summaryrefslogtreecommitdiff
path: root/interface-definitions/include
AgeCommit message (Collapse)Author
2026-01-28vpp: T8202: Remove XDP driver and options from CLI and configNataliia Solomko
- Migration script removes 'driver' and 'xdp-options' nodes. - XDP logic is commented out in config verification and CLI tests, preserving code for future use. - The rest of XDP-related code remains untouched
2026-01-27Merge pull request #4945 from natali-rs1985/T8143John Estabrook
pppoe-server: T8143: Set 'vpp-cp' option automatically if interface is in VPP
2026-01-21Merge pull request #4921 from hedrok/T7664-update-smoketest-scriptChristian Breunig
T7664: support FRR 10.5
2026-01-19pppoe-server: T8143: Set 'vpp-cp' option automatically if interface is in VPPNataliia Solomko
2026-01-12T7664: ip protocol 'kernel' etc removedKyrylo Yatsenko
In FRR 10.5 ip protocols * connected * kernel * local * table * table-direct are removed. First three in fb8e399e4f66d09780f176fbecb99168089e64eb, table* in 7fd030504be060387694e8a2af7f19ddd7dee39d. In `ip protocols`, `ipv6 protocols` and `vrf` VyOS supports * connected * kernel * table Remove these from CLI, add migration scripts, update tests.
2026-01-12openvpn: T7633: Add support for 'data-ciphers-fallback' in site-to-site tunnelsOleksandr Kuchmystyi
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces (used as fallback cipher in site-to-site mode) - Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
2026-01-11Merge pull request #4938 from hedrok/T8158-fix-lsp-timersChristian Breunig
isis: T8158: fix lsp-timers
2026-01-09Merge pull request #4912 from hedrok/T8046-add-link-params-cliViacheslav Hletenko
T8046: traffic-engineering: support link-params
2026-01-09isis: T8158: fix lsp-timersKyrylo Yatsenko
There are three configuration values in VyOS isis XML: * lsp-gen-interval * lsp-refresh-interval * max-lsp-lifetime In FRR they have the following restrictions in yang model: * refresh-interval, default 900 * maximum-lifetime >= refresh-interval + 300 (350-65535), default 1200 * generation-interval < refresh-interval (1..120), default 30 When setting these values in separate steps we can get error e.g.: libyang: Must condition ". >= ../refresh-interval + 300" not satisfied. even when all restrictions are satisfied. To fix the issue: 1. Write default values in our XML. 2. Check these restrictions in protocol_isis.py 3. Use FRR command `lsp-timers` that sets all these values in one go
2026-01-09T8046: traffic-engineering: support link-paramsKyrylo Yatsenko
Add 'traffic-engineering' commands under 'protocols'. set protocols traffic-engineering admin-group ADMINGROUP bit-position 1 set protocols traffic-engineering interface INTERFACE admin-group ADMINGROUP set protocols traffic-engineering interface INTERFACE max-bandwidth 1280 set protocols traffic-engineering interface INTERFACE max-reservable-bandwidth 1280 Also add set protocols isis traffic-engineering export
2025-12-30T8133: BGP add local-rib feature for BMPViacheslav Hletenko
2025-12-14ssh: T8098: remove support for deprecated "rijndael-cbc@lysator.liu.se" cipherChristian Breunig
According to an Arch Linux forum discussion, the cipher rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7. References: - https://bbs.archlinux.org/viewtopic.php?id=188613 - https://www.openssh.org/txt/release-6.7 - https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a
2025-12-11Merge pull request #4894 from c-po/xml-geo-ipDaniil Baturin
firewall: T8089: "geoip country-code" should get a completion helper
2025-12-11Merge pull request #4880 from natali-rs1985/T7972Viacheslav Hletenko
vpp: T7972: Make `nat44 no-forwarding` feature automatically configurable
2025-12-10firewall: T8089: "geoip country-code" should get a completion helperChristian Breunig
There is a CLI constraint for lowercase country codes, but user's do not see this.
2025-12-04Merge pull request #4881 from alexandr-san4ez/T7594-currentDaniil Baturin
ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`
2025-12-04ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`Oleksandr Kuchmystyi
The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.
2025-12-04vpp: T7972: Make `nat44 no-forwarding` feature automatically configurableNataliia Solomko
If any dynamic rule is configured forwarding should be disabled because each packet must be processed through the NAT session table to apply proper translations
2025-12-01interfaces: T8054: use --is-valid-intf-address for validating interface ↵Daniil Baturin
addresses
2025-11-28Merge pull request #4824 from alexandr-san4ez/T4251-currentViacheslav Hletenko
syslog: T4251: Rename "permitted-peers" to "permitted-peer" and improve TLS checks
2025-11-27vpp: T8016: Use "numeric" validator for acl portNataliia Solomko
2025-11-11T7872: VPP XDP with rx-queue-size stuckNataliia Solomko
Queue sizes must be a power of two and between VLIB_FRAME_SIZE=256 and 65535 https://github.com/FDio/vpp/blob/d39cc2bd9374f9df7e42ad39bb9fb8e2531d3da8/src/plugins/af_xdp/device.c#L588-L608
2025-11-04syslog: T4251: Implement migration script for TLS sectionOleksandr Kuchmystyi
- Drop "tls enable" node (make "tls" a standalone key). - Split "tls permitted-peers" list by commas into multiple "tls permitted-peer" entries.
2025-10-31T7849: Extend regex for constraint wildcard interfacesViacheslav Hletenko
Allow ipoe*, vpp and pod interfaceds
2025-10-28dhcp-server: T3936: Added support for DHCP Option 82 (#4665)cblackburn-igl
* dhcp-server: T3936: Added support for DHCP Option 82 This commit adds support in both the CLI and the underlying code for DHCP Option 82 to be used to filter/route DHCP address assignments. The primary use case for this is to support enterprise switches which can "tag" DHCP requests with physical real world informaiton such as which switch first saw the request and which port it originated from (known in this context as remote-id and circuit-id). Once client-classes have been defined they can be assigned to subnets or ranges so that only certain addresses get assigned to specific requests. There is also a corresponding documentation update which pairs with this code change. (cherry picked from commit 326b5e713cb363a2b9f69e2204c4ee2ccd9939bb) * Update src/conf_mode/service_dhcp-server.py Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> * Update src/conf_mode/service_dhcp-server.py Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> * Update interface-definitions/include/dhcp/dhcp-server-common-config.xml.i Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com> --------- Co-authored-by: Daniil Baturin <daniil@baturin.org> Co-authored-by: Nataliia S. <81954790+natali-rs1985@users.noreply.github.com>
2025-10-28Merge pull request #4796 from natali-rs1985/T7938Daniil Baturin
T7938: VPP: Rewrite sFlow implementation
2025-10-21T7938: VPP: Rewrite sFlow implementationNataliia Solomko
Execute commands for vpp sflow with API calls. Use values for polling interval and sampling rate from 'system sflow'. Add op-mode command
2025-10-21Merge pull request #4783 from hedrok/T5942-failover-dhcp-gatewayDaniil Baturin
T5942: Make failover support dhcp-interface
2025-10-19kea: T7821: Use include for dhcp/dhcpv6 subnet-idsarthurdev
2025-10-19kea: T7821: Fix subnet-id accepted rangesarthurdev
'Subnet IDs must be greater than zero and less than 4294967295.'
2025-10-16Merge pull request #4781 from natali-rs1985/T7897Viacheslav Hletenko
T7897: VPP: fix rx-mode interrupt for XDP driver with workers
2025-10-14T5942: Make failover support dhcp-interfaceKyrylo Yatsenko
* Refactor XML a little: move common dhcp-interface properties to separate include file * Add failover support for dhcp-interface * Add test for DHCP in failover protocol
2025-10-14T7897: VPP: fix rx-mode interrupt for XDP driver with workersNataliia Solomko
Remove no-syscall-lock from CLI and enable this option if interrupt/adaptive mode is enabled and workers are configured. Also forbid interrupt mode for ixgbevf driver
2025-10-10dhcp-server: T7723: add DHCP Option 26 (interface MTU)Adam Greene
2025-10-09pppoe: T7485: add DHCPv6 options to disable DNSNicolas Vandamme
Co-Authored-By: Christian Breunig <christian@breunig.cc>
2025-10-08T7803: Make failover route vrf-awareKyrylo Yatsenko
* Added 'protocol failover' to 'set vrf name': set vrf name red protocols failover route 10.11.0.110/32 next-hop 10.0.0.2 * Added vrf and interface to target: set ... next-hop 10.0.0.2 check target '10.120.0.21' vrf blue set ... next-hop 10.0.0.2 check target '10.120.0.21' interface eth1 Last two are needed when check VRF is not same as route VRF. In this case icmp can use any/both options, tcp requires `vrf` and arp requires `interface`
2025-10-06Revert "bgp: T7760: deprecate per bgp vrf instance system-as node"John Estabrook
This reverts commit d871fe9c4c65de87232802ed54b263c9b2824391.
2025-10-06Revert "bgp: T7760: remove per vrf instance system-as node"John Estabrook
This reverts commit 85fe32f0e1a91a47fe4a6d4a5cdd6ac516dcc3b9.
2025-09-23Merge pull request #4684 from c-po/bgp-vrf-system-asDaniil Baturin
bgp: T7760: remove per vrf instance system-as node
2025-09-22Merge pull request #4698 from l0crian1/fw-disable-conntrackDaniil Baturin
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
2025-09-18T7805: VPP remove unused 'default-hugepage-size' from memory section and ↵Nataliia Solomko
restrict page sizes in xml
2025-09-16Merge pull request #4688 from hedrok/T75-migration-to-ipt-netflowDaniil Baturin
T75: migrate from pmacct to ipt_NETFLOW
2025-09-16Merge pull request #4717 from c-po/no-ipv6-default-routeDaniil Baturin
dhcpv6: T7646: restore missing default route after upgrade
2025-09-16T75: migrate from pmacct to ipt_NETFLOWKyrylo Yatsenko
* Change nft to iptables in system_flow-accounting.py as ipt_NETFLOW is iptales plugin * Remove specific and non-relevant pmacct options * Add ipt_NETFLOW options * Move 'interfaces' to 'netflow' tree * Support more flexible 'source-address' and 'source-interface' for each server instead of one source * Add migration script * Update op mode command 'show flow-accounting' * Update op mode command 'restart flow-accounting'
2025-09-14bgp: T6438: add solo option to peer-group config (#4706)l0crian1
- Added solo leafNode to peer-group config - Added solo.xml.i to reduce code duplication - Added solo option to peer-group smoketests
2025-09-13dhcpv6: T7646: restore missing default route after upgradeChristian Breunig
Commit de44c6aef249 ("interface: T7379: do not request SLAAC default route when only DHCPv6 is set") introduced a behavioral change while addressing an earlier issue fixed in e9fb2078d5ea ("interface: T7375: SLAAC assigned address is not cleared when removing SLAAC"). This change caused unintended connectivity loss after upgrading to VyOS 1.4.3. The underlying reason is that VyOS now requires explicit configuration to determine how IPv6 addressing and routing should be handled, rather than making assumptions: Requesting a DHCPv6 address alone will correctly assign an address. However, since the IPv6 default route is typically advertised via SLAAC (and not DHCPv6), SLAAC must also be explicitly enabled to receive the default route. Historically, this distinction was implicit and did not require additional configuration. To preserve backward compatibility, a configuration migrator has been added. It inspects existing configurations that only request a DHCPv6 address and automatically appends the required CLI node to also enable SLAAC, ensuring that the default route is restored after upgrade.
2025-09-09bgp: T7760: remove per vrf instance system-as nodeChristian Breunig
VyOS 1.5 and onwards will no longer have the following CLI node available: set vrf name <name> protocols bgp system-as <asn>
2025-09-09bgp: T7760: deprecate per bgp vrf instance system-as nodeChristian Breunig
Originating from the bug in T7665. To avoid potential issues down the line - and given that there's no compelling technical reason to retain the system-as CLI node under per-VRF BGP configuration, which cannot be achieved through alternative means - the maintainers have collectively decided to deprecate the following command: set vrf name <name> protocols bgp system-as <asn> Starting with VyOS 1.4.4, this CLI command will be considered deprecated. While it will still be accepted, it will no longer have any operational effect. A deprecation warning will be displayed at commit time, indicating that the BGP ASN from the global BGP configuration is now used instead. A migration script will handle the transition and perform the following actions: * Ensure a global BGP configuration exists; if not, initialize one. * Iterate over all configured VRFs to determine whether a BGP instance exists * For any insance, update the configuration to use the global system-as and apply the local-as ASN no-prepend replace-as option on all affected neighbors to preserve existing behavior. * If a neighbor is already configured with a local-as directive, that neighbor will be excluded from the migration process, as it already follows a custom configuration. * Add allowas-in per neighbor option. Required to not deny prefix received updates due to as-path contains our own global ASN.
2025-09-09Merge pull request #4682 from aapostoliuk/T7722-currentJohn Estabrook
isis: T7722: Added interface fast-reroute configuration commands
2025-09-05Firewall: T7475: Disable conntrack per firewall chainl0crian1
- Added command to disable conntrack per firewall chain - Added test_disable_conntrack_per_chain function to smoketest
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-18 14:13:11 +0000