VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls 2026-09-24T06:40:37+00:00 2026-09-24T06:40:37+00:00 Kyrylo Yatsenko hedrok@gmail.com 2026-09-24T06:22:48+00:00 urn:sha1:f4a86a1949f7571d5d3ccde38cfd79d88973f997 Add command set protocols bgp interface <interface> mpls l3vpn-multi-domain-switching that exposes FRR's `mpls bgp l3vpn-multi-domain-switching` under interface node. 2026-09-16T08:22:40+00:00 Oleksandr Kuchmystyi o.kuchmystyi@vyos.io 2026-09-15T09:10:16+00:00 urn:sha1:d1cc3ed65eb1f00409d0b91fc8149431fb614e89 VyOS does not expose the strongSwan `connections.<conn>.unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own. 2026-09-13T19:06:12+00:00 Antonio Quartulli antonio@mandelbit.com 2026-08-30T17:43:51+00:00 urn:sha1:585c491b3ee5c02a0367bf2bd752fe4510200c6a "offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration. 2026-09-11T14:28:09+00:00 Ruben Herold ruben@puettmann.net 2026-09-11T14:28:09+00:00 urn:sha1:8fec254b2d17d5aec30589f0b3c5444ad1dfd1f5 firewall: T9157: add fib-type match for destination/source 2026-08-28T10:27:57+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-08-28T10:27:57+00:00 urn:sha1:90b7de7e084f86450d5ac42b005901972f362999 ha: T9166: add IPv6 support for HA peer links 2026-08-25T18:09:47+00:00 chariri w@chariri.moe 2026-08-22T19:56:00+00:00 urn:sha1:b85a7d6216d1062efd65edd0b25c44431c04f280 Accept IPv6 source and remote addresses for Kea high availability and bracket IPv6 endpoints in generated peer URLs. 2026-08-24T01:03:29+00:00 l0crian1 ryan.claridge13@gmail.com 2026-08-24T01:03:29+00:00 urn:sha1:3641d61b317a6c6ef99bb2fa1a1fa348e48f934e - Add mac-address-mask support to firewall rules - Add smoketest for mac-address-mask 2026-08-17T16:54:14+00:00 Christian Breunig christian@breunig.cc 2026-08-11T18:32:52+00:00 urn:sha1:a57dd68ed40ec77ba0a0fc5a2c641fe344fc0570 Tab completion for source-interface and other interface leafNodes already excludes VRF names, but the shared interface-name constraint accepted them anyway: an existing VRF is a real net device, so it passed the file-path existence check even though it failed the interface-name regex. Replace the file-path validator with a new interface-exists validator that requires the value to both exist under /sys/class/net and not be a VRF. The regex-match fallback is unchanged, so dynamic interfaces (e.g. pppoe) referenced before they exist still validate correctly. 2026-08-14T13:00:14+00:00 Daniil Baturin daniil@vyos.io 2026-08-14T13:00:14+00:00 urn:sha1:0775edcd1eaa668d789f0ee9d00da14f11e7c1dd ddclient: T6981: Upgrade ddclient to v4.0.0 2026-08-12T21:50:20+00:00 Ritika Chopra r.chopra@vyos.io 2026-06-16T05:31:22+00:00 urn:sha1:f55f1ed843894a7eb63bec6de1bbcead9417b67a (cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed)