https://github.com/vyos/vyos-1x/pull/1019
https://github.com/vyos/vyatta-cfg/pull/41
https://github.com/vyos/vyatta-cfg-system/pull/171
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Sep 30 2021
Sep 30 2021
c-po moved T3874: D-Link Ethernet Interface not working. from Open to Finished on the VyOS 1.4 Sagitta board.
GitHub <noreply@github.com> committed rVYOSONEX2a79df6398ea: Merge pull request #1017 from zdc/T3852-equuleus (authored by c-po).
jestabro closed T3869: Rewrite vyatta_net_name/vyatta_interface_rescan in Python, a subtask of T3871: Resolve unexpected interface name reordering, as Resolved.
GitHub <noreply@github.com> committed rVYOSONEXee5af5ddc653: Merge pull request #1019 from jestabro/interface-names (authored by jestabro).
Sep 29 2021
Sep 29 2021
Viacheslav changed the subtype of T3873: Zone based Firewall - Filter traffic in same zone from "Task" to "Feature Request".
zleppy awarded T3420: Support UPNP protocol a Like token.
dmbaturin changed Is it a breaking change? from none to compatible on T311: DHCP: set client-hostname via CLI.
dmbaturin renamed T815: Add DHCPv6 server prefix-delegation support from Add DHCPv6 prefix-delegation support to Add DHCPv6 server prefix-delegation support.
dmbaturin changed Is it a breaking change? from none to compatible on T899: Tunnels cannot be moved from one bridge to another.
dmbaturin changed Is it a breaking change? from none to compatible on T834: New L2TP server implementation based on accel-ppp.
dmbaturin changed Is it a breaking change? from none to compatible on T1171: 1.2.0 epa2 - IPsec VPN initiation.
dmbaturin changed the status of T679: SNMPv3 TSM is no longer supported by net-snmp, a subtask of T652: Rewrite service snmp in new style XML interface definition, from Wontfix to Not Applicable.
dmbaturin changed the status of T679: SNMPv3 TSM is no longer supported by net-snmp from Wontfix to Not Applicable.
dmbaturin set Issue type to improvement on T1350: VRRP transition script will be executed once only.
dmbaturin renamed T1250: FRR not setting default gateway from DHCP from FRR not setting default gateway from dhcp to FRR not setting default gateway from DHCP.
dmbaturin renamed T1249: multiple PBR rules can set to a single interface from multiply PBR rules can set to a single interface to multiple PBR rules can set to a single interface.
dmbaturin set Is it a breaking change? to compatible on T1248: Add a function for copying nodes to the vyos.configtree library.
dmbaturin changed Is it a breaking change? from none to compatible on T1246: VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in values.
dmbaturin removed a project from T1241: Remove of policy route throws CLI error: VyOS 1.3 Equuleus (1.3.0-epa1).
dmbaturin removed a project from T1238: Wireguard allows invalid IP's: VyOS 1.3 Equuleus (1.3.0-epa1).
dmbaturin renamed T1236: Update Linux Kernel from Update Linux Kernel to 4.19.20 to Update Linux Kernel.
dmbaturin set Is it a breaking change? to compatible on T1222: OSPF routing problem - route looping.
dmbaturin set Is it a breaking change? to compatible on T1214: Add `ipaddrcheck` to the packages directory.
dmbaturin set Is it a breaking change? to compatible on T1212: IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred.
dmbaturin set Is it a breaking change? to compatible on T1202: Add `hvinfo` to the packages directory.
dmbaturin removed a project from T1194: cronjob is being setup even if not saved: VyOS 1.3 Equuleus (1.3.0-epa1).
dmbaturin changed Is it a breaking change? from none to compatible on T1192: Wlan regression between 1.2.0-rc11 and rolling.
dmbaturin edited projects for T1187: Command show log vpn display wrong information , added: VyOS-1.2.0-GA; removed VyOS 1.3 Equuleus (1.3.0-epa1).
dmbaturin set Is it a breaking change? to compatible on T1187: Command show log vpn display wrong information .
dmbaturin set Is it a breaking change? to none on T1184: wireguard - extend documentation with the show interface wireguard commands.
Sep 28 2021
Sep 28 2021
jestabro updated the task description for T3869: Rewrite vyatta_net_name/vyatta_interface_rescan in Python.
zsdc changed the status of T3852: DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again, a subtask of T3471: DHCP hook is not able to detect all running DHCP instances, from Open to Needs testing.
zsdc changed the status of T3852: DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again from Open to Needs testing.
The issue solved in the https://github.com/vyos/vyos-1x/pull/1017
However, the question if netplug script is necessary at all is still opened.
Viacheslav closed T3853: nat66 rules gets deleted on reboot in 1.4-rolling-202109240217 as Resolved.
It works now! Thanks!
Sep 27 2021
Sep 27 2021
jestabro changed the status of T3869: Rewrite vyatta_net_name/vyatta_interface_rescan in Python from In progress to Needs testing.
In testing:
https://github.com/vyos/vyos-1x/compare/current...jestabro:interface-names
https://github.com/vyos/vyatta-cfg/compare/current...jestabro:interface-names
The following removes legacy code: vyatta_net_name, vyatta_interface_rescan, XorpConfigParser
https://github.com/vyos/vyatta-cfg-system/compare/current...jestabro:interface-names
jestabro changed the status of T3869: Rewrite vyatta_net_name/vyatta_interface_rescan in Python from Open to In progress.
c-po moved T3858: Deleting OSPFv3 process yields: Unknown command: no router-id from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.0-epa1) board.
c-po moved T3858: Deleting OSPFv3 process yields: Unknown command: no router-id from Needs Triage to Finished on the VyOS 1.2 Crux (VyOS 1.2.9) board.
Backported to crux branch
c-po closed T3863: nat66: commit fails/hangs on non existing interface, a subtask of T3853: nat66 rules gets deleted on reboot in 1.4-rolling-202109240217, as Resolved.
Viacheslav changed the status of T690: Allow OpenVPN servers to push routes with custom metric values from Open to Needs testing.
Viacheslav changed the status of T3853: nat66 rules gets deleted on reboot in 1.4-rolling-202109240217 from Confirmed to Needs testing.
@danielpo Will be fixed in the next rolling release.
c-po committed rVYOSONEXc6d0227d96e4: openvpn: T690: Fix template for gateway and metric (authored by Viacheslav).
GitHub <noreply@github.com> committed rVYOSONEX753757b0fdd6: Merge pull request #1015 from sever-sever/T690 (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX5c8a103ef475: Merge pull request #1016 from sever-sever/T3853 (authored by c-po).
Viacheslav added a comment to T3853: nat66 rules gets deleted on reboot in 1.4-rolling-202109240217.
PR https://github.com/vyos/vyos-1x/pull/1016
Change priority for nat66
c-po renamed T3318: Update Linux Kernel to v5.4.208 / 5.10.142 from Update Linux Kernel to v5.4.143 / 5.10.61 to Update Linux Kernel to v5.4.149 / 5.10.69.
Not all clients support the gateway option (get issues in mac and windows):
Mac
tun_prop_route_error: route destinations other than vpn_gateway or net_gateway are not supported
set interfaces openvpn vtun20 openvpn-option '--push dhcp-option DNS 203.0.113.1'
generated config:
--push dhcp-option DNS 203.0.113.1
expected configuration:
push dhcp-option "DNS 203.0.113.1"
By the way, the SNMPD service of the router will not restart automatically. After the SNMP service is attacked, the SNMP service cannot be restored even if the device is restarted, which may be an inappropriate implementation.
I have a question. If you confirm the existence of the vulnerability, can you report to the NET-SNMP vendor and apply for a CVE number?
I have sent the POC of the vulnerability to daniil@vyos.io.
By the way, The password of the compressed package is HGkasjgJFYL261.
Hello, I have found three vulnerabilities in V1.2.7, one of which can also be reproduced in V1.3, please continue to check the other versions, I will send all three POCs to your email, thank you for your work.
lucasec added a comment to T3861: PKI: changing certificates, keys, crls does not "regenerate" the on-disk certificates.
Adding a few notes here:
- The ideal behavior probably depends on which PKI elements are changed and what services depend on them.
- E.g. OpenVPN does not require a server restart for a CRL change (see https://openvpn.net/community-resources/controlling-a-running-openvpn-process/), but changing the CA or server cert/key would require a restart.
- It seems like there are some swanctrl commands that can conditionally reload parts of the config too without taking all tunnels down
- The former might be useful if you need to renew server certs or something like that and want to do so with the minimal impact