mickvav (Mihail Vasiliev)
User

Projects

Today

  • Clear sailing ahead.

Tomorrow

  • Clear sailing ahead.

Monday

  • Clear sailing ahead.

User Details

User Since
Mar 18 2016, 8:43 PM (66 w, 17 h)
Availability
Available

Recent Activity

Mon, May 29

mickvav added a comment to T316: Latest Nightly build (vyos-999.201705242137-amd64) is not booting.

Do you have BIOS or UEFI boot mode in your motherboard setup selected?
To all - there was some reason why I've included grub-pc in my image, but I'not sure that it will help in this case.

Mon, May 29, 5:51 PM · VyOS 1.2.x (VyOS 1.2.0 beta 3)

May 24 2017

mickvav changed Why the issue appeared? from none to design-mistake on T315: dhcp server config fixup.
May 24 2017, 1:56 PM
mickvav created T315: dhcp server config fixup.
May 24 2017, 1:55 PM

Mar 29 2017

mickvav added a comment to T160: Support NAT64.

@dsummers jool seems to be kernel-level and tayga seems to be userspace-level. The first one should be faster, and I expect package loss in the second one on high packet rate.

Mar 29 2017, 12:54 PM · VyOS 1.2.x
mickvav added a comment to T160: Support NAT64.

Well, I think I can some day do some things on adding this to CLI, if someone points me to known-working config for this feature. Am I right that this IPv4 - IPv6 NAT can not be implemented by iptables/ip6tables stuff? If netfilter already can do it - it's much better to do this things in kernel (as netflow, in my opinion).

Mar 29 2017, 12:49 PM · VyOS 1.2.x

Mar 10 2017

mickvav added a comment to T289: unable to boot from software raid .

It seems to me that it should be linked with removal of in-kernel raid autodetection in recent kernels. We should employ user-space autodetect. Those people at gentoo have something on it here: https://wiki.gentoo.org/wiki/Custom_Initramfs#Software_RAID We should do something similar.

Mar 10 2017, 9:04 AM · VyOS 1.2.x (VyOS 1.2.0 beta 3)

Mar 2 2017

mickvav added a comment to T75: NetFlow have impact on performance.

Well, I take vyos-kernel, iptables, build them in packages directory, and put ipt-netflow from here: https://github.com/mickvav/ipt-netflow-code as git submodule in the same packages directory, build it there and get working .deb package containing module, crafted for current vyos kernel. I have no CLI integration for it though I use my own firewall-messing scripts. But in general, you jest have to do modprobe the module with right parameters (where to send collected data) and add somewhere in firewall the rule with "-j NETFLOW" to trigger, which packets to take into account.

Mar 2 2017, 1:17 PM · VyOS 1.2.x, VyOS 2.0.x

Feb 23 2017

mickvav created T277: CVE-2017-6074 - linux kernel local (?) privilege escalation.
Feb 23 2017, 9:48 AM · VyOS 1.2.x (VyOS 1.2.0 beta 3), VyOS 1.1.x (1.1.8)

Feb 16 2017

mickvav added a comment to T222: Make jenkins build nightly builds again.

Great, thanks!

Feb 16 2017, 5:35 AM · VyOS 1.2.x (VyOS 1.2.0 beta 3), VyOS 2.0.x

Jan 9 2017

mickvav added a comment to T172: URGENT: Fix Quagga CVE-2016-1245.

@Alexis , I've got my build environment up and running and created .deb's for this issue. Feel free to test.

Jan 9 2017, 2:57 PM · VyOS 1.1.x (1.1.8)
mickvav added a comment to V2: Should VyOS-specific shell be the login shell in VyOS 2.0?.

For me the current defaults is fine for router-like device. But it's a good idea to have this option in user config, e.g.

Jan 9 2017, 8:03 AM · VyOS 2.0.x
mickvav added a comment to V3: Tag node syntax for VyOS 2.0.

Well, my vote is "No", because if for small configs it's OK to have just intent-expressed syntax, if you have huge one, e.g. several pages - if you omit prefix before, say, 55, you will have to guess from context, if it is a vlan or preffix list entry, or VRRP group or whatever.

Jan 9 2017, 7:54 AM · VyOS 2.0.x, VyConf

Dec 19 2016

mickvav created T222: Make jenkins build nightly builds again.
Dec 19 2016, 12:09 PM · VyOS 1.2.x (VyOS 1.2.0 beta 3), VyOS 2.0.x
mickvav added a comment to T221: Pmmact bug .

Well, I am not sure I can do this fast, as I am using different approach in flow collection - https://github.com/mickvav/ipt-netflow-code and have no idea on what do do with sflow. If you have someone else to assign this job to - do it.

Dec 19 2016, 12:04 PM · VyOS 1.1.x, VyOS 1.2.x

Nov 19 2016

mickvav added a comment to Q56: nDPI integration, what is required?.

Well, just to make things clear - nDPI is actually a userspace software, that performs DPI analisis of data flow (from pcap-ed interface in real time or from .pcap file). It's interface to netfilter goes through ndpi-netfilter package, which actually opens kernel-userspace socket to forward some packets throug nDPI in userspace. If I am right in brief, we have two important steps:

  1. Make userspace software compile and work.

I thing, this should require almost no vyos-specific coding - just original package should be compiled on vyos vuild system into .deb

  1. Make netfilter-related package integrate into vyos iptables configuration.

Here we need to create some package like vyos-ndpi-netfilter, which fetches and compiles ndpi-netfilter, handles vyos configuration templates and creates correctly working .deb with all this stuff.
vyos-ndpi-netfilter.deb should depend on ndpi.deb

Nov 19 2016, 12:00 PM · VyOS 1.1.x (1.1.8)

Nov 18 2016

mickvav added a comment to Q56: nDPI integration, what is required?.

How exactly can we help you?

Nov 18 2016, 4:58 AM · VyOS 1.1.x (1.1.8)

Nov 10 2016

mickvav added a comment to T172: URGENT: Fix Quagga CVE-2016-1245.

Sent pull request. This thing is really trivial. @Alexis, would be so kind to that resulting package is ok? My building appliance is somewhat disabled right now and I have only a tiny amount of time to do recreate it, so I will be able to test that everything is ok next week only, sorry.

Nov 10 2016, 1:38 PM · VyOS 1.1.x (1.1.8)

Nov 3 2016

mickvav added a comment to T143: Add support for Large BGP Community.

Reviewed the discussion there - I think we have to wait at least couple of weeks until it will be at least a little bit tested there...

Nov 3 2016, 2:41 PM · VyOS 1.2.x, VyOS 2.0.x

Sep 30 2016

mickvav added a comment to T63: Physical Lab.

Well, than it seems to me that the reasonable starting idea is to start with the following configuration:

  1. make tree-like control pane topology on some stupid switch, for example.
  2. make "basic" configuration for every device, where only control pane interfaces are up and running
  3. make your jenkins or some other automated tool able to upload configuration into all these devices.
  4. make full-graph cabling between existing devices with some reasonable background logic

(e.g. "port 1 of any device always goes to hp,
port 2 of any device always goes to srx240
port 3 of any device always goes to ASA
port 4 always goes to Mikrotik)

Sep 30 2016, 5:19 AM · VyOS Test Silo

Sep 29 2016

mickvav added a comment to T63: Physical Lab.

@syncer , do you have any drawing on network topology, that you are going to implement? If you do and it's not a secret, please share.

Sep 29 2016, 1:10 PM · VyOS Test Silo

Sep 26 2016

mickvav added a comment to Q56: nDPI integration, what is required?.

@elico, have a look at https://github.com/mickvav/ipt-netflow-code - it's my vyos/debian repackage for ipt-netflow - another iptables target module which I've ported (and use in production) on my own vyos repackage. If you take it's "debian/" folder, put in your repo, than we can fork it and maintain as submodule.

Sep 26 2016, 12:45 PM · VyOS 1.1.x (1.1.8)
mickvav added a comment to Q56: nDPI integration, what is required?.

Well, I think, I can try to make this thing work on VyOS, especially if the community is interested.
@elico, it seems to me to be that if you have this thing working with ubuntu you already have some debian folder which produces .deb's on dpkg-buildpackage correctly, or you mean that after just "make && make install" on running system, it installs and works?

Sep 26 2016, 10:14 AM · VyOS 1.1.x (1.1.8)

Sep 19 2016

mickvav added a comment to T160: Support NAT64.

The last one seems to be really interesting - it's a kernel module, should be fast and so on.

Sep 19 2016, 10:59 AM · VyOS 1.2.x
mickvav added a comment to Q50: Any hope for DPDK?.

It's an interesting idea, I've even tried this stuff couple of days ago, but it seems to be under heavy development, although seems to be a motion in right direction - snippets of code in documentation doesn't work, things which they demonstrate in videos are already moved in another modules and so on. So to make these things importable into vyos, they should first be made workable.
Thus, if someone needs this stuff to be integrated into vyos, he has to achive some simple goals:

Sep 19 2016, 8:15 AM · VyOS 1.2.x, VyOS 2.0.x

Sep 16 2016

mickvav added a comment to Q50: Any hope for DPDK?.

Ok, @Caesar305, than I'll ask another stupid question - why do you think that if someone will implement FULL linux bridging/routing/firewall stack with DPDK, he will get some significant profit from this decision? May be I miss something, but if all these things are already implemented in kernel, they are just already there, so DPDK seems to be extremely effective if you make it do specific things by throwing away all unneeded things, if you implement everything in userspace application instead of kernel you will benefit only on simplicity of debugging, am I right?

Sep 16 2016, 12:59 PM · VyOS 1.2.x, VyOS 2.0.x
mickvav added a comment to Q50: Any hope for DPDK?.

Well, I think this question can't be correctly answered until it is correctly stated. So I suggest waiting @Caesar305 for some clarifications. @rps 's answer implies that "support" means "ALL the routing stack works over dpdk" which seems to be really far now. But another option is the ability to run specific dpdk software on dedicated ports (e.g. traffic generator software for load testing of external equipment or high performance network sniffer) - this task seems to be achievable, if it's requested and donated for :)

Sep 16 2016, 10:40 AM · VyOS 1.2.x, VyOS 2.0.x

Sep 15 2016

mickvav updated the task description for T154: monito feature strange message.
Sep 15 2016, 9:25 AM · VyOS 1.2.x
mickvav created T154: monito feature strange message.
Sep 15 2016, 9:25 AM · VyOS 1.2.x
mickvav created T153: Deal with web gui.
Sep 15 2016, 7:50 AM · VyOS 1.2.x, VyOS Test Silo

Sep 12 2016

mickvav added a comment to Q50: Any hope for DPDK?.

Hm, I belive it should be relatively easy to make vyos "forget" about some interfaces, on which you plan to use your separate dpdk-enabled software and to just compile dpdk into main distribution. Is it enough for your needs, @Caesar305 or you need some specific application or you are talking about making all firewall stuff work over dpdk (which sounds like A VERY VERY HUGE task)?

Sep 12 2016, 9:48 AM · VyOS 1.2.x, VyOS 2.0.x
mickvav added a comment to Q52: Integrate Vyos with standalone web filtering device?.

And if you have any other known https destinations with different port numbers - redirect corresponding traffic explicitly.

Sep 12 2016, 9:41 AM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)

Sep 4 2016

mickvav created T142: DSA-3659-1.
Sep 4 2016, 6:27 PM · VyOS 1.1.x, VyOS 2.0.x

Aug 24 2016

mickvav added a comment to T91: vyosintfwatchd bug.

I can suggest trying to do fork() on before line 139 and exit this forked child later - this should keep parent daemon's memory footprint constant.

Aug 24 2016, 12:24 PM · VyOS 1.2.x

Aug 22 2016

mickvav added a comment to T132: Allow route-map to set "src".

Can you push your recent changes to github?

Aug 22 2016, 3:27 PM · VyOS 1.2.x
mickvav added a comment to T132: Allow route-map to set "src".

You need "create" section in your templates/policy/route-map/node.tag/rule/node.tag/set/src/node.def to make things survive reboots, I think.

Aug 22 2016, 2:29 PM · VyOS 1.2.x

Jul 15 2016

mickvav added a comment to T103: wrong hostnames in hosts file.

May be you can run tcpdump -nvvv port bootps on your host to catch your client's requests to make sure that clients request hostnames without prefixes?

Jul 15 2016, 1:06 PM · VyOS 1.2.x

Jun 1 2016

mickvav added a comment to T75: NetFlow have impact on performance.

Hm, as ipt-netflow is actually a firewall target, it looks like it's configuration logic should be slightly different from pmacct's one.
Looks like there should be some service level config tree, specifying module load parameters, like

Jun 1 2016, 4:26 PM · VyOS 1.2.x, VyOS 2.0.x

May 31 2016

mickvav added a comment to T75: NetFlow have impact on performance.

I had to disable dkms there
https://github.com/mickvav/ipt-netflow-code
And if anyone is interested - I also have xtables-addons compilable against vyos kernel (it has several interesting firewall features - such as geoip and ipmark) - https://github.com/mickvav/xtables-addons

May 31 2016, 4:12 PM · VyOS 1.2.x, VyOS 2.0.x
mickvav added a comment to T75: NetFlow have impact on performance.

Well, I have ipt-netflow on self-rebuilt vyos kernel, no problems with performance. But I have no vyos-related scripts for interaction with this module.

May 31 2016, 4:03 PM · VyOS 1.2.x, VyOS 2.0.x

May 30 2016

mickvav added a comment to T74: Fix VRRP in nightly development builds.

And some more, on the machine with working config:

May 30 2016, 11:52 AM · VyOS 1.1.x (1.1.8)
mickvav added a comment to T74: Fix VRRP in nightly development builds.

Ok, now works, but I've got some strange notices on "show vrrp" :

May 30 2016, 11:01 AM · VyOS 1.1.x (1.1.8)
mickvav created T74: Fix VRRP in nightly development builds.
May 30 2016, 6:30 AM · VyOS 1.1.x (1.1.8)

May 21 2016

mickvav added a comment to T69: Kill off floppy support..

Why should we remove support for obsolete features, which do not break anything?

May 21 2016, 2:35 PM · VyOS 2.0.x, VyOS 1.1.x (1.1.8)

May 18 2016

mickvav added a comment to T38: Saner BGP default configuration..

I think it leads to incompatibilities with other device's default behavior - cisco, for example, exports/imports everything, if another behavior not stated explicitly, AFAIR.

May 18 2016, 8:20 AM · VyOS 1.2.x (VyOS 1.2.0 beta 3)

May 13 2016

mickvav added a comment to T63: Physical Lab.

Would be great - with some make target for this it's possible to arrange nightly builds with these images.

May 13 2016, 11:31 AM · VyOS Test Silo

May 12 2016

mickvav added a comment to T63: Physical Lab.

Hm, looks like it has 1gbe port working, am I right?
Do you have your .img creating procedure described or scripted somewhere?

May 12 2016, 9:48 PM · VyOS Test Silo
mickvav added a comment to T63: Physical Lab.

You mean, I can order a board, take sd, put some image onto it and get working vyos on this board?

May 12 2016, 1:17 PM · VyOS Test Silo
mickvav added a comment to T63: Physical Lab.

Well, you was discussing hardware here, and I know that mikrotiks used to be bootable into debian, so I've concluded that you are planing to port vyos on mikrotik's hardware. But clearfrog is also interesting idea.

May 12 2016, 12:57 PM · VyOS Test Silo
mickvav added a comment to T63: Physical Lab.

Is there some place, where you track current work on mikrotik port? May I help it somehow?

May 12 2016, 11:36 AM · VyOS Test Silo
mickvav added a comment to T46: Add support for extended community lists..

Steel need someone with known working quagga MPLS confgiuration to test. @afics ?

May 12 2016, 8:43 AM · VyOS 1.2.x
mickvav added a comment to T46: Add support for extended community lists..

- update - i've found minor bug.
May be we need some kind of lint-ing on scripts during package build process?

May 12 2016, 8:42 AM · VyOS 1.2.x

May 10 2016

mickvav added a comment to T46: Add support for extended community lists..

Created pull request - https://github.com/vyos/vyatta-cfg-quagga/pull/9 to track changes, related to this ticket.

May 10 2016, 9:18 AM · VyOS 1.2.x
mickvav added a comment to T46: Add support for extended community lists..

@dmbaturin @syncer should we keep configuration syntax in sync with brocade?

May 10 2016, 9:05 AM · VyOS 1.2.x
mickvav added a comment to T46: Add support for extended community lists..

What is vRouter 5600?

May 10 2016, 8:58 AM · VyOS 1.2.x
mickvav added a comment to T46: Add support for extended community lists..

Well, looks like pre-alpha is here:


N.B. It's completely untested. And I can't test one as I have no working MPLS config for clean quagga.

May 10 2016, 8:57 AM · VyOS 1.2.x
mickvav updated subscribers of T46: Add support for extended community lists..

@afics I think keyword route is unnecessary in your suggested syntax - we have all options right under "set policy" tree. @syncer , @dmbaturin what will you say?

May 10 2016, 7:58 AM · VyOS 1.2.x
mickvav added a comment to T46: Add support for extended community lists..

Well, it's somewhat more complicated than expected, but possible. I'll try do it today, but not 100% sure that I'll have enough time...

May 10 2016, 7:12 AM · VyOS 1.2.x

May 9 2016

mickvav added a comment to T46: Add support for extended community lists..

I think, I can. Need two things - url to docs to check semantics and readyness to test.

May 9 2016, 10:37 PM · VyOS 1.2.x

May 5 2016

mickvav created T61: Consider idea of obtaining CII Best Practices badge.
May 5 2016, 9:49 PM

May 4 2016

mickvav added a comment to T59: Inspect action still exists in firewall and should be removed.

Did you run into some trouble with snort? Are there any discussion on this topic somewhere?

May 4 2016, 3:09 PM

Apr 28 2016

mickvav added a comment to T53: Serial console - related code needs to be adjusted from inittab to systemctl.

About systemd there is another point - if you look into systemd default setup (/lib/systemd/system/serial-getty@.service), you can find that it's default setup is rather clever - it takes advantage from agetty's ability to automatically select console baud rate. But current vyos configuration scheme insists on some fixed baud rate. So, we also have options:

  1. (simple) Remove speed option or ignore it. + allows usage of upstream systemd configuration
  2. Alter systemd configuration to use fixed speed from config.
  3. Modify speed to accept list of possible speeds, e.g.
speed "9600[,38400...]"
Apr 28 2016, 12:32 PM · VyOS 1.2.x, VyOS 2.0.x
mickvav created T53: Serial console - related code needs to be adjusted from inittab to systemctl.
Apr 28 2016, 10:49 AM · VyOS 1.2.x, VyOS 2.0.x
mickvav added projects to T52: Q26 pull request seems to be tested at least.: VyOS 2.0.x, VyOS 1.1.x, VyOS Test Silo.

Looks like this simple patch is ready for production. Backing idea - quagga has route-map to filter routes, going to be installed from ospf into kernel table, but we had no way to install it in vyos config. This patch creates 'router ospf route-map NAME' vyos configuration command, which maps into 'ip protocol ospf route-map NAME' quagga configuration mode command. The development was discussed under Q26.

Apr 28 2016, 10:03 AM · VyOS 1.1.x, VyOS 2.0.x

Apr 27 2016

mickvav added a comment to T49: Kernel NFS server support.

Well, I think that anyone, who really needs some specific feature set, nfs server, samba server, whatever, can make and maintain his own fork of vyos-build and it has (almost) no problem to build a speific iso himself.

Apr 27 2016, 6:49 AM · VyOS 2.0.x

Apr 26 2016

mickvav created T52: Q26 pull request seems to be tested at least..
Apr 26 2016, 1:48 PM · VyOS 1.1.x, VyOS 2.0.x
mickvav closed T47: Some pull requests - please, route them. as Resolved.

Looks like it's closed mostly.

Apr 26 2016, 1:45 PM · VyOS 2.0.x

Apr 19 2016

mickvav added a comment to T49: Kernel NFS server support.
In T49#766, @mickvav wrote:

I think Reukke will answer himself, but as for me - typical use-case is a small server, acting as all-in-one solution for small linux workgroup. E.g. a router, ldap-authentication server, common files storage and a web site ;). It would be hard to maintain and keep secure, but it's possible.
N.B. Persomally I need nfs client and I'll double check, whether it's enabled in my branch tomorrow...

Apr 19 2016, 8:50 PM · VyOS 2.0.x
mickvav added a comment to T49: Kernel NFS server support.

I think Reukke will answer himself, but as for me - typical use-case is a small server, acting as all-in-one solution for small linux workgroup. E.g. a router, ldap-authentication server, common files storage and a web site ;). It would be hard to maintain and keep secure, but it's possible.
N.B. Persomally I need mfs client and I'll double check, whether it's enabled in my branch tomorrow...

Apr 19 2016, 8:48 PM · VyOS 2.0.x

Apr 13 2016

mickvav closed T39: DSA-3534-1 as Invalid.
Apr 13 2016, 6:32 AM · VyOS 1.1.x

Apr 12 2016

mickvav updated the answer details for Q5: non inbox drivers for network devices in VyOS (Answer 36).
Apr 12 2016, 7:10 PM

Apr 11 2016

mickvav closed T25: No debian/control in vyos-kernel as Resolved.
Apr 11 2016, 6:22 PM · VyOS 1.1.x (1.1.8), VyOS 2.0.x
mickvav updated the task description for T47: Some pull requests - please, route them..
Apr 11 2016, 6:20 PM · VyOS 2.0.x
mickvav created T47: Some pull requests - please, route them..
Apr 11 2016, 12:21 PM · VyOS 2.0.x

Apr 5 2016

mickvav added a comment to T43: ISO build fails for squeeze based VyOS.

I am afraid that this is caused by incorrectly built .debs after this:
https://phabricator.vyos.net/T26

Apr 5 2016, 1:23 PM · VyOS 1.1.x (1.1.8)
mickvav added a comment to M2: Facebook Cover.

First one is a nightmare...

Apr 5 2016, 9:05 AM · VyOS 1.1.x

Apr 4 2016

mickvav added a comment to M2: Facebook Cover.

Just a little bit of suggestion:

Apr 4 2016, 4:04 PM · VyOS 1.1.x
mickvav added a comment to M2: Facebook Cover.

Omg... Please, no anime... :)

Apr 4 2016, 10:28 AM · VyOS 1.1.x

Apr 3 2016

mickvav updated the answer details for Q6: UI if do it, how it should look like? (Answer 28).
Apr 3 2016, 10:49 AM
mickvav added a comment to Q6: UI if do it, how it should look like? (Answer 27).
Apr 3 2016, 10:48 AM

Apr 1 2016

mickvav added a comment to T31: Add VRF support.

If this will be included, someone has to make deep testing of quagga vrf-related patchset. Looks like it's described here: http://permalink.gmane.org/gmane.network.quagga.devel/11770 but I'm not sure, whether it's included in upstream quagga or not.

Apr 1 2016, 9:01 AM · VyOS 1.2.x

Mar 31 2016

mickvav created T39: DSA-3534-1.
Mar 31 2016, 7:06 PM · VyOS 1.1.x

Mar 29 2016

syncer awarded T26: Update Quagga - CVE-2016-2342 a Mountain of Wealth token.
Mar 29 2016, 2:54 AM · VyOS 1.1.x (1.1.8), VyOS 2.0.x

Mar 28 2016

mickvav created T26: Update Quagga - CVE-2016-2342.
Mar 28 2016, 6:14 AM · VyOS 1.1.x (1.1.8), VyOS 2.0.x

Mar 26 2016

mickvav updated the answer details for Q15: SIP related functionality in VyOS (Answer 17).
Mar 26 2016, 11:46 PM
mickvav updated the answer details for Q15: SIP related functionality in VyOS (Answer 17).
Mar 26 2016, 11:42 PM
mickvav created T25: No debian/control in vyos-kernel.
Mar 26 2016, 11:29 PM · VyOS 1.1.x (1.1.8), VyOS 2.0.x
mickvav updated the answer details for Q15: SIP related functionality in VyOS (Answer 17).
Mar 26 2016, 1:34 PM

Mar 20 2016

mickvav added a comment to Q10: ARM architecture? (Answer 16).

May be find a way to separate device tree and uboot from main build system?
.iso image is also not an option for most ARMs, I think.

Mar 20 2016, 7:58 PM
mickvav added a watcher for VyOS 2.0.x: mickvav.
Mar 20 2016, 8:43 AM
mickvav updated the answer details for Q3: Basic VyConf architecture (Answer 14).
Mar 20 2016, 8:41 AM
mickvav updated the answer details for Q3: Basic VyConf architecture (Answer 14).
Mar 20 2016, 8:40 AM