- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Mar 20 2023
Mar 20 2023
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
GitHub <[email protected]> committed rVYOSONEX71cea18861d0: Merge pull request #1896 from jestabro/raw-list-openvpn (authored by dmbaturin).
Viacheslav updated the task description for T5099: IPoE server add option 'next-pool' for named ip pools.
I have certain doubts about it.
Netfilter documentation is not always perfect, and many times you may find out some different options.
Viacheslav renamed T5099: IPoE server add option 'next-pool' for named ip pools from IPoE server add option 'next-pool' to IPoE server add option 'next-pool' for named ip pools.
diodep added a comment to T5049: Configure GRE over IPsec tunnel when source port is in VRF, OSPF causes GRE tunnel broken..
Workaround: put these lines to /config/scripts/vyos-postconfig-bootup.script
Mar 19 2023
Mar 19 2023
@n.fort
My judgement may have been too hasty. The commands are accepted by VyOS configure, but it looks like the meta pkttype host is being ignored by my new nftables rules. That is, all IP addresses are matching, not just actual VyOS host router IP addresses.
a.apostoliuk changed the status of T4925: Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2 from In progress to Needs testing.
Mar 17 2023
Mar 17 2023
GitHub <[email protected]> committed rVYOSONEXc820be57b6c7: Merge pull request #1898 from sever-sever/T5086-def (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX92c3ce9fbc26: Merge pull request #1897 from sever-sever/T5086 (authored by c-po).
Viacheslav closed T5092: IPoE-server named pool must not rely on the authentication type as Resolved.
As DROP_MONITOR merged we can extend configuration to
set system sflow drop-monitor-limit 50
hsflowd.conf
dropmon { limit=50 start=on sw=on hw=off }Viacheslav renamed T5091: IPoE server with RADIUS authentication does not verify radius configuration from IPoE server with RADIUS authentication does not check radius configuration to IPoE server with RADIUS authentication does not verify radius configuration.
Viacheslav changed the status of T5092: IPoE-server named pool must not rely on the authentication type from In progress to Needs testing.
Viacheslav changed the status of T5086: Integrate hsflowd for sflow accounting from In progress to Needs testing.
Mar 16 2023
Mar 16 2023
GitHub <[email protected]> committed rVYOSONEXda42b37983e7: Merge pull request #1895 from sever-sever/T5091 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEXfa174bf8e42b: Merge pull request #1893 from sever-sever/T5092 (authored by c-po).
GitHub <[email protected]> committed rVYOSONEX5619dd6fd7b3: Merge pull request #1891 from sever-sever/T5086 (authored by c-po).
jestabro triaged T5095: Return list instead of dict for 'raw' output of op-mode openvpn as Normal priority.
Viacheslav moved T5063: IPoE-server ethX vlan must not be used with client-subnet from Open to Finished on the VyOS 1.4 Sagitta board.
GitHub <[email protected]> committed rVYOSONEX5dcaa00e5f78: Merge pull request #1887 from sever-sever/T2516-eq (authored by dmbaturin).
GitHub <[email protected]> committed rVYOSONEXfda93b223239: Merge pull request #1885 from sever-sever/T5058-eq (authored by dmbaturin).
Viacheslav moved T3083: Add feature event-handler from Backlog to Finished on the VyOS 1.4 Sagitta board.
Viacheslav changed the status of T5091: IPoE server with RADIUS authentication does not verify radius configuration from Open to In progress.
GitHub <[email protected]> committed rVYOSONEX34cab2599c5b: Merge pull request #1892 from sever-sever/T3083-eq (authored by dmbaturin).
Viacheslav renamed T5091: IPoE server with RADIUS authentication does not verify radius configuration from IPoE server with RARIUS authentication does not check radius configuration to IPoE server with RADIUS authentication does not check radius configuration.
[Service]
LimitNOFILE=4096
LimitNOFILESoft=4096
ExecStartPre=/bin/bash -c 'mkdir -p /run/frr/config; \
echo "log syslog" > /run/frr/config/frr.conf; \ echo "log facility local7" >> /run/frr/config/frr.conf; \ chown frr:frr /run/frr/config/frr.conf; \ chmod 664 /run/frr/config/frr.conf; \ mount --bind /run/frr/config/frr.conf /etc/frr/frr.conf'
[edit]
vyos@r14#
Viacheslav added a comment to T5092: IPoE-server named pool must not rely on the authentication type.
Viacheslav changed the status of T5092: IPoE-server named pool must not rely on the authentication type from Open to In progress.
diodep added a comment to T5049: Configure GRE over IPsec tunnel when source port is in VRF, OSPF causes GRE tunnel broken..
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: authentication of 'domain1' with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> peer supports MOBIKE
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: peer supports MOBIKE
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> authentication of 'domain2' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: authentication of 'domain2' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> IKE_SA JXNCCT[2] established between <pubIP2>[domain2]...<pubIP1>[domain1]
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: IKE_SA JXNCCT[2] established between <pubIP2>[domain2]...<pubIP1>[domain1]
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> scheduling rekeying in 28200s
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: scheduling rekeying in 28200s
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> maximum IKE_SA lifetime 31080s
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: maximum IKE_SA lifetime 31080s
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[CFG] <JXNCCT|2> selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[KNL] <JXNCCT|2> received netlink error: Invalid argument (22)
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: received netlink error: Invalid argument (22)
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[KNL] <JXNCCT|2> unable to install source route for 192.168.127.32
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: unable to install source route for 192.168.127.32
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[IKE] <JXNCCT|2> CHILD_SA JXNCCT-tunnel-1{2} established with SPIs c4ba20f9_i c3ba4340_o and TS 192.168.127.32/32 === 192.168.63.32/32
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: CHILD_SA JXNCCT-tunnel-1{2} established with SPIs c4ba20f9_i c3ba4340_o and TS 192.168.127.32/32 === 192.168.63.32/32
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[ENC] <JXNCCT|2> generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Mar 16 12:47:29 bsp-asbr2-cm charon[45036]: 14[NET] <JXNCCT|2> sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (476 bytes)
Mar 16 12:47:29 bsp-asbr2-cm charon-systemd[45036]: sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (476 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[NET] <JXNCCT|2> received packet: from <pubIP1>[4500] to <pubIP2>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: received packet: from <pubIP1>[4500] to <pubIP2>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[ENC] <JXNCCT|2> parsed INFORMATIONAL request 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: parsed INFORMATIONAL request 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[ENC] <JXNCCT|2> generating INFORMATIONAL response 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: generating INFORMATIONAL response 2 [ ]
Mar 16 12:47:59 bsp-asbr2-cm charon[45036]: 06[NET] <JXNCCT|2> sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (76 bytes)
Mar 16 12:47:59 bsp-asbr2-cm charon-systemd[45036]: sending packet: from <pubIP2>[4500] to <pubIP1>[4500] (76 bytes)Mar 15 2023
Mar 15 2023
Agreed. I just posted my workaround as a minimal fix to highlight the issue: accessing $? after another command was ran (which can be easy to miss).
I want to mention, the reason I wrote out the $? is because it can be confusing and fragile, as this issue demonstrates in the first place.
I noticed this as well. The issue is expecting $? to refer to the exit code of minisign -V when it's actually referring to the exit code of the if [ -f ${filename}.asc ]; block which will always be 0.
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1892
n.fort changed the status of T5090: Add support for disk encryption during installation from Open to Confirmed.
@marc_s thanks, it makes sense.
Viacheslav moved T2516: vyos-container: cannot configure ethernet interface from Open to Finished on the VyOS 1.4 Sagitta board.
@Viacheslav Confirmed, that is the culprit.
To be precise: I deleted ipsec-dhclient-hook and renamed 98-vyatta-dhclient-hook back to vyatta-dhclient-hook. Then I ran a renew dhcp interface eth0 and I got a correct .lease file.
Even when the IPSec script is fixed, it might be wise to prepend all scripts in /etc/dhcp/dhclient-exit-hooks.d with a number to enforce script order execution, just like in /etc/dhcp/dhclient-enter-hooks.d.
@n.fort I was too impatient to wait for a rolling build so I ran my own build of current post-merge.
Mar 14 2023
Mar 14 2023
GitHub <[email protected]> committed rVYOSONEX7f0eb0b029c9: Merge pull request #1890 from nicolas-fort/T5055 (authored by Viacheslav).
PR for vyos1x-config:
https://github.com/vyos/vyos1x-config/pull/15
Viacheslav changed the status of T5086: Integrate hsflowd for sflow accounting from Open to In progress.
jestabro added a parent task for T5089: Add unit test of config_diff: T5087: Add support for lexical ordering of nodes in config_tree.
I'll work on it on the next days.
I'll keep you posted!
jestabro renamed T5088: Add lexicographical-numeric compare function for vytree/configtree from Add lexicographical-numerical compare function for vytree/configtree to Add lexicographical-numeric compare function for vytree/configtree.
jestabro added a comment to T5088: Add lexicographical-numeric compare function for vytree/configtree.
jestabro updated the task description for T5088: Add lexicographical-numeric compare function for vytree/configtree.
jestabro renamed T5088: Add lexicographical-numeric compare function for vytree/configtree from Add lexicographic-numerical compare function for vytree/configtree to Add lexicographical-numerical compare function for vytree/configtree.
jestabro triaged T5088: Add lexicographical-numeric compare function for vytree/configtree as Normal priority.
jestabro triaged T5087: Add support for lexical ordering of nodes in config_tree as Normal priority.
Viacheslav changed the status of T5085: ospfv3 route-map not applied in FRR configuration from In progress to Needs testing.