VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=rolling 2026-09-17T09:59:57+00:00 2026-09-17T09:59:57+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-16T19:47:52+00:00 urn:sha1:be9e0690d8a0bb292e08c05711875e09fb99963c 2.7.7 carries CVE-2026-84732: two fixes in the reliability layer, an unbounded reliable TLS timeout and acks being honoured for packets that cannot be outstanding. Debian skipped 2.7.6, so debian/2.7.7-1 is the next packaging tag after the debian/2.7.5-1 this was pinned to. The carried gerrit 1734 patch stays: 2.7.7 still has no net_iface_ovpn_mode(), so pre-created DCO interfaces are not yet handled upstream. It applies to the new tree with line offsets only, and no Debian patch touches the files it edits. 2026-09-11T11:38:54+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-11T11:38:54+00:00 urn:sha1:21c86f974e764087b0afef9c95b16372ae05fcad VyOS creates the "ovpn" device whenever the daemon cannot - a client whose server is not reachable yet never opens its tun - so OpenVPN has to adopt a device it did not make. It takes the device but not its ifindex today, so dco_new_peer() fails, the daemon exits and deletes the interface on its way out. systemd starts it again and the second attempt creates a device of its own, which hides the whole thing behind a tunnel that does come up. Carry Ralf's fix until it is released: it resolves the ifindex on the -EEXIST path, refuses a device whose operating mode does not match, and leaves a pre-existing interface alone on close. https://gerrit.openvpn.net/c/openvpn/+/1734 (patchset 2) 2026-09-10T11:33:04+00:00 Antonio Quartulli antonio@mandelbit.com 2026-08-30T00:05:32+00:00 urn:sha1:af59a46a1a9ae7b7143b4be183b48301c4f81d36 The in-tree "ovpn" module requires OpenVPN 2.7 or later, while bookworm ships 2.6.14 which speaks only ovpn-dco-v2. DCO stays inert until userspace is upgraded. systemd-dev does not exist in bookworm, so it is stripped before mk-build-deps reads debian/control. The package is also added to the rebuild trigger, without which it would never reach the mirror.