vyos-1x.git/data/templates/frr, branch rolling

nhrp: T9128: fix duplicate nftables meter name for multiple redirect tunnels

2026-07-27T07:07:24+00:00

Committing a second NHRP tunnel with "redirect" enabled failed with "Failed to apply NHRP tunnel firewall rules". The redirect chain in nhrpd_nftables.conf.j2 is rendered in a per-tunnel loop but hardcoded the nftables meter name "loglimit-0". With two redirect-enabled tunnels the loop declared the named set "loglimit-0" twice in table vyos_nhrp_redirect, which nft rejects, aborting the atomic ruleset load so the commit failed. Derive the meter name from the loop index (loglimit-0, loglimit-1, ...) so every redirect-enabled tunnel gets a unique meter. The first tunnel keeps the name "loglimit-0", leaving single-tunnel setups unchanged. Add a smoketest that configures two tunnels with redirect + multicast and verifies the commit succeeds and both meters are present. Also clear the "vpn ipsec" tree in tearDown so the IPsec profile created by the existing test does not leak into the new one.

bgp: T6573: fix template indention for "bgp route-reflector"

2026-06-29T15:10:13+00:00

bgp: T6573: add input/output queue limit CLI commands

2026-06-29T15:10:13+00:00

Add input-queue-limit and output-queue-limit CLI nodes to expose global FRR "bgp input-queue-limit" and "bgp output-queue-limit" commands via our CLI. Parameters control the maximum number of queued messages for all BGP peers during message parsing. FRR default is 10000 which we honor. Note that this is a global option and can only be set for the global/default BGP instance.

bgp: T9013: Add BMP source-interface support

2026-06-25T13:06:05+00:00

T8990: bgp: fix VPNv4/VPNv6 leaked routes flapping on every commit

2026-06-20T13:51:25+00:00

VRF route leaking via VPNv4/VPNv6 caused all imported (leaked) routes to be withdrawn and reinstalled on every commit - even commits unrelated to BGP, VRF or routing - briefly blackholing traffic that depends on them. Root cause: the BGP address-family template rendered the route-target using the "route-target vpn ..." alias. FRR accepts that alias on input but its config writer only ever emits the canonical "rt vpn ..." form. frr-reload.py diffs the generated config against FRR's running config line by line and has no normalisation for this, so the route-target lines never matched and were deleted and re-added on every reload. Re-applying the route-target runs FRR's vpn_leak_prechange()/postchange(), a non-atomic withdraw-all then reinstall-all of every leaked route. Emit the canonical "rt vpn" keyword so the rendered config round-trips through frr-reload unchanged. FRR also folds an identical import+export route-target into "both" (an order-sensitive, byte-identical match), so do the same to stay idempotent; reordered or differing lists stay split on both sides. Add test_bgp_33_vpn_route_target_idempotency covering both / identical export+import / asymmetric route-target, reading the generated FRR config (getFRRconfig/vtysh returns FRR's already-canonical form and cannot catch the alias).

T8923: normalize "can not" to "cannot"

2026-06-16T18:24:44+00:00

Replace two-word "can not" / "Can not" with "cannot" across comments, ConfigError messages, CLI help text, and op-mode output. Standard SNMP MIB files under mibs/ are left unchanged.

T8822: Add BFD strict mode for BGP

2026-05-21T13:26:07+00:00

bgp: T8588: Add match source-peer to policy route-map (#5149)

2026-05-13T15:03:50+00:00

frr: T8606: add watchfrr timeout option (#5165)

2026-05-12T14:41:35+00:00

Co-authored-by: Christian Breunig

bgp: T8607: Add CLI support for BGP update-delay and establish-wait

2026-05-11T09:24:43+00:00