diff --git a/src/confd/yang/confd.inc b/src/confd/yang/confd.inc index 85082999..c4b23343 100644 --- a/src/confd/yang/confd.inc +++ b/src/confd/yang/confd.inc @@ -48,11 +48,11 @@ MODULES=( "ieee802-ethernet-phy-type@2025-09-10.yang" "infix-ethernet-interface@2026-05-21.yang" "infix-factory-default@2023-06-28.yang" - "infix-interfaces@2026-05-18.yang -e vlan-filtering" + "infix-interfaces@2026-06-11.yang -e vlan-filtering" "ietf-crypto-types -e cleartext-symmetric-keys" "infix-crypto-types@2026-02-14.yang" "ietf-keystore -e symmetric-keys" - "infix-ntp@2026-03-09.yang" + "infix-ntp@2026-06-11.yang" "infix-keystore@2025-12-17.yang" "ieee1588-ptp-tt@2023-08-14.yang -e timestamp-correction" "ieee802-dot1as-gptp@2025-12-10.yang" diff --git a/src/confd/yang/confd/infix-if-wireguard.yang b/src/confd/yang/confd/infix-if-wireguard.yang index 7441ce25..ed821921 100644 --- a/src/confd/yang/confd/infix-if-wireguard.yang +++ b/src/confd/yang/confd/infix-if-wireguard.yang @@ -36,6 +36,19 @@ submodule infix-if-wireguard { contact "kernelkit@googlegroups.com"; description "WireGuard VPN tunnel interface"; + revision 2026-06-11 { + description "Fix private-key/public-key-bag key-format must expressions. + + deref() of a *-ref leafref resolves to the referenced key's + 'name' leaf, so 'deref(.)/ks:public-key-format' looked for the + format leaf as a child of 'name' (which does not exist). Step + up to the key entry with 'deref(.)/../...', matching the + working preshared-key must. For the truststore public-key-bag, + public-key-format lives under the 'public-key' list, so descend + via 'deref(.)/../ts:public-key/ts:public-key-format'."; + reference "internal"; + } + revision 2025-11-09 { description "Initial revision"; reference "internal"; @@ -149,9 +162,9 @@ submodule infix-if-wireguard { type ks:central-asymmetric-key-ref; mandatory true; description "Reference to WireGuard private key (X25519/Curve25519 format)"; - must "not(deref(.)/ks:public-key-format) or " - + "(derived-from-or-self(deref(.)/ks:public-key-format, 'ixct:x25519-public-key-format') and " - + "derived-from-or-self(deref(.)/ks:private-key-format, 'ixct:x25519-private-key-format'))" { + must "not(deref(.)/../ks:public-key-format) or " + + "(derived-from-or-self(deref(.)/../ks:public-key-format, 'ixct:x25519-public-key-format') and " + + "derived-from-or-self(deref(.)/../ks:private-key-format, 'ixct:x25519-private-key-format'))" { error-message "Private key must be in WireGuard (X25519/Curve25519) format"; } } @@ -177,8 +190,8 @@ submodule infix-if-wireguard { leaf public-key-bag { type ts:central-public-key-bag-ref; - must "not(deref(.)/ts:public-key-format) or " - + "(derived-from-or-self(deref(.)/ts:public-key-format, 'ixct:x25519-public-key-format'))" { + must "not(deref(.)/../ts:public-key/ts:public-key-format) or " + + "(derived-from-or-self(deref(.)/../ts:public-key/ts:public-key-format, 'ixct:x25519-public-key-format'))" { error-message "Public key must be in WireGuard (X25519/Curve25519) format"; } description "Reference to public key bag containing peer public keys"; diff --git a/src/confd/yang/confd/infix-if-wireguard@2025-11-09.yang b/src/confd/yang/confd/infix-if-wireguard@2026-06-11.yang similarity index 100% rename from src/confd/yang/confd/infix-if-wireguard@2025-11-09.yang rename to src/confd/yang/confd/infix-if-wireguard@2026-06-11.yang diff --git a/src/confd/yang/confd/infix-interfaces.yang b/src/confd/yang/confd/infix-interfaces.yang index 6cd517d8..d86a9789 100644 --- a/src/confd/yang/confd/infix-interfaces.yang +++ b/src/confd/yang/confd/infix-interfaces.yang @@ -41,6 +41,12 @@ module infix-interfaces { contact "kernelkit@googlegroups.com"; description "Linux bridge and lag extensions for ietf-interfaces."; + revision 2026-06-11 { + description "Fix WireGuard key-format must expressions, see + infix-if-wireguard@2026-06-11."; + reference "internal"; + } + revision 2026-05-18 { description "Track ieee802-ethernet-interface@2025-09-10 upgrade (IEEE Std 802.3.2-2025): operational data now exposes diff --git a/src/confd/yang/confd/infix-interfaces@2026-05-18.yang b/src/confd/yang/confd/infix-interfaces@2026-06-11.yang similarity index 100% rename from src/confd/yang/confd/infix-interfaces@2026-05-18.yang rename to src/confd/yang/confd/infix-interfaces@2026-06-11.yang diff --git a/src/confd/yang/confd/infix-ntp.yang b/src/confd/yang/confd/infix-ntp.yang index 9a2582b8..08ebb5de 100644 --- a/src/confd/yang/confd/infix-ntp.yang +++ b/src/confd/yang/confd/infix-ntp.yang @@ -29,6 +29,17 @@ module infix-ntp { contact "kernelkit@googlegroups.com"; description "Infix deviations and augments to ietf-ntp."; + revision 2026-06-11 { + description "Fix iburst/burst peer-mode must expressions. + + The must was attached to the iburst/burst leaf, so the + context node was the leaf itself; 'ntp:iburst'/'ntp:burst' + then resolved as a non-existent child of the leaf, which + libyang flagged as an unresolved schema node. Reference + the leaf's own value with '.' instead."; + reference "internal"; + } + revision 2026-03-09 { description "Add stratumweight to NTP server configuration. @@ -351,7 +362,7 @@ module infix-ntp { deviation "/ntp:ntp/ntp:unicast-configuration/ntp:iburst" { deviate add { - must "not(ntp:iburst and ../type = 'ntp:uc-peer')" { + must "not(. = 'true' and ../type = 'ntp:uc-peer')" { error-message "iburst option is not supported in peer mode"; } } @@ -359,7 +370,7 @@ module infix-ntp { deviation "/ntp:ntp/ntp:unicast-configuration/ntp:burst" { deviate add { - must "not(ntp:burst and ../type = 'ntp:uc-peer')" { + must "not(. = 'true' and ../type = 'ntp:uc-peer')" { error-message "burst option is not supported in peer mode"; } } diff --git a/src/confd/yang/confd/infix-ntp@2026-03-09.yang b/src/confd/yang/confd/infix-ntp@2026-06-11.yang similarity index 100% rename from src/confd/yang/confd/infix-ntp@2026-03-09.yang rename to src/confd/yang/confd/infix-ntp@2026-06-11.yang