vyos-1x.git/data/templates, branch nos-task-id

nhrp: T9128: fix duplicate nftables meter name for multiple redirect tunnels

2026-07-27T07:07:24+00:00

Committing a second NHRP tunnel with "redirect" enabled failed with "Failed to apply NHRP tunnel firewall rules". The redirect chain in nhrpd_nftables.conf.j2 is rendered in a per-tunnel loop but hardcoded the nftables meter name "loglimit-0". With two redirect-enabled tunnels the loop declared the named set "loglimit-0" twice in table vyos_nhrp_redirect, which nft rejects, aborting the atomic ruleset load so the commit failed. Derive the meter name from the loop index (loglimit-0, loglimit-1, ...) so every redirect-enabled tunnel gets a unique meter. The first tunnel keeps the name "loglimit-0", leaving single-tunnel setups unchanged. Add a smoketest that configures two tunnels with redirect + multicast and verifies the commit succeeds and both meters are present. Also clear the "vpn ipsec" tree in tearDown so the IPsec profile created by the existing test does not leak into the new one.

Merge pull request #5324 from tjjh89017/frr-exporter-collectors

2026-07-20T15:05:37+00:00

T9073: frr-exporter: add CLI support for optional collectors and collector options

Merge pull request #5139 from sever-sever/T8529

2026-07-16T20:41:18+00:00

T8529: Add configuration CLI to enable OpenSSL FIPS

T9073: frr-exporter: add CLI support for optional collectors and collector options

2026-07-16T11:46:02+00:00

frr_exporter v1.5.0 enables the bgp, ospf, bfd and route collectors by default, while bgpl2vpn, pim and vrrp must be enabled explicitly. Expose bgpl2vpn (CLI: bgp-l2-vpn) and pim under "service monitoring prometheus frr-exporter collector", following the same CLI style as the node-exporter collectors node. The vrrp collector is not exposed since VyOS implements VRRP with keepalived and FRR's vrrpd is never started. Also expose the collector options available in v1.5.0: - collector bgp accept-filtered-prefixes - collector bgp advertised-prefixes - collector bgp peer-description - collector bgp peer-group - collector bgp peer-hostname - collector bgp peer-type - collector ospf-instance - collector detailed-routes The bgp.* options are shared by the bgp, bgp6 and bgpl2vpn collectors upstream. The bgp6 collector remains unconditionally enabled, hence existing configurations render the same ExecStart and no migration is required. Includes code generated by Claude Code

Merge pull request #5307 from natali-rs1985/T9002

2026-07-03T14:19:31+00:00

T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

T8529: Add configuration CLI to enable OpenSSL FIPS

2026-07-03T11:45:19+00:00

Add the new configuration CLI to enable OpenSSL FIPS-140 (Federal Information Processing Standard) cryptographic modules

T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

2026-07-02T12:34:17+00:00

The blackbox-exporter runs as node_exporter user which cannot create ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW capability to the systemd service when ICMP modules are configured. In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet. In VRF mode, replace runuser with setpriv to preserve the capability across the UID change.

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

bgp: T6573: fix template indention for "bgp route-reflector"

2026-06-29T15:10:13+00:00

bgp: T6573: add input/output queue limit CLI commands

2026-06-29T15:10:13+00:00

Add input-queue-limit and output-queue-limit CLI nodes to expose global FRR "bgp input-queue-limit" and "bgp output-queue-limit" commands via our CLI. Parameters control the maximum number of queued messages for all BGP peers during message parsing. FRR default is 10000 which we honor. Note that this is a global option and can only be set for the global/default BGP instance.