summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2025-09-17ssh: T7839: add deprecation warning for DSA hostkey-algorithm usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com
2025-09-17login: T7839: add deprecation warning for DSS public-key usageChristian Breunig
OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following users are using SSH-DSS keys for authentication. User "vyos" with deprecated public-key named: foo
2025-09-17T7796: PPPoE-server add mapping in vpp if vpp-cp is enabledNataliia Solomko
2025-09-16op-mode: T7746: Fix 'show interfaces' description wrappingl0crian1
- Fixed incorrect wrapping of 'show interfaces' description
2025-09-16container: T7681: fix multiple name serversl0crian1
- Fixed error with multiple name servers missing space between --dns options
2025-09-16T7806: VPP do not allow skip-cores to be configured without main-coreNataliia Solomko
2025-09-16Merge pull request #4696 from natali-rs1985/T7783Daniil Baturin
T7783: T7786: VPP clarify error messages for CPU requirements
2025-09-16Merge pull request #4688 from hedrok/T75-migration-to-ipt-netflowDaniil Baturin
T75: migrate from pmacct to ipt_NETFLOW
2025-09-16Merge pull request #4717 from c-po/no-ipv6-default-routeDaniil Baturin
dhcpv6: T7646: restore missing default route after upgrade
2025-09-16T7783: T7786: VPP clarify error messages for CPU requirementsNataliia Solomko
2025-09-16T75: migrate from pmacct to ipt_NETFLOWKyrylo Yatsenko
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'
2025-09-15Merge pull request #4689 from davi2367/vrf-dhcpDaniil Baturin
T6211: Fix kea VRF op-mode commands
2025-09-15Merge pull request #4686 from l0crian1/container-macvlanDaniil Baturin
container: T7186: Add macvlan network type for containers
2025-09-15Merge pull request #4289 from nvandamme/currentDaniil Baturin
op-mode: T5992: show dhcpv6 leases with (mostly) the same fields as dhcp leases
2025-09-14kea: T7821: Update Kea to 3.0sarthurdev
2025-09-14vyos.utils: T7740: update dict_search to return optional default value (#4700)l0crian1
2025-09-13Debian: T7817: vyos_net_name exists in debian/tmp but is not installed to ↵Christian Breunig
anywhere Fix this build warning by placing the vyos_net_name script in it's own udev folder to not accidently be copied to a wrong location.
2025-09-13dhcpv6: T7646: restore missing default route after upgradeChristian Breunig
Commit de44c6aef249 ("interface: T7379: do not request SLAAC default route when only DHCPv6 is set") introduced a behavioral change while addressing an earlier issue fixed in e9fb2078d5ea ("interface: T7375: SLAAC assigned address is not cleared when removing SLAAC"). This change caused unintended connectivity loss after upgrading to VyOS 1.4.3. The underlying reason is that VyOS now requires explicit configuration to determine how IPv6 addressing and routing should be handled, rather than making assumptions: Requesting a DHCPv6 address alone will correctly assign an address. However, since the IPv6 default route is typically advertised via SLAAC (and not DHCPv6), SLAAC must also be explicitly enabled to receive the default route. Historically, this distinction was implicit and did not require additional configuration. To preserve backward compatibility, a configuration migrator has been added. It inspects existing configurations that only request a DHCPv6 address and automatically appends the required CLI node to also enable SLAAC, ensuring that the default route is restored after upgrade.
2025-09-12Merge pull request #4709 from l0crian1/reset-bgp-all-in-out-softViacheslav Hletenko
op-mode: T7516: expand 'reset bgp all' elements with in/out/soft options
2025-09-11Merge pull request #4707 from sarthurdev/T7696Christian Breunig
nat: T7696: Fix NAT op-mode output for protocol and interface groups
2025-09-10BGP: T7516: Expand 'reset bgp all' elements with in/out/soft optionsl0crian1
- Added 'in', 'out', and 'soft' options to all 'reset bgp all' elements - Replaced calls to vtysh_wrapper.sh with new bgp.py reset function - Replaced direct 'vtysh -c' calls with new bgp.py reset function
2025-09-10wlb: T114: Add firewall group support for WAN load balancersarthurdev
2025-09-10Merge pull request #4690 from natali-rs1985/T7757Viacheslav Hletenko
T7757: VPP Verify buffers for rx/tx queues
2025-09-10nat: T7696: Fix NAT op-mode output for protocol and interface groupssarthurdev
2025-09-09bgp: T7760: remove per vrf instance system-as nodeChristian Breunig
VyOS 1.5 and onwards will no longer have the following CLI node available: set vrf name <name> protocols bgp system-as <asn>
2025-09-09bgp: T7760: deprecate per bgp vrf instance system-as nodeChristian Breunig
Originating from the bug in T7665. To avoid potential issues down the line - and given that there's no compelling technical reason to retain the system-as CLI node under per-VRF BGP configuration, which cannot be achieved through alternative means - the maintainers have collectively decided to deprecate the following command: set vrf name <name> protocols bgp system-as <asn> Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While it will still be accepted, it will no longer have any operational effect. A deprecation warning will be displayed at commit time, indicating that the BGP ASN from the global BGP configuration is now used instead. A migration script will handle the transition and perform the following actions: * Ensure a global BGP configuration exists; if not, initialize one. * Iterate over all configured VRFs to determine whether a BGP instance exists * For any insance, update the configuration to use the global system-as and apply the local-as ASN no-prepend replace-as option on all affected neighbors to preserve existing behavior. * If a neighbor is already configured with a local-as directive, that neighbor will be excluded from the migration process, as it already follows a custom configuration. * Add allowas-in per neighbor option. Required to not deny prefix received updates due to as-path contains our own global ASN.
2025-09-09Merge pull request #4682 from aapostoliuk/T7722-currentJohn Estabrook
isis: T7722: Added interface fast-reroute configuration commands
2025-09-09Merge pull request #4687 from l0crian1/vid-to-vni-statsChristian Breunig
op-mode: T7764: Add 'vlan-to-vni statistics' op-mode command
2025-09-09T7757: VPP add auto calculation of buffer-per-numa parameter as defaultNataliia Solomko
2025-09-05Firewall: T7475: Disable conntrack per firewall chainl0crian1
- Added command to disable conntrack per firewall chain - Added test_disable_conntrack_per_chain function to smoketest
2025-09-05T7757: VPP Verify buffers for rx/tx queuesNataliia Solomko
2025-09-04T7366: Firewall rules allow empty nodesl0crian1
Added checks in the verify_rule() function of firewall.py for empty nodes. Added migration script 19-to-20 to remove empty nodes from the config.
2025-09-02Firewall: T6857: Fix default action for prerouting hookl0crian1
- Fixes the op-mode cosmetic bugs with default-action for prerouting hook.
2025-09-01Merge branch 'current' of https://github.com/nvandamme/vyos-1x into currentNicolas Vandamme
2025-09-01Merge branch 'vyos:current' into currentNicolas Vandamme
2025-09-01op-mode: T5992: show dhcpv6 leases with (mostly) the same fields as dhcp leasesNicolas Vandamme
2025-09-01Merge branch 'current' into currentNicolas Vandamme
2025-09-01T6211: Fix kea VRF op-mode commandsDavid Vølker
2025-08-29op-mode: T7764: Add 'vlan-to-vni statistics' op-mode commandl0crian1
2025-08-29Merge pull request #4680 from l0crian1/show-kernel-statsJohn Estabrook
T7742: Add 'show interfaces kernel statistics' command
2025-08-28container: T7186: Add macvlan network type for containersl0crian1
- Moved gen_mac function outside of 'for network' loop - Cached result of get_host_identity() to prevent multiple calls - Other minor improvements per Copilot suggestions
2025-08-28container: T7186: Add macvlan network type for containersl0crian1
Modified: - interface-definitions/container.xml.in: - Add macvlan network type - Add gateway option - python/vyos/utils/network.py: - Add gen_mac function to generate mac address - smoketest/scripts/cli/test_container.py: - Add test for container network types - src/conf_mode/container.py: - Add support for macvlan network type - Add gateway option
2025-08-28T7758: add missing case to allow repeated option --typeJohn Estabrook
2025-08-28Merge pull request #42 from jestabro/list-interfaces-multiple-typesJohn Estabrook
T7758: allow repeated option --type in list_interfaces
2025-08-28Merge pull request #4674 from dmbaturin/op-mode-permissionsDaniil Baturin
op-mode: T7745: add a CLI for operator user command permissions
2025-08-28Merge pull request #4663 from KawaiiNetworks/currentDaniil Baturin
bgp: T7708: correct logic for route-reflector-client peer_as check
2025-08-28T7758: allow repeated option --type in list_interfacesJohn Estabrook
2025-08-28vyos-op-run: T7745: add a command permission checking mechanismDaniil Baturin
2025-08-28isis: T7722: Added interface fast-reroute configuration commandsaapostoliuk
Added interface fast-reroute configuration commands
2025-08-27T7759: Revert "T7709: add atomic write for config file save"John Estabrook
The utility write_file_atomic does not correctly update the file in the bind mount directory /config. Revert for investigation. This reverts commit c140f827f3117609908a3a18034027d3d78149ac.
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-30 21:32:34 +0000