In T4823#138040, @chesskuo wrote:Hello sir,
In vyos-1.4-rolling-202211220318-amd64.iso, the broken syntax was fixed, but I notice a wired behavior on connection.<conn>.remote.id.
The default value on swanctl.conf will be <name> when I don't set site-to-site -> peer <name> -> authentication -> remote-id.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Nov 22 2022
Nov 22 2022
Viacheslav added a project to T4833: Include wireguard peer name in interface summary report: VyOS 1.4 Sagitta.
sarthurdev changed the status of T4834: Limit container network name to 15 characters from In progress to Needs testing.
sarthurdev changed the status of T4834: Limit container network name to 15 characters from Open to In progress.
Hello sir,
@trae32566 My apologies for the inconveniences. You are right. The criteria for triggering this action shall be narrowed down further.
It would be necessary to issue the warning if and only if such colliding peers also specify the exact same remote endpoint addresses (with empty endpoints also being accounted as to be the same).
In other words, we need to identify incoming peers and apply the rule only to them, not the outgoing ones which already have specific remote endpoint addresses statically defined.
Viacheslav changed the status of T4823: swanctl.conf is broken when ipsec site-to-site peer set. from In progress to Needs testing.
This breaks a perfectly valid use case which I utilize regularly: using IPv4 + IPv6 peers with the same public key. Why would I want to create multiple keys for the exact same devices going over IPv4 and IPv6? If you want to include a warning, fine, but don't limit functionality based on someone's interpretation of how something will be used. I understand where this came from, but any time you limit functionality, you limit your users. As Donald Knuth once said:
Unix was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
@Viacheslav Thank you sir!!!
Nov 21 2022
Nov 21 2022
Viacheslav moved T4812: IPsec ability to show all configured connections from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
Viacheslav closed T4812: IPsec ability to show all configured connections, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, as Resolved.
This is a nice addition but it requires also implementation of RFC 8781 for it to work. It has been merged in latest radvd https://github.com/radvd-project/radvd/commit/a6460662c6ac2b13307a8977ef068825b66fbce0 but it still hasnt been released
jestabro closed T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional, a subtask of T4552: Unable to reset IPsec IPv6 peer, as Resolved.
I think the issue is realated to this: https://blog.ipspace.net/2014/09/ipv6-neighbor-discovery-nd-and.html
I add here what I just found and I can reproduce the issue everytime.
You can test with 3-5 servers, the config is basic for each server:
Could you provide config from several items?
How many nodes do we need to reproduce it?
Nov 20 2022
Nov 20 2022
Viacheslav added a project to T4812: IPsec ability to show all configured connections: VyOS 1.3 Equuleus (1.3.3).
Viacheslav changed the status of T4823: swanctl.conf is broken when ipsec site-to-site peer set. from Open to In progress.
Viacheslav changed the status of T4812: IPsec ability to show all configured connections, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, from In progress to Needs testing.
Viacheslav changed the status of T4812: IPsec ability to show all configured connections from In progress to Needs testing.
1.3 backport https://github.com/vyos/vyos-1x/pull/1670
ipsec site-to-site peer <name> - it is just a connection name and is not related to the IP address
I'll take a look at TS
Viacheslav changed the status of T4830: nat66 - Error in port translation rules from Confirmed to Needs testing.
vyos@r14# set policy route-map FOO rule 100 action permit [edit] vyos@r14# set policy route-map FOO rule 50 action 'deny' [edit] vyos@r14# set policy route-map FOO rule 50 continue '100' [edit] vyos@r14# [edit] vyos@r14# commit [ policy ] rule 50 "continue" cannot be used with action deny!
Nov 19 2022
Nov 19 2022
jestabro updated the task description for T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional.
Viacheslav closed T4720: Ability to configure SSH HostKeyAlgorithms, a subtask of T4712: Collaborative Protection Profile cPP for Network Devices root task, as Resolved.
Thanks
Don’t think that there should be a migration
As new keys were added several days ago.
jestabro closed T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer', a subtask of T4552: Unable to reset IPsec IPv6 peer, as Resolved.
Unknown Object (User) added a comment to T4720: Ability to configure SSH HostKeyAlgorithms.
@Viacheslav Works!
It works as expected now on 1.4-rolling-202211190627, but my system failed to boot with the old key types in the config, so I had to remove them before switching to the new image. Thanks for the quick fix!
c-po edited projects for T4760: VyOS does not support running multiple instances of DHCPv6 clients, added: VyOS 1.3 Equuleus (1.3.3); removed VyOS 1.3 Equuleus (1.3.2).
c-po moved T4760: VyOS does not support running multiple instances of DHCPv6 clients from Open to Finished on the VyOS 1.4 Sagitta board.
c-po changed the status of T4760: VyOS does not support running multiple instances of DHCPv6 clients from Open to Needs testing.
Nov 18 2022
Nov 18 2022
jestabro triaged T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional as Normal priority.
jestabro added a parent task for T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer': T4552: Unable to reset IPsec IPv6 peer.
jestabro triaged T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer' as Normal priority.
as we talked , this behavior is the same on vyos1.3.x/frr7.5.x . the main difference is that on vyos-cli doesn't add this command .
@Arc771 Thanks, Could you check it in the next rolling release after 20221118?
Viacheslav changed the status of T4826: Wrong key type is used for SSH SK public keys from Open to Needs testing.
@DerEnderKeks Could you check it in the next rolling release after 20221118?
jestabro closed T4821: Correct calling of config mode script dependencies from firewall.py as Resolved.
jestabro closed T4821: Correct calling of config mode script dependencies from firewall.py, a subtask of T4820: Support for inter-config-mode script dependencies, as Resolved.
Viacheslav changed the status of T4819: Allow printing Warning messages in multiple lines with \n from In progress to Needs testing.
set policy route-map MAP-ISP1-AS1001-EXPORT rule 50 action 'deny' set policy route-map MAP-ISP1-AS1001-EXPORT rule 50 continue '100'
Nov 17 2022
Nov 17 2022
I guess it was implemented in the T4750
Should be easy to fix
@marc_s thanks for testing !
Added file:// parser to vyos.remote.download and used that to simplify the code, no need to check if it's local now.
TheSin- updated the task description for T4797: External address/network lists for firewall (Local and remote).
jestabro changed the status of T4821: Correct calling of config mode script dependencies from firewall.py, a subtask of T4820: Support for inter-config-mode script dependencies, from Open to Needs testing.
jestabro changed the status of T4821: Correct calling of config mode script dependencies from firewall.py from Open to Needs testing.
jestabro added a comment to T4821: Correct calling of config mode script dependencies from firewall.py.
jestabro renamed T4821: Correct calling of config mode script dependencies from firewall.py from Fix calling of config mode script dependencies from firewall.py to Correct calling of config mode script dependencies from firewall.py.
Nov 16 2022
Nov 16 2022
syncer raised the priority of T1797: Implement DPDK Fast-Path using FRR's Alternate Forwarding Planes and VPP from Wishlist to Normal.
Now as linux-cp available we can consider adding support
thank you
fernando added a subtask for T4686: Provides support for veth: T4825: interfaces veth/veth-pairs -standalone used.
fernando added a parent task for T4825: interfaces veth/veth-pairs -standalone used: T4686: Provides support for veth.
Hello sir,
Nov 15 2022
Nov 15 2022
We figured out the problem. So for OSPF segment routing to work we need to enable opaque LSA capabilities. So by default VyOS doesn't have opaque LSAs (type 9, type 10, type 11) enabled. So after checking the configuration for the OSPF FRR template I noticed that the actual command to enable opaque LSAs is broken because it's not in the OSPF FRR template. Once we fix that, we'll have working OSPF segment routing.
jestabro triaged T4821: Correct calling of config mode script dependencies from firewall.py as Normal priority.
a.apostoliuk renamed T4819: Allow printing Warning messages in multiple lines with \n from Allow printing Warning and Critical messages in multiple lines with \n to Allow printing Warning messages in multiple lines with \n.
Unknown Object (User) added a comment to T4720: Ability to configure SSH HostKeyAlgorithms.
First of all, sorry for my late reply. I was on vacation and stayed away from IT for a bit ;)
a.apostoliuk changed the status of T4819: Allow printing Warning messages in multiple lines with \n from Open to In progress.