Needs testing

PR https://github.com/vyos/vyos-1x/pull/4198
Add base64 encrypted password

$ echo -n 1234567890 | base64
MTIzNDU2Nzg5MA==
$ 

@marco_agostani we do not have validators on the insert config step https://github.com/vyos/vyos-1x/blob/8f76c96cb4d7132b7654aa5f37e8ab49fa2e137a/interface-definitions/vpn_ipsec.xml.in#L35-L43
It is more of an interpreter issue/feature

Maybe it will be fixed after merging https://vyos.dev/T6045

@sskaje, what would it be like without an internet connection while the system was loaded? And will the Internet be available 1-2 minutes after boot?
I think you will get the router without wireguard at all, as it was in the previous commits. It cannot resolve the address, so it cannot create a session. And it will be in this state until you reconfigure it again.

We use podman for containers.
Eq command for the podman:

vyos@r14:~$ sudo podman network create pod-net2 --opt mtu=1200
pod-net2
vyos@r14:~$

Check:

vyos@r14:~$ sudo podman network inspect pod-net2
[
     {
          "name": "pod-net2",
          "id": "f1ec367ee95ee0f5b644b7fb96faffa6cf499490e3ff5e8f3915182639302cc7",
          "driver": "bridge",
          "network_interface": "podman1",
          "created": "2024-11-18T10:08:28.26831792Z",
          "subnets": [
               {
                    "subnet": "10.89.0.0/24",
                    "gateway": "10.89.0.1"
               }
          ],
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": true,
          "options": {
               "mtu": "1200"
          },
          "ipam_options": {
               "driver": "host-local"
          }
     }
]
vyos@r14:~$

PR https://github.com/vyos/vyos-build/pull/839

PR https://github.com/vyos/vyos-1x/pull/4192

Check please bug report guidelines https://blog.vyos.io/feature-requests-and-bug-reports-guidelines

We use common-generic password which uses limits
We should change it here.
What number of symbols is better to make?

Needs testing, will be fixed in the next rolling release

@syncer not it doesn’t
JSON parser wasn’t back ported so other branches are not affected

I created a separated bug report https://vyos.dev/T6856

I'm going to close PR, https://github.com/vyos/vyos-build/pull/832#pullrequestreview-2420618828

@paulywog Can you check the latest rolling?

@SteveP Thanks!
I created a PR to exclude these rules https://github.com/vyos/vyos-build/pull/832

PR https://github.com/vyos/vyos-1x/pull/4182

We use suricata only for the rolling
backport not required

@marekm, stop spamming in every message about LTS.
You know all the ways to get LTS images, including entirely free ones.
Thanks!

The vyos-vm-image is deprecated

@natali-rs1985, can we close this task if it is fixed?

@marekm It has to be solved in the upstrem, https://github.com/accel-ppp/accel-ppp
It cannot be fixed otherwise.

Just do not use bond in the flow
Use native ethernet interfaces

@syncer In my opinion, it is better to have a CLI that can process network interrupts only by the local NUMA node.
As I remember, the set system option performance xxx option overrides some sysctl options if it is not fixed.
Otherwise, we have to use customer scripts to balance interrupts on the required cores.

@syncer What I know only from XEN or XCP-NG was reported
Do no have reports from other platforms

It is not implemented
But it probably will not be implemented
The only affected service was SNMP

In T6545#204568, @ordex wrote:

Thanks for the pointer. I am even surprised that this worked with --cipher. In any case, I presume that template needs an exception.

The problem is that the template returns the none values in uppercase https://github.com/vyos/vyos-1x/blob/ba18d12f6863505133cde688d5e8188689af63bb/python/vyos/template.py#L567

In T2584#204474, @syncer wrote:

@Viacheslav do we want to do this?

PR https://github.com/vyos/vyos-build/pull/825

@SteveP could you attach those files for debugging where the issue exists?

/config/config.boot
/run/udev/log/vyos-net-name 
sudo journalctl -b | tee /tmp/journalct.log
sudo journalctl -k | tee /tmp/journalct-k.log

I’d prefer to drop it at all for now.
Until someone can investigate it more deeply.
I don’t have any idea what is wrong.
Thanks

@SteveP Can you try the latest rolling?

PR https://github.com/vyos/vyos-build/pull/823

related https://bugzilla.redhat.com/show_bug.cgi?id=2321325
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20241020124951.180350-1-pablo@netfilter.org/

The issue of breaking smoketest is not with iproute2

• Team upload
  • Revert "Drop legacy /usr/sbin/ip symlink", as many packages still depend on /sbin/ip or /usr/sbin/ip