summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2025-09-23tpm: T7726: Copy encrypted volume when adding system imagessarthurdev
2025-09-23tpm: T4919: Use vyos module function for running image, single-line importssarthurdev
2025-09-23tpm: T7735: Only require key/recovery if unmappedsarthurdev
2025-09-23tpm: T7713: Restore original config mounts when decryptingsarthurdev
2025-09-23tpm: T7717: Preserve group on config and archivessarthurdev
2025-09-23tpm: T7720: Handle encrypt failure and gracefully abortsarthurdev
2025-09-23tpm: T7727: Prompt to overwrite an existing backupsarthurdev
Move encrypted volume check before key input Unmount any conflicting config bind mounts
2025-09-23Merge pull request #4684 from c-po/bgp-vrf-system-asDaniil Baturin
bgp: T7760: remove per vrf instance system-as node
2025-09-23Merge pull request #4743 from sarthurdev/kea3.0Christian Breunig
kea: T7281: Fix Kea 3.0 service failures
2025-09-23kea: T7281: Preserve systemd unit environment in VRF execsarthurdev
2025-09-23kea: T7281: Set folder permissions to expected 0750sarthurdev
2025-09-23kea: T7821: Update paths for Kea v2.7.9 security changessarthurdev
2025-09-22kea: T7281: Use correct Kea unit filessarthurdev
2025-09-22image: T7818: avoid error when skipping config migrationChristian Breunig
Fix "No such file or directory" error triggered during image upgrade when user opts not to migrate config. GRUB cmdline migration incorrectly attempts to access non-existent config in new image path.
2025-09-22image: T7818: re-use global path definitions from vyos.defaultsChristian Breunig
Reduce amount of duplicate file/folder strings.
2025-09-22Merge pull request #4698 from l0crian1/fw-disable-conntrackDaniil Baturin
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
2025-09-22Merge pull request #4711 from jestabro/interstitial-setDaniil Baturin
T7737: add vyconf-aware analogue of configfs
2025-09-20ssh: T7839: fix warning on deprecated algorithms during commitChristian Breunig
The list calculation of in-use but deprecated SSH hostkey algorithms was wrong. This was implemented in commit 6deda171e ("ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage"). It always returned the content of the list of deprecated algorithms, but not the list of deprecated algorithms actually - in use - by the configuration. This has been corrected. Before: DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com After: DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss The generation of the MOTD was not affected!
2025-09-19T7836: use /opt/vyatta/etc/config as source of truth in tpm encryptionJohn Estabrook
The mount point /opt/vyatta/etc/config is considered the source of truth whereas /config is simply a bind mount of convenience. As the latter is no longer defined at boot, all operations should use the former.
2025-09-19T7836: move bind mount of /config to vyos-1xJohn Estabrook
We are removing the bind mount construction from the initrd components in live-boot, as: (1) it is not needed before initialization in the vyos-router script (2) does not correctly update inodes on libc rename (3) fails on the livecd (cf. /var/log/live/boot.log)
2025-09-18Merge pull request #4723 from sarthurdev/kea3.0Viacheslav Hletenko
kea: T7821: Update Kea to 3.0
2025-09-18Merge pull request #4692 from l0crian1/fw-pre-def-fixSimon
op-mode: T6857: Fix default action for prerouting hook
2025-09-18Merge pull request #4724 from l0crian1/fix-container-branchChristian Breunig
container: T7681: fix multiple name servers
2025-09-18op-mode: T7746: Fix 'show interfaces' description wrapping (#4725)Christian Breunig
- Fixed incorrect wrapping of 'show interfaces' description
2025-09-18Merge pull request #4731 from c-po/openssh-T7787Daniil Baturin
T7787: add deprecation warning for ssh-dss keys
2025-09-18container: T6673: Fix restart of containers with podman (#4691)l0crian1
Fixed issue with podman and systemd sync when restarting containers with 'podman restart' command. - Placed podman storage directory in vyos/defaults.py - Replaced repeated declarations with vyos.defaults.directories['podman_storage']
2025-09-18T7737: inject env vars provided by vyconfd sessionJohn Estabrook
2025-09-18Merge pull request #4722 from natali-rs1985/T7796Daniil Baturin
T7796: PPPoE-server add mapping in vpp if vpp-cp is enabled
2025-09-18Merge pull request #4708 from sarthurdev/T114Daniil Baturin
wlb: T114: Add firewall group support for WAN load balancer
2025-09-17ssh: T7839: add deprecation warning for DSA hostkey-algorithm usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com
2025-09-17login: T7839: add deprecation warning for DSS public-key usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following users are using SSH-DSS keys for authentication. User "vyos" with deprecated public-key named: foo
2025-09-17T7796: PPPoE-server add mapping in vpp if vpp-cp is enabledNataliia Solomko
2025-09-16op-mode: T7746: Fix 'show interfaces' description wrappingl0crian1
- Fixed incorrect wrapping of 'show interfaces' description
2025-09-16container: T7681: fix multiple name serversl0crian1
- Fixed error with multiple name servers missing space between --dns options
2025-09-16T7806: VPP do not allow skip-cores to be configured without main-coreNataliia Solomko
2025-09-16Merge pull request #4696 from natali-rs1985/T7783Daniil Baturin
T7783: T7786: VPP clarify error messages for CPU requirements
2025-09-16Merge pull request #4688 from hedrok/T75-migration-to-ipt-netflowDaniil Baturin
T75: migrate from pmacct to ipt_NETFLOW
2025-09-16Merge pull request #4717 from c-po/no-ipv6-default-routeDaniil Baturin
dhcpv6: T7646: restore missing default route after upgrade
2025-09-16T7783: T7786: VPP clarify error messages for CPU requirementsNataliia Solomko
2025-09-16T75: migrate from pmacct to ipt_NETFLOWKyrylo Yatsenko
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'
2025-09-15Merge pull request #4689 from davi2367/vrf-dhcpDaniil Baturin
T6211: Fix kea VRF op-mode commands
2025-09-15Merge pull request #4686 from l0crian1/container-macvlanDaniil Baturin
container: T7186: Add macvlan network type for containers
2025-09-15Merge pull request #4289 from nvandamme/currentDaniil Baturin
op-mode: T5992: show dhcpv6 leases with (mostly) the same fields as dhcp leases
2025-09-14kea: T7821: Update Kea to 3.0sarthurdev
2025-09-14vyos.utils: T7740: update dict_search to return optional default value (#4700)l0crian1
2025-09-13Debian: T7817: vyos_net_name exists in debian/tmp but is not installed to ↵Christian Breunig
anywhere Fix this build warning by placing the vyos_net_name script in it's own udev folder to not accidently be copied to a wrong location.
2025-09-13dhcpv6: T7646: restore missing default route after upgradeChristian Breunig
Commit de44c6aef249 ("interface: T7379: do not request SLAAC default route when only DHCPv6 is set") introduced a behavioral change while addressing an earlier issue fixed in e9fb2078d5ea ("interface: T7375: SLAAC assigned address is not cleared when removing SLAAC"). This change caused unintended connectivity loss after upgrading to VyOS 1.4.3. The underlying reason is that VyOS now requires explicit configuration to determine how IPv6 addressing and routing should be handled, rather than making assumptions: Requesting a DHCPv6 address alone will correctly assign an address. However, since the IPv6 default route is typically advertised via SLAAC (and not DHCPv6), SLAAC must also be explicitly enabled to receive the default route. Historically, this distinction was implicit and did not require additional configuration. To preserve backward compatibility, a configuration migrator has been added. It inspects existing configurations that only request a DHCPv6 address and automatically appends the required CLI node to also enable SLAAC, ensuring that the default route is restored after upgrade.
2025-09-12Merge pull request #4709 from l0crian1/reset-bgp-all-in-out-softViacheslav Hletenko
op-mode: T7516: expand 'reset bgp all' elements with in/out/soft options
2025-09-11Merge pull request #4707 from sarthurdev/T7696Christian Breunig
nat: T7696: Fix NAT op-mode output for protocol and interface groups
2025-09-10BGP: T7516: Expand 'reset bgp all' elements with in/out/soft optionsl0crian1
- Added 'in', 'out', and 'soft' options to all 'reset bgp all' elements - Replaced calls to vtysh_wrapper.sh with new bgp.py reset function - Replaced direct 'vtysh -c' calls with new bgp.py reset function
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-30 11:19:17 +0000