VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling 2026-10-12T10:08:59+00:00 2026-10-12T10:08:59+00:00 Kyrylo Yatsenko hedrok@gmail.com 2026-10-12T10:08:59+00:00 urn:sha1:507625435cf70a6fd5ae9a26d8f19eac1a50d4ae pseudo-ethernet: T9253: fix anycast-gateway with shared MAC on bridge VLANs 2026-10-11T19:20:57+00:00 Christian Breunig christian@breunig.cc 2026-10-11T19:20:57+00:00 urn:sha1:713626a1978b40e0a818203e95a529f9fb32a228 container: T9401: add chown option to tmpfs mounts 2026-10-11T18:57:18+00:00 Christian Breunig christian@breunig.cc 2026-10-11T18:57:18+00:00 urn:sha1:1bd02305554643b698e254fcc725487b0d66b20f firewall: T9332: fix GeoIP source/destination nftables set name colli… 2026-10-09T13:32:03+00:00 Antonio Quartulli antonio@mandelbit.com 2026-10-01T13:28:13+00:00 urn:sha1:0d49d1ba8dbfabb6c1a49216b69d79ed47b4a251 Static key mode only supports CBC, so OpenVPN refuses to start with an AEAD "data-ciphers-fallback" just like with an AEAD "encryption cipher". Reject it at commit time. 2026-10-09T13:02:37+00:00 John Estabrook jestabro@vyos.io 2026-10-09T13:02:37+00:00 urn:sha1:998fe8286fea7c2a0492fcf77ee87ae41597f0e8 config-management: T6304: Rewrite commit-archive location into a structured CLI 2026-10-08T19:36:33+00:00 Christian Breunig christian@breunig.cc 2026-10-07T18:44:34+00:00 urn:sha1:e3643b21a507dc744b9b64d919a555ff597cc71c Several anycast-gateway pseudo-ethernets with the same MAC on different VLANs of one bridge (the usual EVPN layout) failed to commit with "bridge fdb add ... File exists". The local FDB entry was always installed without a VLAN, so every interface competed for the same entry. A failing commit at boot left only one interface configured and dropped the rest of the config. The local FDB entry is now bound to the VLAN of the bridge sub-interface when the bridge is VLAN aware, and it is installed with replace so a re-commit over an existing entry no longer fails. Two anycast-gateways with the same MAC on the same source-interface are rejected. 2026-10-08T11:36:32+00:00 Nataliia Solomko natalirs1985@gmail.com 2026-09-04T13:32:01+00:00 urn:sha1:d054b7c82f239ff09a905b506943c03094d2d26b On a VPP-bound interface the MTU limit is the NIC's, which only VPP knows (the kernel side is an LCP tap reporting a meaningless larger max). Reject at commit an MTU larger than that limit, read from VPP's 'show hardware-interfaces' (max mtu + driver frame overhead), so the kernel and dataplane cannot silently end up with different MTUs. Also apply a VLAN sub-interface's MTU to its VPP dataplane sub-interface and its linux-cp tap (created with MTU 0), not just the parent; a sub-interface without its own MTU inherits the parent's. Covers ethernet (vif/vif-s) and VPP bond/loopback (vif). 2026-10-08T07:48:58+00:00 Christian Breunig christian@breunig.cc 2026-10-08T07:48:58+00:00 urn:sha1:1ac0219e62c7b0efee9e81e7266558dffc7b14e6 configd: T9368: reconcile FRR after a DHCP lease without the commit socket 2026-10-07T18:04:21+00:00 Christian Breunig christian@breunig.cc 2026-10-07T18:04:21+00:00 urn:sha1:58ccdee2d255f4e952322467902f7d69b4f828fa openvpn: T9370: add chacha20poly1305 data cipher 2026-10-07T17:59:15+00:00 Christian Breunig christian@breunig.cc 2026-10-07T17:59:15+00:00 urn:sha1:8cfc171402bbe8fbc67bea3b579a27d7e0d78ac6 A PPPoE session is restarted from within the commit that changes it and comes back up milliseconds later, while that commit is still running. The hook which then configures the interface reads the running configuration, which until the commit finishes is still the one from before it. Everything the commit adds is missing at that point: for an interface newly set to IPv6 autoconf the hook disabled router advertisements and autoconfiguration on the link, and nothing turned them back on. The link kept its link-local address and never received a global one, until the next commit or reconnect. Which interface is hit varies with the order the commit happens to process them, so this surfaced as an intermittent failure. The hook now waits for the commit to finish before reading the configuration.