Resolved by: https://vyos.dev/T5564
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Sep 11 2023
Sep 11 2023
This can be put to resolved when the backports are confirmed aswell.
Viacheslav moved T5564: Both show firewall group and show firewall summary fails from Open to Backport Candidates on the VyOS 1.5 Circinus board.
Viacheslav added a project to T5564: Both show firewall group and show firewall summary fails: VyOS 1.4 Sagitta.
Im a bit allergic to have stuff automatically created which clearly is not enabled by the config.
pim6reg is created by FFR's pim6d. It seems to me that it will create such as interface for each VRF. Does this interface have any functional impact on your setup?
c-po moved T3424: PPPoE IA-PD doesn't work in VRF from Backport Candidates to Finished on the VyOS 1.4 Sagitta board.
Sep 10 2023
Sep 10 2023
sarthurdev changed the status of T5568: Install image from live ISO always defaults boot to KVM entry from In progress to Needs testing.
sarthurdev changed the status of T5568: Install image from live ISO always defaults boot to KVM entry from Open to In progress.
PR https://github.com/vyos/vyos-1x/pull/2240
set protocols static proxy-arp 192.0.2.1 interface eth0 set protocols static proxy-arp 192.0.2.1 interface eth1 set protocols static proxy-ndp 2001:db8::1 interface eth1
I dont know if its related to this task but I noticed recently that even if I have no IPv6 configured on any interface and have IPv6 disabled for forwarding:
set system ipv6 disable-forwarding
I can in VyOS 1.5-rolling-202309080021 see an additional pim6reg interface!?
vyos@vyos:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq master MGMT state UP group default qlen 1000
...
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq master INTERNET state UP group default qlen 1000
...
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq master INTERNET state UP group default qlen 1000
...
5: eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq master INTERNET state UP group default qlen 1000
...
6: pim6reg@NONE: <NOARP,UP,LOWER_UP> mtu 1452 qdisc noqueue state UNKNOWN group default qlen 1000
link/pimreg
7: INTERNET: <NOARP,MASTER,UP,LOWER_UP> mtu 65575 qdisc noqueue state UP group default qlen 1000
...
8: MGMT: <NOARP,MASTER,UP,LOWER_UP> mtu 65575 qdisc noqueue state UP group default qlen 1000
...Its also visible when running:
monitor bandwidth interface *
table ip raw {
ct helper rpc_tcp {
type "rpc" protocol tcp
l3proto ip
}Oh sorry, I missed that this commit was for LTS 1.3.x series.
@Apachez I am running kernel 6.1.49-amd64-vyos and this works fine with my local setup.
The patch is already in linux kernel since at least 4.3 (you can confirm with https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/include/net/netfilter/nf_conntrack_zones.h?h=linux-4.3.y), but it was added to nft command only since Feb 2017: https://git.netfilter.org/nftables/commit/src/ct.c?id=ed66d9966294a3bab6c8611e369861ba57374743
Can we see the output of sudo nft list table ip raw on an affected router?
@vfreex the referenced netfilter patch is from 2015, is that really valid for current version thats included in the Linux 6.1 LTS kernel?
You can test this approach on a running VyOS router using following commands:
I created a PR to fix this issue by using direction parameter of conntrack zones: https://github.com/vyos/vyos-1x/pull/2236
I have a very basic VRF setup and it works fine. It would be much appreciated if someone could test this with more complex VRF setup.
Sorry to bother you @sdev , the latest releases of 1.5-rolling-202309080021 and 1.4-rolling-202309070021 still have this problem.
c-po moved T5555: Fix timezone migrator (system 13-to-14) from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.4) board.
I guess we should use the current ip neighbor xxx instead of old arp. I hope it does the same.
sudo ip neighbor add proxy 192.0.2.1 dev eth0 sudo ip -6 neigh add proxy aa::1 dev eth0
Show
vyos@r1# sudo ip neighbor show proxy 192.168.122.11 dev eth0 proxy 192.0.2.1 dev eth0 proxy aa::1 dev eth0 proxy [edit] vyos@r1#
Viacheslav closed T5565: Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp as Resolved.
https://github.com/vyos/vyos-1x/pull/2233 to fix the smoketest.
In T5518#159341, @Apachez wrote:Something is broken in smoketest test_protocols_pim6.py:
https://github.com/vyos/vyos-rolling-nightly-builds/actions/runs/6133954453/job/16646294279
See "Run smoketests" line 28676 and forward.
Something is broken in smoketest test_protocols_pim6.py:
Sep 9 2023
Sep 9 2023
alainlamar changed the status of T5567: vyos-1x: webproxy: maximum-object-size allowed ranges not in sync with Equuleus from Open to In progress.
Viacheslav moved T4426: Add arpwatch to the image from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.4) board.
Viacheslav moved T5489: Change to BBR as TCP congestion control, or at least make it an config option from Open to Finished on the VyOS 1.4 Sagitta board.
Viacheslav changed the status of T4754: Improvement: system login: show configured 2FA OTP key, a subtask of T4564: Root task for rewriting [op-mode] to vyos.opmode format, from Open to Needs testing.
Viacheslav changed the status of T4754: Improvement: system login: show configured 2FA OTP key from Open to Needs testing.
Viacheslav changed the status of T5554: Disable sudo for PAM RADIUS, a subtask of T3191: PAM RADIUS freezing when accounting does not configured on RADIUS server, from Open to In progress.
PR for 1.3.x https://github.com/vyos/vyos-1x/pull/2225
c-po closed T3700: Support VLAN tunnel mapping of VLAN aware bridges, a subtask of T3137: Let VLAN aware bridge approach the behavior of professional equipment, as Resolved.
c-po closed T3700: Support VLAN tunnel mapping of VLAN aware bridges, a subtask of T5415: Upgrade FRR to version 9.0, as Resolved.
set interfaces bridge br0 member interface vxlan0 set interfaces vxlan vxlan0 external set interfaces vxlan vxlan0 source-interface 'dum0' set interfaces vxlan vxlan0 vlan-to-vni 10 vni '10010' set interfaces vxlan vxlan0 vlan-to-vni 11 vni '10011' set interfaces vxlan vxlan0 vlan-to-vni 30 vni '10030' set interfaces vxlan vxlan0 vlan-to-vni 31 vni '10031'
Sep 8 2023
Sep 8 2023
This pr breaks environment variable processing as it resets env_opt to an empty string when startting to process the labels.
c-po changed the status of T3700: Support VLAN tunnel mapping of VLAN aware bridges, a subtask of T3137: Let VLAN aware bridge approach the behavior of professional equipment, from On hold to In progress.
c-po changed the status of T3700: Support VLAN tunnel mapping of VLAN aware bridges, a subtask of T5415: Upgrade FRR to version 9.0, from On hold to In progress.
c-po changed the status of T3700: Support VLAN tunnel mapping of VLAN aware bridges from On hold to In progress.
Viacheslav moved T5423: ipsec: no output for op-cmd "show vpn ike secrets" from Open to Finished on the VyOS 1.5 Circinus board.
Viacheslav added a project to T5423: ipsec: no output for op-cmd "show vpn ike secrets": VyOS 1.5 Circinus.
Cherry-pick to 1.4 https://github.com/vyos/vyos-1x/pull/2226
Viacheslav added a comment to T5489: Change to BBR as TCP congestion control, or at least make it an config option.
PR for 1.4 https://github.com/vyos/vyos-1x/pull/2224
Viacheslav moved T5502: Firewall - wrong parser for inbound and/or outbound interface from Open to Finished on the VyOS 1.4 Sagitta board.
Viacheslav moved T5460: Firewall - remove config-trap from Open to Finished on the VyOS 1.4 Sagitta board.
Viacheslav moved T5450: Firewall interface group - Allow inverted matcher from Open to Finished on the VyOS 1.4 Sagitta board.
n.fort changed the status of T5561: NAT - Inbound or outbound interface should not be mandatory from Open to Confirmed.
I'm closing this one. No news in the last year, and the tests I've done last month were ok.
n.fort changed the status of T4072: Feature Request: Firewall on bridge interfaces from Open to In progress.
Feature included in: https://github.com/vyos/vyos-1x/pull/2222
Viacheslav added a project to T5559: Selective proxy-arp/proxy-ndp when doing SNAT/DNAT: VyOS 1.5 Circinus.
Sagitta PR updated with fix for regression in T5556.
Sep 7 2023
Sep 7 2023
jestabro closed T5412: Add support for extending config-mode dependencies in supplemental package, a subtask of T4820: Support for inter-config-mode script dependencies, as Unknown Status.
jestabro closed T5412: Add support for extending config-mode dependencies in supplemental package, a subtask of T5403: Add support for extending xml cache , as Unknown Status.
jestabro closed T5412: Add support for extending config-mode dependencies in supplemental package as Unknown Status.
Apachez closed T5489: Change to BBR as TCP congestion control, or at least make it an config option as Resolved.
Using VyOS 1.4-rolling-202309070021.
For 1.4 add session [default=ignore success=2] pam_succeed_if.so service = sudo to /etc/pam.d/common-session-noninteractive fixes the issue
# here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # and here are more per-package modules (the "Additional" block) session required pam_mkhomedir.so umask=0022 skel=/etc/skel session [default=ignore success=2] pam_succeed_if.so service = sudo session [default=ignore success=ignore] pam_succeed_if.so user ingroup aaa quiet session [authinfo_unavail=ignore success=ok default=ignore] pam_radius_auth.so session required pam_unix.so # end of pam-auth-update config
Viacheslav edited projects for T5555: Fix timezone migrator (system 13-to-14), added: VyOS 1.3 Equuleus (1.3.4); removed VyOS 1.3 Equuleus (1.3.5).
sarthurdev moved T5555: Fix timezone migrator (system 13-to-14) from Need Triage to In Progress on the VyOS 1.3 Equuleus (1.3.5) board.
sarthurdev moved T5555: Fix timezone migrator (system 13-to-14) from Open to In Progress on the VyOS 1.5 Circinus board.
sarthurdev moved T5555: Fix timezone migrator (system 13-to-14) from Open to In Progress on the VyOS 1.4 Sagitta board.
sarthurdev changed the status of T5555: Fix timezone migrator (system 13-to-14) from In progress to Needs testing.
sarthurdev changed the status of T5555: Fix timezone migrator (system 13-to-14) from Open to In progress.
I see this in 20230329 rolling, but don't see on the latest one.
Could please the vyos_debconfig files be updated aswell?
Apachez added a comment to T5510: Shrink imagesize and improve read performance by changing mksquashfs syntax.
PR392 was merged in VyOS 1.4-rolling-202309070021.
jestabro edited a custom field on T5353: config-mgmt: normalize archive updates and commit log entries.