summaryrefslogtreecommitdiff
path: root/data
AgeCommit message (Collapse)Author
2026-01-05Merge pull request #4929 from bilde2910/T8140Christian Breunig
router-advert: T8140: add captive portal support (RFC 8910)
2026-01-01router-advert: T8140: add captive portal support (RFC 8910)Marius Lindvall
Add support for captive portal identification in IPv6 router adverts as defined in RFC 8910. The value is a quoted URL pointing to an RFC 8908-compliant API endpoint.
2026-01-01T8138: add nat66 as dependent of firewall groupsMarius Lindvall
Add nat66 as a dependency of firewall groups, because nat66 may reference firewall groups via source-destination-group-ipv6.xml.i. The dependency is necessary to ensure a fresh nft ruleset is built when dependent groups are updated, so that the changes actually take effect in nat66 on commit. Add a smoketest to cover nft rulesets failing to update as a result of changes to dependent firewall groups. Original commit adding support for groups in nat66 is commit f96733dd.
2025-12-30T8133: BGP add local-rib feature for BMPViacheslav Hletenko
2025-12-30bgp: T7664: add 'no bgp reject-as-sets'Kyrylo Yatsenko
In FRR 10.5 'bgp reject-as-sets' became default (https://frrouting.org/release/10.5.0/): > BGP rejects AS_SET by default > Until 10.5.0, it was disabled by default, and since RFC 9774 was > published, we switched this on by default (to reject). Add 'no bgp reject-as-sets' when VyOS option reject_as_sets is not set.
2025-12-29T7635: OpenConnect Certificate AuthenticationGiga Murphy
2025-12-19T8010: Added the vyos_vpp plugin to the accel-pppd's templateAndrii Melnychenko
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-12-18Merge pull request #4895 from natali-rs1985/T8082Viacheslav Hletenko
T8082: VPP fails to start with buffers page-size 1G
2025-12-14ssh: T8098: rename "ciphers" CLI node to "cipher"Christian Breunig
Follow VyOS CLI best practices for using singular whenever possible to build a CLI node. As we introduce a new migration 2 -> 3 for SSH we can correct this minor detail.
2025-12-11T8082: VPP fails to start with buffers page-size 1GNataliia Solomko
2025-12-09Merge pull request #4882 from sever-sever/T8011Viacheslav Hletenko
T8011: VPP fix log duplication in systemd journal
2025-12-04ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`Oleksandr Kuchmystyi
The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.
2025-12-01T8011: VPP fix log duplication in systemd journalViacheslav Hletenko
Set the standard output/error to null to avoid log duplication. Starting the service as "nodaemon" seems cause of this behavior.
2025-11-28Merge pull request #4824 from alexandr-san4ez/T4251-currentViacheslav Hletenko
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
2025-11-27snmp: T8039: fix v3 trap targetsChristian Breunig
The generated Net-SNMP configuration for SNMPv3 trap-targets was fundamentally broken. Not only was the auth/priv type not written in uppercase letters, but also the ordering of transport protocol, IP(v6) address and port was wrong. To complete the issues above - IPv6 addresses did not get wrapped into mandatory [] brackets.
2025-11-25Merge pull request #4859 from cpcowart/cpcowart/send-cert-alwaysDaniil Baturin
T8027: vpn: adding config for swanctl "send-cert always"
2025-11-25Merge pull request #4860 from sarthurdev/ping-checkJohn Estabrook
kea: T7913: Fixes for ping-check handling
2025-11-24Merge pull request #4672 from apschultz/zone_default_firewall_rulesetSimon
firewall: T7739: Default ruleset for firewall zones
2025-11-21T8027: vpn: adding config for swanctl "send-cert always"Chris Cowart
This setting seems to be required for various Apple clients to connect to the IKEv2 IPSec VPN.
2025-11-20kea: T7913: Fixes for ping-check handlingsarthurdev
- Kea docs state multi-threaded mode is required for ping checking. - Parent scope needs enabling if shared-network/subnet has ping-check enabled.
2025-11-19Merge pull request #4855 from sever-sever/T7970-vppconfViacheslav Hletenko
T7970: VPP use systemd-notify to start the service
2025-11-18T7970: VPP use systemd-notify to start the serviceViacheslav Hletenko
This allows systemd to properly track VPP startup and manage service dependencies using Type=notify service configuration.
2025-11-14T7556: VPP add IPFIX collector configurationViacheslav Hletenko
Add VPP IPFIX configuration commands: ``` set vpp ipfix active-timeout '8' set vpp ipfix collector 192.0.2.2 port '2055' set vpp ipfix collector 192.0.2.2 source-address '192.0.2.1' set vpp ipfix flowprobe-record 'l2' set vpp ipfix flowprobe-record 'l3' set vpp ipfix flowprobe-record 'l4' set vpp ipfix inactive-timeout '32' set vpp ipfix interface eth0 set vpp ipfix interface eth1 direction 'both' set vpp ipfix interface eth1 flow-variant 'ipv4' ```
2025-11-12T7731: Static ARP entries are missing after an interface status changeNataliia Solomko
2025-11-03Merge pull request #4808 from natali-rs1985/T7949Daniil Baturin
T7949: VPP add the ability to configure bond subinterfaces for NAT
2025-10-31syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS ↵Oleksandr Kuchmystyi
checks - Renamed `permitted-peers` to `permitted-peer` across templates, schema, and tests. - Added support for multiple `permitted-peer` entries and trimmed empty values. - Replaced TLS/UDP warning with ConfigError for strict validation. - Updated tests to use TCP for TLS and verified new validation logic.
2025-10-29Merge pull request #4810 from bl0way/T7896-frr-profileChristian Breunig
T7896: Add frr profile selection
2025-10-29frr: T7896: Configure frr profile with 'system frr profile' commandbl0way
Co-authored-by: Christian Breunig <christian@breunig.cc>
2025-10-28dhcp-server: T3936: Added support for DHCP Option 82 (#4665)cblackburn-igl
* dhcp-server: T3936: Added support for DHCP Option 82 This commit adds support in both the CLI and the underlying code for DHCP Option 82 to be used to filter/route DHCP address assignments. The primary use case for this is to support enterprise switches which can "tag" DHCP requests with physical real world informaiton such as which switch first saw the request and which port it originated from (known in this context as remote-id and circuit-id). Once client-classes have been defined they can be assigned to subnets or ranges so that only certain addresses get assigned to specific requests. There is also a corresponding documentation update which pairs with this code change. (cherry picked from commit 326b5e713cb363a2b9f69e2204c4ee2ccd9939bb) * Update src/conf_mode/service_dhcp-server.py Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> * Update src/conf_mode/service_dhcp-server.py Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> * Update interface-definitions/include/dhcp/dhcp-server-common-config.xml.i Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> --------- Co-authored-by: Daniil Baturin <daniil@baturin.org> Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
2025-10-28Merge pull request #4796 from natali-rs1985/T7938Daniil Baturin
T7938: VPP: Rewrite sFlow implementation
2025-10-27Merge pull request #4806 from alexandr-san4ez/T7906-currentChristian Breunig
haproxy: T7906: Probing of a port other than the one to which normal traffic is sent
2025-10-24haproxy: T7906: Probing of a port other than the one to which normal traffic ↵Oleksandr Kuchmystyi
is sent Add support for specifying a custom health check port for HAProxy backend servers. This allows health probes to target a dedicated endpoint - such as port 8080 - separate from normal traffic ports (e.g., 80 or 443).
2025-10-24syslog: T4251: Fix TLS enablement logic for syslogOleksandr Kuchmystyi
2025-10-23T7949: VPP add the ability to configure bond subinterfaces for NATNataliia Solomko
2025-10-21firewall: T7739: Default ruleset for firewall zonesAdam Schultz
In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax: set firewall zone <name> default_firewall name <name> set firewall zone <name> default_firewall ipv6_name <name> The proposed behavior is the following: local in: The default firewall ruleset for the local zone will be appended after all from configurations. local out: If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname forward: The default firewall ruleset for the zone will be appended after all from configurations To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset. The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules.
2025-10-21T7938: VPP: Rewrite sFlow implementationNataliia Solomko
Execute commands for vpp sflow with API calls. Use values for polling interval and sampling rate from 'system sflow'. Add op-mode command
2025-10-15Merge pull request #4780 from natali-rs1985/T7750Viacheslav Hletenko
T7750: VPP: CGNAT commit failure with vpptunX interface
2025-10-14T7750: VPP: CGNAT commit failure with vpptunX interfaceNataliia Solomko
Allow using bond interfaces in CGNAT. Improve interface cleanup to rely on VPP API queries, as VPP config changes may modify interface indexes
2025-10-09pppoe: T7485: add DHCPv6 options to disable DNSNicolas Vandamme
Co-Authored-By: Christian Breunig <christian@breunig.cc>
2025-10-08T7803: Make failover route vrf-awareKyrylo Yatsenko
* Added 'protocol failover' to 'set vrf name': set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2 * Added vrf and interface to target: set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1 Last two are needed when check VRF is not same as route VRF. In this case icmp can use any/both options, tcp requires `vrf` and arp requires `interface`
2025-10-06Revert "bgp: T7760: deprecate per bgp vrf instance system-as node"John Estabrook
This reverts commit d871fe9c4c65de87232802ed54b263c9b2824391.
2025-09-30syslog: T4251: Add TLS support to syslogOleksandr Kuchmystyi
Add TLS support for remote syslog by extending the CLI and backend to support configuration of CA certificates, client certificates, keys, and authentication modes. This update integrates with the PKI subsystem for certificate management, ensures proper validation of protocol settings when TLS is enabled, and generates secure rsyslog configuration for forwarding logs over TLS.
2025-09-24T7859: VPP de-hardcode plugin pathViacheslav
De-hardcode plugin path allows starting VPP on different ARCHs
2025-09-23Merge pull request #4684 from c-po/bgp-vrf-system-asDaniil Baturin
bgp: T7760: remove per vrf instance system-as node
2025-09-23kea: T7821: Update paths for Kea v2.7.9 security changessarthurdev
2025-09-22Merge pull request #4698 from l0crian1/fw-disable-conntrackDaniil Baturin
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
2025-09-22Merge pull request #4738 from peterablehmann/frr_exporterDaniil Baturin
frr_exporter: T7851: export IPv6 BGP sessions
2025-09-22Merge pull request #4740 from sever-sever/T7773Viacheslav Hletenko
T7773: VPP move crypto engines to crypto-engines template section
2025-09-22T7773: VPP move crypto engines to crypto-engines template sectionViacheslav
VPP 25.06 introduces a new format for crypto engines configuration https://github.com/FDio/vpp/commit/f479eeb76 Update the template to account for this change.
2025-09-20frr_exporter: T7851: export IPv6 BGP sessionsPeter Lehmann
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-12 00:52:45 +0000