vyos-1x.git/src/conf_mode, branch rolling

Merge pull request #5539 from c-po/T9253-anycast-gw-shared-mac

2026-10-12T10:08:59+00:00

pseudo-ethernet: T9253: fix anycast-gateway with shared MAC on bridge VLANs

Merge pull request #5534 from jbsky/container-tmpfs-chown

2026-10-11T19:20:57+00:00

container: T9401: add chown option to tmpfs mounts

Merge pull request #5487 from ar0311/fix/T9332-geoip-src-dst-set-collision

2026-10-11T18:57:18+00:00

firewall: T9332: fix GeoIP source/destination nftables set name colli…

openvpn: T9386: reject AEAD fallback cipher with shared-secret-key

2026-10-09T13:32:03+00:00

Static key mode only supports CBC, so OpenVPN refuses to start with an AEAD "data-ciphers-fallback" just like with an AEAD "encryption cipher". Reject it at commit time.

Merge pull request #5502 from natali-rs1985/T6304

2026-10-09T13:02:37+00:00

config-management: T6304: Rewrite commit-archive location into a structured CLI

pseudo-ethernet: T9253: fix anycast-gateway with shared MAC on bridge VLANs

2026-10-08T19:36:33+00:00

Several anycast-gateway pseudo-ethernets with the same MAC on different VLANs of one bridge (the usual EVPN layout) failed to commit with "bridge fdb add ... File exists". The local FDB entry was always installed without a VLAN, so every interface competed for the same entry. A failing commit at boot left only one interface configured and dropped the rest of the config. The local FDB entry is now bound to the VLAN of the bridge sub-interface when the bridge is VLAN aware, and it is installed with replace so a re-commit over an existing entry no longer fails. Two anycast-gateways with the same MAC on the same source-interface are rejected.

vpp: T9161: Enforce NIC MTU limit and apply MTU to VLAN sub-interfaces

2026-10-08T11:36:32+00:00

On a VPP-bound interface the MTU limit is the NIC's, which only VPP knows (the kernel side is an LCP tap reporting a meaningless larger max). Reject at commit an MTU larger than that limit, read from VPP's 'show hardware-interfaces' (max mtu + driver frame overhead), so the kernel and dataplane cannot silently end up with different MTUs. Also apply a VLAN sub-interface's MTU to its VPP dataplane sub-interface and its linux-cp tap (created with MTU 0), not just the parent; a sub-interface without its own MTU inherits the parent's. Covers ethernet (vif/vif-s) and VPP bond/loopback (vif).

Merge pull request #5523 from mandelbitdev/T9370-openvpn-chacha20poly1305

2026-10-07T18:04:21+00:00

openvpn: T9370: add chacha20poly1305 data cipher

config-management: T6304: Rewrite commit-archive location into a structured CLI

2026-10-07T13:45:58+00:00

Replace the free-form 'commit-archive location ' leafNode with a structured, per-destination tagNode: `set system config-management commit-archive location \ authentication { username | password } | server | port | path` Each location selects exactly one transport protocol (scp, sftp, ssh, ftp, ftps, http, https, git, tftp). 'git' additionally accepts a 'transport' (https/http/ssh, default https). 'source-address' and 'vrf' stay under 'commit-archive' and apply to every location, as before.

container: T9401: add chown option to tmpfs mounts

2026-10-06T04:38:13+00:00

Since T9024 (Podman 5.8.4, crun replaced by runc 1.1.5), a tmpfs mounted over a directory that already exists in the image is owned by root:root 0755, whatever the image prepared. A container running as a non-root user (image USER or uid/gid) can no longer write its pid file or control socket there and fails to start. With crun 1.8.1 every tmpfs was 1777, so the same configuration used to work. runc 1.1.5 ignores tmpfs-mode; the Podman mount option `U` (chown the mount to the container user) is the only one that works on the runtime VyOS ships. Expose it as a valueless `chown` node: set container name tmpfs chown Without the option the generated Quadlet line is unchanged. Co-Authored-By: Claude Opus 5.5