After the fix
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Apr 1 2024
Apr 1 2024
c-po added a comment to T2590: DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c.
HollyGurza added a comment to T6178: reverse-proxy doesn't check that a certificate exists at set time.
HollyGurza changed the status of T6178: reverse-proxy doesn't check that a certificate exists at set time from Open to In progress.
Personally I dont think its a good idea to be able to use VyOS as a jumphost towards victims of scanning.
@ServerForge It is question for hsflowd
You can open the issue on their git repo
Unknown Object (User) added a comment to T6181: A feature for checking popular ports..
ok, i'll change a port list and nmap scenario
Its no longer failing to start, but it seems to be only capturing inbound traffic on the tunnel, no outbound. I'm also observing this behavior on vlan interfaces, IE bond0.10.
Mar 31 2024
Mar 31 2024
jestabro closed T6185: Simplify marshalling of section and config data for config-sync, a subtask of T6121: Extend service config-sync for sections vpn, policy, vrf, as Unknown Status.
jestabro closed T6185: Simplify marshalling of section and config data for config-sync as Unknown Status.
jestabro closed T6180: Add application of mask to configtree, a subtask of T6185: Simplify marshalling of section and config data for config-sync, as Unknown Status.
Proposed CLI:
set nat cgnat pool external <external> range 192.0.2.0/30 seq 1 set nat cgnat pool external <external> range 192.0.2.128-192.0.2.132 seq 2 set nat cgnat pool external <external> per-user-limit port 1024 set nat cgnat pool external <external> global-port-range 1024-65535 set nat cgnat pool internal <internal> range 100.64.1.0/24
c-po changed the status of T6192: Support running SSH server in more than one VRF, a subtask of T2321: VRF support for SSH, NTP, SNMP service, from Open to In progress.
c-po changed the status of T6192: Support running SSH server in more than one VRF from Open to In progress.
GitHub <noreply@github.com> committed rVYOSONEXf62827c80466: Merge pull request #3211 from jestabro/tree-mask (authored by Viacheslav).
I'm not sure that a list of ports will be helpful in this way.
From time to time, we need to scan specific ports.
What about
force scan-port-host <x.x.x.x> proto <tcp|udp> port '8080-8081,9200' force port--discovery-host <x.x.x.x> proto <tcp|udp> port '8080' force port-scan host <x.x.x.x> proto <tcp|udp> port '8080'
And use native nmap binaries (as python3 nmap module is not installed by default)
Also, it has XML format if you want a custom table:
sudo nmap -oX - 127.0.0.1
Viacheslav changed the status of T6173: Build Causes Errors When "--version" Contains Slashes ("/") from Open to In progress.
Viacheslav triaged T6173: Build Causes Errors When "--version" Contains Slashes ("/") as Normal priority.
Viacheslav triaged T6156: Include commit hash from repos in nightly build release description as Normal priority.
Viacheslav added a parent task for T6154: Installer should ask for password twice: T4516: Rewrite system image manipulation tools in Python.
Viacheslav edited projects for T6154: Installer should ask for password twice, added: VyOS 1.4 Sagitta (1.4.0-epa3), VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta (1.4.0-epa2).
Viacheslav changed the status of T6185: Simplify marshalling of section and config data for config-sync, a subtask of T6121: Extend service config-sync for sections vpn, policy, vrf, from Open to In progress.
Viacheslav changed the status of T6185: Simplify marshalling of section and config data for config-sync from Open to In progress.
Viacheslav triaged T6188: Add firewall rule description to the output of "show firewall" commands as Wishlist priority.
Viacheslav moved T5832: Allow setting the interface for excluded address in VRRP from Open to Finished on the VyOS 1.4 Sagitta board.
Viacheslav renamed T6191: Policy route set-mss option is not working correctly from Policy Route Behavior Different from 1.3.x to Policy Route TCP-MSS Behavior Different from 1.3.x.
Probably VNI is applied after BGP
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "vrf|bri|vxlan"
11 vrf.py ['vrf']
310 interfaces_bridge.py ['interfaces', 'bridge']
460 interfaces_vxlan.py ['interfaces', 'vxlan']
481 protocols_static.py ['vrf', 'name', 'protocols', 'static']
611 protocols_isis.py ['vrf', 'name', 'protocols', 'isis']
621 protocols_ospf.py ['vrf', 'name', 'protocols', 'ospf']
621 protocols_ospfv3.py ['vrf', 'name', 'protocols', 'ospfv3']
821 protocols_bgp.py ['vrf', 'name', 'protocols', 'bgp']
821 protocols_eigrp.py ['vrf', 'name', 'protocols', 'eigrp']
822 vrf_vni.py ['vrf', 'name', 'vni']
vyos@r4:~$The current priorities:
vyos@r4:~$ /usr/libexec/vyos/priority.py | match "vrf|bri|vxlan"
11 vrf.py ['vrf']
310 interfaces_bridge.py ['interfaces', 'bridge']
460 interfaces_vxlan.py ['interfaces', 'vxlan']
481 protocols_static.py ['vrf', 'name', 'protocols', 'static']
611 protocols_isis.py ['vrf', 'name', 'protocols', 'isis']
621 protocols_ospf.py ['vrf', 'name', 'protocols', 'ospf']
621 protocols_ospfv3.py ['vrf', 'name', 'protocols', 'ospfv3']
821 protocols_bgp.py ['vrf', 'name', 'protocols', 'bgp']
821 protocols_eigrp.py ['vrf', 'name', 'protocols', 'eigrp']
822 vrf_vni.py ['vrf', 'name', 'vni']
vyos@r4:~$Viacheslav edited projects for T6167: VNI not set on VRF after reboot, added: VyOS 1.4 Sagitta (1.4.0-epa3), VyOS 1.5 Circinus; removed VyOS 1.4 Sagitta.
@kevinrausch Thank you for the report, next time it is better to use set of the commands to reproduce
vyos@r4:~$ generate tech-support archive /tmp/foo
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/generate_tech-support_archive.py", line 123, in <module>
tmp_dir.mkdir()
File "/usr/lib/python3.11/pathlib.py", line 1117, in mkdir
os.mkdir(self, mode)
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/foo/drops-debug_2024-03-31T12-07-09'
vyos@r4:~$It seems hardcoded here https://github.com/vyos/vyos-1x/blob/252d03d6e419aae14ae75caed38d1b1001c916a2/src/op_mode/generate_tech-support_archive.py#L96
GitHub <noreply@github.com> committed rVYOSONEX9edf1e7c23f1: Merge pull request #3220 from vyos/mergify/bp/sagitta/pr-3218 (authored by c-po).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX92d44fb6aef6: accel-ppp: T6187: use correct CPU counts adjusted for SMT (authored by dmbaturin).
Mar 30 2024
Mar 30 2024
GitHub <noreply@github.com> committed rVYOSONEX495bf823b7c7: Merge pull request #3216 from vyos/mergify/bp/sagitta/pr-3213 (authored by c-po).
khramshinr <khramshinr@gmail.com> committed rVYOSONEX0d82dfa3725a: dhcp-server: T4718: Listen-address is not commit if the ip address is on the….
GitHub <noreply@github.com> committed rVYOSONEX252d03d6e419: Merge pull request #3195 from HollyGurza/T4718-current (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX89a6299156b8: Merge pull request #3218 from dmbaturin/half-cpus (authored by c-po).
Viacheslav edited projects for T6189: BGP L3VPN connectivity is broken after re-enabling VRF, added: VyOS 1.5 Circinus, VyOS 1.4 Sagitta (1.4.0-epa3); removed VyOS 1.4 Sagitta.
Apachez added a comment to T6188: Add firewall rule description to the output of "show firewall" commands.
I think the wrapping should be left for the output to select since you can either be in a regular serialconsole of 80x25 or some highresmode which brings more characters per line or even through SSH with a 4k monitor which will be plenty of lines.
L0crian added a comment to T6188: Add firewall rule description to the output of "show firewall" commands.
Since descriptions can be very long I assume there will be a linewrap at the end?
Apachez added a comment to T6188: Add firewall rule description to the output of "show firewall" commands.
Since descriptions can be very long I assume there will be a linewrap at the end?
GitHub <noreply@github.com> committed rVYOSONEX058eed53fd73: Merge pull request #3217 from vyos/mergify/bp/sagitta/pr-3215 (authored by dmbaturin).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEXfd3b84818f8a: image-tools: T6186: simplify image annotations fixing regression (authored by jestabro).
Mergify <37929162+mergify[bot]@users.noreply.github.com> committed rVYOSONEX210358615269: bgp: T6106: Valid commit error for route-reflector-client option defined in… (authored by khramshinr <khramshinr@gmail.com>).
khramshinr <khramshinr@gmail.com> committed rVYOSONEX84f05b1dd41b: bgp: T6106: Valid commit error for route-reflector-client option defined in….
GitHub <noreply@github.com> committed rVYOSONEXa95063831f83: Merge pull request #3213 from HollyGurza/T6106 (authored by dmbaturin).
GitHub <noreply@github.com> committed rVYOSONEX2b55d0f947e8: Merge pull request #3215 from jestabro/fix-annotation (authored by dmbaturin).
jestabro triaged T6186: 'set system image default-boot' fails to find images that actually do exist in the system as High priority.
Mar 29 2024
Mar 29 2024
line 107: available_images: list[str] = annotated_list(grub.version_list())
Should be: available_images: list[str] = grub.version_list()
haakon.nore added a comment to T6148: Reset vpn ipsec command breaks tunnel and does not reset SAs that are down.
Not sure if it is meaningful to create a new operational vyos command "initiate" or re-write the reset to be consistent with older VyOS.
Viacheslav changed the status of T6033: hsflowd fails to start when using a tunnel interface from In progress to Needs testing.
Viacheslav changed the status of T6033: hsflowd fails to start when using a tunnel interface from Open to In progress.
@ServerForge, it seems to be working with the v2.0.55-1 version. Could you build a package and re-check?
git clone -b v2.0.55-1 --single-branch https://github.com/sflow/host-sflow.git sudo apt-get install -y libpcap0.8-dev make deb FEATURES="PCAP DROPMON DBUS"
Viacheslav changed the subtype of T6033: hsflowd fails to start when using a tunnel interface from "Task" to "Bug".
Viacheslav added a project to T6033: hsflowd fails to start when using a tunnel interface: VyOS 1.5 Circinus.
Only ethernet interfaces or bridges are allowed; from their docs https://sflow.net/host-sflow-linux-config.php
PCAP Packet Sampling
It seems a broken local build; close the task.
Reopen if necessary.
Viacheslav added a comment to T6148: Reset vpn ipsec command breaks tunnel and does not reset SAs that are down.
"reset vpn ipsec " command and does not reset SAs that are dow