Did a quick test...
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Aug 5 2021
Aug 5 2021
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Already rewritten in 1.4 and 1.3 T3535
https://phabricator.vyos.net/rVYOSONEX21527ef4551613fe9b7eed9e4b2ce33ad46fe540
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Hmmmm....it worked last time. I'll give it another run.
Viacheslav reopened T3634: Add op command option for ping for do not fragment bit to be set as "Open".
Reopen
It doesn't work properly
Viacheslav added a project to T681: Shaper QoS policy does not recognize 'lowdelay' DSCP value: VyOS 1.4 Sagitta.
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
ipsec start error ..
jestabro added a project to T3574: Add constraintGroup for combining validators with logical AND: test.
c-po closed T3719: Restart vpn shows some missed files, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, as Resolved.
jestabro closed T3574: Add constraintGroup for combining validators with logical AND as Unknown Status.
Unknown Object (User) added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
It is not critical, please test without this package "libstrongswan-standard-plugins"
All necessary data is already installed.
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
Setting up libstrongswan (5.7.2-1) ... Setting up libstrongswan-extra-plugins (5.7.2-1) ... dpkg: dependency problems prevent configuration of libstrongswan-standard-plugins: libstrongswan-standard-plugins depends on libssl1.0.0 (>= 1.0.2~beta3); however: Version of libssl1.0.0:amd64 on system is 1.0.1t-1+deb8u14.
Unknown Object (User) added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
strongswan.tar2 MBDownload
I have patched packages for 1.2.8. It works on my routers in the virtual environment.
Instruction:
- Upload package to the router
- Unarchiv it
sudo tar -xvf strongswan.tar
- Install packages
sudo dpkg -i *.deb
- Reboot router or reconfigure IPSec
As I understand there are 2 bugs:
- It expected --iroute-ipv6, i.e
iroute-ipv6 2001:470:1f14:af1:: ffff:ffff:ffff:ffff::
- Something wrong with such format (ipv6 address/ ipv4 mask)
ifconfig-push 2001:470:1f14:af1::2 255.255.240.0
Aug 4 2021
Aug 4 2021
c-po closed T3718: VPN IPsec IKE group by default not use DH-group 2, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, as Resolved.
@SrividyaA does this configuration work or not?
set interfaces openvpn vtun10 encryption cipher 'aes256' set interfaces openvpn vtun10 hash 'sha512' set interfaces openvpn vtun10 local-host '10.2.0.15' set interfaces openvpn vtun10 local-port '1194' set interfaces openvpn vtun10 mode 'server' set interfaces openvpn vtun10 persistent-tunnel set interfaces openvpn vtun10 protocol 'udp' set interfaces openvpn vtun10 server client client1 ip '2001:470:1f14:af1::2' set interfaces openvpn vtun10 server client client1 subnet '2001:470:1f14:af1::/64' set interfaces openvpn vtun10 server push-route '2001:db8:0:abc::/64' set interfaces openvpn vtun10 server subnet '10.140.0.0/20' set interfaces openvpn vtun10 server topology 'subnet' set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ea1/ca.crt' set interfaces openvpn vtun10 tls cert-file '/config/auth/ea1/central.crt' set interfaces openvpn vtun10 tls dh-file '/config/auth/ea1/dh.pem' set interfaces openvpn vtun10 tls key-file '/config/auth/ea1/central.key'
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file, a subtask of T1962: Add syntax version to schema, from Open to In progress.
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file, a subtask of T3475: XML dictionary cache unable to process syntaxVersion elements, from Open to In progress.
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file from Open to In progress.
Viacheslav closed T320: OSPF does not redistribute connected routes associated with virtual tunnel interfaces as Resolved.
I don't see this bug in 1.3.0-rc5,
Aug 3 2021
Aug 3 2021
@stepler I created https://github.com/FRRouting/frr/pull/9281 for "easier" debugging
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
OK , Thank you!
GitHub <noreply@github.com> committed rVYOSONEXbc9936e5bebd: Merge pull request #950 from sever-sever/T1594 (authored by c-po).
c-po changed the status of T3718: VPN IPsec IKE group by default not use DH-group 2, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Open to Confirmed.
c-po changed the status of T3718: VPN IPsec IKE group by default not use DH-group 2 from Open to Confirmed.
I tried this locally and you can do no router bgp 100 vrf blue before no vni 2000, my vtysh instance does not scream for an error - it more feels like a programming issue on our side.
Viacheslav added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
In T2851#99364, @lawrencepan wrote:
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
sudo ip rule add prio 219 from 192.0.2.48/30 to 192.0.2.48/30 lookup main }
Viacheslav added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
As a workaround it can help in such cases:
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
I get the same issue in 1.2.8.
Viacheslav updated the task description for T3720: IPSec set vti secondary address cause interface disable.
@xrobau You have to set remote-as for peer-group or for neighbor
vyos@r4-1.3# set protocols bgp 65001 peer-group FOO [edit] vyos@r4-1.3# set protocols bgp 65001 neighbor 203.0.113.2 peer-group FOO [edit] vyos@r4-1.3# set protocols bgp 65001 neighbor 203.0.113.2 remote-as 65002 [edit] vyos@r4-1.3# commit [edit] vyos@r4-1.3#
Unknown Object (User) closed T2432: dhcpd: Can't create new lease file: Permission denied as Unknown Status.
Unknown Object (User) added a comment to T2661: SSTP wrong certificates check.
@Viacheslav I believe it is still actual for 1.3 https://github.com/vyos/vyos-1x/blob/equuleus/src/conf_mode/vpn_sstp.py#L60-L78
I saw we changed the PKI model only for 1.4. Implement PKI model for 1.3-epa1 a risky
Aug 2 2021
Aug 2 2021
I figured out the order we need to remove things in:
UnicronNL closed T3601: Error in ssh keys for vmware cloud-init if ssh keys is left empty. as Resolved.
GitHub <noreply@github.com> committed rVYOSONEX7a32e9ee70d6: Merge pull request #952 from sever-sever/T1594-curr (authored by c-po).
Viacheslav closed T2623: Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1 at tunnel creation” as Resolved.
Fixed, tested in 1.3.0-rc5
set firewall ipv6-name WAN6_IN6 set firewall ipv6-name WAN6_LOCAL6 set interfaces ethernet eth1 address '192.0.2.1/24' set interfaces ethernet eth1 description 'FOO' set interfaces tunnel tun1 6rd-prefix '2607:FA48:6ED8::/45' set interfaces tunnel tun1 6rd-relay-prefix '24.225.128.0/17' set interfaces tunnel tun1 address '2607:FA48:6ED8:8A50::1/60' set interfaces tunnel tun1 description 'Videotron 6rd Tunnel' set interfaces tunnel tun1 encapsulation 'sit' set interfaces tunnel tun1 firewall in ipv6-name 'WAN6_IN6' set interfaces tunnel tun1 firewall local ipv6-name 'WAN6_LOCAL6' set interfaces tunnel tun1 mtu '1480' set interfaces tunnel tun1 multicast 'disable' set interfaces tunnel tun1 parameters ip ttl '255' set interfaces tunnel tun1 remote '192.0.2.2' set interfaces tunnel tun1 source-address '192.0.2.1'
Commit:
vyos@r4-1.3# commit [edit] vyos@r4-1.3# sudo ip tunnel show sit0: ipv6/ip remote any local any ttl 64 nopmtudisc 6rd-prefix 2002::/16 tun1: ipv6/ip remote 192.0.2.2 local 192.0.2.1 ttl 255 tos inherit 6rd-prefix 2002::/16 [edit] vyos@r4-1.3#
Viacheslav added a subtask for T2199: Rewrite firewall in new XML/Python style: T2194: "show firewall" garbled output.
Viacheslav added a parent task for T2194: "show firewall" garbled output: T2199: Rewrite firewall in new XML/Python style.
@trae32566 Can you re-check it?
There are different outputs from "iptables" between 1.2 and 1.3:
By default:
vyos@r4-1.3:~$ sudo netstat -tulpn | grep 161 udp 0 0 0.0.0.0:161 0.0.0.0:* 1405/snmpd udp6 0 0 :::161 :::* 1405/snmpd vyos@r4-1.3:~$
After rebooting router starts with a clean routing configuration.
After that, it loads/commits configuration from /config/config.boot file.
It can be a cause, needs more tests.
It will be must impossible to get another behavior.
PR for current version https://github.com/vyos/vyos-1x/pull/952
I've cleaned the build space and rebuilt the Docker container - no dice locally or in the CI stack, still fails the same way.
It looks like they're using an AWS CA in the cert chain:
Certificate chain 0 s:CN = repo.saltstack.com i:C = US, O = Amazon, OU = Server CA 1B, CN = Amazon 1 s:C = US, O = Amazon, OU = Server CA 1B, CN = Amazon i:C = US, O = Amazon, CN = Amazon Root CA 1 2 s:C = US, O = Amazon, CN = Amazon Root CA 1 i:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2 3 s:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2 i:C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority
i do recall the starfield certs being a problem back in the day as well, but guessing its quite unlikely for the base build environment to have an AWS root CA in its trusted list.
Aug 1 2021
Aug 1 2021
c-po moved T1594: l2tpv3 error on IPv6 local-ip from Open to In Progress on the VyOS 1.4 Sagitta board.
c-po moved T3090: Move 'adjust-mss' firewall options to the interface section. from Open to Backlog on the VyOS 1.4 Sagitta board.
c-po moved T3707: Ping incorrect ip host checks from Need Triage to Finished on the VyOS 1.3 Equuleus board.
c-po moved T3707: Ping incorrect ip host checks from Open to Finished on the VyOS 1.4 Sagitta board.