vyos-1x.git/data, branch fix/T8955-http-api-verify-tls

openvpn: T9364: default the MTU to 1420 when DCO is enabled

2026-09-29T21:33:24+00:00

The ovpn Kernel module does no MSS clamping, so with a 1500 bytes MTU full sized packets get fragmented on the underlay. Add an "mtu" node, rendered as "tun-mtu". With "offload dco" it defaults to 1420, unless a raw tun-mtu/link-mtu/udp-mtu option is present. Reject "mtu" together with such an option, below 100, and below 1280 when IPv6 runs inside the tunnel.

openvpn: T9363: multiply the site-to-site keepalive timeout

2026-09-29T18:40:44+00:00

"failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults.

Merge pull request #5496 from vyos/T9338-l3vpn-multi-domain-switching

2026-09-29T05:11:42+00:00

T9338: add bgp mpls l3vpn-multi-domain-switching

Merge pull request #5204 from scottlaird/push-kqmtoppvykzm

2026-09-28T18:32:43+00:00

ntp: T8882: add ntp polling options

ntp: T8882: add per-server poll interval, presend and extension field options

2026-09-28T18:30:00+00:00

Poll intervals were left entirely to the NTP daemon's built-in defaults, so an operator could not widen or narrow the polling range for an individual server, warm up authenticated associations before a poll, or ask a peer for the higher resolution timestamps it may be able to provide. Each configured server and pool now accepts a minimum and maximum poll exponent, defaulting to the values the daemon already used, plus an optional presend exponent and a switch for the F323 extension field. Existing configurations render the same associations as before. Co-authored-by: Christian Breunig

Merge pull request #5511 from ordex/T9337-s2s-keepalive-zero

2026-09-28T18:28:20+00:00

T9337: openvpn: stop rendering "ping 0" in site-to-site

openvpn: T9337: stop rendering "ping 0" in site-to-site

2026-09-28T11:40:44+00:00

"keep-alive interval 0" turns the keepalive off, but site-to-site renders "ping" and "ping-restart" unguarded. A zero interval leaves "ping 0" with the restart timer still armed, so an idle tunnel tears itself down instead of running without keepalive. Leave both directives out when the interval is zero, as T9334 does for the server-mode "keepalive".

Merge pull request #5389 from ruben-herold/T9175-security-poll-suffix

2026-09-28T09:43:06+00:00

dns: T9175: make PowerDNS security status poll opt-in

bgp: T9360: render "orf prefix-list both" if send and receive are set

2026-09-27T18:03:43+00:00

When both the ORF send and receive capability were enabled for a BGP neighbor address-family, the FRR template emitted two individual statements: neighbor 192.0.2.1 capability orf prefix-list send neighbor 192.0.2.1 capability orf prefix-list receive FRR stores this combination as a single "both" directive, so its running configuration never matched what VyOS generated. As a result every subsequent commit, even one entirely unrelated to BGP, removed and re-added the ORF capability. Each of those cycles resets the established BGP session for about two seconds. Cover all three combinations for both a plain neighbor and a peer-group: * send only -> neighbor capability orf prefix-list send * receive only -> neighbor capability orf prefix-list receive * send + receive -> neighbor capability orf prefix-list both The "both" case additionally verifies that the individual send and receive statements are no longer rendered, as those are exactly what made FRR and VyOS disagree about the running configuration. Co-authored-by: Christian Breunig

Merge pull request #5376 from natali-rs1985/T9146

2026-09-25T14:55:23+00:00

vpp: T9146: Enable DPDK no-multi-seg when a full frame fits the buffer