Merge branch 'vyos:current' into current

.github/workflows/add-pr-labels.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   add-pr-label:
-    uses: vyos/.github/.github/workflows/add-pr-labels.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/add-pr-labels.yml@current
     secrets: inherit

.github/workflows/auto-author-assign.yml

@@ -10,5 +10,5 @@ permissions:
 
 jobs:
   assign-author:
-    uses: vyos/.github/.github/workflows/assign-author.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/assign-author.yml@current
     secrets: inherit

.github/workflows/chceck-pr-message.yml

@@ -16,5 +16,5 @@ permissions:
 
 jobs:
   check-pr-title:
-    uses: vyos/.github/.github/workflows/check-pr-message.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/check-pr-message.yml@current
     secrets: inherit

.github/workflows/check-pr-conflicts.yml

@@ -10,5 +10,5 @@ permissions:
 
 jobs:
   check-pr-conflict-call:
-    uses: vyos/.github/.github/workflows/check-pr-merge-conflict.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/check-pr-merge-conflict.yml@current
     secrets: inherit

.github/workflows/check-stale.yml

@@ -9,5 +9,5 @@ permissions:
 
 jobs:
   stale:
-    uses: vyos/.github/.github/workflows/check-stale.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/check-stale.yml@current
     secrets: inherit

.github/workflows/check-unused-imports.yml

@@ -12,5 +12,5 @@ permissions:
 
 jobs:
   check-unused-imports:
-    uses: vyos/.github/.github/workflows/check-unused-imports.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/check-unused-imports.yml@current
     secrets: inherit

.github/workflows/codeql.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   codeql-analysis-call:
-    uses: vyos/.github/.github/workflows/codeql-analysis.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/codeql-analysis.yml@current
     secrets: inherit
     with:
       languages: "['python']"

.github/workflows/label-backport.yml

@@ -8,5 +8,5 @@ permissions:
 
 jobs:
   mergifyio-backport:
-    uses: vyos/.github/.github/workflows/label-backport.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/label-backport.yml@current
     secrets: inherit

.github/workflows/package-smoketest.yml

@@ -0,0 +1,106 @@
+name: Package ISO Test
+
+on:
+  pull_request:
+    branches:
+      - current
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    container:
+      image: vyos/vyos-build:current
+      options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
+    env:
+      BUILD_BY: [email protected]
+      DEBIAN_MIRROR: http://deb.debian.org/debian/
+    outputs:
+      build_version: ${{ steps.version.outputs.build_version }}
+    steps:
+      - name: Clone vyos-build source code
+        uses: actions/checkout@v4
+        with:
+          repository: vyos/vyos-build
+      - name: Clone vyos-1x source code
+        uses: actions/checkout@v4
+        with:
+          repository: vyos/vyos-1x
+          path: packages/vyos-1x
+          fetch-tags: true # required for Debian package version
+      - name: Build vyos-1x package
+        run: |
+          cd packages/vyos-1x; dpkg-buildpackage -uc -us -tc -b
+      - name: Generate ISO version string
+        id: version
+        run: |
+          echo "build_version=1.5-integration-$(date -u +%Y%m%d%H%M)" >> $GITHUB_OUTPUT
+      - name: Build custom ISO image
+        run: |
+          sudo --preserve-env ./build-vyos-image \
+          --architecture amd64 \
+          --build-by $BUILD_BY \
+          --debian-mirror $DEBIAN_MIRROR \
+          --version ${{ steps.version.outputs.build_version }} \
+          --build-type release \
+          generic
+      - uses: actions/upload-artifact@v4
+        with:
+          name: vyos-${{ steps.version.outputs.build_version }}
+          path: build/live-image-amd64.hybrid.iso
+
+  cli-smoketests:
+    needs: build
+    runs-on: ubuntu-24.04
+    container:
+      image: vyos/vyos-build:current
+      options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
+    steps:
+      # We need the test script from vyos-build repo
+      - name: Clone vyos-build source code
+        uses: actions/checkout@v4
+        with:
+          repository: vyos/vyos-build
+      - uses: actions/download-artifact@v4
+        with:
+          name: vyos-${{ needs.build.outputs.build_version }}
+          path: build
+      - name: VyOS CLI smoketests
+        run: ls -al; ls -al build; sudo make test
+
+  config-load-tests:
+    needs: build
+    runs-on: ubuntu-24.04
+    container:
+      image: vyos/vyos-build:current
+      options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
+    steps:
+      # We need the test script from vyos-build repo
+      - name: Clone vyos-build source code
+        uses: actions/checkout@v4
+        with:
+          repository: vyos/vyos-build
+      - uses: actions/download-artifact@v4
+        with:
+          name: vyos-${{ needs.build.outputs.build_version }}
+          path: build
+      - name: VyOS config tests
+        run: sudo make testc
+
+  raid1-install-test:
+    needs: build
+    runs-on: ubuntu-24.04
+    container:
+      image: vyos/vyos-build:current
+      options: --sysctl net.ipv6.conf.lo.disable_ipv6=0 --privileged
+    steps:
+      # We need the test script from vyos-build repo
+      - name: Clone vyos-build source code
+        uses: actions/checkout@v4
+        with:
+          repository: vyos/vyos-build
+      - uses: actions/download-artifact@v4
+        with:
+          name: vyos-${{ needs.build.outputs.build_version }}
+          path: build
+      - name: VyOS RAID1 install test
+        run: sudo make testraid

.github/workflows/repo-sync.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   trigger-sync:
-    uses: vyos/.github/.github/workflows/trigger-repo-sync.yml@feature/T6349-reusable-workflows
+    uses: vyos/.github/.github/workflows/trigger-repo-sync.yml@current
     secrets:
       REMOTE_REPO: ${{ secrets.REMOTE_REPO }}
       REMOTE_OWNER: ${{ secrets.REMOTE_OWNER }}

.github/workflows/sonarcloud.yml

@@ -0,0 +1,20 @@
+name: Sonar Checks
+on:
+  push:
+    branches:
+      - current
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+jobs:
+  sonar-cloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Makefile

@@ -61,12 +61,13 @@ op_mode_definitions: $(op_xml_obj)
 	rm -f $(OP_TMPL_DIR)/clear/node.def
 	rm -f $(OP_TMPL_DIR)/delete/node.def
 
-	# XXX: ping, traceroute and mtr must be able to recursivly call themselves as the
+	# XXX: tcpdump, ping, traceroute and mtr must be able to recursivly call themselves as the
 	# options are provided from the scripts themselves
 	ln -s ../node.tag $(OP_TMPL_DIR)/ping/node.tag/node.tag/
 	ln -s ../node.tag $(OP_TMPL_DIR)/traceroute/node.tag/node.tag/
 	ln -s ../node.tag $(OP_TMPL_DIR)/mtr/node.tag/node.tag/
 	ln -s ../node.tag $(OP_TMPL_DIR)/monitor/traceroute/node.tag/node.tag/
+	ln -s ../node.tag $(OP_TMPL_DIR)/monitor/traffic/interface/node.tag/node.tag/
 
 	# XXX: test if there are empty node.def files - this is not allowed as these
 	# could mask help strings or mandatory priority statements
@@ -77,7 +78,7 @@ vyshim:
 	$(MAKE) -C $(SHIM_DIR)
 
 .PHONY: all
-all: clean interface_definitions op_mode_definitions check test j2lint vyshim
+all: clean interface_definitions op_mode_definitions check test j2lint vyshim check_migration_scripts_executable
 
 .PHONY: check
 .ONESHELL:
@@ -102,6 +103,12 @@ test:
 	set -e; python3 -m compileall -q -x '/vmware-tools/scripts/, /ppp/' .
 	PYTHONPATH=python/ python3 -m "nose" --with-xunit src --with-coverage --cover-erase --cover-xml --cover-package src/conf_mode,src/op_mode,src/completion,src/helpers,src/validators,src/tests --verbose
 
+.PHONY: check_migration_scripts_executable
+.ONESHELL:
+check_migration_scripts_executable:
+	@echo "Checking if migration scripts have executable bit set..."
+	find src/migration-scripts -type f -not -executable -print -exec false {} + || sh -c 'echo "Found files that are not executable! Add permissions." && exit 1'
+
 .PHONY: j2lint
 j2lint:
 ifndef J2LINT

data/config-mode-dependencies/vyos-1x.json

@@ -59,5 +59,8 @@
         "wireguard": ["interfaces_wireguard"],
         "wireless": ["interfaces_wireless"],
         "wwan": ["interfaces_wwan"]
+    },
+    "system_wireless": {
+        "wireless": ["interfaces_wireless"]
     }
 }

data/configd-include.json

@@ -79,6 +79,7 @@
 "service_router-advert.py",
 "service_salt-minion.py",
 "service_sla.py",
+"service_snmp.py",
 "service_ssh.py",
 "service_tftp-server.py",
 "service_webproxy.py",
@@ -92,6 +93,7 @@
 "system_ip.py",
 "system_ipv6.py",
 "system_lcd.py",
+"system_login.py",
 "system_login_banner.py",
 "system_logs.py",
 "system_option.py",
@@ -102,6 +104,7 @@
 "system_task-scheduler.py",
 "system_timezone.py",
 "system_update-check.py",
+"system_wireless.py",
 "vpn_ipsec.py",
 "vpn_l2tp.py",
 "vpn_openconnect.py",

data/templates/firewall/nftables.j2

@@ -86,7 +86,7 @@ table ip vyos_filter {
 {%         for prior, conf in ipv4.output.items() %}
     chain VYOS_OUTPUT_{{ prior }} {
         type filter hook output priority {{ prior }}; policy accept;
-{%             if global_options.state_policy is vyos_defined %}
+{%             if global_options.state_policy is vyos_defined and prior == 'filter' %}
         jump VYOS_STATE_POLICY
 {%             endif %}
 {%             if conf.rule is vyos_defined %}

data/templates/system/40_usb_autosuspend.j2

@@ -0,0 +1,5 @@
+{% set autosuspend = "auto" %}
+{% if disable_usb_autosuspend is vyos_defined %}
+{%     set autosuspend = "on" %}
+{% endif %}
+ACTION=="add", SUBSYSTEM=="usb", TEST=="power/control", ATTR{power/control}="{{ autosuspend }}"

data/templates/wifi/hostapd.conf.j2

@@ -383,23 +383,25 @@ vht_oper_chwidth={{ capabilities.vht.channel_set_width }}
 {%     for short_gi in capabilities.vht.short_gi if capabilities.vht.short_gi is vyos_defined %}
 {%         set output.value = output.value ~ '[SHORT-GI-' ~ short_gi | upper ~ ']'  %}
 {%     endfor %}
-{%     for beamform in capabilities.vht.beamform if capabilities.vht.beamform is vyos_defined %}
-{%         set output.value = output.value ~ '[SU-BEAMFORMER]' if beamform is vyos_defined('single-user-beamformer') else '' %}
-{%         set output.value = output.value ~ '[SU-BEAMFORMEE]' if beamform is vyos_defined('single-user-beamformee') else '' %}
-{%         set output.value = output.value ~ '[MU-BEAMFORMER]' if beamform is vyos_defined('multi-user-beamformer')  else '' %}
-{%         set output.value = output.value ~ '[MU-BEAMFORMEE]' if beamform is vyos_defined('multi-user-beamformee')  else '' %}
-{%     endfor %}
-{%     if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1  %}
-{%         if capabilities.vht.beamform is vyos_defined %}
-{%             if capabilities.vht.beamform == 'single-user-beamformer' %}
+{%     if capabilities.vht.beamform is vyos_defined %}
+{%         for bf in capabilities.vht.beamform %}
+{%             set output.value = output.value ~ '[SU-BEAMFORMER]' if bf is vyos_defined('single-user-beamformer') else output.value %}
+{%             set output.value = output.value ~ '[SU-BEAMFORMEE]' if bf is vyos_defined('single-user-beamformee') else output.value %}
+{%             set output.value = output.value ~ '[MU-BEAMFORMER]' if bf is vyos_defined('multi-user-beamformer') else output.value %}
+{%             set output.value = output.value ~ '[MU-BEAMFORMEE]' if bf is vyos_defined('multi-user-beamformee') else output.value %}
+{%         endfor %}
+{%         if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1  %}
+{%             if 'single-user-beamformer' in capabilities.vht.beamform %}
 {%                 if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 6  %}
-{%                     set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
-{%                     set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count | int -1 ~ ']' %}
+{%                     set dimension = capabilities.vht.antenna_count | int - 1 %}
+{%                     set output.value = output.value ~ '[BF-ANTENNA-' ~ dimension ~ ']' %}
+{%                     set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ dimension ~ ']' %}
+{%                 endif %}
+{%             else %}
+{%                 if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 5  %}
+{%                     set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count ~ ']' %}
+{%                     set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count ~ ']' %}
 {%                 endif %}
-{%             endif %}
-{%             if capabilities.vht.antenna_count is vyos_defined and capabilities.vht.antenna_count | int > 1 and capabilities.vht.antenna_count | int < 5  %}
-{%                 set output.value = output.value ~ '[BF-ANTENNA-' ~ capabilities.vht.antenna_count ~ ']' %}
-{%                 set output.value = output.value ~ '[SOUNDING-DIMENSION-' ~ capabilities.vht.antenna_count ~ ']' %}
 {%             endif %}
 {%         endif %}
 {%     endif %}

interface-definitions/include/bgp/peer-group.xml.i

@@ -3,7 +3,7 @@
   <properties>
     <help>Peer group for this peer</help>
     <completionHelp>
-      <path>protocols bgp peer-group</path>
+      <path>${COMP_WORDS[@]:1:${#COMP_WORDS[@]}-5} peer-group</path>
     </completionHelp>
     <valueHelp>
       <format>txt</format>

interface-definitions/include/version/interfaces-version.xml.i

@@ -1,3 +1,3 @@
 <!-- include start from include/version/interfaces-version.xml.i -->
-<syntaxVersion component='interfaces' version='32'></syntaxVersion>
+<syntaxVersion component='interfaces' version='33'></syntaxVersion>
 <!-- include end -->

interface-definitions/include/version/openvpn-version.xml.i

@@ -1,3 +1,3 @@
 <!-- include start from include/version/openvpn-version.xml.i -->
-<syntaxVersion component='openvpn' version='1'></syntaxVersion>
+<syntaxVersion component='openvpn' version='2'></syntaxVersion>
 <!-- include end -->