vyos-1x.git/data, branch rolling

Merge pull request #5347 from statio/T9122-flow-accounting-netflow-vrf

2026-08-08T16:46:36+00:00

flow-accounting: T9122: bind NetFlow export to the configured VRF

Merge pull request #5320 from natali-rs1985/T9065

2026-08-06T15:26:53+00:00

sflow: T9065: Always set psample group even when egress sampling is disabled

flow-accounting: T9122: bind NetFlow export to the configured VRF

2026-07-30T17:21:51+00:00

After the migration from pmacct to the ipt_NETFLOW kernel module the "system flow-accounting vrf" node no longer had any effect on the export path. NetFlow is emitted by the kernel module, so there is no daemon left to wrap in "ip vrf exec" and the module socket was never bound to the VRF. A collector reachable only inside a VRF therefore never received any flows when the export was configured with a source-address. Bind the export socket to a device via the ipt_NETFLOW "%device" destination suffix: a per-server source-interface takes precedence, otherwise the global VRF device is used, reproducing the previous "ip vrf exec" behaviour. The module parses "@source-address" before "%device", so the source-address is now rendered first - the previous template emitted them in the opposite order, which only worked because the two options are mutually exclusive per server. Reject a source-interface that is used together with a VRF but is not a member of that VRF: the exported flows would otherwise silently leave via a different routing table. This mirrors the existing OSPF, OSPFv3, IS-IS and BGP checks.

nhrp: T9128: fix duplicate nftables meter name for multiple redirect tunnels

2026-07-27T07:07:24+00:00

Committing a second NHRP tunnel with "redirect" enabled failed with "Failed to apply NHRP tunnel firewall rules". The redirect chain in nhrpd_nftables.conf.j2 is rendered in a per-tunnel loop but hardcoded the nftables meter name "loglimit-0". With two redirect-enabled tunnels the loop declared the named set "loglimit-0" twice in table vyos_nhrp_redirect, which nft rejects, aborting the atomic ruleset load so the commit failed. Derive the meter name from the loop index (loglimit-0, loglimit-1, ...) so every redirect-enabled tunnel gets a unique meter. The first tunnel keeps the name "loglimit-0", leaving single-tunnel setups unchanged. Add a smoketest that configures two tunnels with redirect + multicast and verifies the commit succeeds and both meters are present. Also clear the "vpn ipsec" tree in tearDown so the IPsec profile created by the existing test does not leak into the new one.

Merge pull request #5324 from tjjh89017/frr-exporter-collectors

2026-07-20T15:05:37+00:00

T9073: frr-exporter: add CLI support for optional collectors and collector options

Merge pull request #5139 from sever-sever/T8529

2026-07-16T20:41:18+00:00

T8529: Add configuration CLI to enable OpenSSL FIPS

T9073: frr-exporter: add CLI support for optional collectors and collector options

2026-07-16T11:46:02+00:00

frr_exporter v1.5.0 enables the bgp, ospf, bfd and route collectors by default, while bgpl2vpn, pim and vrrp must be enabled explicitly. Expose bgpl2vpn (CLI: bgp-l2-vpn) and pim under "service monitoring prometheus frr-exporter collector", following the same CLI style as the node-exporter collectors node. The vrrp collector is not exposed since VyOS implements VRRP with keepalived and FRR's vrrpd is never started. Also expose the collector options available in v1.5.0: - collector bgp accept-filtered-prefixes - collector bgp advertised-prefixes - collector bgp peer-description - collector bgp peer-group - collector bgp peer-hostname - collector bgp peer-type - collector ospf-instance - collector detailed-routes The bgp.* options are shared by the bgp, bgp6 and bgpl2vpn collectors upstream. The bgp6 collector remains unconditionally enabled, hence existing configurations render the same ExecStart and no migration is required. Includes code generated by Claude Code

sflow: T9065: Always set psample group even when egress sampling is disabled

2026-07-10T09:23:08+00:00

Merge pull request #5307 from natali-rs1985/T9002

2026-07-03T14:19:31+00:00

T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

T8529: Add configuration CLI to enable OpenSSL FIPS

2026-07-03T11:45:19+00:00

Add the new configuration CLI to enable OpenSSL FIPS-140 (Federal Information Processing Standard) cryptographic modules