Follow-up: I filed T9552 for the longer-term direction. VPP has a native BFD implementation, and in my lab it interoperates with FRR bfdd on a kernel-only peer (IPv4 single-hop, multihop and IPv6 sessions came up, and with bfd udp echo-source set interface <if> the echo mode works without the spoofed-address drop described here). What is missing is a bridge that creates the sessions in VPP and reports their state to FRR, see T9552 for the details and the open points.

Sat, Oct 31, 3:37 PM · VyOS Rolling

c-po added a comment to T9547: vyos-build: image built without an explicit version gets a wrong default version string.

https://github.com/vyos/vyos-build/pull/1341

Sat, Oct 31, 11:31 AM · VyOS Rolling

c-po closed T9543: 'reset vpn ipsec site-to-site peer' does not bring the tunnel back when connection-type is unset as Resolved.

Sat, Oct 31, 11:05 AM · VyOS Rolling

c-po closed T3871: Resolve unexpected interface name reordering as Resolved.

Sat, Oct 31, 10:56 AM · Bugs, VyOS 1.4 Sagitta (1.4.0-GA)

c-po closed T9442: frrender: after a failed FRR apply, later commits do not reapply the FRR configuration as Resolved.

Sat, Oct 31, 10:10 AM · VyOS Rolling

c-po added a comment to T9553: ISO built in a container without CAP_SYS_MODULE has an initrd without kernel modules and does not boot.

https://github.com/vyos/vyos-build/pull/1340

Sat, Oct 31, 10:06 AM · VyOS Rolling

c-po updated the task description for T9553: ISO built in a container without CAP_SYS_MODULE has an initrd without kernel modules and does not boot.

Sat, Oct 31, 9:26 AM · VyOS Rolling

c-po changed the status of T9553: ISO built in a container without CAP_SYS_MODULE has an initrd without kernel modules and does not boot from Open to In progress.

Sat, Oct 31, 9:19 AM · VyOS Rolling

c-po created T9553: ISO built in a container without CAP_SYS_MODULE has an initrd without kernel modules and does not boot.

Sat, Oct 31, 9:19 AM · VyOS Rolling

c-po closed T9550: Update Linux Kernel to 6.18.60 | 6.6.161 as Resolved.

Sat, Oct 31, 9:09 AM · VyOS Rolling

rherold added a comment to T9543: 'reset vpn ipsec site-to-site peer' does not bring the tunnel back when connection-type is unset.

PR: https://github.com/vyos/vyos-1x/pull/5615

Sat, Oct 31, 7:54 AM · VyOS Rolling

rherold added a comment to T9543: 'reset vpn ipsec site-to-site peer' does not bring the tunnel back when connection-type is unset.

I reproduced this on 2026.10.16-0024-rolling with two VMs (peer A without connection-type, peer B with connection-type none, VTI):

Sat, Oct 31, 7:14 AM · VyOS Rolling

rherold created T9552: VPP: use the native VPP BFD implementation instead of FRR bfdd on VPP interfaces.

Sat, Oct 31, 5:52 AM · VyOS Rolling

rherold added a comment to T9548: BFD echo-mode over VPP echo packets not return.

I reproduced this on 2026.10.16-0024-rolling (VPP 25.10.0, FRR 10.7.1) with two VMs and a direct link. One side runs VPP on the link interface, the other side uses the kernel only (no VPP).

Sat, Oct 31, 5:50 AM · VyOS Rolling

Fri, Oct 30

rherold added a comment to T9185: config-mgmt commit_confirm child never exits after successful confirm; spins at 100% CPU indefinitely.

I checked the current state of this on a 2026.10.16 image, because the reverted fix left the original problem open.

Fri, Oct 30, 9:40 PM · VyOS Rolling

rherold added a comment to T9537: Unbinding VPP interface used by pppoe-server drops all PPPoE session on server.

I could reproduce this on a 2026.10.16 rolling image (r2 only: VPP, pppoe-server with local users, two clients behind eth0 and eth2). Two findings, one of them different from the description.

Fri, Oct 30, 9:21 PM · VyOS Rolling

rherold added a comment to T9537: Unbinding VPP interface used by pppoe-server drops all PPPoE session on server.

I could reproduce this on a 2026.10.16 rolling image (r2 only: VPP, pppoe-server with local users, two clients behind eth0 and eth2). Two findings, one of them different from the description.

Fri, Oct 30, 9:02 PM · VyOS Rolling

rherold added a comment to T9535: API commit-confirm with action reboot: failed commit still starts the reboot timer.

Context from the discussion in vyos-1x#5558 (comments of jestabro on 2026-10-27 and 2026-10-29): starting the timer before the commit is intended for the action reboot. A failed partial commit should be rebooted, the reboot into the saved configuration is the safety net. The ticket is the part that was left open there: the API cannot tell a commit that failed before anything was applied from one that failed after some scripts ran.

Fri, Oct 30, 8:50 PM · VyOS Rolling

rherold created T9551: `strip_config.py`: secrets of about 80 CLI nodes are not redacted by `vyos-show-config --strip-private` and the machine-readable tech-support data.

Fri, Oct 30, 8:39 PM · VyOS Rolling

natali-rs1985 added a comment to T9549: firewall zone template: from_conf.firewall[fw_name] typo renders 'jump NAME_' with no target.

https://github.com/vyos/vyos-1x/pull/5614

Fri, Oct 30, 4:21 PM · VyOS Rolling

c-po added a comment to T9550: Update Linux Kernel to 6.18.60 | 6.6.161.

https://github.com/vyos/vyos-build/pull/1339

Fri, Oct 30, 3:56 PM · VyOS Rolling

c-po claimed T9550: Update Linux Kernel to 6.18.60 | 6.6.161.

Fri, Oct 30, 3:53 PM · VyOS Rolling

c-po created T9550: Update Linux Kernel to 6.18.60 | 6.6.161.

Fri, Oct 30, 3:53 PM · VyOS Rolling

o.kuchmystyi changed the status of T9329: internal PKI cannot be linked to the Telegraf configuration from Open to In progress.

Fri, Oct 30, 2:50 PM · VyOS Rolling

natali-rs1985 claimed T9549: firewall zone template: from_conf.firewall[fw_name] typo renders 'jump NAME_' with no target.

Fri, Oct 30, 2:21 PM · VyOS Rolling

natali-rs1985 created T9549: firewall zone template: from_conf.firewall[fw_name] typo renders 'jump NAME_' with no target.

Fri, Oct 30, 2:21 PM · VyOS Rolling

natali-rs1985 added a comment to T9546: protocols_nhrp: nftables rules not re-rendered on delete, stale multicast-drop rules reapplied.

https://github.com/vyos/vyos-1x/pull/5613

Fri, Oct 30, 2:15 PM · VyOS Rolling

a.pidnebesny created T9548: BFD echo-mode over VPP echo packets not return.

Fri, Oct 30, 1:55 PM · VyOS Rolling

c-po changed the status of T9547: vyos-build: image built without an explicit version gets a wrong default version string from Open to In progress.

Fri, Oct 30, 1:54 PM · VyOS Rolling

c-po added a comment to T9542: 'show vpn debug peer' fails: /usr/sbin/ipsec is no longer on the image.

https://github.com/vyos/vyos-1x/pull/5612

Fri, Oct 30, 1:52 PM · VyOS Rolling

a.kudientsov created T9547: vyos-build: image built without an explicit version gets a wrong default version string.

Fri, Oct 30, 1:47 PM · VyOS Rolling

natali-rs1985 claimed T9546: protocols_nhrp: nftables rules not re-rendered on delete, stale multicast-drop rules reapplied.

Fri, Oct 30, 1:44 PM · VyOS Rolling

natali-rs1985 created T9546: protocols_nhrp: nftables rules not re-rendered on delete, stale multicast-drop rules reapplied.

Fri, Oct 30, 1:43 PM · VyOS Rolling

natali-rs1985 added a comment to T9545: zabbix-agent: verify compares mode to 'pre_shared_secret' instead of 'pre-shared-secret'.

https://github.com/vyos/vyos-1x/pull/5611

Fri, Oct 30, 1:37 PM · VyOS Rolling

rherold added a comment to T8461: kea: DHCPv4 ip allocation issue on vlan interfaces.

@Viacheslav I know but I can only do draft pr cause the five pr limit on the repo

Fri, Oct 30, 1:31 PM · VyOS 1.5 Circinus (Circinus-Next), VyOS Rolling

c-po claimed T9542: 'show vpn debug peer' fails: /usr/sbin/ipsec is no longer on the image.

Fri, Oct 30, 1:30 PM · VyOS Rolling

natali-rs1985 claimed T9545: zabbix-agent: verify compares mode to 'pre_shared_secret' instead of 'pre-shared-secret'.

Fri, Oct 30, 1:07 PM · VyOS Rolling

natali-rs1985 created T9545: zabbix-agent: verify compares mode to 'pre_shared_secret' instead of 'pre-shared-secret'.

Fri, Oct 30, 1:07 PM · VyOS Rolling

natali-rs1985 added a comment to T9544: firewall: fqdn in prerouting raw rules references an undeclared nft set.

https://github.com/vyos/vyos-1x/pull/5610

Fri, Oct 30, 1:03 PM · VyOS Rolling

natali-rs1985 triaged T9544: firewall: fqdn in prerouting raw rules references an undeclared nft set as High priority.

Fri, Oct 30, 12:21 PM · VyOS Rolling

natali-rs1985 created T9544: firewall: fqdn in prerouting raw rules references an undeclared nft set.

Fri, Oct 30, 12:21 PM · VyOS Rolling

Viacheslav added a comment to T8461: kea: DHCPv4 ip allocation issue on vlan interfaces.

@rherold

Side note: the vyos/vyos-build:current container has an APT source packages.vyos.net/repositories/current that answers 404 now

The actual container is vyos/vyos-build:rolling

Fri, Oct 30, 12:20 PM · VyOS 1.5 Circinus (Circinus-Next), VyOS Rolling

Viacheslav triaged T9521: VPP: VRRP rfc3768 (vmac) on VPP interface as Normal priority.

Fri, Oct 30, 12:11 PM · VyOS Rolling

rherold added a comment to T8461: kea: DHCPv4 ip allocation issue on vlan interfaces.

ollowing the discussion here I looked at the patch route for Kea 3.0.3.

Fri, Oct 30, 12:10 PM · VyOS 1.5 Circinus (Circinus-Next), VyOS Rolling

Viacheslav triaged T9542: 'show vpn debug peer' fails: /usr/sbin/ipsec is no longer on the image as High priority.

Fri, Oct 30, 12:10 PM · VyOS Rolling

a.kudientsov created T9543: 'reset vpn ipsec site-to-site peer' does not bring the tunnel back when connection-type is unset.

Fri, Oct 30, 12:08 PM · VyOS Rolling

a.kudientsov created T9542: 'show vpn debug peer' fails: /usr/sbin/ipsec is no longer on the image.

Fri, Oct 30, 11:53 AM · VyOS Rolling

natali-rs1985 added a comment to T9536: nat64: 'one netfilter instance' check keys on a nonexistent 'mode' node.

https://github.com/vyos/vyos-1x/pull/5609

Fri, Oct 30, 11:41 AM · VyOS Rolling

Viacheslav closed T9539: Bump accel-ppp-ng version to 9c2c18e as Resolved.

PR https://github.com/vyos/vyos-build/pull/1337

Fri, Oct 30, 11:38 AM · VyOS Rolling

natali-rs1985 closed T9528: OpenConnect: “show openconnect-server user <name> otp” crashes for hotp-event token type as Resolved.

Fri, Oct 30, 10:33 AM · VyOS Rolling

natali-rs1985 closed T9531: pki: openconnect certificate usage check uses leaked loop variable, NameError when haproxy has no certificate as Resolved.

Fri, Oct 30, 10:32 AM · VyOS Rolling

natali-rs1985 closed T9533: pppoe peer template: connect-on-demand branch tests a 'default_route' key removed by migration as Resolved.

Fri, Oct 30, 10:32 AM · VyOS Rolling

natali-rs1985 closed T9534: ldpd template: 'ttl-security disable' renders 'ttl-security hops disable' as Resolved.

Fri, Oct 30, 10:31 AM · VyOS Rolling

natali-rs1985 closed T9530: op-mode: OpenVPN client-file generator validates wrong node for private key as Resolved.

Fri, Oct 30, 10:31 AM · VyOS Rolling

Viacheslav triaged T9540: OpenVPN 2.7: multi-homed UDP server replies out the wrong interface, clients on the second WAN cannot connect as Normal priority.

Fri, Oct 30, 10:21 AM · VyOS Rolling

Viacheslav added a comment to T8461: kea: DHCPv4 ip allocation issue on vlan interfaces.

I'd start with patches this time; this way, we can backport it to the LTS without additional changes or potential new risks.
Then, when we are ready, bump the KEA version for the rolling.

Fri, Oct 30, 10:18 AM · VyOS 1.5 Circinus (Circinus-Next), VyOS Rolling

a.kudientsov added a comment to T8461: kea: DHCPv4 ip allocation issue on vlan interfaces.

Testing confirmed two ways to fix the duplicate DHCPOFFER from the VLAN parent:

Fri, Oct 30, 8:30 AM · VyOS 1.5 Circinus (Circinus-Next), VyOS Rolling

a.kudientsov created T9541: OpenVPN 2.7: pushed DNS overrides the router's resolvers until the next commit.

Fri, Oct 30, 5:28 AM · VyOS Rolling

a.kudientsov created T9540: OpenVPN 2.7: multi-homed UDP server replies out the wrong interface, clients on the second WAN cannot connect.

Fri, Oct 30, 5:23 AM · VyOS Rolling

Thu, Oct 29

c-po closed T9538: op-mode: "reset wireguard" verify_cli_exists reads 'intf_name' but parameter is 'interface' as Resolved.

Thu, Oct 29, 8:17 PM · VyOS Rolling

RC renamed T9539: Bump accel-ppp-ng version to 9c2c18e from Bump accel-ppp-ng version to 9c2c18ec to Bump accel-ppp-ng version to 9c2c18e.

Thu, Oct 29, 7:29 PM · VyOS Rolling

RC created T9539: Bump accel-ppp-ng version to 9c2c18e.

Thu, Oct 29, 7:14 PM · VyOS Rolling

Viacheslav closed T9504: wwan: op-mode "show interfaces wwan <name>" passes wrong interface type as Resolved.

Thu, Oct 29, 5:59 PM · VyOS Rolling

Viacheslav reassigned T9504: wwan: op-mode "show interfaces wwan <name>" passes wrong interface type from SeeMyPing to c-po.

PR superseded by

Thu, Oct 29, 5:59 PM · VyOS Rolling

Viacheslav closed T9517: openvpn: bump to 2.7.8 as Resolved.

Thu, Oct 29, 5:55 PM · VyOS Rolling

Viacheslav closed T9495: vyos-geoip cron update job not completing as Resolved.

Thu, Oct 29, 5:53 PM · VyOS Rolling

Viacheslav raised the priority of T7752: Setting OpenVPN site-to-site vtunX Interface Description Fails and Disrupts Service from Normal to High.

Thu, Oct 29, 5:31 PM · Bugs

Viacheslav triaged T9527: pppoe-server subscriber cannot reach a kernel-side subscriber as Normal priority.

Thu, Oct 29, 5:30 PM · VyOS Rolling

c-po added a comment to T9538: op-mode: "reset wireguard" verify_cli_exists reads 'intf_name' but parameter is 'interface'.

https://github.com/vyos/vyos-1x/pull/5608

Thu, Oct 29, 4:44 PM · VyOS Rolling

c-po changed the status of T9538: op-mode: "reset wireguard" verify_cli_exists reads 'intf_name' but parameter is 'interface' from Open to In progress.

Thu, Oct 29, 4:42 PM · VyOS Rolling

c-po created T9538: op-mode: "reset wireguard" verify_cli_exists reads 'intf_name' but parameter is 'interface'.

Thu, Oct 29, 4:42 PM · VyOS Rolling

a.pidnebesny created T9537: Unbinding VPP interface used by pppoe-server drops all PPPoE session on server.

Thu, Oct 29, 3:44 PM · VyOS Rolling

Viacheslav closed T9491: interfaces: mirror/redirect targets lack reverse-dependency check, delete drops the source at boot as Resolved.

Thu, Oct 29, 3:42 PM · VyOS Rolling

Viacheslav closed T9525: WAN load-balancing: “show wan-load-balance connection” prints unfiltered connections in non-raw output as Resolved.

Thu, Oct 29, 3:30 PM · VyOS Rolling

rherold added a comment to T9527: pppoe-server subscriber cannot reach a kernel-side subscriber.

I could reproduce this on a 2026.10.16 rolling image (two VMs, VPP on eth0, kernel on eth2 of the server, same pppoe-server configuration as in the report, local users). Two sessions come up: rvtest2 on the VPP side (pppoe_session0, 10.255.0.10) and rvtest on the kernel side (ppp0, 10.255.0.11). From the VPP client a ping to the kernel client gets 100% loss, a ping to the gateway 10.255.0.1 as well. The kernel client reaches the gateway.

Thu, Oct 29, 3:28 PM · VyOS Rolling

natali-rs1985 updated the task description for T9536: nat64: 'one netfilter instance' check keys on a nonexistent 'mode' node.

Thu, Oct 29, 2:58 PM · VyOS Rolling

natali-rs1985 claimed T9536: nat64: 'one netfilter instance' check keys on a nonexistent 'mode' node.

Thu, Oct 29, 2:54 PM · VyOS Rolling

natali-rs1985 created T9536: nat64: 'one netfilter instance' check keys on a nonexistent 'mode' node.

Thu, Oct 29, 2:54 PM · VyOS Rolling

Viacheslav closed T9481: VPP linux-cp: a VLAN that comes up during the netlink overflow resync is pushed back to admin-down as Resolved.

Thu, Oct 29, 2:40 PM · VyOS Rolling

Viacheslav closed T9481: VPP linux-cp: a VLAN that comes up during the netlink overflow resync is pushed back to admin-down, a subtask of T7070: VPP related bugs the root task, as Resolved.

Thu, Oct 29, 2:40 PM · VyOS Rolling

natali-rs1985 added a comment to T9534: ldpd template: 'ttl-security disable' renders 'ttl-security hops disable'.