summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2025-09-24Merge pull request #4737 from jestabro/edit-level-op-mode-dictViacheslav Hletenko
T7850: make op_mode_config_dict edit level aware
2025-09-23Merge pull request #4684 from c-po/bgp-vrf-system-asDaniil Baturin
bgp: T7760: remove per vrf instance system-as node
2025-09-23Merge pull request #4743 from sarthurdev/kea3.0Christian Breunig
kea: T7281: Fix Kea 3.0 service failures
2025-09-23T7850: add nosetest for util list_stripJohn Estabrook
2025-09-23kea: T7281: Preserve systemd unit environment in VRF execsarthurdev
2025-09-23kea: T7281: Set folder permissions to expected 0750sarthurdev
2025-09-23kea: T7821: Update paths for Kea v2.7.9 security changessarthurdev
2025-09-22kea: T7281: Use correct Kea unit filessarthurdev
2025-09-22image: T7818: avoid error when skipping config migrationChristian Breunig
Fix "No such file or directory" error triggered during image upgrade when user opts not to migrate config. GRUB cmdline migration incorrectly attempts to access non-existent config in new image path.
2025-09-22image: T7818: re-use global path definitions from vyos.defaultsChristian Breunig
Reduce amount of duplicate file/folder strings.
2025-09-22Merge pull request #4698 from l0crian1/fw-disable-conntrackDaniil Baturin
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
2025-09-22Merge pull request #4711 from jestabro/interstitial-setDaniil Baturin
T7737: add vyconf-aware analogue of configfs
2025-09-20ssh: T7839: fix warning on deprecated algorithms during commitChristian Breunig
The list calculation of in-use but deprecated SSH hostkey algorithms was wrong. This was implemented in commit 6deda171e ("ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage"). It always returned the content of the list of deprecated algorithms, but not the list of deprecated algorithms actually - in use - by the configuration. This has been corrected. Before: DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com After: DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss The generation of the MOTD was not affected!
2025-09-19T7836: use /opt/vyatta/etc/config as source of truth in tpm encryptionJohn Estabrook
The mount point /opt/vyatta/etc/config is considered the source of truth whereas /config is simply a bind mount of convenience. As the latter is no longer defined at boot, all operations should use the former.
2025-09-19T7836: move bind mount of /config to vyos-1xJohn Estabrook
We are removing the bind mount construction from the initrd components in live-boot, as: (1) it is not needed before initialization in the vyos-router script (2) does not correctly update inodes on libc rename (3) fails on the livecd (cf. /var/log/live/boot.log)
2025-09-18Merge pull request #4723 from sarthurdev/kea3.0Viacheslav Hletenko
kea: T7821: Update Kea to 3.0
2025-09-18Merge pull request #4692 from l0crian1/fw-pre-def-fixSimon
op-mode: T6857: Fix default action for prerouting hook
2025-09-18Merge pull request #4724 from l0crian1/fix-container-branchChristian Breunig
container: T7681: fix multiple name servers
2025-09-18op-mode: T7746: Fix 'show interfaces' description wrapping (#4725)Christian Breunig
- Fixed incorrect wrapping of 'show interfaces' description
2025-09-18Merge pull request #4731 from c-po/openssh-T7787Daniil Baturin
T7787: add deprecation warning for ssh-dss keys
2025-09-18container: T6673: Fix restart of containers with podman (#4691)l0crian1
Fixed issue with podman and systemd sync when restarting containers with 'podman restart' command. - Placed podman storage directory in vyos/defaults.py - Replaced repeated declarations with vyos.defaults.directories['podman_storage']
2025-09-18T7737: inject env vars provided by vyconfd sessionJohn Estabrook
2025-09-18Merge pull request #4722 from natali-rs1985/T7796Daniil Baturin
T7796: PPPoE-server add mapping in vpp if vpp-cp is enabled
2025-09-18Merge pull request #4708 from sarthurdev/T114Daniil Baturin
wlb: T114: Add firewall group support for WAN load balancer
2025-09-17ssh: T7839: add deprecation warning for DSA hostkey-algorithm usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com
2025-09-17login: T7839: add deprecation warning for DSS public-key usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following users are using SSH-DSS keys for authentication. User "vyos" with deprecated public-key named: foo
2025-09-17T7796: PPPoE-server add mapping in vpp if vpp-cp is enabledNataliia Solomko
2025-09-16op-mode: T7746: Fix 'show interfaces' description wrappingl0crian1
- Fixed incorrect wrapping of 'show interfaces' description
2025-09-16container: T7681: fix multiple name serversl0crian1
- Fixed error with multiple name servers missing space between --dns options
2025-09-16T7806: VPP do not allow skip-cores to be configured without main-coreNataliia Solomko
2025-09-16Merge pull request #4696 from natali-rs1985/T7783Daniil Baturin
T7783: T7786: VPP clarify error messages for CPU requirements
2025-09-16Merge pull request #4688 from hedrok/T75-migration-to-ipt-netflowDaniil Baturin
T75: migrate from pmacct to ipt_NETFLOW
2025-09-16Merge pull request #4717 from c-po/no-ipv6-default-routeDaniil Baturin
dhcpv6: T7646: restore missing default route after upgrade
2025-09-16T7783: T7786: VPP clarify error messages for CPU requirementsNataliia Solomko
2025-09-16T75: migrate from pmacct to ipt_NETFLOWKyrylo Yatsenko
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'
2025-09-15Merge pull request #4689 from davi2367/vrf-dhcpDaniil Baturin
T6211: Fix kea VRF op-mode commands
2025-09-15Merge pull request #4686 from l0crian1/container-macvlanDaniil Baturin
container: T7186: Add macvlan network type for containers
2025-09-15Merge pull request #4289 from nvandamme/currentDaniil Baturin
op-mode: T5992: show dhcpv6 leases with (mostly) the same fields as dhcp leases
2025-09-14kea: T7821: Update Kea to 3.0sarthurdev
2025-09-14vyos.utils: T7740: update dict_search to return optional default value (#4700)l0crian1
2025-09-13Debian: T7817: vyos_net_name exists in debian/tmp but is not installed to ↵Christian Breunig
anywhere Fix this build warning by placing the vyos_net_name script in it's own udev folder to not accidently be copied to a wrong location.
2025-09-13dhcpv6: T7646: restore missing default route after upgradeChristian Breunig
Commit de44c6aef249 ("interface: T7379: do not request SLAAC default route when only DHCPv6 is set") introduced a behavioral change while addressing an earlier issue fixed in e9fb2078d5ea ("interface: T7375: SLAAC assigned address is not cleared when removing SLAAC"). This change caused unintended connectivity loss after upgrading to VyOS 1.4.3. The underlying reason is that VyOS now requires explicit configuration to determine how IPv6 addressing and routing should be handled, rather than making assumptions: Requesting a DHCPv6 address alone will correctly assign an address. However, since the IPv6 default route is typically advertised via SLAAC (and not DHCPv6), SLAAC must also be explicitly enabled to receive the default route. Historically, this distinction was implicit and did not require additional configuration. To preserve backward compatibility, a configuration migrator has been added. It inspects existing configurations that only request a DHCPv6 address and automatically appends the required CLI node to also enable SLAAC, ensuring that the default route is restored after upgrade.
2025-09-12Merge pull request #4709 from l0crian1/reset-bgp-all-in-out-softViacheslav Hletenko
op-mode: T7516: expand 'reset bgp all' elements with in/out/soft options
2025-09-11Merge pull request #4707 from sarthurdev/T7696Christian Breunig
nat: T7696: Fix NAT op-mode output for protocol and interface groups
2025-09-10BGP: T7516: Expand 'reset bgp all' elements with in/out/soft optionsl0crian1
- Added 'in', 'out', and 'soft' options to all 'reset bgp all' elements - Replaced calls to vtysh_wrapper.sh with new bgp.py reset function - Replaced direct 'vtysh -c' calls with new bgp.py reset function
2025-09-10wlb: T114: Add firewall group support for WAN load balancersarthurdev
2025-09-10Merge pull request #4690 from natali-rs1985/T7757Viacheslav Hletenko
T7757: VPP Verify buffers for rx/tx queues
2025-09-10nat: T7696: Fix NAT op-mode output for protocol and interface groupssarthurdev
2025-09-09bgp: T7760: remove per vrf instance system-as nodeChristian Breunig
VyOS 1.5 and onwards will no longer have the following CLI node available: set vrf name <name> protocols bgp system-as <asn>
2025-09-09bgp: T7760: deprecate per bgp vrf instance system-as nodeChristian Breunig
Originating from the bug in T7665. To avoid potential issues down the line - and given that there's no compelling technical reason to retain the system-as CLI node under per-VRF BGP configuration, which cannot be achieved through alternative means - the maintainers have collectively decided to deprecate the following command: set vrf name <name> protocols bgp system-as <asn> Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While it will still be accepted, it will no longer have any operational effect. A deprecation warning will be displayed at commit time, indicating that the BGP ASN from the global BGP configuration is now used instead. A migration script will handle the transition and perform the following actions: * Ensure a global BGP configuration exists; if not, initialize one. * Iterate over all configured VRFs to determine whether a BGP instance exists * For any insance, update the configuration to use the global system-as and apply the local-as ASN no-prepend replace-as option on all affected neighbors to preserve existing behavior. * If a neighbor is already configured with a local-as directive, that neighbor will be excluded from the migration process, as it already follows a custom configuration. * Add allowas-in per neighbor option. Required to not deny prefix received updates due to as-path contains our own global ASN.
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-30 12:35:17 +0000