Weekly update

Week of 2026-04-13

A complete L2TP/PPP access stack, TACACS+ and pluggable AAA, a VPP dataplane, and new nftables/tc firewall backends.

← All weekly updates

🛰️ L2TP & PPP access

Ze gained a full L2TPv2 implementation for broadband access.

  • Wire layer, tunnel FSM (SCCRQ/SCCRP/SCCCN handshake with tie-breaker resolution), and session FSM (ICRQ/ICRP/ICCN, OCRQ/OCRP, CDN)
  • Reliable delivery engine (sequencing, congestion window, reordering) and HELLO keepalives
  • PPP authentication: PAP, CHAP-MD5, and MS-CHAPv2, with LCP auth-protocol fallback and periodic CHAP re-authentication
  • Wired into config reload, the CLI, and route redistribution

🔐 Authentication & AAA

  • TACACS+ client wired into SSH, web, and API authentication, behind a new pluggable AAA backend registry
  • Multi-user YANG-based login, ze passwd, and Junos-style plaintext password import

🧱 Firewall, traffic control & VPP

  • New nftables firewall backend and tc-netlink traffic-control backend, sharing one YANG data model, plus show firewall/show traffic-control CLI commands
  • VPP dataplane support: connection management, startup.conf generation, DPDK binding, FIB programming via GoVPP, and a VPP interface backend with MAC/monitor support
  • VPP-backed traffic control now rejects unsupported configuration at commit time instead of failing later

🔌 Interfaces & sysctl

  • IPv6 default routes are now managed from Router Advertisements
  • DHCP-installed routes can carry a configurable priority (route metric), for multi-uplink setups
  • Named sysctl profiles for interface units, with an offline ze sysctl CLI and three-layer precedence

⚡ Route-server performance

Route-server forwarding got a fast path: a reactor-owned forwarding cache cuts allocations on the per-UPDATE hot path. RIB best-path records are packed more tightly with a shared interner, next-hops now store as typed IP addresses instead of strings, and encoding for FlowSpec/BGP-LS JSON and static/MVPN UPDATEs got zero- or low-allocation paths.

🛠️ Under the hood

New show host * commands surface hardware inventory. MCP now speaks Streamable HTTP transport with session management. The gokrazy appliance boots its config entirely from zefs (no static files), with first-boot bootstrap merging a template with live interface discovery, and a management proxy now exposes gokrazy's own console through Ze's web server. BFD authentication state now survives a session restart. BMP Route Monitoring was silently sending collectors headerless, malformed messages; it now emits complete RFC 4271 BGP messages. Redistribution can now filter per source family.