In T4823#138040, @chesskuo wrote:Hello sir,
In vyos-1.4-rolling-202211220318-amd64.iso, the broken syntax was fixed, but I notice a wired behavior on connection.<conn>.remote.id.
The default value on swanctl.conf will be <name> when I don't set site-to-site -> peer <name> -> authentication -> remote-id.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Nov 22 2022
Nov 22 2022
Viacheslav added a project to T4833: Include wireguard peer name in interface summary report: VyOS 1.4 Sagitta.
sarthurdev changed the status of T4834: Limit container network name to 15 characters from In progress to Needs testing.
sarthurdev changed the status of T4834: Limit container network name to 15 characters from Open to In progress.
Hello sir,
@trae32566 My apologies for the inconveniences. You are right. The criteria for triggering this action shall be narrowed down further.
It would be necessary to issue the warning if and only if such colliding peers also specify the exact same remote endpoint addresses (with empty endpoints also being accounted as to be the same).
In other words, we need to identify incoming peers and apply the rule only to them, not the outgoing ones which already have specific remote endpoint addresses statically defined.
Viacheslav changed the status of T4823: swanctl.conf is broken when ipsec site-to-site peer set. from In progress to Needs testing.
This breaks a perfectly valid use case which I utilize regularly: using IPv4 + IPv6 peers with the same public key. Why would I want to create multiple keys for the exact same devices going over IPv4 and IPv6? If you want to include a warning, fine, but don't limit functionality based on someone's interpretation of how something will be used. I understand where this came from, but any time you limit functionality, you limit your users. As Donald Knuth once said:
Unix was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
@Viacheslav Thank you sir!!!
Nov 21 2022
Nov 21 2022
Viacheslav moved T4812: IPsec ability to show all configured connections from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.3) board.
Viacheslav closed T4812: IPsec ability to show all configured connections, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, as Resolved.
GitHub <noreply@github.com> committed rVYOSONEX1b2a8c822bb5: Merge pull request #1672 from sever-sever/T4812-eq (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX827f2b223d70: Merge pull request #1673 from sever-sever/T4823 (authored by c-po).
This is a nice addition but it requires also implementation of RFC 8781 for it to work. It has been merged in latest radvd https://github.com/radvd-project/radvd/commit/a6460662c6ac2b13307a8977ef068825b66fbce0 but it still hasnt been released
jestabro closed T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional, a subtask of T4552: Unable to reset IPsec IPv6 peer, as Resolved.
GitHub <noreply@github.com> committed rVYOSONEXdc9726636f18: Merge pull request #1671 from jestabro/reset-tunnel-arg-optional (authored by dmbaturin).
I think the issue is realated to this: https://blog.ipspace.net/2014/09/ipv6-neighbor-discovery-nd-and.html
I add here what I just found and I can reproduce the issue everytime.
You can test with 3-5 servers, the config is basic for each server:
Could you provide config from several items?
How many nodes do we need to reproduce it?
Nov 20 2022
Nov 20 2022
Viacheslav added a project to T4812: IPsec ability to show all configured connections: VyOS 1.3 Equuleus (1.3.3).
Viacheslav changed the status of T4823: swanctl.conf is broken when ipsec site-to-site peer set. from Open to In progress.
Viacheslav changed the status of T4812: IPsec ability to show all configured connections, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, from In progress to Needs testing.
Viacheslav changed the status of T4812: IPsec ability to show all configured connections from In progress to Needs testing.
GitHub <noreply@github.com> committed rVYOSONEX2e011313a9b5: Merge pull request #1657 from sever-sever/T4812 (authored by dmbaturin).
1.3 backport https://github.com/vyos/vyos-1x/pull/1670
ipsec site-to-site peer <name> - it is just a connection name and is not related to the IP address
I'll take a look at TS
Viacheslav changed the status of T4830: nat66 - Error in port translation rules from Confirmed to Needs testing.
vyos@r14# set policy route-map FOO rule 100 action permit [edit] vyos@r14# set policy route-map FOO rule 50 action 'deny' [edit] vyos@r14# set policy route-map FOO rule 50 continue '100' [edit] vyos@r14# [edit] vyos@r14# commit [ policy ] rule 50 "continue" cannot be used with action deny!
GitHub <noreply@github.com> committed rVYOSONEXb7e203d168d5: Merge pull request #1667 from sever-sever/T4827 (authored by c-po).
Viacheslav changed the status of T4831: implement Telegraf build on arm64 / fix hardcoded x86-64 reference from Open to Needs testing.
mcbridematt added a comment to T4831: implement Telegraf build on arm64 / fix hardcoded x86-64 reference.
Pull request: https://github.com/vyos/vyos-build/pull/286
Nov 19 2022
Nov 19 2022
jestabro updated the task description for T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional.
GitHub <noreply@github.com> committed rVYOSONEX2fa43aea9c47: Merge pull request #1666 from nicolas-fort/T4830-nat66 (authored by c-po).
Viacheslav closed T4720: Ability to configure SSH HostKeyAlgorithms, a subtask of T4712: Collaborative Protection Profile cPP for Network Devices root task, as Resolved.
Thanks
Don’t think that there should be a migration
As new keys were added several days ago.
jestabro closed T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer', a subtask of T4552: Unable to reset IPsec IPv6 peer, as Resolved.
Unknown Object (User) added a comment to T4720: Ability to configure SSH HostKeyAlgorithms.
@Viacheslav Works!
It works as expected now on 1.4-rolling-202211190627, but my system failed to boot with the old key types in the config, so I had to remove them before switching to the new image. Thanks for the quick fix!
c-po edited projects for T4760: VyOS does not support running multiple instances of DHCPv6 clients, added: VyOS 1.3 Equuleus (1.3.3); removed VyOS 1.3 Equuleus (1.3.2).
c-po moved T4760: VyOS does not support running multiple instances of DHCPv6 clients from Open to Finished on the VyOS 1.4 Sagitta board.
c-po changed the status of T4760: VyOS does not support running multiple instances of DHCPv6 clients from Open to Needs testing.
GitHub <noreply@github.com> committed rVYOSONEX0cec72de1716: Merge pull request #1665 from jestabro/op-mode-value-error (authored by c-po).
Nov 18 2022
Nov 18 2022
jestabro triaged T4829: Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional as Normal priority.
jestabro added a parent task for T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer': T4552: Unable to reset IPsec IPv6 peer.
jestabro triaged T4828: Raise appropriate op-mode errors in ipsec.py 'reset_peer' as Normal priority.
as we talked , this behavior is the same on vyos1.3.x/frr7.5.x . the main difference is that on vyos-cli doesn't add this command .
In T973#137840, @elico wrote:@Viacheslav I want to test this, what should be done?
@Arc771 Thanks, Could you check it in the next rolling release after 20221118?
Viacheslav changed the status of T4826: Wrong key type is used for SSH SK public keys from Open to Needs testing.
@DerEnderKeks Could you check it in the next rolling release after 20221118?
GitHub <noreply@github.com> committed rVYOSONEX95abda42a4ef: Merge pull request #1664 from sever-sever/T4826 (authored by c-po).
jestabro closed T4821: Correct calling of config mode script dependencies from firewall.py as Resolved.
jestabro closed T4821: Correct calling of config mode script dependencies from firewall.py, a subtask of T4820: Support for inter-config-mode script dependencies, as Resolved.
GitHub <noreply@github.com> committed rVYOSONEX97056cad1866: Merge pull request #1662 from jestabro/config-script-dependency (authored by dmbaturin).
@Viacheslav I want to test this, what should be done?
Viacheslav changed the status of T4819: Allow printing Warning messages in multiple lines with \n from In progress to Needs testing.
set policy route-map MAP-ISP1-AS1001-EXPORT rule 50 action 'deny' set policy route-map MAP-ISP1-AS1001-EXPORT rule 50 continue '100'