summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2026-05-20load-balancing: T7928: Fix port conflict check to respect `listen-address` ↵Alexandr K.
(#5186) The port availability check in `verify()` was using `front_config.get('address')` which always resolved to `None`, causing the validator to treat any process holding a given port number as a conflict regardless of which IP it was bound to.
2026-05-20T7880: Add NTP hardware timestamp receive-filter compatibility check (#5160)Nataliia S.
Add a check to determine whether the NIC supports hardware timestamp receive filters required for NTP timestamping. Implement the query in a new python/vyos/netlink/timestamp.py module using pyroute2 generic netlink ETHTOOL_MSG_TSINFO_GET, avoiding ethtool output parsing.
2026-05-20T6933: fix "system option performance" overwrites sysctl parameters from ↵Christian Breunig
firewall (#5206) sysctl values written by firewall global-options are overwritten when using "system option performance" configuration on VyOS CLI. This is caused by a missing dependency fall from system_option.py to the firewall CLI helper script.
2026-05-18vyos-netlinkd: T8781: try IPRoute.bind() RTNL subscription first (#5207)Christian Breunig
Not all pyroute2 versions which ship IPRoute() support subscribing to RTNL multicast groups. If subscribing fails, fallback to all messages.
2026-05-15vyos-netlinkd: T8781: use faster commit_in_progress2 with order O(1)Christian Breunig
Move to the re-implementation of the commit in progress check added in commit 002d45b70efd ("vyos.commit: T8781: move from O(n) to O(1) for commit_in_progress() checks").
2026-05-15vyos-netlinkd: T8781: do not call commit_in_progress() for EVERY netlink ↵Christian Breunig
message (#5199) * vyos-netlinkd: T8781: do not call commit_in_progress() for EVERY netlink message Signed-off-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one> * vyos-netlinkd: T8781: restrict netlink subscription to link multicast group Bind IPRoute with RTMGRP_LINK only so route/rule/neighbour/address updates (e.g. full-table BGP) are not delivered to this socket. Add a match wildcard so unexpected message types do not raise MatchError and get logged as generic errors. --------- Signed-off-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one> Co-authored-by: Fabrizzio Petrucci <fabrizziopm@compumundohipermegared.one>
2026-05-14Merge pull request #5182 from c-po/systemctl-stop-helperChristian Breunig
T8831: smoketests: irregular PermissionError caused by systemctl stop
2026-05-14T8831: smoketests: irregular PermissionError caused by systemctl stopChristian Breunig
Failures appear during PPPoEIf.remove() -> flush_addrs() -> set_dhcpv6(False), where disable uses self._cmd(f'systemctl stop ...'), which raises on any non-zero exit code of cmd(). PermissionError: [Errno 1] is misleading: cmd() raises OSError(exit_code, feedback); exit code 1 maps to PermissionError in Python 3, so logs point at "permissions" while the real signal is systemctl stop returned 1 (job failure, timeout, restart contention with Restart=always on dhcp6c@.service. Add a small systemd teardown helper stop_systemd_unit() validating the return codes from the "systemctl stop" calls.
2026-05-13bgp: T8588: Add match source-peer to policy route-map (#5149)Robin Christ
2026-05-13T8600: Add option to change logging verbosity in Kea (#5178)Nataliia S.
2026-05-13serial: T8853: limit "kernel" CLI option to ttyS and ttyAMA interfaces only ↵Christian Breunig
(#5193) Recently (commit 35db941bcf "serial: T8375: add CLI option to explicitly set kernel console") we added the CLI knob to enable the Kernel and GRUB serial console on a given device. Currently this is supported for serial console interfaces starting with ttyS and ttyAMA only. Main limitation is that these interfaces are wired to the CPU and bootloader infos can be displayed.
2026-05-12wan: T8481: scope flush-connections to WLB connection marks (#5163)Simon
* wan: T8481: scope flush-connections to WLB connection marks flush-connections runs conntrack --delete which destroys all conntrack entries system-wide, including unrelated NAT translations and established connections that have nothing to do with WLB. WLB tags every connection it manages with a conntrack mark via the wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope the flush to these marks so only WLB-managed connections are affected. Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> * wan: T8481: replace conntrack deletion from state changed block --------- Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
2026-05-11Merge pull request #5162 from natali-rs1985/T8760Christian Breunig
dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface option
2026-05-11bgp: T8607: Add CLI support for BGP update-delay and establish-waitNataliia Solomko
2026-05-06Merge pull request #5159 from c-po/kernel-6.18Christian Breunig
T8147: Update Linux Kernel to 6.18
2026-05-04dhcp-relay: T7879: verify listen and upstream interfaces existNataliia Solomko
2026-05-04dhcp-relay: T8760: Remove redundant deprecation warning for legacy interface ↵Nataliia Solomko
option
2026-05-02Debian: T8147: remove out-of-tree OpenVPN DCO module - incl. in Kernel 6.18Christian Breunig
Move from the out-of-tree to an in-tree variant of the OpenVPN DCO module. As this was not available in the previous used LTS 6.6 Kernel it now is available while we upgrade to Linux 6.18.
2026-04-30Merge pull request #5152 from alexandr-san4ez/T8280-currentChristian Breunig
migration: T8280: Fix auth file read for interfaces on first boot of new image
2026-04-30T6750: sr-te: Adding initial Segment Routing Traffic Engineering portion of ↵Cheeze-It
FRR (#4994) * sr-te: T6750: Adding Segment Routing Traffic Engineering portion of FRR --------- Co-authored-by: Cheeze_It <none@none.com> Co-authored-by: Christian Breunig <christian@breunig.cc>
2026-04-30Merge pull request #5140 from josephillips85/currentViacheslav Hletenko
T8539: Unable to traceroute using hostname and ipv6 source address
2026-04-28Merge pull request #5146 from c-po/serialChristian Breunig
utils: T8541: add write-config-file-value helper
2026-04-28migration: T8280: Fix auth file read for interfaces on first boot of new imageOleksandr Kuchmystyi
During first boot after installing a new VyOS image, migrations are executed before the filesystem is fully initialized. At this point `/config` is not yet bind-mounted, causing auth files (certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet EAPoL interfaces under `/config/auth` to be inaccessible even though they exist under the underlying `/opt/vyatta/etc/config/auth` path which is available at all boot stages. Add fallback logic to `read_auth_file()` to retry the file lookup under `/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.
2026-04-27T8293: Add ability to set timeout for high-availability health-checkNataliia Solomko
Setting a timeout allows VRRP health-check scripts to run longer than the set interval. Without timeout, keepalived considers the script as failed after interval seconds. With timeout set higher than interval, the script has more time to complete before being marked as failed and transitioning VRRP to FAULT state.
2026-04-26utils: T8541: add write-config-file-value helperChristian Breunig
Introduce src/helpers/write-config-file-value.py to patch a saved config.boot from scripts by writing a quoted CLI path with an optional value (omit --value to create a valueless node). Extend vyos.utils.config.write_saved_value() to safely update saved configs: create missing parent nodes before tagging (ConfigTree.set_tag requires nodes to exist) and then write the requested value/valueless leaf back to disk. Remove the legacy serial console activation script which is now replaced by the helper-based approach. The helper is run once during ISO Image assembly and will inject the approprate serial console defintiions into config.boot.default.
2026-04-24Merge pull request #5130 from natali-rs1985/T8460Viacheslav Hletenko
vpp: T8460: Use isolated cpus for VPP cpu-cores
2026-04-24Merge pull request #5129 from inetman28/fix-acl-subinterfacesViacheslav Hletenko
VPP: T8495: fix issue with assigning acl on sub interfaces
2026-04-24Merge pull request #5137 from c-po/sr-sysctl-fixViacheslav Hletenko
T8534: refactor sysctl_(read|write) to accept key parts
2026-04-22traceroute: T8539: fix invalid hostnameJose Phillips
2026-04-21traceroute: T8539: fix source-address AF lookupJose Phillips
2026-04-21Merge pull request #5136 from c-po/vyos-utils-mergeViacheslav Hletenko
T8532: merge unrelated histories of vyos-utils and vyos-1x repo
2026-04-21vpp: T8460: Use isolated cpus for VPP cpu-coresNataliia Solomko
VPP CPU core assignment now uses kernel-isolated CPUs (from /sys/devices/system/cpu/isolated) with explicit corelist-workers instead of computing offsets from available cores with skip-cores/workers. Added validation that enough CPUs are actually isolated before VPP starts, and that isolate-cpus config only references existing CPU IDs. Moved smoketest for kernel option 'isolate-cpus' to test_vpp.py
2026-04-21Merge pull request #5100 from sarthurdev/T8446Daniil Baturin
firewall: T8446: Prevent chain with offload rule on local zone
2026-04-21Merge branch 'current' into vyos-utils-mergeDaniil Baturin
2026-04-21traceroute: T8539: fix IPv6 hostname resolutionJose Phillips
2026-04-21T8534: refactor sysctl_(read|write) to accept key partsChristian Breunig
Interface names can contain dots (e.g. VLAN subinterfaces like eth0.10), which conflicts with sysctl's dot-separated key syntax. Change sysctl_read() and sysctl_write() to take key components as a list and normalize each component by replacing . with / before invoking sysctl. This fixes sysctl lookups/updates for VLAN subinterfaces. Extend the SR-TE smoketest to cover a VLAN subinterface. Previous error raising this issue: vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/10/seg6_enabled: No such file or directory vyos-configd: sysctl: cannot stat /proc/sys/net/ipv6/conf/eth0/201/seg6_enabled: No such file or directory
2026-04-20Merge pull request #5096 from jestabro/extend-activation-systemJohn Estabrook
T8445: T8335: Extend config activation system
2026-04-20VPP: T8495: Apply suggestions from code reviewRuslan Volodin
2026-04-20VPP: T8495: fix issue with assigning acl on sub interfacesRuslan Volodin
2026-04-19T8532: update URL and bump version of OCaml toolsChristian Breunig
2026-04-19Merge branch 'current' of github.com:vyos/vyos-utils into vyos-utils-mergeChristian Breunig
* 'current' of github.com:vyos/vyos-utils: (65 commits) T8269: add option to silence output of individual validators T8306: update package version vyos-op-run: T8306: add error messages for system exceptions vyos-op-run: T8306: improve execution logic logging vyos-op-run: T8301: improve the security of UID check and setuid logic T8110: "list_interfaces --bondable" must not return VLAN subinterfaces vyos-op-run: T7901: skip permission checks if the user is root vyos-op-run: T8005: sanitize environment variables to prevent malicious variable injection T7878: conflict check updated to use mergify T7878: conflict check updated to use mergify T7899: virtual-ethernet interfaces support broadcasts Debian: T7899: bump dh compat version T7758: add missing case to allow repeated option --type T7758: allow repeated option --type in list_interfaces vyos-op-run: T7745: add a command permission checking mechanism op-mode: T7583: add a new operational command runner T7644: mirror workflow refactoring rollout T7579: fix of the run trigger for CLA T7579: added workflow for CLA validators: T6622: Radix-aware numeric validation ...
2026-04-17Merge pull request #5122 from c-po/op-mode-sensorsViacheslav Hletenko
op-mode: T8483: fix /show_sensors.py: No such file or directory
2026-04-16Merge pull request #5133 from c-po/serial-console-for-loopChristian Breunig
serial: T8375: call update_serial_console() only once for default tty
2026-04-16op-mode: T8483: remove hypervisor checks from sensors detectionChristian Breunig
Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is arbitrary and can produce incorrect behavior. Sensors can be passed through to virtual machines, so running in a VM should not be treated differently. If no sensors are detected - whether on a hypervisor VM or on bare metal - the command now reports: "No sensors found".
2026-04-16op-mode: T8483: fix whitespace format issues for show_sensors.pyChristian Breunig
2026-04-16Merge pull request #5132 from natali-rs1985/T8505Daniil Baturin
vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API call
2026-04-16Merge pull request #5113 from srnoth/T8211-multiport-serial-symlinksDaniil Baturin
serial: T8211: fix symlink collisions for multi-port USB serial adapters
2026-04-16vpp: T8505: Switch PPPoE bindings retrieval from CLI parsing to API callNataliia Solomko
2026-04-15T8445: set activation hint during install imageJohn Estabrook
2026-04-15T8445: update ethernet offload support activation scriptJohn Estabrook
Use refined activation tools for correct behavior on first installed boot.
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-31 19:09:46 +0000