All 3 original issues are still present on 1.4-rolling-202303170317.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Mar 21 2023
Mar 21 2023
Looks good on 1.4-rolling-202303170317:
c-po changed the status of T5102: ospf: "redistribute babel" is always set, a subtask of T4977: Babel routing protocol support, from Open to In progress.
c-po changed the status of T5102: ospf: "redistribute babel" is always set from Open to In progress.
Viacheslav changed the status of T5099: IPoE server add option 'next-pool' for named ip pools from Open to In progress.
PR https://github.com/vyos/vyos-1x/pull/1901
set service ipoe-server authentication mode 'noauth' set service ipoe-server client-ip-pool name first-pool gateway-address '192.0.2.1' set service ipoe-server client-ip-pool name first-pool next-pool 'second-pool' set service ipoe-server client-ip-pool name first-pool subnet '192.0.2.0/25' set service ipoe-server client-ip-pool name second-pool gateway-address '203.0.113.1' set service ipoe-server client-ip-pool name second-pool next-pool 'third-pool' set service ipoe-server client-ip-pool name second-pool subnet '203.0.113.0/25' set service ipoe-server client-ip-pool name third-pool gateway-address '198.51.100.1' set service ipoe-server client-ip-pool name third-pool subnet '198.51.100.0/24' set service ipoe-server interface eth1
Viacheslav changed the status of T5050: Firewall - Add options for logging packets from In progress to Needs testing.
Viacheslav edited projects for T5098: PPPoE client holdoff configuration, added: VyOS 1.3 Equuleus (1.3.3); removed VyOS 1.3 Equuleus (1.3.4).
Viacheslav moved T5098: PPPoE client holdoff configuration from Need Triage to Backport Candidates on the VyOS 1.4 Sagitta board.
Mar 20 2023
Mar 20 2023
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
I have certain doubts about it.
Netfilter documentation is not always perfect, and many times you may find out some different options.
Viacheslav renamed T5099: IPoE server add option 'next-pool' for named ip pools from IPoE server add option 'next-pool' to IPoE server add option 'next-pool' for named ip pools.
diodep added a comment to T5049: Configure GRE over IPsec tunnel when source port is in VRF, OSPF causes GRE tunnel broken..
Workaround: put these lines to /config/scripts/vyos-postconfig-bootup.script
Mar 19 2023
Mar 19 2023
@n.fort
My judgement may have been too hasty. The commands are accepted by VyOS configure, but it looks like the meta pkttype host is being ignored by my new nftables rules. That is, all IP addresses are matching, not just actual VyOS host router IP addresses.
a.apostoliuk changed the status of T4925: Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2 from In progress to Needs testing.
Mar 17 2023
Mar 17 2023
Viacheslav closed T5092: IPoE-server named pool must not rely on the authentication type as Resolved.
As DROP_MONITOR merged we can extend configuration to
set system sflow drop-monitor-limit 50
hsflowd.conf
dropmon { limit=50 start=on sw=on hw=off }Viacheslav renamed T5091: IPoE server with RADIUS authentication does not verify radius configuration from IPoE server with RADIUS authentication does not check radius configuration to IPoE server with RADIUS authentication does not verify radius configuration.
Viacheslav changed the status of T5092: IPoE-server named pool must not rely on the authentication type from In progress to Needs testing.
Viacheslav changed the status of T5086: Integrate hsflowd for sflow accounting from In progress to Needs testing.
Mar 16 2023
Mar 16 2023
jestabro triaged T5095: Return list instead of dict for 'raw' output of op-mode openvpn as Normal priority.
Viacheslav moved T5063: IPoE-server ethX vlan must not be used with client-subnet from Need Triage to Finished on the VyOS 1.4 Sagitta board.
Viacheslav moved T3083: Add feature event-handler from Backlog to Finished on the VyOS 1.4 Sagitta board.
Viacheslav changed the status of T5091: IPoE server with RADIUS authentication does not verify radius configuration from Open to In progress.
Viacheslav renamed T5091: IPoE server with RADIUS authentication does not verify radius configuration from IPoE server with RARIUS authentication does not check radius configuration to IPoE server with RADIUS authentication does not check radius configuration.
[Service]
LimitNOFILE=4096
LimitNOFILESoft=4096
ExecStartPre=/bin/bash -c 'mkdir -p /run/frr/config; \
echo "log syslog" > /run/frr/config/frr.conf; \ echo "log facility local7" >> /run/frr/config/frr.conf; \ chown frr:frr /run/frr/config/frr.conf; \ chmod 664 /run/frr/config/frr.conf; \ mount --bind /run/frr/config/frr.conf /etc/frr/frr.conf'
[edit]
vyos@r14#
Viacheslav added a comment to T5092: IPoE-server named pool must not rely on the authentication type.
Viacheslav changed the status of T5092: IPoE-server named pool must not rely on the authentication type from Open to In progress.
diodep added a comment to T5049: Configure GRE over IPsec tunnel when source port is in VRF, OSPF causes GRE tunnel broken..
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: authentication of 'domain1' with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> peer supports MOBIKE
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: peer supports MOBIKE
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> authentication of 'domain2' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: authentication of 'domain2' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> IKE_SA JXNCCT[2] established between <pubIP2>[domain2]...<pubIP1>[domain1]
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: IKE_SA JXNCCT[2] established between <pubIP2>[domain2]...<pubIP1>[domain1]
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> scheduling rekeying in 28200s
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: scheduling rekeying in 28200s
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> maximum IKE_SA lifetime 31080s
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: maximum IKE_SA lifetime 31080s
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[CFG] <JXNCCT|2> selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[KNL] <JXNCCT|2> received netlink error: Invalid argument (22)
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: received netlink error: Invalid argument (22)
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[KNL] <JXNCCT|2> unable to install source route for 192.168.127.32
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: unable to install source route for 192.168.127.32
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> CHILD_SA JXNCCT-tunnel-1{2} established with SPIs c4ba20f9_i c3ba4340_o and TS 192.168.127.32/32 === 192.168.63.32/32
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: CHILD_SA JXNCCT-tunnel-1{2} established with SPIs c4ba20f9_i c3ba4340_o and TS 192.168.127.32/32 === 192.168.63.32/32
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[ENC] <JXNCCT|2> generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[NET] <JXNCCT|2> sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (476 bytes)
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (476 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[NET] <JXNCCT|2> received packet: from <pubIP1>[4500] to <pubIP2>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: received packet: from <pubIP1>[4500] to <pubIP2>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[ENC] <JXNCCT|2> parsed INFORMATIONAL request 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: parsed INFORMATIONAL request 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[ENC] <JXNCCT|2> generating INFORMATIONAL response 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: generating INFORMATIONAL response 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[NET] <JXNCCT|2> sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (76 bytes)Mar 15 2023
Mar 15 2023
Agreed. I just posted my workaround as a minimal fix to highlight the issue: accessing $? after another command was ran (which can be easy to miss).
I want to mention, the reason I wrote out the $? is because it can be confusing and fragile, as this issue demonstrates in the first place.
I noticed this as well. The issue is expecting $? to refer to the exit code of minisign -V when it's actually referring to the exit code of the if [ -f ${filename}.asc ]; block which will always be 0.
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1892
n.fort changed the status of T5090: Add support for disk encryption during installation from Open to Confirmed.
@marc_s thanks, it makes sense.
Viacheslav moved T2516: vyos-container: cannot configure ethernet interface from Need Triage to Finished on the VyOS 1.4 Sagitta board.
@Viacheslav Confirmed, that is the culprit.
To be precise: I deleted ipsec-dhclient-hook and renamed 98-vyatta-dhclient-hook back to vyatta-dhclient-hook. Then I ran a renew dhcp interface eth0 and I got a correct .lease file.
Even when the IPSec script is fixed, it might be wise to prepend all scripts in /etc/dhcp/dhclient-exit-hooks.d with a number to enforce script order execution, just like in /etc/dhcp/dhclient-enter-hooks.d.
@n.fort I was too impatient to wait for a rolling build so I ran my own build of current post-merge.
Mar 14 2023
Mar 14 2023
PR for vyos1x-config:
https://github.com/vyos/vyos1x-config/pull/15
Viacheslav changed the status of T5086: Integrate hsflowd for sflow accounting from Open to In progress.
jestabro added a parent task for T5089: Add unit test of config_diff: T5087: Add support for lexical ordering of nodes in config_tree.
I'll work on it on the next days.
I'll keep you posted!
jestabro renamed T5088: Add lexicographical-numeric compare function for vytree/configtree from Add lexicographical-numerical compare function for vytree/configtree to Add lexicographical-numeric compare function for vytree/configtree.
jestabro added a comment to T5088: Add lexicographical-numeric compare function for vytree/configtree.
jestabro updated the task description for T5088: Add lexicographical-numeric compare function for vytree/configtree.
jestabro renamed T5088: Add lexicographical-numeric compare function for vytree/configtree from Add lexicographic-numerical compare function for vytree/configtree to Add lexicographical-numerical compare function for vytree/configtree.
jestabro triaged T5088: Add lexicographical-numeric compare function for vytree/configtree as Normal priority.
jestabro triaged T5087: Add support for lexical ordering of nodes in config_tree as Normal priority.
Viacheslav changed the status of T5085: ospfv3 route-map not applied in FRR configuration from In progress to Needs testing.
Will be fixed in the next rolling release
In pcap mode when sampling is set to value larger then 1 hsflowd uses kernel based sampling available on kernels starting from 3.16
I think NFLOG and TCP can be dropped for sure.
Jenkins job looks simple
git clone https://github.com/sflow/host-sflow make deb FEATURES="NFLOG PCAP TCP DBUS SYSTEMD"
pavel_odintsov added a comment to T3721: ARM64: 1.4: Fastnetmon in current is a precompiled custom "blob" and amd64 only. (blocks all arm64 builds).
Hello! We have plans to add official ARM64 builds in near future.
PR https://github.com/vyos/vyos-1x/pull/1888
set policy route-map RMAP6 rule 10 action 'deny' set policy route-map RMAP6 rule 10 match ip address prefix-len '0' set protocols ospfv3 route-map 'RMAP6'
Viacheslav changed the status of T5085: ospfv3 route-map not applied in FRR configuration from Open to In progress.