@dmbaturin , @Viacheslav - I use debian snapshot repository when building VyOS LTS on my own.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Tue, Apr 16
Tue, Apr 16
side note, if you flush ruleset, and only add:
Something I just figured out is that the minute I do:
jestabro moved T6243: Update vyos-http-api-tools for package idna security advisory from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
jestabro moved T6243: Update vyos-http-api-tools for package idna security advisory from Need Triage to Finished on the VyOS 1.5 Circinus board.
n.fort changed Version from 1.4.0-epa2 to 1.4.0-epa2, 1.5-rolling-202404141045 on T6191: Policy Route TCP-MSS Behavior Different from 1.3.x.
n.fort changed the status of T6191: Policy Route TCP-MSS Behavior Different from 1.3.x from Open to Confirmed.
The regression causing 'image cannot be found" was fixed in https://vyos.dev/T6186.
jestabro added a parent task for T6186: Fix regression in 'set system image default-boot': T6022: set system image default-boot.
jestabro removed a parent task for T5917: Restore annotations of (running)/(default boot) in select image list: T6022: set system image default-boot.
Viacheslav changed the status of T5722: Failing to add route in failover if gateway not in the same interface network from In progress to Needs testing.
jestabro triaged T6243: Update vyos-http-api-tools for package idna security advisory as Normal priority.
Status update:
- "Like for like" functionality between .sh script and .py script is complete and working (can be viewed in PR)
- Raw output capability -> in progress
Giggum added a comment to T6099: Suppress unsupported interfaces from appearing in messages log by Telegraf .
@Viacheslav concur that it looks to be resolved, will close ticket. Thank you for the insight.
Viacheslav changed the status of T6123: Limit NTP allow-client config to internal addresses by default from Open to Needs testing.
Viacheslav changed the status of T4915: Minisign verification failure == pass?? from Needs testing to Needs reporter action.
We'll close it if no response
Viacheslav edited projects for T4982: Openconnect should have TLS 1.0 and TLS 1.1 disabled by default(?), added: VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta (1.4.0-epa3), Restricted Project.
Viacheslav closed T5946: TASK [setup-root-partition : Create a fileystem on EFI partition] failing in Docker as Wontfix.
A docker container usually has issues with loop devices:
Use the VM or attach dev
HollyGurza changed the status of T4248: There isn't a way to remove the only rule from the (traffic-policy) class. from Open to In progress.
Mon, Apr 15
Mon, Apr 15
Viacheslav moved T5734: OpenVPN server dh-params that are not in PKI error from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
Viacheslav moved T5734: OpenVPN server dh-params that are not in PKI error from Need Triage to Finished on the VyOS 1.5 Circinus board.
Viacheslav changed the status of T5722: Failing to add route in failover if gateway not in the same interface network from Open to In progress.
Viacheslav added a comment to T5722: Failing to add route in failover if gateway not in the same interface network.
PR https://github.com/vyos/vyos-1x/pull/3313
set interfaces ethernet eth0 vif 10 address '10.20.30.1/32' set protocols static route 10.20.30.0/32 interface eth0.10
sarthurdev closed T6174: can't view dhcp server leases if logged in as a tacacs account as Resolved.
sarthurdev changed the status of T6241: Updating CRL in "pki" config does not update OpenVPN from Open to Needs testing.
n.fort added a comment to T5535: disable-directed-broadcast should be moved to firewall global-options.
Viacheslav triaged T6242: Loadbalancer reverse-proxy: SSL backend skip CA certificate verification as Wishlist priority.
Viacheslav added a comment to T5722: Failing to add route in failover if gateway not in the same interface network.
It is more of a feature request than a bug due to specific kernel routes.
Feature to add onlink option
Viacheslav renamed T5722: Failing to add route in failover if gateway not in the same interface network from Failing to add route in failover to Failing to add route in failover if gateway not in the same interface network.
n.fort changed the status of T5535: disable-directed-broadcast should be moved to firewall global-options from Open to Confirmed.
Viacheslav changed the status of T5734: OpenVPN server dh-params that are not in PKI error from Confirmed to In progress.
I even commented on that issue…
It would seem my memory ages out after 3 years 🤣
Read the documentation for the 1.5
The same task https://vyos.dev/T3861
I probably can continue here in summer at first.
jestabro moved T3574: Add constraintGroup for combining validators with logical AND from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0-epa1) board.
Sun, Apr 14
Sun, Apr 14
lucasec renamed T6177: Intel QAT causes CPU runaway/stall with ipsec VPN from CPU runaway/stall possibly related to Strongswan to Intel QAT causes CPU runaway/stall with ipsec VPN.
My system finally crashed again today. I found a workload that generates enough traffic over the VPN to reliably re-produce.
Seems like its either fixed or was a quirk in that specific version.
Viacheslav changed the status of T6099: Suppress unsupported interfaces from appearing in messages log by Telegraf from Open to Needs reporter action.
Viacheslav added a comment to T6099: Suppress unsupported interfaces from appearing in messages log by Telegraf .
I don't see those logs:
set service monitoring telegraf influxdb authentication organization 'vyos' set service monitoring telegraf influxdb authentication token 'lxxx=' set service monitoring telegraf influxdb bucket 'vyos' set service monitoring telegraf influxdb url 'http://192.168.122.14'
Viacheslav reassigned T6210: Add container ability to configure capability sys-nice from Viacheslav to theflakes.
Viacheslav edited projects for T3968: Add network type ptp (veth) for containers, added: VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta.
Viacheslav added a comment to T5986: Container: Error on commit when environment variable value contains \n line break.
The dictionaries process the \n different way
1.5
vyos@r4# commit
[ container ]
{'container_remove': ['c1', 'c2'],
'name': {'test-postgres-master': {'allow_host_networks': {},
'command': 'postgres -c wal_level=replica '
'-c hot_standby=on -c '
'max_wal_senders=10 -c '
'max_replication_slots=10 -c '
'hot_standby_feedback=on',
'environment': {'POSTGRES_HOST_AUTH_METHOD': {'value': 'scram-sha-256\\nhost '
'replication '
'all '
'0.0.0.0/0 '
'md5'},
'POSTGRES_PASSWORD': {'value': 'password'}},
'image': 'postgres:14-alpine',
'memory': '512',
'restart': 'always',
'shared_memory': '64'}},
'network': {'NET01': {'prefix': ['10.0.0.0/24']}},
'registry': {'docker.io': {}, 'quay.io': {}}}Viacheslav added a comment to T5986: Container: Error on commit when environment variable value contains \n line break.
Diff
1.5
vyos@r4# cat /run/systemd/system/vyos-container-test-postgres-master.service | grep ExecStart -A2
ExecStartPre=/bin/rm -f %t/%n.pid %t/%n.cid
ExecStart=/usr/bin/podman run \
--conmon-pidfile %t/%n.pid --cidfile %t/%n.cid --cgroups=no-conmon \
--detach --interactive --tty --replace --memory 512m --shm-size 64m --memory-swap 0 --restart always --name test-postgres-master --env "POSTGRES_HOST_AUTH_METHOD=scram-sha-256\nhost replication all 0.0.0.0/0 md5" --env "POSTGRES_PASSWORD=password" --net host postgres:14-alpine postgres -c wal_level=replica -c hot_standby=on -c max_wal_senders=10 -c max_replication_slots=10 -c hot_standby_feedback=onViacheslav removed a project from T5986: Container: Error on commit when environment variable value contains \n line break: VyOS 1.5 Circinus.
Try the latest version
vyos@r4# set container name test-postgres-master environment POSTGRES_HOST_AUTH_METHOD value 'scram-sha-256\nhost replication all 0.0.0.0/0 md5' [edit] vyos@r4# commit [edit] vyos@r4# run show container CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 75a7fb610b57 localhost/gobgp-new:1 3 weeks ago Created new fdb74e9700e5 docker.io/library/alpine:3.19 /bin/sh 47 minutes ago Up 47 minutes c1 c05806fdb92c docker.io/library/busybox:latest sh 39 minutes ago Up 39 minutes c2 1b5fc3d4a07b docker.io/library/postgres:14-alpine postgres -c wal_l... 24 seconds ago Up 25 seconds test-postgres-master [edit] vyos@r4# run show ver Version: VyOS 1.5-rolling-202404140022 Release train: current
Viacheslav lowered the priority of T6233: Container configurations on VyOS 1.5 prevent containers from starting from Urgent! to Normal.
Viacheslav added a comment to T6233: Container configurations on VyOS 1.5 prevent containers from starting.
Did you try some other image (not hello-world)?
set container network NET01 prefix '10.0.0.0/24' set container name c1 image docker.io/library/alpine:3.19 set container name c1 network NET01
rleinfelder added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
Apachez, the QOS-MAPPING is FROM:TO, which means egress-priority 0 will be mapped to 2, egress-priority 2 will be mapped to 3. In my case i need only 0:3 or 0:5 on vif-s or vif-c because priority 0 is used by default for iperf application. Hope this helps for your understanding...
Apachez added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
How is this supposed to work?
rleinfelder added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
Viacheslav, YES it works, THANK YOU so much, now it's possible to set the priority on vif-c and vif-s. This is a great step forward to have this opportunity in my lab.
Now i have two questions:
-Is there a possibility to make the setting permanent ?
-And do you think, someone in the community is willing to implement a command/parameter to configure the priority on vif-c and vif-s also CLI ?. As i wrote I would pay for this implementation so everyone in the community can use this feature in VyOS.
Viacheslav added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
Does it work?
vyos@r4:~$ sudo cat /proc/net/vlan/eth2.100.200
eth2.100.200 VID: 200 REORDER_HDR: 1 dev->priv_flags: 81121
total frames received 0
total bytes received 0
Broadcast/Multicast Rcvd 0@dmbaturin hope you don't mind but this looked like a good task for a beginner and with it being low priority thought I'd give it a go.
drw_08 added a comment to T6226: add HAPROXY `tcp-request content accept` related block to load-balancing reverse proxy config .
can we also include this change into sagitta epa3?
Apachez added a comment to T5694: NTP should always be allowed from localhost and bindaddress/binddevice can only exist once.
Will a migrationsscript be included so that users who used the default of:
Will a migrationsscript be included so that users who used the default of:
Sat, Apr 13
Sat, Apr 13
rleinfelder added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
The priorisation for data traffic on our DSLAM access network is based on 802.1q because this are mainly Layer2 devices. The network between the DSLAMs prioritize also the data traffic based on 802.1q header. At the moment we need Layer2 ethernet tester which allow us to set the COS bit (0-7) on vif and vif-c+vif-s to measure the QoS through the network. The reason for my request was, to ask some VyOS community member, if this would be possible with VyOS + iperf like we do it today with the Layer2 ethernet tester.
chenxiaolong added a comment to T6163: kea-dhcp4-server crashes due to incorrect lease file permissions after 1.5-rolling-202403120022 -> 1.5-rolling-202403230018 upgrade.
Thanks for the quick fix! I intentionally messed with the file ownership and can confirm that VyOS 1.5-rolling-202404130016 will correct them to the proper values.
Apachez added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
You can do the QoS priority on the VyOS by matching the traffic based on VLAN ID and then set the DSCP (TOS) using "set-dscp" according to the manuals below:
rleinfelder added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
Yes, we want to configure the QoS priority "three bits" of the 802.1p field. In our lab the packet forwarding is based on 802.1q priority.
https://en.wikipedia.org/wiki/IEEE_802.1Q
Apachez added a comment to T6239: Would it be possible to implement an additional command/parameter to configure the vlan priority 0-7 on vif or vif-c+vif-s.
You mean you want QoS based on VLAN which is named 802.1p ?
Viacheslav closed T6238: vyos-build Check pull request title requires the python script as Resolved.
There is also an inactivity timer in systemd-logind, but this will log you out even while running e.g. htop and just watching - I wonder if that's the preferred way :/
c-po moved T2518: Support NAT for ipv6(NPT) from Need Triage to Finished on the VyOS 1.5 Circinus board.
c-po moved T2518: Support NAT for ipv6(NPT) from Need Triage to Finished on the VyOS 1.4 Sagitta (1.4.0) board.
c-po edited projects for T2518: Support NAT for ipv6(NPT), added: VyOS 1.4 Sagitta (1.4.0), VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta.
GitHub <[email protected]> closed T6173: Build Causes Errors When "--version" Contains Slashes ("/") as Resolved by committing Restricted Diffusion Commit.
Link to forum thread: https://forum.vyos.io/t/output-similar-to-packet-tracer/