Change Details

**Security** * CVE-2024-3596 (BlastRADIUS) mitigations for pam_radius (T7285). * Kernel: remove io_uring support from Kernel (T7428). **New features and improvements** * Add support for AMD pstate driver (T6703). * Allow setting name server for containers (T6927). * dhcp: support definition of custom DNS server for specific static mappings (T6993). * Add support for configuring container registry mirrors (T7092). * Route leaking using route-map (T7157). * Add Filtering Option for ‘show bgp ipv4/ipv6 vpn’ by RD and Prefix (T7227). * Add apply_patches option for the build packages script (T7342). * VPN IPsec add the ability to exclude IPv6 traffic selectors for VTI interfaces (T7343). * Add FRR ip import-table x feature to import routes from non-main kernel table (T7349). * Image update: confirm image name is available before accepting (T7359). * Implement auto-ignore-prefix syntax for router advertisements (T7380). * Add "system kernel option quiet" to suppress boot messages (T7397). * containers: Allow privileged option (T7412). * show * bgp neighbors * advertised-routes detail or show * bgp neighbors *received-routes detail missing (T7509). * Pin iproute2 version 6.14.0-3~bpo12+1 for sagitta (T7519). * Build package binaries script should exit if a package repository cannot be cloned for some reason (T7530). * Add FRR no-ipv6-auto-ra option (T7531). **Bug fixes** * Stray compiled Python objects break the VMware virtual machine resume script (T3681). * PKI import OpenVPN shared key includes unexpected BEGIN and END (T5744). * [email protected] cannot stop gracefully when VyOS shutdowns (T6113). * Update system image without enough space for the files can to break the system (T6144). * no-default-route not being honoured (T6253). * Autocomplete for "show arp interface" is missing non-ethernet interfaces (T6792). * System CA Not Updated with Configuration (T6809). * FRR config is lost upon daemon restart (T6963). * Issue with Configuration Migration from VyOS 1.3.8 to 1.4.1 (T6968). * dhcp: smoketests fail as IP address is not removed in time (T6972). * Allow configuring IPoE servers without a client IP pool if DHCP relay is used (T6997). * Boot failure after installing on RAID1 (T7049). * OpenVPN error : Unable to bind the tunnel interface to bridge if misconfigured first (T7056). * Adding community 'internet' throws an exception (T7116). * PKI: Unable to switch from custom cert to ACME when haproxy service is running with 'redirect-http-to-https' option (T7122). * "show qos shaper" doesn't work with VRFs (T7138). * Some sysctl options like nf_conntrack_buckets are diffrent between clean install and the first reboot (T7208). * NAT checking translation address is an expensive operation (T7237). * Wireguard: Traceback error received if the public-key starts with // (T7246). * certbot: When using ACME certificates, consuming daemons are not reloaded on update (T7249). * op-mode: not all groups are displayed correctly with `show firewall groups` (T7282). * VPN Openconnect does not check dictionary key server with authentication mode RADIUS (T7287). * VPN IPsec log level does not work (T7290). * Need commit validation for interfaces when mtu configured below 1280 (T7316). * wifi: mac80211_hwsim kernel module no longer supports VLAN interfaces in smoketests (T7325). * grub: "system option kernel" options are not honored after image upgrade (T7327). * FQDN resolver uses IPv4 cache for failed IPv6 resolution (T7333). * Haproxy mistake URL instead of the PATH in the description redirect-location (T7335). * isisd: Fix memory leaks when the transition of neighbor state from non-UP to DOWN (T7341). * netplug: PermissionError on fast interface changes (T7346). * Add an option to limit the number of threads for accel-ppp services (T7348). * Do not allow deleting interfaces referenced in flowtables (T7350). * netplug: behavior change 1.3.8 -> 1.4 when interface with DHCP address looses carrier (T7353). * netplug: DHCPv6 address is not cleared when interface is going to operational down (T7360). * Arguments of lb_config are not properly quoted (T7372). * IPv6 assigned address using SLAAC is not cleared when SLAAC is deconfigured (T7375). * Invalid sysctl configuration during startup causes IPv6 default route to be installed for DHCPv6 only interface (T7379). * Router advertisement duplicate prefix safeguard (T7389). * HTTPS API listens on all addresses after changing its listen-address (T7393). * Image upgrade fails when the "system option kernel" subtree is empty (T7394). * Update vyos-http-api-tools for package h11 security advisory (T7398). * smoketest: fix unbound variable issue when checking for VXLAN remote and group error (T7400). * smoketest: TypeError: VyOSUnitTestSHIM.TestCase.getFRRconfig() got an unexpected keyword argument 'substring' (T7401). * FRRouting Configuration Loss on Abnormal Service Restart (T7411). * Conntrack Rule Fails When Using Comma-Separated Ports (T7414). * QoS match TCP ACK not working (T7415). * vrf: config Migration failed 1.3.4--> 1.4.2 for static routes (T7417). * Add the missing kernel option CONFIG_PSAMPLE (T7437). * reboot/shutdown: unable to log in prior 5 minutes to planned reboot/shutdown time (T7443). * VPN IPsec unexpected passthrough logic bug (T7458). * Unable to load the config file when community attribute define with "replace" (T7460). * CoA is not applied to Accel-PPP services (T7463). * Bonding interface mode allows malformed variations of 802.3ad (T7466). * IPoE: Add stricter validation for giaddr if dhcp-relay is configured (T7472). * Modem connection code doesn't work (T7492). * Fix commit-confirm action 'reboot' (T7500). * Remove unnecessary PAT for docker image rebuild (T7501). * Table 254 is a default table and must not be used for VRF (T7506). * Fix default commit-confirm action (T7508). * OSPF NSSA translation error (T7510). * Unable to apply OpenConnect RADIUS accounting settings (T7511). * Container sysctl parameters with values containing spaces cause errors (T7532). * wwan: extend smoketests to cover WWAN driver option and hwsim (T7539). * pki: TypeError: argument of type 'NoneType' is not iterable when HAProxy is not in use (T7573). * Upgrade from 1.3.x to 1.4.2 or later fails due to an ISO image format change (T7610). * Deleting the TACACS server configuration raises an error (T7632). **Other resolved issues** * Display the non-production banner depending on the build type (T7159). * Image build fails due to missing linux-tools package (T7253). * Remove support for GnuPG signatures (T7301). * Addition and deletion of allowed-vlans on a bridge member is slow (T7322). * Add vyos prefix to package names of RADIUS libs (T7336). * Build a compatible version of bash-completion from source (T7344). * Do not use Debian Buster repos in image build (T7345). * Console text remains white and bold after boot messages (T7356). * Use the reusable completion helper for the RADIUS dynamic authorization option in PPP/IPoE services (T7471). * Fix the typo in completion help for remote option in dhcp-server high-availability (T7559).

**Security** * CVE-2024-3596 (BlastRADIUS) mitigations for pam_radius (T7285). * Remove io_uring support from the kernel (T7428). **New features and improvements** * Add support for AMD pstate driver (T6703). * Allow setting name server for containers (T6927). * dhcp: support definition of custom DNS server for specific static mappings (T6993). * Add support for configuring container registry mirrors (T7092). * Route leaking using route-map (T7157). * Add Filtering Option for ‘show bgp ipv4/ipv6 vpn’ by RD and Prefix (T7227). * VPN IPsec add the ability to exclude IPv6 traffic selectors for VTI interfaces (T7343). * Add FRR ip import-table x feature to import routes from non-main kernel table (T7349). * Image update: confirm image name is available before accepting (T7359). * Implement auto-ignore-prefix syntax for router advertisements (T7380). * Add "system kernel option quiet" to suppress boot messages (T7397). * containers: Allow privileged option (T7412). * show * bgp neighbors * advertised-routes detail or show * bgp neighbors *received-routes detail missing (T7509). * Build package binaries script should exit if a package repository cannot be cloned for some reason (T7530). * Add FRR no-ipv6-auto-ra option (T7531). **Bug fixes** * Stray compiled Python objects break the VMware virtual machine resume script (T3681). * PKI import OpenVPN shared key includes unexpected BEGIN and END (T5744). * [email protected] cannot stop gracefully when VyOS shutdowns (T6113). * Update system image without enough space for the files can to break the system (T6144). * no-default-route not being honoured (T6253). * Autocomplete for "show arp interface" is missing non-ethernet interfaces (T6792). * System CA Not Updated with Configuration (T6809). * FRR config is lost upon daemon restart (T6963). * Issue with Configuration Migration from VyOS 1.3.8 to 1.4.1 (T6968). * dhcp: smoketests fail as IP address is not removed in time (T6972). * Allow configuring IPoE servers without a client IP pool if DHCP relay is used (T6997). * Boot failure after installing on RAID1 (T7049). * OpenVPN error : Unable to bind the tunnel interface to bridge if misconfigured first (T7056). * Adding community 'internet' throws an exception (T7116). * PKI: Unable to switch from custom cert to ACME when haproxy service is running with 'redirect-http-to-https' option (T7122). * "show qos shaper" doesn't work with VRFs (T7138). * Some sysctl options like nf_conntrack_buckets are diffrent between clean install and the first reboot (T7208). * NAT checking translation address is an expensive operation (T7237). * Wireguard: Traceback error received if the public-key starts with // (T7246). * certbot: When using ACME certificates, consuming daemons are not reloaded on update (T7249). * op-mode: not all groups are displayed correctly with `show firewall groups` (T7282). * VPN Openconnect does not check dictionary key server with authentication mode RADIUS (T7287). * VPN IPsec log level does not work (T7290). * Need commit validation for interfaces when mtu configured below 1280 (T7316). * wifi: mac80211_hwsim kernel module no longer supports VLAN interfaces in smoketests (T7325). * grub: "system option kernel" options are not honored after image upgrade (T7327). * FQDN resolver uses IPv4 cache for failed IPv6 resolution (T7333). * Haproxy mistake URL instead of the PATH in the description redirect-location (T7335). * isisd: Fix memory leaks when the transition of neighbor state from non-UP to DOWN (T7341). * netplug: PermissionError on fast interface changes (T7346). * Add an option to limit the number of threads for accel-ppp services (T7348). * Do not allow deleting interfaces referenced in flowtables (T7350). * netplug: behavior change 1.3.8 -> 1.4 when interface with DHCP address looses carrier (T7353). * netplug: DHCPv6 address is not cleared when interface is going to operational down (T7360). * Arguments of lb_config are not properly quoted (T7372). * IPv6 assigned address using SLAAC is not cleared when SLAAC is deconfigured (T7375). * Invalid sysctl configuration during startup causes IPv6 default route to be installed for DHCPv6 only interface (T7379). * Router advertisement duplicate prefix safeguard (T7389). * HTTPS API listens on all addresses after changing its listen-address (T7393). * Image upgrade fails when the "system option kernel" subtree is empty (T7394). * Update vyos-http-api-tools for package h11 security advisory (T7398). * smoketest: fix unbound variable issue when checking for VXLAN remote and group error (T7400). * smoketest: TypeError: VyOSUnitTestSHIM.TestCase.getFRRconfig() got an unexpected keyword argument 'substring' (T7401). * FRRouting Configuration Loss on Abnormal Service Restart (T7411). * Conntrack Rule Fails When Using Comma-Separated Ports (T7414). * QoS match TCP ACK not working (T7415). * vrf: config Migration failed 1.3.4--> 1.4.2 for static routes (T7417). * Add the missing kernel option CONFIG_PSAMPLE (T7437). * reboot/shutdown: unable to log in prior 5 minutes to planned reboot/shutdown time (T7443). * VPN IPsec unexpected passthrough logic bug (T7458). * Unable to load the config file when community attribute define with "replace" (T7460). * CoA is not applied to Accel-PPP services (T7463). * Bonding interface mode allows malformed variations of 802.3ad (T7466). * IPoE: Add stricter validation for giaddr if dhcp-relay is configured (T7472). * Modem connection code doesn't work (T7492). * Fix commit-confirm action 'reboot' (T7500). * Remove unnecessary PAT for docker image rebuild (T7501). * Table 254 is a default table and must not be used for VRF (T7506). * Fix default commit-confirm action (T7508). * OSPF NSSA translation error (T7510). * Unable to apply OpenConnect RADIUS accounting settings (T7511). * Container sysctl parameters with values containing spaces cause errors (T7532). * wwan: extend smoketests to cover WWAN driver option and hwsim (T7539). * pki: TypeError: argument of type 'NoneType' is not iterable when HAProxy is not in use (T7573). * Upgrade from 1.3.x to 1.4.2 or later fails due to an ISO image format change (T7610). * Deleting the TACACS server configuration raises an error (T7632). **Other resolved issues** * Display the non-production banner depending on the build type (T7159). * Image build fails due to missing linux-tools package (T7253). * Remove support for GnuPG signatures (T7301). * Addition and deletion of allowed-vlans on a bridge member is slow (T7322). * Add vyos prefix to package names of RADIUS libs (T7336). * Add apply_patches option for the build packages script (T7342). * Build a compatible version of bash-completion from source (T7344). * Do not use Debian Buster repos in image build (T7345). * Console text remains white and bold after boot messages (T7356). * Use the reusable completion helper for the RADIUS dynamic authorization option in PPP/IPoE services (T7471). * Pin iproute2 version 6.14.0-3~bpo12+1 for sagitta (T7519). * Fix the typo in completion help for remote option in dhcp-server high-availability (T7559).

**Security** * CVE-2024-3596 (BlastRADIUS) mitigations for pam_radius (T7285). * Kernel: r* Remove io_uring support from Kthe kernel (T7428). **New features and improvements** * Add support for AMD pstate driver (T6703). * Allow setting name server for containers (T6927). * dhcp: support definition of custom DNS server for specific static mappings (T6993). * Add support for configuring container registry mirrors (T7092). * Route leaking using route-map (T7157). * Add Filtering Option for ‘show bgp ipv4/ipv6 vpn’ by RD and Prefix (T7227). * Add apply_patches option for the build packages script (T7342). * VPN IPsec add the ability to exclude IPv6 traffic selectors for VTI interfaces (T7343). * Add FRR ip import-table x feature to import routes from non-main kernel table (T7349). * Image update: confirm image name is available before accepting (T7359). * Implement auto-ignore-prefix syntax for router advertisements (T7380). * Add "system kernel option quiet" to suppress boot messages (T7397). * containers: Allow privileged option (T7412). * show * bgp neighbors * advertised-routes detail or show * bgp neighbors *received-routes detail missing (T7509). * Pin iproute2 version 6.14.0-3~bpo12+1 for sagitta (T7519). * Build package binaries script should exit if a package repository cannot be cloned for some reason (T7530). * Add FRR no-ipv6-auto-ra option (T7531). **Bug fixes** * Stray compiled Python objects break the VMware virtual machine resume script (T3681). * PKI import OpenVPN shared key includes unexpected BEGIN and END (T5744). * [email protected] cannot stop gracefully when VyOS shutdowns (T6113). * Update system image without enough space for the files can to break the system (T6144). * no-default-route not being honoured (T6253). * Autocomplete for "show arp interface" is missing non-ethernet interfaces (T6792). * System CA Not Updated with Configuration (T6809). * FRR config is lost upon daemon restart (T6963). * Issue with Configuration Migration from VyOS 1.3.8 to 1.4.1 (T6968). * dhcp: smoketests fail as IP address is not removed in time (T6972). * Allow configuring IPoE servers without a client IP pool if DHCP relay is used (T6997). * Boot failure after installing on RAID1 (T7049). * OpenVPN error : Unable to bind the tunnel interface to bridge if misconfigured first (T7056). * Adding community 'internet' throws an exception (T7116). * PKI: Unable to switch from custom cert to ACME when haproxy service is running with 'redirect-http-to-https' option (T7122). * "show qos shaper" doesn't work with VRFs (T7138). * Some sysctl options like nf_conntrack_buckets are diffrent between clean install and the first reboot (T7208). * NAT checking translation address is an expensive operation (T7237). * Wireguard: Traceback error received if the public-key starts with // (T7246). * certbot: When using ACME certificates, consuming daemons are not reloaded on update (T7249). * op-mode: not all groups are displayed correctly with `show firewall groups` (T7282). * VPN Openconnect does not check dictionary key server with authentication mode RADIUS (T7287). * VPN IPsec log level does not work (T7290). * Need commit validation for interfaces when mtu configured below 1280 (T7316). * wifi: mac80211_hwsim kernel module no longer supports VLAN interfaces in smoketests (T7325). * grub: "system option kernel" options are not honored after image upgrade (T7327). * FQDN resolver uses IPv4 cache for failed IPv6 resolution (T7333). * Haproxy mistake URL instead of the PATH in the description redirect-location (T7335). * isisd: Fix memory leaks when the transition of neighbor state from non-UP to DOWN (T7341). * netplug: PermissionError on fast interface changes (T7346). * Add an option to limit the number of threads for accel-ppp services (T7348). * Do not allow deleting interfaces referenced in flowtables (T7350). * netplug: behavior change 1.3.8 -> 1.4 when interface with DHCP address looses carrier (T7353). * netplug: DHCPv6 address is not cleared when interface is going to operational down (T7360). * Arguments of lb_config are not properly quoted (T7372). * IPv6 assigned address using SLAAC is not cleared when SLAAC is deconfigured (T7375). * Invalid sysctl configuration during startup causes IPv6 default route to be installed for DHCPv6 only interface (T7379). * Router advertisement duplicate prefix safeguard (T7389). * HTTPS API listens on all addresses after changing its listen-address (T7393). * Image upgrade fails when the "system option kernel" subtree is empty (T7394). * Update vyos-http-api-tools for package h11 security advisory (T7398). * smoketest: fix unbound variable issue when checking for VXLAN remote and group error (T7400). * smoketest: TypeError: VyOSUnitTestSHIM.TestCase.getFRRconfig() got an unexpected keyword argument 'substring' (T7401). * FRRouting Configuration Loss on Abnormal Service Restart (T7411). * Conntrack Rule Fails When Using Comma-Separated Ports (T7414). * QoS match TCP ACK not working (T7415). * vrf: config Migration failed 1.3.4--> 1.4.2 for static routes (T7417). * Add the missing kernel option CONFIG_PSAMPLE (T7437). * reboot/shutdown: unable to log in prior 5 minutes to planned reboot/shutdown time (T7443). * VPN IPsec unexpected passthrough logic bug (T7458). * Unable to load the config file when community attribute define with "replace" (T7460). * CoA is not applied to Accel-PPP services (T7463). * Bonding interface mode allows malformed variations of 802.3ad (T7466). * IPoE: Add stricter validation for giaddr if dhcp-relay is configured (T7472). * Modem connection code doesn't work (T7492). * Fix commit-confirm action 'reboot' (T7500). * Remove unnecessary PAT for docker image rebuild (T7501). * Table 254 is a default table and must not be used for VRF (T7506). * Fix default commit-confirm action (T7508). * OSPF NSSA translation error (T7510). * Unable to apply OpenConnect RADIUS accounting settings (T7511). * Container sysctl parameters with values containing spaces cause errors (T7532). * wwan: extend smoketests to cover WWAN driver option and hwsim (T7539). * pki: TypeError: argument of type 'NoneType' is not iterable when HAProxy is not in use (T7573). * Upgrade from 1.3.x to 1.4.2 or later fails due to an ISO image format change (T7610). * Deleting the TACACS server configuration raises an error (T7632). **Other resolved issues** * Display the non-production banner depending on the build type (T7159). * Image build fails due to missing linux-tools package (T7253). * Remove support for GnuPG signatures (T7301). * Addition and deletion of allowed-vlans on a bridge member is slow (T7322). * Add vyos prefix to package names of RADIUS libs (T7336). * Add apply_patches option for the build packages script (T7342). * Build a compatible version of bash-completion from source (T7344). * Do not use Debian Buster repos in image build (T7345). * Console text remains white and bold after boot messages (T7356). * Use the reusable completion helper for the RADIUS dynamic authorization option in PPP/IPoE services (T7471). * Fix the typo in completion help for remote opt* Pin iproute2 version in dhcp-server high-availability6.14.0-3~bpo12+1 for sagitta (T755919). * Fix the typo in completion help for remote option in dhcp-server high-availability (T7559).