Implementation superseeded by https://github.com/vyos/vyos-1x/pull/5579
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Sun, Oct 18
Sun, Oct 18
c-po changed the status of T9394: policy: Route-map deletion check misses nested BGP VPN/VRF references from Open to In progress.
c-po added a comment to T9394: policy: Route-map deletion check misses nested BGP VPN/VRF references.
a.kudientsov updated the task description for T9484: VPP netlink: receive buffer is silently capped at 4 MiB by 'net.core.rmem_max'; the configured 256 MiB is not applied.
a.kudientsov changed the status of T9451: frr: every 'router bgp <ASN>' re-runs VRF route leaking over the whole VPN table from Open to In progress.
a.kudientsov changed the status of T9450: bgp: commits re-send unchanged BGP settings to FRR from Open to In progress.
Removing bgpq3 from data/live-build-config/package-lists/vyos-utils.list.chroot resolves the error. I must have had dragged it with me in my own version of that file.
c-po renamed T9477: Remove no longer needed executable bit from conf_mode and migration helper scripts from Remove no longer needed executable bot from conf_mode scripts to Remove no longer needed executable bit from conf_mode and migration helper scripts.
c-po changed Version from - to rolling on T9477: Remove no longer needed executable bit from conf_mode and migration helper scripts.
Sat, Oct 17
Sat, Oct 17
c-po triaged T9473: cgnat: invalid input crashes commit and overlapping pools hand out the same external address and ports as Normal priority.
c-po renamed T9473: cgnat: invalid input crashes commit and overlapping pools hand out the same external address and ports from CGNAT: invalid input crashes commit and overlapping pools hand out the same external address and ports to cgnat: invalid input crashes commit and overlapping pools hand out the same external address and ports.
c-po updated the task description for T9473: cgnat: invalid input crashes commit and overlapping pools hand out the same external address and ports.
c-po changed the status of T9472: wlb: silent daemon failures, ignored options and connections broken by commits from Open to In progress.
c-po added a comment to T8928: Backport Intel ice Out-Of-Tree driver (E825-C, E835-C support) to Stream and LTS, Related to T6847, T8147..
@najieb_haswell VyOS 1.5.2 will run at least Kernel 6.6.159 and ICE 2.6.7, IAVF 4.13.35, I40E 2.30.18 - or even newer
jvoss changed the status of T9227: Add IS-IS distribute link-state for BGP-LS SRv6 from Blocked to In progress.
vyos-build was recently updated with FRR 10.7.1. This is now unblocked, PR#5570 submitted.
c-po renamed T9470: Update Linux Kernel to 6.18.57 | 6.6.159 from Update Linux Kernel to 6.18.55 | 6.6.158 to Update Linux Kernel to 6.18.57 | 6.6.159.
Fri, Oct 16
Fri, Oct 16
Viacheslav triaged T9469: openvpn: generated client config lacks tls-crypt/tls-auth static key as Normal priority.
I can confirm "set system option disable-usb-autosuspend" fixes the issue on Supermicro X11SCM-F with current BIOS 2.9 / BMC 1.74.21.
The virtual keyboard can be made to work for a while by clicking Options -> Keyboard Mouse Hotplug in the iKVM window.
Then quickly type this (the keyboard freezes again after a few seconds of inactivity):
rherold added a comment to T9468: IPsec VTI: dual-stack traffic selectors in a single CHILD_SA are narrowed to IPv4 by some peers (Sophos SFOS).
With no traffic-selector configured, the template falls back to 0.0.0.0/0,::/0 for both local and remote. That is the same proposal as listing both families explicitly, so the result is identical: the responder narrows the CHILD_SA to IPv4 and IPv6 stays down. The default does not help, because both families are always sent in one CHILD_SA.
The only way to get both families up against this peer is one CHILD_SA per family. That is what the PR does: https://github.com/vyos/vyos-1x/pull/5565. I tested it against a real Sophos Firewall by configuring the two children by hand: both were installed and IPv6 worked, with no change on the Sophos side.
natali-rs1985 changed the status of T9466: Local SSH and HA proxy SSH service give a commit error from Open to In progress.
Viacheslav changed the status of T9388: wwan: address dhcp/dhcpv6/autoconf never get an address from a static QMI bearer from Open to In progress.
Viacheslav added a comment to T9468: IPsec VTI: dual-stack traffic selectors in a single CHILD_SA are narrowed to IPv4 by some peers (Sophos SFOS).
@rherold, what will happen if you remove the traffic-selector option altogether?
Viacheslav closed T9300: VPP: GRE tunnel-type teb validation for a VPP bridge only checks the last member, a subtask of T7070: VPP related bugs the root task, as Resolved.
Thanks for the capture, that settles it.
Viacheslav changed the subtype of T9466: Local SSH and HA proxy SSH service give a commit error from "Task" to "Bug".
Options on a client class (and possibly a list of classes per subnet) would be a new feature. I can open a separate task for that if you want it.
Viacheslav triaged T9467: Title: dhcp-server: tftp-server-name (option 66) rejects provisioning URLs as Normal priority.
Thanks for testing, @DuxOv8.
The default server in the yealink phone is normal and this is the default URL after a factory reset (https://updateyealink.lydis.com ....
SrividyaA raised the priority of T9466: Local SSH and HA proxy SSH service give a commit error from Low to High.
Chynnon added a comment to T6285: Listen-address in DHCP-server when going VyOS 1.4 to 1.5 will cause problems.
Hi Team,
Thu, Oct 15
Thu, Oct 15
Great @Viacheslav ! I'll wait for the next rolling release to test this new feature. Thank you both (you and @rherold) and VyOS Team
Viacheslav changed the status of T7150: Traffic marked invalid on bridge member interfaces from Open to In progress.
@DuxOv8 feel free to test/check it. It will be available in the next rolling release (after the 15th of October)
There's now a fix for this in https://github.com/vyos/vyos-1x/pull/5519
It would be great if a maintainer could take a look when there's time.
Wed, Oct 14
Wed, Oct 14
RBrunk added a comment to T9154: IPsec vti-up-down: DB keyed only by connection name causes admin-down of a VTI still carried by a live IKE_SA.
Another instance, VyOS Stream 2026.03 (vyos-1x 1.5dev0-3990-g9a296ec12), site-to-site to an Azure VPN Gateway (IKEv2, no reauth, DPD restart). On 2026-10-12 the vti was left admin-down while its CHILD_SA stayed INSTALLED: IKE and child SA reported up, BGP over the vti sat in Active, bytes out 0 for two days. /tmp/ipsec_vti_interfaces had lost the entry; reset vpn ipsec site-to-site peer re-ran up-client and recovered it. Confirms the DB key needs the SA identity (PLUTO_UNIQUEID), as proposed. Workaround in place: a cron job that re-raises any xfrm interface whose if_id matches an INSTALLED CHILD_SA (via vici) by re-running the updown hook's up path.
Viacheslav changed the status of T9462: PPTP silently ignores the configured MPPE encryption policy from Open to In progress.
This behaviour was observed on our current production version from January 2026.
I have tried it on the rolling version from the 7th October but i cannot get this version to work because it is affected by the interface renaming bug (T9291), so the WWAN interface will not come up at all.
I guess we have to wait until the bug is fixed before we can test if the bug we discovered is still applicable.
Viacheslav changed the status of T9463: Firewall migration can silently repoint a rule at the wrong group from Open to In progress.