Thank you for sharing your information.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
All Stories
Dec 7 2021
For anyone looking for a work around until it is patched this is my workaround. I am just adding a line to restart the service right after bootup in the “/config/scripts/vyos-postconfig-bootup.script” (more info on this file in the command scripting section - Command Scripting — VyOS 1.4.x (sagitta) documentation)
I confirm the bug. After rebooting script doesn't work on sync-groups. It's necessary to reload vrrp to start running the script (After rebooting).
More detail:
https://phabricator.vyos.net/T4041
There is a task with VRRP scripts problem on reboot:
Dec 6 2021
I tested this bug on "vyos-1.3-beta-202112060443".
The problem has been partially resolved. If you restart VYOS, scripts on syn-groups don't work. After using the "vrrp restart" command, everything is ok.
To reproduce:
set policy access-list 100 rule 1 source any set policy access-list 100 rule 1 destination any set policy access-list 100 rule 1 action permit set interface ethernet eth1 address 203.0.113.1/24 set protocols mpls ldp discovery transport-ipv4-address 203.0.113.1 set protocols mpls ldp interface eth1 set protocols mpls ldp router-id 203.0.113.1 commit
Access list is present:
vyos@r4-epa2# vtysh -c "show run" | grep access access-list 100 seq 5 permit ip any any [edit]
Add hello interval:
set protocols mpls ldp discovery hello-ipv4-interval 1
There is no access-list anymore
vyos@r4-epa2# commit [edit] vyos@r4-epa2# vtysh -c "show run" | grep access [edit] vyos@r4-epa2#
As mentioned I'm running: VyOS 1.3.0-rc6
cpo@LR1.wue3:~$ show vrf mgmt processes 2030 nginx 2031 nginx 2032 nginx
BGP/OSPF bfd profile support will be implemented in T4058
VyOS
set protocols bfd profile BFD_OSPF interval multiplier '3' set protocols bfd profile BFD_OSPF interval receive '300' set protocols bfd profile BFD_OSPF interval transmit '300'
FRR
bfd profile BFD_OSPF !
It invokes systemd-tty-ask-password-agent which stalls the process termination:
The correct key for sflow sfprobe_source_ip
PR https://github.com/vyos/vyos-1x/pull/1099
cf. T3980, also
I believe that CLI should protect a user and deny him to shoot in his leg. In any case, we cannot guarantee a successful update if the script will not be migrated
We definitely have to delete enable_script_security from https://github.com/vyos/vyos-1x/blob/current/data/templates/vrrp/keepalived.conf.tmpl#L10
I think this actually inadvertently broke things even more, because now:
I have the same problem. I created a script, but it doesn't work. VRRP Log write that the skript is unsecure.
