By the way, the SNMPD service of the router will not restart automatically. After the SNMP service is attacked, the SNMP service cannot be restored even if the device is restarted, which may be an inappropriate implementation.

I have a question. If you confirm the existence of the vulnerability, can you report to the NET-SNMP vendor and apply for a CVE number?

I have sent the POC of the vulnerability to daniil@vyos.io.

By the way, The password of the compressed package is HGkasjgJFYL261.

Hello, I have found three vulnerabilities in V1.2.7, one of which can also be reproduced in V1.3, please continue to check the other versions, I will send all three POCs to your email, thank you for your work.

@zoenan7 Thanks for your research! You can send the PoC to daniil@vyos.io

I met the same issue. Currently bridge vifs are missing firewall options.

I created a PR to add those options to the config system, but I am not sure if anything else needs to be changed to support them: https://github.com/vyos/vyatta-cfg-quagga/pull/88

This command already exists, VyOS 1.3.0-rc6

Okay, a lot has changed in the recent 1.4 version in terms of changing interface parameters due to T2738 - can you please retry one of the latest 1.4 images starting from 2021-09-21?

I'm also hitting this issue in 1.4-rolling-202109160217
This task has been kicking around for a while now. What needs to be done to get the code from @ruliane or @elbandi into the rolling build?

Please take a look at the commit 9213ce6672582bc12f02c1530726fe97030d2cfe for kernel 5.13.

1.3-beta-202109120646 doesn't have any commits from T3821:

Migration scripts are meant for adjusting old configs for a new configuration syntax version. I feel that using that mechanism for fresh installs is wrong and we should move that logic to a different place, ideally to the script that inserts MAC addresses in the config—I forgot which script it is.

Ot feels thos change broke more then it fixed. Can we revert it?

This is because of T3821

Note: config versions were added to the default configs here https://github.com/vyos/vyos-build/commit/23639568a945f19471af88547dab45b87bbd642d, but the current vyos-build-ami replaces the default file with its own that hasn't been modified to add the versioning comment yet. That can probably be fixed whenever that repo is updated for equuleus (I have my own patched local branch that I could publish if desired).

cc: @c-po maybe this was a side effect of unifying the two parsers

Note the version string should be different in 1.3:

Setting this to resolved as implementation is almost complete. Please file individual tasks for bugs so we can properly track them in the 1.3 release cycle.

Confirmed fixed and working in 1.3.0-rc6

Cisco Auth is a necessity for those who want to migrate from this vendor's hardware to VyOS. You can easily add a VyOS node to an existing DMVPN.

A new ISO 1.4-rolling-202109081242 is currently build - you may check in 30 minutes and try if this works for you - it did in my example config.