vyos-1x.git/data, branch fix/T8859-dh-keysize-validation

Merge pull request #5376 from natali-rs1985/T9146

2026-09-25T14:55:23+00:00

vpp: T9146: Enable DPDK no-multi-seg when a full frame fits the buffer

Merge pull request #5453 from m-songer/T9274-add-telegraf-config

2026-09-25T14:03:20+00:00

T9274: Add more telegraf configuration

T9274: Add more telegraf configuration- #5453

2026-09-24T16:00:38+00:00

Added the ability to make several agent values configurable instead of hardcoded.

dhcpv6-client: T9349: do not start dhcp6c in debug mode

2026-09-24T15:03:23+00:00

dhcp6c was unconditionally started with -D (debug level 2). In daemon mode setloglevel() only calls setlogmask() for levels 0 and 1 - level 2 falls through and leaves the log mask wide open, so every LOG_DEBUG message ends up in syslog: dhcp6c[3935]: copy_option: set client ID (len 18) dhcp6c[3935]: copyout_option: set identity association dhcp6c[3935]: copy_option: set elapsed time (len 2) dhcp6c[3935]: copy_option: set option request (len 4) dhcp6c[3935]: client6_send: send solicit to ff02::1:2%wwan0 dhcp6c[3935]: dhcp6_reset_timer: reset a timer on wwan0, state=SOLICIT, ... On a link where no DHCPv6 server answers this repeats for every SOLICIT retransmission, forever. Drop the flag - errors and the parser diagnostics used by the T7058 smoketest are logged at LOG_ERR and remain visible.

openvpn: T9334: stop rendering "keepalive 0 0"

2026-09-18T09:10:41+00:00

An interval of 0 is how the CLI turns keepalive off, and it rendered "keepalive 0 0" because OpenVPN skipped its own sanity checks on that pair. OpenVPN 2.7.6 dropped the exception and now refuses to start: "keepalive ping: Must be an integer between 1 and 86400, not 0". Leave the directive out of the file instead. Nothing then sets ping or ping-restart, which is the keepalive-off the interval asked for, and a saved configuration still commits untouched.

Merge pull request #5481 from c-po/arm64-smoketests

2026-09-17T08:39:17+00:00

T9014: bugfixes for arm64 platform

lcd: T9014: resolve the LCDd driver path at runtime

2026-09-16T18:35:02+00:00

The LCDd driver modules are shipped in the architecture dependent multiarch library directory, but the template hardcoded the x86_64 path. On arm64 this pointed LCDd at a directory that does not exist, so no driver could be loaded. Derive the multiarch triplet at runtime and render it into LCDd.conf instead of assuming x86_64.

ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers

2026-09-16T08:22:40+00:00

VyOS does not expose the strongSwan `connections..unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own.

Merge pull request #5429 from rockfish-vyos/T9254-ike-esn

2026-09-15T12:48:01+00:00

ipsec: T9254: do not emit ESN transforms in IKE proposals

ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher()

2026-09-14T08:19:12+00:00

get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA semantics), and every IKE_SA call site had to remember to pass esn=False. Nothing enforced that, so a future call site could reintroduce the ESN-in-IKE bug this task fixed. Following review feedback from hedrok, split it into two public filters: get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True get_ike_cipher(group_config) IKE_SA, esn=False always The shared implementation moves to _get_esp_ike_cipher() (no register_filter), so a template can no longer call it directly and skip picking one of the two entry points. Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2 (proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and test_template.py.