vyos-1x.git/src/conf_mode, branch rolling

Merge pull request #5314 from natali-rs1985/T9018

2026-07-09T13:56:31+00:00

vpp: T9018: Auto-enable promiscuous mode for interfaces with VLANs

vpp: T9062: Enable DHCP/DHCPv6 client detection on VLAN sub-interfaces

2026-07-09T09:26:19+00:00

The 'ip4-dhcp-client-detect' and 'ip6-icmp-ra-punt' VPP features were only ever enabled on the base ethernet interface, so DHCP and DHCPv6 clients never worked on VLAN sub-interfaces (vif/vif-s) of a VPP-managed interface. Apply the same feature toggles to each vif/vif-s using its own address configuration. vif-c is intentionally excluded, as Q-in-Q sub-interfaces are not currently functional under VPP.

vpp: T9018: Auto-enable promiscuous mode for interfaces with VLANs

2026-07-07T08:35:18+00:00

VPP drops VLAN-tagged frames unless the parent interface has promiscuous mode enabled, causing VLAN sub-interfaces to lose connectivity. Automatically enable promiscuous mode on VPP interfaces that have VLAN sub-interfaces (vif/vif-s) configured.

Merge pull request #5307 from natali-rs1985/T9002

2026-07-03T14:19:31+00:00

T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

2026-07-02T12:34:17+00:00

The blackbox-exporter runs as node_exporter user which cannot create ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW capability to the systemd service when ICMP modules are configured. In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet. In VRF mode, replace runuser with setpriv to preserve the capability across the UID change.

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

Merge pull request #5254 from jd82k/domain-group

2026-06-30T15:05:19+00:00

T8963: policy-route: trigger domain resolver for domain groups

T9031: Fix updating pppoe server protocols

2026-06-30T07:55:26+00:00

Authentication protocols are implemented as modules in accel-ppp-ng. The CLI setting configures which modules need to be loaded, for this change to take effect pppoe server must be restarted.

Merge pull request #5296 from statio/https-full-ca-chain

2026-06-29T17:16:15+00:00

https: T9022: serve the full CA certificate chain

ci: T8490: fix typos in comments, strings, and local identifiers

2026-06-29T12:10:10+00:00

Reaches a clean typos baseline for the T8490 ruleset pilot. Categories: - Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError; "ned" -> "new" (migration comments). - Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is". - Local variables (all refs in-function): commited, formating, presistent; inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision). - Self-contained renames (definition + all references in-file): formated_stats, _get_formatted_output_conections -> ..._connections, expension_failure -> expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required. False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's "U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert the real upstream `vppctl` output). Verified: typos clean, py_compile of every edited .py, zero remaining old-identifier references. 🤖 Generated by [robots](https://vyos.io)