| Age | Commit message (Collapse) | Author |
|---|
|
vpp: T8468: Apply MAC address changes on VPP interfaces
|
|
vpp: T9139: Check interface not referenced by a feature before removal
|
|
vyos-netlinkd: T9143: seed operstate cache at startup
|
|
fstrim: T9133: skip /etc/fstab to properly identify devices to trim
|
|
The state tracker starts empty whenever vyos-netlinkd starts, so the first same-state RTM_NEWLINK UP notification is treated as a transition and unnecessarily restarts DHCP.
Seed matching interface states from the kernel link dump after binding the rtnetlink socket. This preserves real DOWN-to-UP handling while suppressing the first redundant UP notification.
|
|
Reject deletion of a gre, ipip, vxlan or loopback interface that is still
used by a feature.
|
|
The interface config filter stripped the "mac" node, so a MAC address
configured on a VPP interface never reached the dataplane. Allow "mac"
through the filter; VPP applies it to the hardware interface via lcp-sync.
Some DPDK drivers (e.g. vmxnet3) cannot change the MAC and would fail to
bring the interface up. Reject such a change at verify time - both when
setting the MAC and when adding an interface that already has one to VPP.
|
|
The default (coming from util-linux) fstrim.service in VyOS fails to
perform any trimming because it stops evaluating mount points after
reading /etc/fstab, which contains only overlay filesystems that
fstrim inherently ignores.
More info: https://vyos.dev/T9133
|
|
apply_interface() unconditionally deleted the "parent ffff:" ingress
qdisc before re-applying QoS, even for interfaces with an egress-only
policy.
Since call_dependents() had already restored an unrelated ingress
redirect/mirror qdisc on that handle just before, and only directions
present in the interface's QoS config get re-applied, the redirect
was silently lost and never recreated.
|
|
This fixes just the case for the Bash project added via commit b12a8c5ae
("image: T9021: Save bash history during image upgrade")
|
|
vpp: T8367: Fix identical default MAC on bridged loopback interfaces
|
|
firewall: T9076: add per-remote-group update interval
|
|
Previously, bash history was silently lost on every image upgrade,
forcing operators to start with an empty history each time.
Extend the image upgrade script to detect and migrate bash history
files from the currently running image to the newly installed one.
|
|
T9073: frr-exporter: add CLI support for optional collectors and collector options
|
|
wireless: T9104: fix CLI/OS race on interface removal
|
|
VPP assigns loopback interfaces a default MAC address derived only from
the interface instance number (de:ad:00:00:00:<instance>), with no
host-specific entropy. Two independent VPP nodes configuring the same
loopback instance (e.g. as a bridge BVI over VXLAN) therefore end up with
an identical MAC address.
When that MAC arrives from a peer over the shared L2 segment, VPP's L2
learning logic rejects it as a `mac move violation` - it's statically
pinned to the local BVI and cannot legitimately appear on another port.
This silently drops ARP traffic between the loopbacks while ordinary
bridged client traffic (unique MACs) is unaffected, breaking
loopback-to-loopback connectivity.
Add a mac-address option to the VPP loopback interface, and fall back to
a deterministic, host-unique MAC (derived from host UUID/hostname, same
scheme already used for container interfaces) whenever none is
configured, so the collision can no longer occur by default.
Also fix a related bug found while reproducing the above: a loopback is
fully deleted and recreated in VPP on every apply, receiving a new
`sw_if_index` each time. The loopback conf_mode script never registered
the bridge it's a BVI member of as a dependent, so the bridge kept its
L2 membership bound to the stale, deleted index instead of reattaching
the current one. Register the bridge dependency and reuse the existing
`verify_vpp_remove_bridge_interface()` check to block deleting a
loopback still in use as a BVI.
|
|
A classical race condition detected depending on host system CPU load while
executing smoketests.
Removal of the Wireless/Wifi interfaces can cause a KeyError.
Traceback (most recent call last):
File "/usr/libexec/vyos/conf_mode/interfaces_wireless.py", line 414, in <module>
apply(c)
File "/usr/libexec/vyos/conf_mode/interfaces_wireless.py", line 325, in apply
WiFiIf(**wifi).remove()
^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/ifconfig/interface.py", line 358, in __init__
self._create()
File "/usr/lib/python3/dist-packages/vyos/ifconfig/wireless.py", line 33, in _create
cmd = ['iw', 'phy', self.config['physical_device'], 'interface', 'add',
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
KeyError: 'physical_device'
In src/conf_mode/interfaces_wireless.py:apply(), the delete path
unconditionally does WiFiIf(**wifi).remove(). Since the wifi dict for a
deleted node never contains physical_device, and Interface.__init__ calls
self._create() whenever the kernel interface doesn't already exist,
WiFiIf._create() crashes with KeyError: 'physical_device' when the interface
never actually got created (or already vanished) before deletion.
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
T8529: Add configuration CLI to enable OpenSSL FIPS
|
|
T9079: Update on-dhcpv6-event.sh
|
|
wireguard: T8921: Fix false port-conflict error on qos dependent re-verify
|
|
options
frr_exporter v1.5.0 enables the bgp, ospf, bfd and route collectors by
default, while bgpl2vpn, pim and vrrp must be enabled explicitly. Expose
bgpl2vpn (CLI: bgp-l2-vpn) and pim under "service monitoring prometheus
frr-exporter collector", following the same CLI style as the
node-exporter collectors node. The vrrp collector is not exposed since
VyOS implements VRRP with keepalived and FRR's vrrpd is never started.
Also expose the collector options available in v1.5.0:
- collector bgp accept-filtered-prefixes
- collector bgp advertised-prefixes
- collector bgp peer-description <json|plain-text>
- collector bgp peer-group
- collector bgp peer-hostname
- collector bgp peer-type
- collector ospf-instance <id>
- collector detailed-routes
The bgp.* options are shared by the bgp, bgp6 and bgpl2vpn collectors
upstream. The bgp6 collector remains unconditionally enabled, hence
existing configurations render the same ExecStart and no migration is
required.
Includes code generated by Claude Code
|
|
T9068: Add config manager module and refactor vyos-configd
|
|
|
|
Add 'set firewall group remote-group <name> interval <value>' to
control how often each remote group list is re-downloaded,
independent of the global resolver-interval that also drives
domain-group/FQDN resolution.
The value accepts plain seconds or time-unit suffixes s/m/h/d/w
(e.g. 4h), range 60 seconds to 4 weeks, enforced at commit time
after conversion. When unset, the group keeps following
'firewall global-options resolver-interval', so existing
configurations are unaffected.
vyos-domain-resolver now tracks a last-update timestamp per
remote group and sleeps until the next due update instead of a
fixed resolver-interval tick, honoring per-group intervals both
shorter and longer than the global one. A group is only stamped
as updated after a successful download; failed downloads fall
back to the cached list and are retried at the resolver cadence
rather than after the full group interval.
human_to_seconds() now treats a plain number as seconds instead
of returning 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
qos.py re-invokes this script mid-commit after the interface has
already bound its port, causing the port-availability check to fail
against itself and drop the whole QoS config. This can happen on any
commit that sets or changes the port. Skip the check on that dependent
re-run only.
|
|
udev: T9071: fix invalid ATTR key assignment
|
|
Prefent ISO build issue:
Skipping overridden file '/usr/lib/udev/rules.d/40-usb_modeswitch.rules'.
Reading rules file: /etc/udev/rules.d/40-usb_modeswitch.rules
|
|
This fixes a (cosmetic) error which pops up in the logfiles:
40-usb_modeswitch.rules:4 ATTR key takes '==', '!=', or '=' operator, assuming '='.
It was introduced in commit 93406237d ("wwan: T8924: add UDEV configuration for
USB modeswitch")
|
|
vpp: T9018: Auto-enable promiscuous mode for interfaces with VLANs
|
|
vpp: T9062: Enable DHCP/DHCPv6 client detection on VLAN sub-interfaces
|
|
The 'ip4-dhcp-client-detect' and 'ip6-icmp-ra-punt' VPP features were only
ever enabled on the base ethernet interface, so DHCP and DHCPv6 clients
never worked on VLAN sub-interfaces (vif/vif-s) of a VPP-managed interface.
Apply the same feature toggles to each vif/vif-s using its own address
configuration. vif-c is intentionally excluded, as Q-in-Q sub-interfaces
are not currently functional under VPP.
|
|
|
|
remote: T8829: fall back to GET when HEAD is not supported
|
|
VPP drops VLAN-tagged frames unless the parent interface has promiscuous
mode enabled, causing VLAN sub-interfaces to lose connectivity.
Automatically enable promiscuous mode on VPP interfaces that have VLAN
sub-interfaces (vif/vif-s) configured.
|
|
T8344: Preserve symlinks when copying config to/from TPM encrypted volume
|
|
T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured
|
|
Add the new configuration CLI to enable OpenSSL FIPS-140
(Federal Information Processing Standard) cryptographic modules
|
|
shutil.copytree() defaults to symlinks=False, so it recurses into
symlinked directories and recreates them as real directories instead
of preserving the symlink.
cloud-init creates /opt/vyatta/etc/config/cloud/instance as a symlink
to instances/i-<id>. Enabling/disabling config encryption copied this
tree with copytree() and silently turned that symlink into a real
directory, causing cloud-init to fail on later runs with:
IsADirectoryError: [Errno 21] Is a directory: '.../cloud/instance'
Pass symlinks=True to preserve symlinks during the copy.
|
|
The blackbox-exporter runs as node_exporter user which cannot create
ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW
capability to the systemd service when ICMP modules are configured.
In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet.
In VRF mode, replace runuser with setpriv to preserve the capability
across the UID change.
|
|
This change re-implements the intended behaviour from T4180 aswell as from
T4506, it ensures that both the vrf-member interface aswell as the vrf itself
is added as an oifname -> meaning that traffic traversing and originating from
withing VyOS is matches outbound.
Changes done by c-po:
* re-sort dependency list to keep diff low
* vyos.configdict.is_vrf_changed() should return early and not carry
over the to-be return value
* keep common coding style (dict by . separation) in nftables-zone.j2
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
T8963: policy-route: trigger domain resolver for domain groups
|
|
Authentication protocols are implemented as modules in accel-ppp-ng.
The CLI setting configures which modules need to be loaded, for this
change to take effect pppoe server must be restarted.
|
|
https: T9022: serve the full CA certificate chain
|
|
ci: T8490: fix typos in comments, strings, and local identifiers
|
|
utils: T9003: add list-argument variant of cmd() for safer subprocess execution
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
When a certificate is assigned to the HTTPS service, nginx was only
sent the leaf certificate. An intermediate CA was included only when
an operator manually configured "ca-certificate", and even then just
that single CA - the rest of the issuer chain was never followed.
As a result, clients that do not already trust the issuing intermediate
CA (for example Let's Encrypt's newer E- and R-series intermediates)
could not build a path to a trusted root and rejected the connection.
Build the complete chain from the CA certificates present in the PKI
using find_chain(), the same helper already used by HAProxy, OpenConnect,
stunnel and the other PKI consumers. The intermediate chain is now
discovered automatically, so configuring "ca-certificate" is no longer
required; it remains accepted for backwards compatibility.
|
|
bgp: T8865: Reject `vni` sub-block in VRF l2vpn-evpn when `advertise-all-vni` is globally active
|
|
geoip: T8987: Support updates via source-address/vrf
|
