| Age | Commit message (Collapse) | Author |
|---|
|
vyos-netlinkd: T9086: ignore stale link-DOWN; drain netlink during commit
|
|
Original bug: while a commit held the lock, the daemon called sleep(1)
without reading the netlink socket. The pending message stayed queued
in the kernel buffer, so once the commit ended, a stale event (e.g. a
DOWN from a disable that had already been re-enabled) got processed as
if it were fresh - stopping dhclient on an interface that was actually
back UP.
The applied fix keeps only the two pieces that are actually
load-bearing:
1. Drain instead of sleep - while commit_in_progress2() is true, still
call ipr.get() to read and discard any pending netlink messages, so
nothing stale survives to be processed after the commit ends.
2. Reconcile on commit end - once the commit finishes, walk all
matching interfaces, compare live sysfs operstate against the last
state the daemon acted on (_iface_prev_operstate), and run the
normal DHCP handler for any that disagree. This catches a real
transition that happened only inside the drain window and would
otherwise be silently lost.
Dropped from the original fix: an unconditional live-sysfs override
inside _handle_dhcp_events() that ran on every event, not just around
commits - redundant with reconcile, and risked discarding genuine fast
link flaps unrelated to any commit.
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
pki: T9135: derive ACME certificate chains from disk
|
|
op-mode: T7250: restore image/file path completion for show/copy/delete file
|
|
firewall: T8221: Add last-used option to firewall rules
|
|
firewall: T7552: Output rule in verify_rule() ConfigError messages
|
|
The imagefiles comptype dispatched to _vyatta_image_file_complete, a function
that was never ported when the legacy vyatta-op bash completion script was
imported in commit 72a704d2e2 ("T6527: add legacy Vyatta interpreter files
still in us"), causing "Invalid command: [_vyatta_image_file_complete]" on
tab-completion.
Port the original vyatta-image-complete interpreter so completion of works
again as it did on VyOS 1.4.x.
|
|
"show pki ca/certificate <name>" only ever offered PEM output, which isn't
practical for a human to actually read. Add a "text" form that runs the
certificate through OpenSSL's own "-text" formatter, the same human-readable
breakdown "openssl x509 -text" produces.
|
|
The local-file branch of CA certificate import recognized a file:// URL
by scheme but never actually decoded it - os.path.exists()/open() still
received the full "file://..." string rather than the path component, so
an explicit file:// URL always failed with "File not found" even when it
pointed at a real, readable file.
|
|
certbot_request() ultimately shells out via cmdl(), which can fail with
something other than ConfigError - e.g. FileNotFoundError if the certbot
binary itself is missing, or another OSError from the underlying process
call. The backup/restore wrapper around a certificate replacement only
caught ConfigError, so any other failure skipped restoration entirely and
left the certificate deleted with no way back, defeating the point of taking
a backup before requesting a replacement in the first place.
|
|
certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.
Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.
|
|
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
|
|
A failed certbot request or renewal only showed the CLI a raw dump of the
invoked command line and its exit code - not the actual reason (e.g. rate
limiting, failed domain validation), because certbot's own non-interactive
error reporting can itself crash on an unrelated internal bug while trying
to display the failure, masking it entirely from the captured output.
Read the real reason directly out of certbot's own debug log instead, scoped
to what the current invocation appended, and use it as the error message
shown to the user. Falls back to the previous generic message when no such
line is found.
|
|
An ACME-issued certificate's intermediate CA was previously imported into the
running configuration as a synthetic object, purely so consumers building a
full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could
find it. This leaked certbot's internal state into the CLI as a real, deletable
object that never needed to exist there: the intermediate is available on disk
the moment the certificate is issued, same as the leaf certificate and its key.
Read it live from disk instead, purely in memory, wherever a full chain is
resolved or displayed - never as a settable or deletable configuration object.
An already-configured CA that completes the chain on its own takes precedence
and nothing synthetic is added.
Adding, changing, or removing a CA now reloads only the services whose resolved
chain is actually affected, with no side effect on certificates whose own
content did not change.
|
|
The path argument to the CA import command now also accepts a remote URL
(http, https, ftp, sftp, scp, tftp, ...), detected by scheme, in addition to
a local file path. Makes it convenient to pull a well-known public intermediate
directly by URL instead of downloading and pasting PEM content by hand.
|
|
container: T7736: fix smoketest failures caused by netavark/aardvark-dns IPv6 DAD race
|
|
flow-accounting: T9122: bind NetFlow export to the configured VRF
|
|
netavark assigns the IPv6 gateway address to a container "pod-*" bridge
and immediately invokes aardvark-dns to bind its DNS listener to it. While
the address is "tentative" during Duplicate Address Detection, that bind()
fails with EADDRNOTAVAIL and container startup fails for any IPv6-enabled
network.
The kernel only skips DAD for an address if both "all" and the specific
interface's own accept_dad are disabled at the moment the interface is
created. A per-interface override is always either too late for a network's
first-ever container - as the network can only be created in-time and not
explicitly before starting the first container.
|
|
Podman's default "vethN" auto-naming for a container's host-side veth can
collide with VyOS's own "virtual-ethernet vethN" interfaces.
Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name"
network connect option) and use it to name every non-macvlan container network
attachment "veth-<container name>" instead, eliminating the collision by
construction. Container names too long to fit are shortened to a recognizable
prefix plus a short hash of the full name; verify() rejects the rare case
where two containers still generate the same interface name.
Add "show container interface" to display the resulting name-to-container
mapping.
|
|
|
|
|
|
vpp: T8468: Apply MAC address changes on VPP interfaces
|
|
vpp: T9139: Check interface not referenced by a feature before removal
|
|
vyos-netlinkd: T9143: seed operstate cache at startup
|
|
fstrim: T9133: skip /etc/fstab to properly identify devices to trim
|
|
- Add last-used option to firewall rules
- Updated output of show firewall to include last-used
- Added smoketest for last-used option
|
|
I had initially treated the VRF as just another interface that could be
used as a source-interface, but after a bit more research none of the
major vendors treat VRFs as interfaces - Cisco and Juniper both source a
flow exporter from a routed interface and never from a VRF - and I don't
think we should either.
Reject a source-interface that names a VRF device with a clear message
instead of the misleading "is not a member of VRF" error, and cover the
rejection in the smoketest. VRF export continues to be selected through
the "system flow-accounting vrf" node.
|
|
After the migration from pmacct to the ipt_NETFLOW kernel module the
"system flow-accounting vrf" node no longer had any effect on the export
path. NetFlow is emitted by the kernel module, so there is no daemon left
to wrap in "ip vrf exec" and the module socket was never bound to the VRF.
A collector reachable only inside a VRF therefore never received any flows
when the export was configured with a source-address.
Bind the export socket to a device via the ipt_NETFLOW "%device"
destination suffix: a per-server source-interface takes precedence,
otherwise the global VRF device is used, reproducing the previous
"ip vrf exec" behaviour. The module parses "@source-address" before
"%device", so the source-address is now rendered first - the previous
template emitted them in the opposite order, which only worked because the
two options are mutually exclusive per server.
Reject a source-interface that is used together with a VRF but is not a
member of that VRF: the exported flows would otherwise silently leave via
a different routing table. This mirrors the existing OSPF, OSPFv3, IS-IS
and BGP checks.
|
|
The state tracker starts empty whenever vyos-netlinkd starts, so the first same-state RTM_NEWLINK UP notification is treated as a transition and unnecessarily restarts DHCP.
Seed matching interface states from the kernel link dump after binding the rtnetlink socket. This preserves real DOWN-to-UP handling while suppressing the first redundant UP notification.
|
|
Reject deletion of a gre, ipip, vxlan or loopback interface that is still
used by a feature.
|
|
The interface config filter stripped the "mac" node, so a MAC address
configured on a VPP interface never reached the dataplane. Allow "mac"
through the filter; VPP applies it to the hardware interface via lcp-sync.
Some DPDK drivers (e.g. vmxnet3) cannot change the MAC and would fail to
bring the interface up. Reject such a change at verify time - both when
setting the MAC and when adding an interface that already has one to VPP.
|
|
The default (coming from util-linux) fstrim.service in VyOS fails to
perform any trimming because it stops evaluating mount points after
reading /etc/fstab, which contains only overlay filesystems that
fstrim inherently ignores.
More info: https://vyos.dev/T9133
|
|
apply_interface() unconditionally deleted the "parent ffff:" ingress
qdisc before re-applying QoS, even for interfaces with an egress-only
policy.
Since call_dependents() had already restored an unrelated ingress
redirect/mirror qdisc on that handle just before, and only directions
present in the interface's QoS config get re-applied, the redirect
was silently lost and never recreated.
|
|
This fixes just the case for the Bash project added via commit b12a8c5ae
("image: T9021: Save bash history during image upgrade")
|
|
vpp: T8367: Fix identical default MAC on bridged loopback interfaces
|
|
firewall: T9076: add per-remote-group update interval
|
|
Previously, bash history was silently lost on every image upgrade,
forcing operators to start with an empty history each time.
Extend the image upgrade script to detect and migrate bash history
files from the currently running image to the newly installed one.
|
|
T9073: frr-exporter: add CLI support for optional collectors and collector options
|
|
wireless: T9104: fix CLI/OS race on interface removal
|
|
VPP assigns loopback interfaces a default MAC address derived only from
the interface instance number (de:ad:00:00:00:<instance>), with no
host-specific entropy. Two independent VPP nodes configuring the same
loopback instance (e.g. as a bridge BVI over VXLAN) therefore end up with
an identical MAC address.
When that MAC arrives from a peer over the shared L2 segment, VPP's L2
learning logic rejects it as a `mac move violation` - it's statically
pinned to the local BVI and cannot legitimately appear on another port.
This silently drops ARP traffic between the loopbacks while ordinary
bridged client traffic (unique MACs) is unaffected, breaking
loopback-to-loopback connectivity.
Add a mac-address option to the VPP loopback interface, and fall back to
a deterministic, host-unique MAC (derived from host UUID/hostname, same
scheme already used for container interfaces) whenever none is
configured, so the collision can no longer occur by default.
Also fix a related bug found while reproducing the above: a loopback is
fully deleted and recreated in VPP on every apply, receiving a new
`sw_if_index` each time. The loopback conf_mode script never registered
the bridge it's a BVI member of as a dependent, so the bridge kept its
L2 membership bound to the stale, deleted index instead of reattaching
the current one. Register the bridge dependency and reuse the existing
`verify_vpp_remove_bridge_interface()` check to block deleting a
loopback still in use as a BVI.
|
|
A classical race condition detected depending on host system CPU load while
executing smoketests.
Removal of the Wireless/Wifi interfaces can cause a KeyError.
Traceback (most recent call last):
File "/usr/libexec/vyos/conf_mode/interfaces_wireless.py", line 414, in <module>
apply(c)
File "/usr/libexec/vyos/conf_mode/interfaces_wireless.py", line 325, in apply
WiFiIf(**wifi).remove()
^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/vyos/ifconfig/interface.py", line 358, in __init__
self._create()
File "/usr/lib/python3/dist-packages/vyos/ifconfig/wireless.py", line 33, in _create
cmd = ['iw', 'phy', self.config['physical_device'], 'interface', 'add',
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
KeyError: 'physical_device'
In src/conf_mode/interfaces_wireless.py:apply(), the delete path
unconditionally does WiFiIf(**wifi).remove(). Since the wifi dict for a
deleted node never contains physical_device, and Interface.__init__ calls
self._create() whenever the kernel interface doesn't already exist,
WiFiIf._create() crashes with KeyError: 'physical_device' when the interface
never actually got created (or already vanished) before deletion.
|
|
Complete the safer-subprocess migration started by the cmdl()/ifconfig
refactoring and convert every remaining vyos.utils.process.cmd() call site to
the list-based cmdl().
Drop the vyos.utils.process.cmd() implementation as it is no longer in use.
|
|
T8529: Add configuration CLI to enable OpenSSL FIPS
|
|
T9079: Update on-dhcpv6-event.sh
|
|
wireguard: T8921: Fix false port-conflict error on qos dependent re-verify
|
|
options
frr_exporter v1.5.0 enables the bgp, ospf, bfd and route collectors by
default, while bgpl2vpn, pim and vrrp must be enabled explicitly. Expose
bgpl2vpn (CLI: bgp-l2-vpn) and pim under "service monitoring prometheus
frr-exporter collector", following the same CLI style as the
node-exporter collectors node. The vrrp collector is not exposed since
VyOS implements VRRP with keepalived and FRR's vrrpd is never started.
Also expose the collector options available in v1.5.0:
- collector bgp accept-filtered-prefixes
- collector bgp advertised-prefixes
- collector bgp peer-description <json|plain-text>
- collector bgp peer-group
- collector bgp peer-hostname
- collector bgp peer-type
- collector ospf-instance <id>
- collector detailed-routes
The bgp.* options are shared by the bgp, bgp6 and bgpl2vpn collectors
upstream. The bgp6 collector remains unconditionally enabled, hence
existing configurations render the same ExecStart and no migration is
required.
Includes code generated by Claude Code
|
|
T9068: Add config manager module and refactor vyos-configd
|
|
|
|
Add 'set firewall group remote-group <name> interval <value>' to
control how often each remote group list is re-downloaded,
independent of the global resolver-interval that also drives
domain-group/FQDN resolution.
The value accepts plain seconds or time-unit suffixes s/m/h/d/w
(e.g. 4h), range 60 seconds to 4 weeks, enforced at commit time
after conversion. When unset, the group keeps following
'firewall global-options resolver-interval', so existing
configurations are unaffected.
vyos-domain-resolver now tracks a last-update timestamp per
remote group and sleeps until the next due update instead of a
fixed resolver-interval tick, honoring per-group intervals both
shorter and longer than the global one. A group is only stamped
as updated after a successful download; failed downloads fall
back to the cached list and are retried at the resolver cadence
rather than after the full group interval.
human_to_seconds() now treats a plain number as seconds instead
of returning 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
qos.py re-invokes this script mid-commit after the interface has
already bound its port, causing the port-availability check to fail
against itself and drop the whole QoS config. This can happen on any
commit that sets or changes the port. Skip the check on that dependent
re-run only.
|
