There is now some python XML code to parse the XML. m4 is not a nice tool. If better pre-processing is required, which I would not argue for, please explain the issue you are trying to solve.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Jul 31 2020
Jul 31 2020
@c-po According to H3C, the relevant operations are as follows:
@c-po According to H3C and the third-party information on the Internet, NPT is also called nat66. Nat66 is actually the SNAT and DNAT implementation of IPv6, and implements 1-to-1 mapping and prefix address translation. Since there is no separate configuration directory for these two directions in the configuration, this draft implements two directions. Tomorrow, we will try to modify the configuration path according to the document of H3C device, add the diff of the draft, and then propose Submit merger request.
@c-po It has been revised as follows:
zsdc changed the status of T2726: Allow to use all supported SSH key types in Cloud-init from Open to In progress.
zsdc changed the status of T2703: VMWare OVA won't deploy an ed25519 key, a subtask of T2726: Allow to use all supported SSH key types in Cloud-init, from Open to In progress.
Well I would just have plumbed up the commands locally before doing any templating. Please keep us updated if it works.
zsdc assigned T2748: "show vpn ike sa" shows state "down" when tunnel is up to Unknown Object (User).
zsdc assigned T2747: "enable-local-traffic" has no effect in load-balancing to redirect local traffic to Unknown Object (User).
I didn't get any specific help. The modified pudding was set up based on the trial and limited third-party data here, and it needs to be fully tested.
@c-po This is a simple draft of my current implementation of NPT. At present, I haven't tested it, and I haven't applied for merger. I can send it here for some discussion.
Jul 30 2020
Jul 30 2020
ajgnet updated the task description for T2747: "enable-local-traffic" has no effect in load-balancing to redirect local traffic.
No I didn't, sorry. I'll test it and see :)
Have you tested the latest codebase? It more or less follows your design for the member ports.
This is not enough, bridge and bond members also didn't get IPv6 link-locals in the previous implementation. To have them is incorrect and a security risk.
The last bug mentioned could be due to: https://phabricator.vyos.net/T2746
c-po closed T2746: IPv6 link-local addresses not configured, a subtask of T2653: "set interfaces" Python handler code improvements - next iteration, as Resolved.
c-po changed the status of T2746: IPv6 link-local addresses not configured, a subtask of T2653: "set interfaces" Python handler code improvements - next iteration, from Open to In progress.
c-po changed the status of T2746: IPv6 link-local addresses not configured from Open to In progress.
c-po closed T679: SNMPv3 TSM is no longer supported by net-snmp, a subtask of T652: Rewrite service snmp in new style XML interface definition, as Wontfix.
TSM support has been droppen in 1.3
c-po changed the status of T2745: router-advert: migrate to get_config_dict() from Open to In progress.
dmbaturin changed the status of T2728: Protocol option ignored for IPSec peers in transport mode from In progress to Needs testing.
related to T1699
Unknown Object (User) claimed T2333: Increase default sysctl values.
Unknown Object (User) created T2744: igmp-proxy issue: Address already in use.
@Merijn Have such problems been repeated?
Jul 29 2020
Jul 29 2020
c-po closed T2743: WireGuard: move key migration from config script to migration script as Resolved.
c-po changed the status of T2243: Bridge interface fails if member is VXLAN interface with VTI underlay, a subtask of T2353: Interface [conf_mode] errors parent task, from Open to On hold.
c-po changed the status of T2243: Bridge interface fails if member is VXLAN interface with VTI underlay from Open to On hold.
c-po added a comment to T2243: Bridge interface fails if member is VXLAN interface with VTI underlay.
The problem is that vti interfaces are only created when VPN is configured this is done very late with priority 900. VXLAN, bridge etc (also in 1.2) use a lower priority. The only solution will be that the vti interface is added imediately and then later bound to the VPN.
The issue did not reproduce neither in 1.2.5 nor in 1.3 version.
Try in the new release and re-open the ticket if any new information appeared.
@olofl I can't confirm this bug int the 1.2.5 LTS version.
I can't confirm this bug.
vyos@vyos# set vpn ipsec ike-group IKEv2_DEFAULT mobike disable [edit] vyos@vyos# commit [edit] vyos@vyos# run show version Version: VyOS 1.2.5 Built by: Sentrium S.L. Built on: Sun 12 Apr 2020 15:18 UTC Build UUID: 1695c660-d785-4b16-a54b-66d6a02ea24f Build Commit ID: 48cc9fc46569e6
c-po added a comment to T2243: Bridge interface fails if member is VXLAN interface with VTI underlay.
That configuration does not work in 1.2.5 either - we probably should exclude vti from VXLAN source interface?
c-po added a comment to T2243: Bridge interface fails if member is VXLAN interface with VTI underlay.
In latest rolling releases this will break b/c of:
@c-po In my vyos, the following commands run successfully, and the rule settings are normal, but the rules are not tested to be effective and correct. For reference only, if I have time, I will open the eve ng simulation environment.
@c-po Since I can't find a suitable place to use ndptool send, in this task list, cancel the implementation of this function. If necessary, the user can run it directly from the command, and now submit the correction. If possible, please re audit pr
jestabro changed the status of T2582: Script daemon to offload processing during commit from In progress to Needs testing.
What is here:
Although this document may not be a direct help, it may help us understand how to set up IPv6 NAT for nftables?
c-po changed the status of T2743: WireGuard: move key migration from config script to migration script from Open to In progress.
Viacheslav added a comment to T1076: SSH: make configuration (sshd_config) volatile and store it to /run.
It may be a good idea to also have an option to hook debug logging to syslog.
It is possible to use https://github.com/vyos/vyos-1x/blob/b704d0676ab2d623d2eeb1ed4dc1bcf2a2c4a5e2/python/vyos/logger.py for this purpose now.
thomas-mangin added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
Yes, it would solve the issue ... but ... currently, we re-apply the whole interface setting, so there is no change to have the vyos and live configuration not sync'ed.
This would be lost. It is a trade-off, but it could be done. It would be however the only sub-system working that way.
zsdc added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
Changing description in a master transition script will lead to an endless loop, because of:
- Description change (or any other interface update) in a script trigger EthernetIf.update().
- EthernetIf.update() trigger a lot of interface changes:
Jul 29 14:05:36 vyos sudo[3097]: root : TTY=ttyS0 ; PWD=/home/vyos ; USER=root ; COMMAND=/usr/bin/sh -c VYOS_TAGNODE_VALUE='eth1' /usr/libexec/vyos/conf_mode/interfaces-ethernet.py Jul 29 14:05:36 vyos sudo[3097]: pam_unix(sudo:session): session opened for user root by vyos(uid=0) Jul 29 14:05:36 vyos control.py[3098]: set_interface: alias, Jul 29 14:05:36 vyos control.py[3098]: set_interface: link_detect, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: vrf, Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_cache_tmo, 30 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_filter, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_accept, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_announce, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_ignore, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: proxy_arp, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: proxy_arp_pvlan, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_forwarding, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_accept_ra, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_autoconf, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_dad_transmits, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: mtu, 1500 Jul 29 14:05:36 vyos control.py[3098]: set_interface: alias, MASTER_by_script Jul 29 14:05:36 vyos control.py[3098]: set_interface: link_detect, 1 Jul 29 14:05:36 vyos Keepalived_vrrp[1302]: (lan) Entering BACKUP STATE Jul 29 14:05:36 vyos Keepalived_vrrp[1302]: (lan) sent 0 priority Jul 29 14:05:36 vyos control.py[3098]: set_interface: vrf, Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_cache_tmo, 30 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_filter, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_accept, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_announce, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: arp_ignore, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: proxy_arp, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: proxy_arp_pvlan, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_forwarding, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_accept_ra, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_autoconf, 0 Jul 29 14:05:36 vyos control.py[3098]: set_interface: ipv6_dad_transmits, 1 Jul 29 14:05:36 vyos control.py[3098]: set_interface: gro, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: gso, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: sg, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: tso, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: ufo, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: admin_state, up Jul 29 14:05:36 vyos Keepalived_vrrp[1302]: (lan) Entering MASTER STATE Jul 29 14:05:36 vyos control.py[3098]: set_interface: gro, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: gso, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: sg, off Jul 29 14:05:36 vyos control.py[3098]: set_interface: tso, off Jul 29 14:05:37 vyos control.py[3098]: set_interface: ufo, off Jul 29 14:05:37 vyos control.py[3098]: set_interface: admin_state, up
- Something from this all trigger keepalived interface reinitialization.
- Keepalived change VRRP state to BACKUP and then MASTER, and run transition scripts.
- GOTO 1.
thomas-mangin placed T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization up for grabs.
Ideally which interface is master/slave should be recorded and handled by VyOS so that users do not have to put some workaround like this one to know.
Viacheslav added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
Removing this line from the master prevents erroneous changes master/backup. And CPU displays normal values.
thomas-mangin added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
I do not have a lab to reproduce this ATM.
@c-po I have changed the top-level command, maybe it's better, can you help me see it, if possible, request a merge, otherwise, please reply?
@c-po I have changed the top-level command, maybe it's better, can you help me see it, if possible, request a merge, otherwise, please reply?
gadams changed Version from - to 1.3-rolling-202007241919 on T2741: DHCPv6-PD breaks interface config if it refers to VLAN interfaces.
I should add that this problem has existed for at least a couple months, right up until 1.3-rolling-202007241919. Rolling builds after that one appear to ignore the prefix-delegation configuration entirely (T2740), so they don't exhibit this problem.
This is because our other daemons are written using zeromq and the fact that pynng is not a part of the upstream debian source.
jack9603301 added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
It seems that the problem is serious and under attention
Viacheslav added a comment to T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization.
The master change state every few seconds.
Jul 29 07:52:39 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-master.sh Jul 29 07:52:40 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE Jul 29 07:52:40 vyos Keepalived_vrrp[1821]: (lan) sent 0 priority Jul 29 07:52:40 vyos Keepalived_vrrp[1821]: (lan) Entering MASTER STATE Jul 29 07:52:41 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-fail.sh Jul 29 07:52:42 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE Jul 29 07:52:42 vyos Keepalived_vrrp[1821]: (lan) sent 0 priority Jul 29 07:52:42 vyos Keepalived_vrrp[1821]: (lan) Entering MASTER STATE Jul 29 07:52:43 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-master.sh Jul 29 07:52:44 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE Jul 29 07:52:44 vyos Keepalived_vrrp[1821]: (lan) sent 0 priority Jul 29 07:52:44 vyos Keepalived_vrrp[1821]: (lan) Entering MASTER STATE Jul 29 07:52:45 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-fail.sh Jul 29 07:52:46 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE Jul 29 07:52:46 vyos Keepalived_vrrp[1821]: (lan) sent 0 priority Jul 29 07:52:46 vyos Keepalived_vrrp[1821]: (lan) Entering MASTER STATE Jul 29 07:52:46 vyos Keepalived_vrrp[1821]: Warning: Failed to connect to the agentx master agent ([NIL]): Jul 29 07:52:47 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-master.sh Jul 29 07:52:48 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE Jul 29 07:52:48 vyos Keepalived_vrrp[1821]: (lan) sent 0 priority Jul 29 07:52:48 vyos Keepalived_vrrp[1821]: (lan) Entering MASTER STATE Jul 29 07:52:49 vyos keepalived-fifo.py[1822]: Running the command: /config/scripts/vrrp-trans-fail.sh Jul 29 07:52:50 vyos Keepalived_vrrp[1821]: (lan) Entering BACKUP STATE
Viacheslav renamed T2738: Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization from VRRP lock configuration to VRRP lock configuration and High CPU utilization..
Please consider using zeromq instead of pynng
Here is a draft of what I meant when I said reworking the XML schema.
Jul 28 2020
Jul 28 2020