T7557: Updates for Debian Trixie

Makefile

@@ -107,7 +107,7 @@ clean:
 .PHONY: test
 test: generate-configd-include-json
 	set -e; python3 -m compileall -q -x '/vmware-tools/scripts/' .
-	PYTHONPATH=python/ python3 -m "nose" --with-xunit src --with-coverage --cover-erase --cover-xml --cover-package src/conf_mode,src/op_mode,src/completion,src/helpers,src/validators,src/tests --verbose
+	PYTHONPATH=python/ python3 -m nose2 -v
 
 .PHONY: check_migration_scripts_executable
 .ONESHELL:

data/templates/container/quadlet-network.j2

@@ -0,0 +1,8 @@
+### Autogenerated by container.py ###
+[Unit]
+Description=VyOS Network {{ name }}
+
+[Network]
+{% for opt in opts %}
+{{ opt }}
+{% endfor %}

data/templates/container/quadlet-unit.j2

@@ -0,0 +1,11 @@
+### Autogenerated by container.py ###
+[Unit]
+Description=VyOS Container {{ name }}
+
+[Container]
+{% for opt in opts %}
+{{ opt }}
+{% endfor %}
+
+[Service]
+Restart={{ restart }}

data/templates/dns-forwarding/override.conf.j2

@@ -5,4 +5,4 @@ After=vyos-router.service
 [Service]
 RuntimeDirectoryPreserve=yes
 ExecStart=
-ExecStart=/usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no --config-dir={{ config_dir }}
+ExecStart=/usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no --config-dir={{ config_dir }} --enable-old-settings

data/templates/dns-forwarding/recursor.conf.lua.j2

@@ -2,7 +2,9 @@
 -- Do not edit, your changes will get overwritten --
 
 -- Load DNSSEC root keys from dns-root-data package.
-dofile("/usr/share/pdns-recursor/lua-config/rootkeys.lua")
+-- dofile("/usr/share/pdns-recursor/lua-config/rootkeys.lua")
+-- lua-config no longer present, copying line from file
+readTrustAnchorsFromFile("/usr/share/dns/root.key")
 
 -- Load lua from vyos-hostsd --
 dofile("{{ config_dir }}/recursor.vyos-hostsd.conf.lua")

data/templates/ssh/sshd_config.j2

@@ -7,7 +7,6 @@
 #
 Protocol 2
 HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_dsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key
 SyslogFacility AUTH

debian/control

@@ -31,7 +31,7 @@ Build-Depends:
   python3-hurry.filesize,
   python3-netaddr,
   python3-netifaces,
-  python3-nose,
+  python3-nose2,
   python3-jinja2,
   python3-paramiko,
   python3-passlib,
@@ -132,6 +132,7 @@ Depends:
   mokutil,
   shim-signed [amd64],
   sbsigntool [amd64],
+  e2fsprogs,
 # Image signature verification tool
   minisign,
 # Live filesystem tools
@@ -404,6 +405,7 @@ Description: VyOS configuration scripts and data for AWS Gateway Load Balancer
 Package: vyos-1x-smoketest
 Architecture: all
 Depends:
+ python3-systemd,
  skopeo,
  snmp,
  vyos-1x

interface-definitions/include/version/ssh-version.xml.i

@@ -1,3 +1,3 @@
 <!-- include start from include/version/ssh-version.xml.i -->
-<syntaxVersion component='ssh' version='2'></syntaxVersion>
+<syntaxVersion component='ssh' version='3'></syntaxVersion>
 <!-- include end -->

interface-definitions/include/version/system-version.xml.i

@@ -1,3 +1,3 @@
 <!-- include start from include/version/system-version.xml.i -->
-<syntaxVersion component='system' version='29'></syntaxVersion>
+<syntaxVersion component='system' version='30'></syntaxVersion>
 <!-- include end -->

interface-definitions/service_ssh.xml.in

@@ -138,11 +138,11 @@
               <help>Allowed host key signature algorithms</help>
               <completionHelp>
                 <!-- generated by ssh -Q HostKeyAlgorithms | tr '\n' ' ' as this will not change dynamically  -->
-                <list>ssh-ed25519 ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com sk-ssh-ed25519-cert-v01@openssh.com ssh-rsa rsa-sha2-256 rsa-sha2-512 ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com webauthn-sk-ecdsa-sha2-nistp256@openssh.com ssh-rsa-cert-v01@openssh.com rsa-sha2-256-cert-v01@openssh.com rsa-sha2-512-cert-v01@openssh.com ssh-dss-cert-v01@openssh.com ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521-cert-v01@openssh.com sk-ecdsa-sha2-nistp256-cert-v01@openssh.com</list>
+                <list>ssh-ed25519 ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com sk-ssh-ed25519-cert-v01@openssh.com ssh-rsa rsa-sha2-256 rsa-sha2-512 ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com webauthn-sk-ecdsa-sha2-nistp256@openssh.com ssh-rsa-cert-v01@openssh.com rsa-sha2-256-cert-v01@openssh.com rsa-sha2-512-cert-v01@openssh.com ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521-cert-v01@openssh.com sk-ecdsa-sha2-nistp256-cert-v01@openssh.com</list>
               </completionHelp>
               <multi/>
               <constraint>
-                <regex>(ssh-ed25519|ssh-ed25519-cert-v01@openssh.com|sk-ssh-ed25519@openssh.com|sk-ssh-ed25519-cert-v01@openssh.com|ssh-rsa|rsa-sha2-256|rsa-sha2-512|ssh-dss|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ecdsa-sha2-nistp256@openssh.com|webauthn-sk-ecdsa-sha2-nistp256@openssh.com|ssh-rsa-cert-v01@openssh.com|rsa-sha2-256-cert-v01@openssh.com|rsa-sha2-512-cert-v01@openssh.com|ssh-dss-cert-v01@openssh.com|ecdsa-sha2-nistp256-cert-v01@openssh.com|ecdsa-sha2-nistp384-cert-v01@openssh.com|ecdsa-sha2-nistp521-cert-v01@openssh.com|sk-ecdsa-sha2-nistp256-cert-v01@openssh.com)</regex>
+                <regex>(ssh-ed25519|ssh-ed25519-cert-v01@openssh.com|sk-ssh-ed25519@openssh.com|sk-ssh-ed25519-cert-v01@openssh.com|ssh-rsa|rsa-sha2-256|rsa-sha2-512|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ecdsa-sha2-nistp256@openssh.com|webauthn-sk-ecdsa-sha2-nistp256@openssh.com|ssh-rsa-cert-v01@openssh.com|rsa-sha2-256-cert-v01@openssh.com|rsa-sha2-512-cert-v01@openssh.com|ecdsa-sha2-nistp256-cert-v01@openssh.com|ecdsa-sha2-nistp384-cert-v01@openssh.com|ecdsa-sha2-nistp521-cert-v01@openssh.com|sk-ecdsa-sha2-nistp256-cert-v01@openssh.com)</regex>
               </constraint>
             </properties>
           </leafNode>
@@ -151,11 +151,11 @@
               <help>Allowed pubkey signature algorithms</help>
               <completionHelp>
                 <!-- generated by ssh -Q PubkeyAcceptedAlgorithms | tr '\n' ' ' as this will not change dynamically  -->
-                <list>ssh-ed25519 ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com sk-ssh-ed25519-cert-v01@openssh.com ecdsa-sha2-nistp256 ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384 ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521 ecdsa-sha2-nistp521-cert-v01@openssh.com sk-ecdsa-sha2-nistp256@openssh.com sk-ecdsa-sha2-nistp256-cert-v01@openssh.com webauthn-sk-ecdsa-sha2-nistp256@openssh.com ssh-dss ssh-dss-cert-v01@openssh.com ssh-rsa ssh-rsa-cert-v01@openssh.com rsa-sha2-256 rsa-sha2-256-cert-v01@openssh.com rsa-sha2-512 rsa-sha2-512-cert-v01@openssh.com</list>
+                <list>ssh-ed25519 ssh-ed25519-cert-v01@openssh.com sk-ssh-ed25519@openssh.com sk-ssh-ed25519-cert-v01@openssh.com ecdsa-sha2-nistp256 ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384 ecdsa-sha2-nistp384-cert-v01@openssh.com ecdsa-sha2-nistp521 ecdsa-sha2-nistp521-cert-v01@openssh.com sk-ecdsa-sha2-nistp256@openssh.com sk-ecdsa-sha2-nistp256-cert-v01@openssh.com webauthn-sk-ecdsa-sha2-nistp256@openssh.com ssh-rsa ssh-rsa-cert-v01@openssh.com rsa-sha2-256 rsa-sha2-256-cert-v01@openssh.com rsa-sha2-512 rsa-sha2-512-cert-v01@openssh.com</list>
               </completionHelp>
               <multi/>
               <constraint>
-                <regex>(ssh-ed25519|ssh-ed25519-cert-v01@openssh.com|sk-ssh-ed25519@openssh.com|sk-ssh-ed25519-cert-v01@openssh.com|ecdsa-sha2-nistp256|ecdsa-sha2-nistp256-cert-v01@openssh.com|ecdsa-sha2-nistp384|ecdsa-sha2-nistp384-cert-v01@openssh.com|ecdsa-sha2-nistp521|ecdsa-sha2-nistp521-cert-v01@openssh.com|sk-ecdsa-sha2-nistp256@openssh.com|sk-ecdsa-sha2-nistp256-cert-v01@openssh.com|webauthn-sk-ecdsa-sha2-nistp256@openssh.com|ssh-dss|ssh-dss-cert-v01@openssh.com|ssh-rsa|ssh-rsa-cert-v01@openssh.com|rsa-sha2-256|rsa-sha2-256-cert-v01@openssh.com|rsa-sha2-512|rsa-sha2-512-cert-v01@openssh.com)</regex>
+                <regex>(ssh-ed25519|ssh-ed25519-cert-v01@openssh.com|sk-ssh-ed25519@openssh.com|sk-ssh-ed25519-cert-v01@openssh.com|ecdsa-sha2-nistp256|ecdsa-sha2-nistp256-cert-v01@openssh.com|ecdsa-sha2-nistp384|ecdsa-sha2-nistp384-cert-v01@openssh.com|ecdsa-sha2-nistp521|ecdsa-sha2-nistp521-cert-v01@openssh.com|sk-ecdsa-sha2-nistp256@openssh.com|sk-ecdsa-sha2-nistp256-cert-v01@openssh.com|webauthn-sk-ecdsa-sha2-nistp256@openssh.com|ssh-rsa|ssh-rsa-cert-v01@openssh.com|rsa-sha2-256|rsa-sha2-256-cert-v01@openssh.com|rsa-sha2-512|rsa-sha2-512-cert-v01@openssh.com)</regex>
               </constraint>
             </properties>
           </leafNode>

interface-definitions/system_login.xml.in

@@ -138,12 +138,8 @@
                         <properties>
                           <help>SSH public key type</help>
                           <completionHelp>
-                            <list>ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com</list>
+                            <list>ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com</list>
                           </completionHelp>
-                          <valueHelp>
-                            <format>ssh-dss</format>
-                            <description>Digital Signature Algorithm (DSA) key support</description>
-                          </valueHelp>
                           <valueHelp>
                             <format>ssh-rsa</format>
                             <description>Key pair based on RSA algorithm</description>
@@ -173,7 +169,7 @@
                             <description>Elliptic curve 25519 security key</description>
                           </valueHelp>
                           <constraint>
-                            <regex>(ssh-dss|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519|sk-ecdsa-sha2-nistp256@openssh.com|sk-ssh-ed25519@openssh.com)</regex>
+                            <regex>(ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519|sk-ecdsa-sha2-nistp256@openssh.com|sk-ssh-ed25519@openssh.com)</regex>
                           </constraint>
                         </properties>
                       </leafNode>

nose2.cfg

@@ -0,0 +1,9 @@
+[unittest]
+start-dir = src
+code-directories = conf_mode
+                   op_mode
+                   completion
+                   validators
+                   tests
+test-file-pattern = test_*.py
+test-method-prefix = test

python/vyos/airbag.py

@@ -24,6 +24,8 @@
 
 
 def enable(log=True):
+    if 'nose2' in sys.modules:
+        return
     if log:
         _intercepting_logger()
     _intercepting_exceptions()
@@ -157,7 +159,7 @@ def _intercepting_exceptions(_singleton=[False]):
 {instructions}
 
 When reporting problems, please include as much information as possible:
-- do not obfuscate any data (feel free to contact us privately if your 
+- do not obfuscate any data (feel free to contact us privately if your
   business policy requires it)
 - and include all the information presented below
 

python/vyos/ifconfig/interface.py

@@ -1629,7 +1629,7 @@ def set_mirror_redirect(self):
                 if direction == 'ingress':
                     handle = 'ffff: ingress'
                     parent = 'ffff:'
-                elif direction == 'egress':
+                else: # egress
                     handle = '1: root prio'
                     parent = '1:'
 

python/vyos/utils/auth.py

@@ -104,8 +104,8 @@ def split_ssh_public_key(key_string, defaultname=""):
     else:
         key_type, key_data, key_name = parts[0], parts[1], defaultname
 
-    if key_type not in ['ssh-rsa', 'ssh-dss', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519']:
-        raise ValueError("Bad key type \'{0}\', must be one of must be one of ssh-rsa, ssh-dss, ecdsa-sha2-nistp<256|384|521> or ssh-ed25519".format(key_type))
+    if key_type not in ['ssh-rsa', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519']:
+        raise ValueError("Bad key type \'{0}\', must be one of must be one of ssh-rsa, ecdsa-sha2-nistp<256|384|521> or ssh-ed25519".format(key_type))
 
     return({"type": key_type, "data": key_data, "name": key_name})
 

python/vyos/utils/network.py

@@ -663,3 +663,11 @@ def is_valid_ipv6_address_or_range(addr: str) -> bool:
             return ip_network(addr).version == 6
     except:
         return False
+
+def is_carrier_up(ifname: str) -> bool | None:
+    try:
+        carrier_path = f'/sys/class/net/{ifname}/carrier'
+        with open(carrier_path, 'r') as f:
+            return f.read().strip() == '1'
+    except:
+        return None

python/vyos/utils/serial.py

@@ -24,7 +24,6 @@
 RE_GETTY_DEVICES = re.compile(r'.+@(.+).service$')
 
 SD_UNIT_PATH = '/run/systemd/system'
-UTMP_PATH = '/run/utmp'
 
 def get_serial_units(include_devices=[]):
     # Since we cannot depend on the current config for decommissioned ports,
@@ -60,10 +59,10 @@ def get_authenticated_ports(units):
     #
     # We can safely skip blank or LOGIN sessions with valid device names.
     #
-    for line in cmd(f'utmpdump {UTMP_PATH}').splitlines():
-        row = line.split('] [')
-        user_name = row[3].strip()
-        user_term = row[4].strip()
+    for line in cmd(f'who').splitlines():
+        row = line.split()
+        user_name = row[0].strip()
+        user_term = row[1].strip()
         if user_name and user_name != 'LOGIN' and user_term in ports:
             connected.append(user_term)
 

smoketest/config-tests/basic-vyos

@@ -86,12 +86,14 @@ set service ssh ciphers 'aes192-ctr'
 set service ssh ciphers 'aes256-ctr'
 set service ssh ciphers 'chacha20-poly1305@openssh.com'
 set service ssh ciphers 'rijndael-cbc@lysator.liu.se'
+set service ssh hostkey-algorithm 'ssh-rsa'
 set service ssh key-exchange 'curve25519-sha256@libssh.org'
 set service ssh key-exchange 'diffie-hellman-group1-sha1'
 set service ssh key-exchange 'diffie-hellman-group-exchange-sha1'
 set service ssh key-exchange 'diffie-hellman-group-exchange-sha256'
 set service ssh listen-address '192.168.0.1'
 set service ssh port '22'
+set service ssh pubkey-accepted-algorithm 'ssh-rsa'
 set system config-management commit-revisions '100'
 set system conntrack ignore ipv4 rule 1 destination address '192.0.2.2'
 set system conntrack ignore ipv4 rule 1 source address '192.0.2.1'

smoketest/configs/basic-vyos

@@ -228,6 +228,10 @@ service {
         key-exchange curve25519-sha256@libssh.org
         key-exchange diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
         port 22
+        hostkey-algorithm ssh-rsa
+        hostkey-algorithm ssh-dss
+        pubkey-accepted-algorithm ssh-rsa
+        pubkey-accepted-algorithm ssh-dss
     }
 }
 system {

smoketest/scripts/cli/test_container.py

@@ -28,7 +28,6 @@
 
 base_path = ['container']
 PROCESS_NAME = 'conmon'
-PROCESS_PIDFILE = '/run/vyos-container-{0}.service.pid'
 
 busybox_image = 'busybox:stable'
 busybox_image_path = '/usr/share/vyos/busybox-stable.tar'
@@ -68,9 +67,13 @@ def tearDown(self):
         self.assertIsNone(process_named_running(PROCESS_NAME))
 
         # Ensure systemd units are removed
-        units = glob.glob('/run/systemd/system/vyos-container-*')
+        units = glob.glob('/run/containers/systemd/vyos*')
         self.assertEqual(units, [])
 
+    def is_running(self, name):
+        command = f'systemctl show vyos-{name} --property=ActiveState --value'
+        return cmd(command).strip() == 'active'
+
     def test_basic(self):
         cont_name = 'c1'
 
@@ -99,12 +102,7 @@ def test_basic(self):
         # commit changes
         self.cli_commit()
 
-        pid = 0
-        with open(PROCESS_PIDFILE.format(cont_name), 'r') as f:
-            pid = int(f.read())
-
-        # Check for running process
-        self.assertEqual(process_named_running(PROCESS_NAME), pid)
+        self.assertTrue(self.is_running(cont_name))
 
         # verify
         tmp = cmd(f'sudo podman exec -it {cont_name} sysctl kernel.msgmax')
@@ -143,6 +141,8 @@ def test_name_server(self):
         self.cli_set(base_path + ['network', net_name, 'no-name-server'])
         self.cli_commit()
 
+        self.assertTrue(self.is_running(cont_name))
+
         n = cmd_to_json(f'sudo podman inspect {cont_name}')
         self.assertEqual(n['HostConfig']['Dns'][0], name_server)
 
@@ -158,12 +158,7 @@ def test_cpu_limit(self):
 
         self.cli_commit()
 
-        pid = 0
-        with open(PROCESS_PIDFILE.format(cont_name), 'r') as f:
-            pid = int(f.read())
-
-        # Check for running process
-        self.assertEqual(process_named_running(PROCESS_NAME), pid)
+        self.assertTrue(self.is_running(cont_name))
 
     def test_ipv4_network(self):
         prefix = '192.0.2.0/24'

smoketest/scripts/cli/test_interfaces_bridge.py

@@ -515,19 +515,16 @@ def test_bridge_root_bpdu_guard(self):
         self.cli_set(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0', 'root-guard'])
         with self.assertRaises(ConfigSessionError):
             self.cli_commit()
-        self.cli_discard()
 
         # Test if bpdu_guard configured
-        self.cli_set(['interfaces', 'bridge', 'br0', 'stp'])
-        self.cli_set(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0', 'bpdu-guard'])
+        self.cli_delete(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0', 'root-guard'])
         self.cli_commit()
 
         tmp = read_file(f'/sys/class/net/eth0/brport/bpdu_guard')
         self.assertEqual(tmp, '1')
 
         # Test if root_guard configured
-        self.cli_delete(['interfaces', 'bridge', 'br0'])
-        self.cli_set(['interfaces', 'bridge', 'br0', 'stp'])
+        self.cli_delete(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0', 'bpdu-guard'])
         self.cli_set(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0', 'root-guard'])
         self.cli_commit()
 

smoketest/scripts/cli/test_interfaces_pppoe.py

@@ -15,8 +15,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import unittest
+import psutil
 
-from psutil import process_iter
 from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSessionError
@@ -48,10 +48,13 @@ def tearDown(self):
         # Validate PPPoE client process
         for interface in self._interfaces:
             running = False
-            for proc in process_iter():
-                if interface in proc.cmdline():
-                    running = True
-                    break
+            for proc in psutil.process_iter():
+                try:
+                    if interface in proc.cmdline():
+                        running = True
+                        break
+                except psutil.ZombieProcess:
+                    pass
             self.assertTrue(running)
 
         self.cli_delete(base_path)
@@ -110,10 +113,13 @@ def test_pppoe_client_disabled_interface(self):
         # Validate PPPoE client process - must not run as interfaces are disabled
         for interface in self._interfaces:
             running = False
-            for proc in process_iter():
-                if interface in proc.cmdline():
-                    running = True
-                    break
+            for proc in psutil.process_iter():
+                try:
+                    if interface in proc.cmdline():
+                        running = True
+                        break
+                except psutil.ZombieProcess:
+                    pass
             self.assertFalse(running)
 
         # enable PPPoE interfaces