Cannot pass the smoketest:

 DEBUG - ======================================================================
DEBUG - FAIL: test_01_dyndns_service_standard (__main__.TestServiceDDNS.test_01_dyndns_service_standard)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_dns_dynamic.py", line 82, in test_01_dyndns_service_standard
DEBUG -     self.assertIn(f'use=if', ddclient_conf)
DEBUG - AssertionError: 'use=if' not found in '### Autogenerated by dns_dynamic.py ###\ndaemon=300\nsyslog=yes\nssl=yes\npid=/run/ddclient/ddclient.pid\ncache=/run/ddclient/ddclient.cache\nweb=googledomains use=no            \n # Web service dynamic DNS configuration for cloudflare: [cloudflare, test.ddns.vyos.io]\nusev4=ifv4, \\\nifv4=eth0, \\\nprotocol=cloudflare, \\\nzone=vyos.io, \\\npassword=paSS_@4ord \\\ntest.ddns.vyos.io'
DEBUG - 
DEBUG - ----------------------------------------------------------------------
DEBUG - Ran 4 tests in 11.489s
DEBUG - 
DEBUG - FAILED (failures=1)

I think this broke a whole lot of things for RADIUS users (these work fine in 1.4-rolling-202308040317, but are broken in 1.5-rolling-202309170024):

This is the one I was thinking of:

This seems to have been resolved since a few days (1.5-rolling nightly).

PR for sagitta https://github.com/vyos/vyos-build/pull/415

@Apachez The empty table inet vyos_offload is to ensure the table exists before deleting its content. Regarding hardware offload, I don't have a hardware supporting that. The implementation is totally based on documentation and I don't add any checks before applying the nftables config.

PR created: https://github.com/vyos/vyos-build/pull/414

PR created: https://github.com/vyos/vyos-build/pull/413

1. Using hardware flowtable (flags offload;) on an interface which doesnt support it returns an error:

Tried to enable both software and hardware flowtable with VyOS 1.5-rolling-202309151051:

How does FRR/vrrpd work regarding SNMP compatability?

PR https://github.com/vyos/vyos-1x/pull/2273

Some extra lines were mistakenly included during rebase:

Note that PR2062 is broken.

Regarding testing of arm-builds, hopefully this article might come handy (how to use qemu-system-aarch64 (on x86) part of the qemu-system-arm package):

In my case the upgrade from 1.4-rolling-202308060317 to vyos-1.4-rolling-202308060317 made the vrf unavailable so no access to management. Booting back to old version became working again.

The excludes-file in PR406 had incorrectly a '/' as first character (for the directory to be excluded from the squashfs-file).

Would also be nice to include the global known_hosts file in /etc/ssh/ssh_known_hosts.

I would also like to know if zone based firewall still work or support is removed?

PR created: https://github.com/vyos/vyos-1x/pull/2264

Should probably add "-M rpki" permanently to FRR/bgp.

Could the error from latest nightly be due to that rpki module isnt loaded for FRR/bgp?

@fernando This is really nice. Thank you for the testing!

Could https://vyos.dev/T2044 be related to the failed nightly build from last night?

Added PR here https://github.com/vyos/vyos-1x/pull/2263

This is still the case in VyOS 1.5-rolling-202309130022:

Suggestion of "hidden" ruleset (visible when doing show firewall and show firewall statistics):

PR created: https://github.com/vyos/vyos-build/pull/406

Found out that mksquashfs supports -ef EXCLUDE_FILE as a file that (line by line) defines which files and directories to be excluded during creation of filesystem.squashfs. Adding -wildcard will make it possible to use wildcards within the EXCLUDE_FILE.

PR for 1.5: https://github.com/vyos/vyos-1x/pull/2256

Something like this console command but more handy in op-mode?

PR https://github.com/vyos/vyos-1x/pull/2257

@sdev greats !!!

PR: https://github.com/vyos/vyos-1x/pull/2253

PR for 1.3.x https://github.com/vyos/vyatta-cfg-quagga/pull/102
PR for the current https://github.com/vyos/vyos-1x/pull/2252

@fernando See here: https://github.com/vyos/vyos-build/pull/297

command on 1.5 :

@Apachez note that all lb commands take --debug and --verbose: using 'lb build --debug' in scripts/build-vyos-image will output the full mksquashfs command.

@vfreex I've tested in my labs related this issues , I can confirm that it work as expected . this original zone solved the problem when there was a src-nat /dst-nat with different VRFs or leaking with them ,Thanks you for this contribution .

In T2405#159522, @Apachez wrote:

Note that command = command.lstrip() for def cmd in python/vyos/utils/process.py was reverted yesterday.

Causes funny problems during smoketests.

Note that command = command.lstrip() for def cmd in python/vyos/utils/process.py was reverted yesterday.

I created a PR for Git support here: https://github.com/vyos/vyos-1x/pull/2241

I have created a PR upstream which hopefully resolves why the logging didnt work as expected in VyOS (since the binary_rootfs in vyos-live-build isnt used by the nightly build who uses vyos-build and the deb-package of live-build from Debian 12.x (bookworm)):

op-mode: https://github.com/vyos/vyos-1x/pull/2242

100% agree. If this isn't too big of a hassle to implement, I would very much appreciate the approach/workaround of @Apachez, until nftables supports this feature ootb...

Checked with #netfilter irc-channel.

I just tested this with a firewall config with no connection tracking config enabled, still the conntrack modules are loaded and used.

The same situation as @svd135 . The passive FTP data connection now is stopped by the problem with FTP ALG.

I was thinking about N/D and personally I would prefer "None" to be listed for the various "show firewall" commands instead of N/D.