Change Details

RPKI SSH key files are globbed and deleted for every VRF before only the current VRF's keys are rewritten, and the file names are not VRF-qualified. Location [[ RPKI SSH key files are globbed and deleted for every VRF before only the current VRF's keys are rewritten, and the file names are not VRF-qualified. Location src/conf_mode/protocols_rpki.py:82-83, :93-94 python/vyos/frrender.py:469-470, :660-661 Problem Glob-unlink runs before VRF selection; key file names are not VRF-qualified. Impact Default-VRF RPKI SSH caches lose their keys when a VRF instance commits; same cache name in two VRFs collides. Suggested fix Qualify file names with the VRF and delete only that VRF's stale keys. | src/conf_mode/protocols_rpki.py:82-83 ]], :[[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/protocols_rpki.py#L93-L94 | 93-94 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/python/vyos/frrender.py#L469-L470 | python/vyos/frrender.py:469-470 ]], :660-661 Problem Glob-unlink runs before VRF selection; key file names are not VRF-qualified. Impact Default-VRF RPKI SSH caches lose their keys when a VRF instance commits; same cache name in two VRFs collides. Suggested fix Qualify file names with the VRF and delete only that VRF's stale keys.

RPKI SSH key files are globbed and deleted for every VRF before only the current VRF's keys are rewritten, and the file names are not VRF-qualified. Location [[ src/conf_mode/protocols_rpki.py:82-83 ]], :[[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/protocols_rpki.py#L93-L94 | 93-94 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/python/vyos/frrender.py#L469-L470 | python/vyos/frrender.py:469-470 ]], :660-661 Problem Glob-unlink runs before VRF selection; key file names are not VRF-qualified. Impact Default-VRF RPKI SSH caches lose their keys when a VRF instance commits; same cache name in two VRFs collides. Suggested fix Qualify file names with the VRF and delete only that VRF's stale keys.

RPKI SSH key files are globbed and deleted for every VRF before only the current VRF's keys are rewritten, and the file names are not VRF-qualified. Location [[ RPKI SSH key files are globbed and deleted for every VRF before only the current VRF's keys are rewritten, and the file names are not VRF-qualified. Location src/conf_mode/protocols_rpki.py:82-83, :93-94 python/vyos/frrender.py:469-470, :660-661 Problem Glob-unlink runs before VRF selection; key file names are not VRF-qualified. Impact Default-VRF RPKI SSH caches lose their keys when a VRF instance commits; same cache name in two VRFs collides. Suggested fix Qualify file names with the VRF and delete only that VRF's stale keys. | src/conf_mode/protocols_rpki.py:82-83 ]], :[[ https://github.com/vyos/vyos-1x/blob/rolling/src/conf_mode/protocols_rpki.py#L93-L94 | 93-94 ]] [[ https://github.com/vyos/vyos-1x/blob/rolling/python/vyos/frrender.py#L469-L470 | python/vyos/frrender.py:469-470 ]], :660-661 Problem Glob-unlink runs before VRF selection; key file names are not VRF-qualified. Impact Default-VRF RPKI SSH caches lose their keys when a VRF instance commits; same cache name in two VRFs collides. Suggested fix Qualify file names with the VRF and delete only that VRF's stale keys.