Page MenuHomeVyOS Platform
Feed All Stories

Today

runar added a comment to T3096: Add a build option to disallow live CD boot.

Does this mean to to disallow installing the syslinux bootloader to the iso by default? The reason for asking is the arm builds we try to make, as syslinux is incompatible with arm, and a iso cant be generated for such a system as it tries to install syslinux when building the image.

Wed, Dec 2, 5:59 AM · VyOS 1.3 Equuleus
jack9603301 added a comment to T3096: Add a build option to disallow live CD boot.

LiveCD is usually only used for temporary testing and installation, isn't it? Will using this restriction cause the normal use of livecd to become troublesome?

Wed, Dec 2, 5:17 AM · VyOS 1.3 Equuleus
thadrumr created T3104: LLDP Traceback error.
Wed, Dec 2, 4:17 AM · VyOS 1.3 Equuleus
Asteroza added a comment to T3096: Add a build option to disallow live CD boot.

I think the intention here is by default build with no liveCD support, and use the flag to explicitly build liveCD images when needed. The justification is if an image is cloud type image, there are certain security assumptions about the live network the image is connected to (because many cloud providers provision an image via information over specific link local addresses). If you boot a physical PC with a cloud ISO, you run the risk of exposing cloud-init to the local network, which would allow trivial takeover.

Wed, Dec 2, 2:40 AM · VyOS 1.3 Equuleus

Yesterday

runar created T3103: Rewrite parts of vyos\frr.py for readability, logging and to fix mulitiline regex "bugs".
Tue, Dec 1, 11:13 PM
c-po closed T3102: Destination NAT fails to commit as Resolved.
Tue, Dec 1, 10:04 PM · VyOS 1.3 Equuleus
c-po added a comment to T3102: Destination NAT fails to commit.
table ip nat {
        chain PREROUTING {
                type nat hook prerouting priority dstnat; policy accept;
                iifname "eth1" tcp dport { 22 } counter packets 0 bytes 0 dnat to 192.168.1.4 comment "DST-NAT-100"
        }
}
Tue, Dec 1, 10:03 PM · VyOS 1.3 Equuleus
c-po added a comment to T3102: Destination NAT fails to commit.

Thank you @Dmitry, it will be in tomorrows rolling release.

Tue, Dec 1, 9:59 PM · VyOS 1.3 Equuleus
c-po changed the status of T3102: Destination NAT fails to commit from In progress to Needs testing.
Tue, Dec 1, 9:58 PM · VyOS 1.3 Equuleus
Dmitry assigned T3102: Destination NAT fails to commit to c-po.
Tue, Dec 1, 8:55 PM · VyOS 1.3 Equuleus
Dmitry changed the status of T3102: Destination NAT fails to commit from Open to In progress.

PR https://github.com/vyos/vyos-1x/pull/628

Tue, Dec 1, 8:55 PM · VyOS 1.3 Equuleus
arfbarky created T3102: Destination NAT fails to commit.
Tue, Dec 1, 8:43 PM · VyOS 1.3 Equuleus
Viacheslav changed the status of T3093: Add xml for vpn ipsec, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Open to Needs testing.
Tue, Dec 1, 5:26 PM · VyOS 1.3 Equuleus
Viacheslav changed the status of T3093: Add xml for vpn ipsec from Open to Needs testing.
Tue, Dec 1, 5:26 PM · VyOS 1.3 Equuleus
syncer renamed T3099: invalid from How to attract Zero cost Microsoft Office? to invalid.
Tue, Dec 1, 5:24 PM · Rejected
jack9603301 added a comment to T3096: Add a build option to disallow live CD boot.

I am a little confused. What is the specific function of the --allow-cd-boot compilation parameter that this task hopes to add? Forgive me for not seeming to understand!

Tue, Dec 1, 3:39 PM · VyOS 1.3 Equuleus
c-po added a subtask for T3100: Migrate DHCP server to get_config_dict(): T2562: VyOS can't be used as a DHCP server for a DHCP relay.
Tue, Dec 1, 3:07 PM · VyOS 1.3 Equuleus
c-po added a parent task for T2562: VyOS can't be used as a DHCP server for a DHCP relay: T3100: Migrate DHCP server to get_config_dict().
Tue, Dec 1, 3:07 PM · VyOS 1.3 Equuleus
c-po merged T3101: Support configuration of DHCP scopes even when there is no locally attached subnet into T2562: VyOS can't be used as a DHCP server for a DHCP relay.
Tue, Dec 1, 3:07 PM · VyOS 1.3 Equuleus
c-po merged task T3101: Support configuration of DHCP scopes even when there is no locally attached subnet into T2562: VyOS can't be used as a DHCP server for a DHCP relay.
Tue, Dec 1, 3:07 PM · VyOS 1.3 Equuleus
c-po created T3101: Support configuration of DHCP scopes even when there is no locally attached subnet.
Tue, Dec 1, 3:05 PM · VyOS 1.3 Equuleus
c-po changed the status of T3100: Migrate DHCP server to get_config_dict() from Open to In progress.
Tue, Dec 1, 3:05 PM · VyOS 1.3 Equuleus
c-po created T3100: Migrate DHCP server to get_config_dict().
Tue, Dec 1, 3:04 PM · VyOS 1.3 Equuleus
jhonmaccuine created T3099: invalid.
Tue, Dec 1, 2:40 PM · Rejected
c-po closed T3094: Can not specify multiple deny ports in FW rule as Resolved.
Tue, Dec 1, 2:29 PM · VyOS 1.2 Crux (VyOS 1.2.7), VyOS 1.3 Equuleus
c-po closed T2713: VyOS must not change permissions on files in /config/auth as Resolved.
Tue, Dec 1, 1:22 PM · VyOS 1.3 Equuleus
Viacheslav added a comment to T1316: Support for IS-IS .

Perhaps replace config (from_re "interface") delete also and route-maps/prefix-lists from FRR configuration.
https://github.com/vyos/vyos-1x/blob/current/src/conf_mode/protocols_isis.py#L121

Tue, Dec 1, 10:47 AM · VyOS 1.3 Equuleus
Opacha triaged T3098: Cannot talk to rtnetlink: Message too long Command failed -:1 as Normal priority.
Tue, Dec 1, 10:36 AM
Opacha created T3097: Cannot talk to rtnetlink: Message too long Command failed -:1.
Tue, Dec 1, 10:32 AM
Viacheslav added a comment to T2713: VyOS must not change permissions on files in /config/auth.

Before update

Tue, Dec 1, 8:28 AM · VyOS 1.3 Equuleus
dmbaturin created T3096: Add a build option to disallow live CD boot.
Tue, Dec 1, 7:48 AM · VyOS 1.3 Equuleus

Mon, Nov 30

c-po added a comment to T3094: Can not specify multiple deny ports in FW rule.

Ah, thanks for the clarification.

Mon, Nov 30, 6:29 PM · VyOS 1.2 Crux (VyOS 1.2.7), VyOS 1.3 Equuleus
Viacheslav added a comment to T3094: Can not specify multiple deny ports in FW rule.

@c-po It's mean all NOT ports. If you want to drop not 22,23,24,25

Mon, Nov 30, 6:28 PM · VyOS 1.2 Crux (VyOS 1.2.7), VyOS 1.3 Equuleus
Cheeze_It added a comment to T1316: Support for IS-IS .

This will be on my list to test here in a little bit. I'm almost done with stuff relating to LDP.

Mon, Nov 30, 5:03 PM · VyOS 1.3 Equuleus
Viacheslav closed T3091: Add "tag" for static route as Resolved.
Mon, Nov 30, 3:30 PM · VyOS 1.3 Equuleus
Dmitry closed T1207: DMVPN behind NAT as Resolved.

PR with changed types in docs https://github.com/vyos/vyos-documentation/pull/380
ESP transport mode works properly on Cisco Router and VyOS routers together.

Mon, Nov 30, 2:28 PM · VyOS 1.3 Equuleus
Viacheslav changed the status of T1316: Support for IS-IS from Open to Needs testing.
Mon, Nov 30, 11:03 AM · VyOS 1.3 Equuleus
Viacheslav added a comment to T3093: Add xml for vpn ipsec.

PR https://github.com/vyos/vyos-1x/pull/626

Mon, Nov 30, 9:03 AM · VyOS 1.3 Equuleus
Dmitry changed the status of T1207: DMVPN behind NAT from Open to In progress.

DMVPN Spokes works properly behind a NAT if we use transport mode instead of tunnel. e.g.

set vpn ipsec esp-group ESP-HUB mode transport

So I think we need to add this info to docs.vyos.io and close this Feature Request

Mon, Nov 30, 7:27 AM · VyOS 1.3 Equuleus

Sun, Nov 29

Cheeze_It added a comment to T915: MPLS Support.

Put in a new PR to enable ethernet sub interface MPLS enablement. I screwed up the first one...but here's hoping this one is good.

Sun, Nov 29, 9:17 PM · VyOS 1.3 Equuleus
c-po renamed T3095: Migrate dhcp-relay and dhcpv6-relay to get_config_dict() from Migrate dhcp-relay to get_config_dict() to Migrate dhcp-relay and dhcpv6-relay to get_config_dict().
Sun, Nov 29, 6:48 PM · VyOS 1.3 Equuleus
c-po added a comment to T2297: NTP add support for pool configuration.

See documentation https://docs.vyos.io/en/latest/system/ntp.html, support will be in next rolling release

Sun, Nov 29, 12:50 PM · VyOS 1.3 Equuleus
c-po renamed T2297: NTP add support for pool configuration from ntp configuration to NTP add support for pool configuration.
Sun, Nov 29, 12:31 PM · VyOS 1.3 Equuleus
c-po closed T3095: Migrate dhcp-relay and dhcpv6-relay to get_config_dict() as Resolved.
Sun, Nov 29, 11:31 AM · VyOS 1.3 Equuleus
c-po triaged T3095: Migrate dhcp-relay and dhcpv6-relay to get_config_dict() as Low priority.
Sun, Nov 29, 10:52 AM · VyOS 1.3 Equuleus
c-po changed the status of T3095: Migrate dhcp-relay and dhcpv6-relay to get_config_dict() from Open to In progress.
Sun, Nov 29, 10:52 AM · VyOS 1.3 Equuleus
c-po created T3095: Migrate dhcp-relay and dhcpv6-relay to get_config_dict().
Sun, Nov 29, 10:51 AM · VyOS 1.3 Equuleus
c-po added a project to T3094: Can not specify multiple deny ports in FW rule: VyOS 1.2 Crux (VyOS 1.2.7).
Sun, Nov 29, 9:56 AM · VyOS 1.2 Crux (VyOS 1.2.7), VyOS 1.3 Equuleus
c-po created T3094: Can not specify multiple deny ports in FW rule.
Sun, Nov 29, 9:56 AM · VyOS 1.2 Crux (VyOS 1.2.7), VyOS 1.3 Equuleus
Viacheslav claimed T3093: Add xml for vpn ipsec.
Sun, Nov 29, 9:30 AM · VyOS 1.3 Equuleus
Viacheslav created T3093: Add xml for vpn ipsec.
Sun, Nov 29, 9:30 AM · VyOS 1.3 Equuleus
c-po added a comment to T2947: Nat translation many-many with prefix does not map 1-1..

Even on Kernel 5.4 this is not supported.

Sun, Nov 29, 7:32 AM · VyOS 1.3 Equuleus

Sat, Nov 28

c-po closed T3092: nat: migrate to get_config_dict() as Resolved.
Sat, Nov 28, 8:56 PM · VyOS 1.3 Equuleus
c-po added a comment to T2947: Nat translation many-many with prefix does not map 1-1..

The command works on the experimental Kernel 5.9.9 VyOS ISO, but not using a 4.19 series Kernel. looks like it's not yet supported in nftables.

Sat, Nov 28, 8:55 PM · VyOS 1.3 Equuleus
c-po added a comment to T2947: Nat translation many-many with prefix does not map 1-1..

We actually need this:
http://git.nftables.org/nftables/commit/?id=35a6b10c1bc488ca195e9c641563c29251f725f3

Sat, Nov 28, 8:07 PM · VyOS 1.3 Equuleus
c-po changed the status of T3092: nat: migrate to get_config_dict() from Open to In progress.
Sat, Nov 28, 7:03 PM · VyOS 1.3 Equuleus
c-po added a subtask for T3092: nat: migrate to get_config_dict(): T2947: Nat translation many-many with prefix does not map 1-1..
Sat, Nov 28, 7:03 PM · VyOS 1.3 Equuleus
c-po added a parent task for T2947: Nat translation many-many with prefix does not map 1-1.: T3092: nat: migrate to get_config_dict().
Sat, Nov 28, 7:03 PM · VyOS 1.3 Equuleus
c-po created T3092: nat: migrate to get_config_dict().
Sat, Nov 28, 7:03 PM · VyOS 1.3 Equuleus
Viacheslav changed the status of T3091: Add "tag" for static route from Open to Needs testing.
Sat, Nov 28, 4:41 PM · VyOS 1.3 Equuleus
Viacheslav closed T2890: NAT error adding translation address range as Resolved.

Fixed.

Sat, Nov 28, 4:39 PM · VyOS 1.3 Equuleus
Viacheslav closed T2539: Issues with parsing ip range for source nat translation address as Resolved.

Fixed

set nat source rule 1000 outbound-interface 'eth1'
set nat source rule 1000 source address '203.0.113.1-203.0.113.4'
set nat source rule 1000 translation address '10.0.0.1-10.0.0.4'
vyos@r5# commit
[ nat ]
Warning: IP address 10.0.0.1 does not exist on the system!
Warning: IP address 10.0.0.4 does not exist on the system!
Sat, Nov 28, 4:37 PM · VyConf
Viacheslav changed the status of T3020: The "scp" example is wrong in the bash-completion for "set system config-management commit-archive location" from In progress to Needs testing.
Sat, Nov 28, 4:20 PM · VyOS 1.3 Equuleus
Viacheslav added a comment to T3091: Add "tag" for static route.

PR https://github.com/vyos/vyatta-cfg-quagga/pull/57

Sat, Nov 28, 4:16 PM · VyOS 1.3 Equuleus
Viacheslav updated the task description for T3091: Add "tag" for static route.
Sat, Nov 28, 4:03 PM · VyOS 1.3 Equuleus
Viacheslav updated the task description for T3091: Add "tag" for static route.
Sat, Nov 28, 3:07 PM · VyOS 1.3 Equuleus
Viacheslav created T3091: Add "tag" for static route.
Sat, Nov 28, 2:37 PM · VyOS 1.3 Equuleus
c-po claimed T2947: Nat translation many-many with prefix does not map 1-1..
Sat, Nov 28, 2:28 PM · VyOS 1.3 Equuleus
Viacheslav created T3090: Move 'adjust-mss' firewall options to the interface section..
Sat, Nov 28, 2:16 PM · VyOS 1.3 Equuleus
Viacheslav closed T2868: Tcp-mss option in policy calls kernel-panic as Resolved.
Sat, Nov 28, 1:14 PM · VyOS 1.3 Equuleus
Viacheslav added a comment to T2713: VyOS must not change permissions on files in /config/auth.

@jjakob can you check the latest rolling?

Sat, Nov 28, 10:41 AM · VyOS 1.3 Equuleus
jack9603301 updated the task description for T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring.
Sat, Nov 28, 10:36 AM · VyOS 1.3 Equuleus
jack9603301 updated the task description for T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring.
Sat, Nov 28, 10:32 AM · VyOS 1.3 Equuleus
jack9603301 added a comment to T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring.

https://github.com/vyos/vyatta-cfg-qos/pull/8
https://github.com/vyos/vyos-1x/pull/621

Sat, Nov 28, 9:57 AM · VyOS 1.3 Equuleus
jack9603301 updated the task description for T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring.
Sat, Nov 28, 8:23 AM · VyOS 1.3 Equuleus
jack9603301 updated the task description for T3030: Support ERSPAN Tunnel Protocol.
Sat, Nov 28, 8:23 AM · VyOS 1.3 Equuleus
jack9603301 renamed T3030: Support ERSPAN Tunnel Protocol from Support ERSPAN port mirroring to Support ERSPAN Tunnel Protocol.
Sat, Nov 28, 8:22 AM · VyOS 1.3 Equuleus
jack9603301 changed the subtype of T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring from "Task" to "Feature Request".
Sat, Nov 28, 4:38 AM · VyOS 1.3 Equuleus

Fri, Nov 27

c-po changed the status of T2947: Nat translation many-many with prefix does not map 1-1. from Open to Confirmed.
Fri, Nov 27, 9:31 PM · VyOS 1.3 Equuleus
c-po added a comment to T2947: Nat translation many-many with prefix does not map 1-1..

The root cause here is that there is yet no nftables map support in our template.

Fri, Nov 27, 9:30 PM · VyOS 1.3 Equuleus
ossicoinc added a comment to T2947: Nat translation many-many with prefix does not map 1-1..

This one is holding us back from some great 1.3 features... would love to get it looked at!

Fri, Nov 27, 7:27 PM · VyOS 1.3 Equuleus
jack9603301 closed T2714: A collection of utilities supporting IPv6 or ipv4 as Resolved.
Fri, Nov 27, 3:29 PM · VyOS 1.3 Equuleus
jack9603301 closed T2714: A collection of utilities supporting IPv6 or ipv4, a subtask of T2706: Support NDP protocol monitoring, as Resolved.
Fri, Nov 27, 3:29 PM · VyOS 1.3 Equuleus
jack9603301 closed T2715: Duplicate address detection option supporting ARP, a subtask of T2714: A collection of utilities supporting IPv6 or ipv4, as Resolved.
Fri, Nov 27, 3:29 PM · VyOS 1.3 Equuleus
jack9603301 closed T2715: Duplicate address detection option supporting ARP as Resolved.
Fri, Nov 27, 3:29 PM · VyOS 1.3 Equuleus
Viacheslav added a comment to T2713: VyOS must not change permissions on files in /config/auth.

PR https://github.com/vyos/vyatta-cfg-system/pull/132

Fri, Nov 27, 3:00 PM · VyOS 1.3 Equuleus
c-po added a comment to T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring.

+1

Fri, Nov 27, 2:48 PM · VyOS 1.3 Equuleus
Viacheslav changed the status of T2868: Tcp-mss option in policy calls kernel-panic from Open to Needs testing.
Fri, Nov 27, 1:56 PM · VyOS 1.3 Equuleus
Viacheslav added a comment to T2868: Tcp-mss option in policy calls kernel-panic.

PR https://github.com/vyos/vyatta-cfg-firewall/pull/19

Fri, Nov 27, 1:19 PM · VyOS 1.3 Equuleus
runar updated subscribers of T2744: igmp-proxy issue: Address already in use.

@Dmitry I dont really know if this is a good idea.
The reason for this is that the configuration synchronisation between frr daemons depends on the daemons started at the same time, and always running when global configuration is applied.. this is also one of the reasons why frr-daemons starts prior to vyos starting on bootup and not when a daemon is configured. I do not know if this will be a issue with PIM, so i'm not sure what will happen with this daemon.
as an example for such synctonization is a prefix-list.
If you start bgp and ospf and then create a prefix-list, the list will be created in both ospf and bgp.
If you start bgp , then create the prefix-list and then start ospf, ospf will not automatically add the prefix-list but when you show the combined configuration is is still show'ed as a global prefix-list.. to get the prefix-list into ospf you need to manually add the commands to the daemon to get in sync.

Fri, Nov 27, 1:18 PM · VyOS 1.3 Equuleus
jack9603301 moved T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring from Need Triage to In Progress on the VyOS 1.3 Equuleus board.
Fri, Nov 27, 10:32 AM · VyOS 1.3 Equuleus
jack9603301 changed the status of T3089: Migrate port mirroring to vyos-1x and support two-way traffic mirroring from Open to In progress.
Fri, Nov 27, 10:32 AM · VyOS 1.3 Equuleus
c-po closed T3088: Migrate IGMP-Proxy over to get_config_dict() and add smoketests as Resolved.
Fri, Nov 27, 10:04 AM · VyOS 1.3 Equuleus
c-po changed the status of T3088: Migrate IGMP-Proxy over to get_config_dict() and add smoketests from Open to In progress.
Fri, Nov 27, 9:51 AM · VyOS 1.3 Equuleus
c-po created T3088: Migrate IGMP-Proxy over to get_config_dict() and add smoketests.
Fri, Nov 27, 9:51 AM · VyOS 1.3 Equuleus
Viacheslav added a comment to T2713: VyOS must not change permissions on files in /config/auth.

This probably happens at this stage.
https://github.com/vyos/vyatta-cfg-system/blob/current/scripts/install/install-image-existing#L217-L224

Fri, Nov 27, 9:09 AM · VyOS 1.3 Equuleus
Viacheslav added a comment to T2868: Tcp-mss option in policy calls kernel-panic.

It seems a wrong logic.
We want that option to have an effect on "local" and "forward" directions, so we use table mangle and "PREROUTING" and VYATTA_FW_IN_HOOK hook
Generated rules

Fri, Nov 27, 7:58 AM · VyOS 1.3 Equuleus
Dmitry claimed T1207: DMVPN behind NAT.

Following this issue request https://sourceforge.net/p/opennhrp/support-requests/3/ we need to use transport mode instead of a tunnel. Was tested on AWS node and it looks working even with selector remote_ts = dynamic[gre]

Fri, Nov 27, 7:51 AM · VyOS 1.3 Equuleus
debiansid added a comment to T2884: Upstream Kernel Patches from Semper Victus Linux Hardened Tree.

it stop at

Fri, Nov 27, 1:28 AM · VyOS 1.3 Equuleus

Thu, Nov 26

Viacheslav added a comment to T2868: Tcp-mss option in policy calls kernel-panic.

T490

Thu, Nov 26, 6:11 PM · VyOS 1.3 Equuleus