() only once for default ttyChristian Breunig
When there are multiple serial consoles defined; but either none or the last used the 'kernel' CLI option to disply Kernel messages, the GRUB code was called multiple times. By moving the call to the GRUB helpers outside the for loop we gain a single execution of the code path, not that it matters performance wise - but messing with the bootloader should be reduced to a minimum.
2026-04-14Merge pull request #5092 from c-po/kernel-serial-activationChristian Breunig
serial: T8375: use boot activation script to define a serial console on the CLI
2026-04-13Merge pull request #5081 from alexandr-san4ez/T7784-currentJohn Estabrook
config-sync: T7784: Add command to diff configuration with secondary node
2026-04-13Merge pull request #5121 from c-po/netlinkd-high-cpuViacheslav Hletenko
vyos-netlinkd: T8486: fix high-cpu utilisation due to excessive CLI calls
2026-04-12op-mode: T8483: fix /show_sensors.py: No such file or directoryChristian Breunig
After rewriting the op-mode handlind code and introducing virtualTagNodes for op-mode, also all <command> statements will be executed by a runner. Executing "bash -c ''" code within that runner lacks the proper environment. This can be verified by adding "env" into the bash -c '' executions string. Solve this issue by moving the hypervisor detection code to show_sensors.py.
2026-04-12vyos-netlinkd: T8486: fix high-cpu utilisation due to excessive CLI callsChristian Breunig
strace: Process 16362 attached [pid 16362] execve("/bin/cli-shell-api", ["/bin/cli-shell-api", "--show-active-only", "showConfig", "interfaces"], ...) = 0 [pid 16362] +++ exited with 0 +++ --- SIGCHLD ... strace: Process 16363 attached [pid 16363] execve("/bin/cli-shell-api", ["/bin/cli-shell-api", "--show-active-only", "showConfig", "interfaces"], ...) = 0 [pid 16363] +++ exited with 0 +++ --- SIGCHLD ... This would appear to be due to vyos-netlinkd calling op_mode_config_dict() more than is necessary: it can be called only when it may be applicable (this patch). Co-Authored-by: John Estabrook <jestabro@vyos.io>
2026-04-10Merge pull request #5108 from sever-sever/T8448Christian Breunig
T8448: add an option to enable SNMP traps in VRRP
2026-04-10Merge pull request #5118 from sever-sever/T8459Christian Breunig
T8459: Fix cron GeoIP update remove unexpected force option
2026-04-10T8448: VRRP add configuration for the SNMP trapsViacheslav Hletenko
Allow to configure Keepalived VRRP traps - set high-availability vrrp snmp trap
2026-04-10Merge pull request #5115 from c-po/commit-archive-vrfDaniil Baturin
remote: T4732: add VRF option for commit-archive
2026-04-10T8459: Fix cron GeoIP update remove unexpected force optionViacheslav Hletenko
Remove unexpected `--force` option for the GeoIP update cron task $ /usr/libexec/vyos/geoip-update.py --force usage: geoip-update.py [-h] [--init] geoip-update.py: error: unrecognized arguments: --force
2026-04-09serial: T8375: add CLI option to explicitly set kernel consoleChristian Breunig
Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or tty0, with no post-install CLI method to change it (manual GRUB edits were required). This commit adds a new CLI node: system console device <name> kernel When set, the selected serial console is used as the kernel boot console. When removed, the kernel boot console falls back to tty0.
2026-04-09serial: T8375: use boot activation script to define a serial console on the CLIChristian Breunig
Required during first-boot of a system. We have images form amd64 and arm64 CPUs which also tend to have different serial interfaces (ttyS vs. ttyAMA). The images which are installed have the correct serial setting for GRUB (ttyS0 or ttyAMA0) and the activation script will probe the Kernel command-line. If a serial interface is defined, we will include it in the VyOS CLI configuration.
2026-04-09vyos-router: T8375: rename "system" to "activate"Christian Breunig
Clearly indicate during startup what happens. When we see "system" on the CLI, infact we ran the activation scripts, thus the rename.
2026-04-09T8375: general import cleanup on the way to serial activationChristian Breunig
For the sake of nice grep lines and refactoring we have an unspoken - unwritten rule considered as folklore to have imports one per line. This helped in the past with refactorings.
2026-04-09Merge pull request #5004 from jd82k/ndproxyDaniil Baturin
T8292: Fix ndp-proxy verify key mismatch for prefix rules
2026-04-09Merge pull request #5114 from mihakralj/fix/T8452-typo-vppDaniil Baturin
vpp: T8452: fix typo in variable name
2026-04-08serial: T8211: refactor rule to reduce duplicationStephen Nothnagel
Store the PROGRAM output in a temporary .BY_BUS ENV variable, then reference it via %E{.BY_BUS} in the SYMLINK+= assignments. This collapses the three duplicated PROGRAM pipelines into a single invocation and removes the mixed usage of $result and %c. No functional change: tested on MosChip MCS7840 (2x 4-port chips, 8 ports total), FTDI FT4232H, and Sierra EM7455 -- all symlinks identical before and after, verified with udevadm test. Reduces duplication; refactor suggested by @copilot-pull-request-reviewer on PR #5113.
2026-04-07Merge pull request #5103 from alexandr-san4ez/T8281-currentDaniil Baturin
firewall: T8281: Normalize network prefixes in rule configuration
2026-04-07Merge pull request #5107 from alexandr-san4ez/T8282-currentDaniil Baturin
firewall: T8282: Normalize invalid network-group names during migration
2026-04-06vpp: T8452: fix typo in variable nameMiha
Rename `id_from_persisten_conf` to `id_from_persistent_conf`.
2026-04-06serial: T8211: fix symlink collisions for multi-port USB serial adaptersStephen Nothnagel
Multi-port USB serial adapters (e.g., MosChip MCS7840) where all ports share the same USB ID_PATH create identical symlink names in /dev/serial/by-bus/, causing only the last-enumerated port to be accessible. Split the existing catch-all rule for devices with .ID_PORT into two cases: - Port 0: keeps the base symlink name (backward compatible) - Port 1+: appends pN suffix (e.g., usb0b1.4.1p1.0p1) Devices where each port has a unique ID_PATH (e.g., FTDI FT4232H) and single-port devices are unaffected.
2026-04-06remote: T4732: add VRF option for commit-archiveChristian Breunig
Add new CLI option to make transfers to the commit-archive working using a dedicated (e.g. management) VRF. set system config-management commit-archive vrf MGMT All transfers using vyos.remote module will now run through the VRF defined on the CLI.
2026-04-06firewall: T8281: Normalize network prefixes in rule configurationOleksandr Kuchmystyi
Convert non-canonical IPv4 and IPv6 prefixes in 'source/destination address' fields to proper network addresses (e.g. 10.10.10.1/30 -> 10.10.10.0/30). This prevents invalid configurations and ensures consistent prefix handling.
2026-04-03Merge pull request #5101 from natali-rs1985/T8438Viacheslav Hletenko
vpp: T8438: Add bidirectional interface-in-use validation
2026-04-03Merge pull request #5106 from c-po/joolViacheslav Hletenko
nat64: T8456: add constraint for translation port range
2026-04-03firewall: T8282: Normalize invalid network-group names during migrationOleksandr Kuchmystyi
Replace unsupported characters (e.g. `,`, `+`) with `_` when migrating from 1.3.x and handle name collisions safely to prevent commit failures.
2026-04-03nat64: T8456: add constraint for translation port rangeChristian Breunig
NAT64 requires dedicated transport address space for translation, similar to exclusive port ownership during socket binding. If a local process and Jool translation both use the same transport tuple (for example, 192.0.2.1:5000), traffic conflicts can occur. Jool does not prevent pool4 from overlapping with other port allocations, so avoiding conflicts is an operator responsibility. In addition to service ports already in use, account for Linux ephemeral range (net.ipv4.ip_local_port_range), which defaults to 32768-60999. This default is why, when pool4 is empty, Jool uses 61001-65535 on the node's primary global addresses. One can adjust the ephemeral range via sysctl, and Jools translation range via pool4 add/remove. vyos@vyos:~$ sysctl net.ipv4.ip_local_port_range net.ipv4.ip_local_port_range = 32768 60999 VyOS now uses verify() in NAT64 to check that the supplied tranlation port range does not overlap with the Kernels ephemeral port range.
2026-04-03nat64: T8456: rename CLI path variables for a better fitChristian Breunig
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-03 02:09:32 +0000