PR https://github.com/vyos/vyos-1x/pull/1116

@boevering Do you know how to reproduce it?

There is a reason https://github.com/vyos/vyatta-cfg-vpn/blob/de19cb9b03b78c4e3da93e014764bb2400ffe8a6/scripts/vpn-config.pl#L34

@Viacheslav found the source of the restriction:

I've opened a PR: https://github.com/vyos/vyos-1x/pull/1111

@Dmitry there it is:

@GallySoft could you please share your configuration commands?
Is S-VLAN 995 and C-VLAN 2092 as an example configured on the bond0 interface?

Hi @Dmitry, thank you.

Hi @GallySoft, this fix is still not in 1.3. Try to test it on 1.4 fresh rollings.

On VyOS 1.3-beta-202112150443 seems not working:

Now that's......different.

There is a task with VRRP scripts problem on reboot:

I tested this bug on "vyos-1.3-beta-202112060443".

To reproduce:

set policy access-list 100 rule 1 source any
set policy access-list 100 rule 1 destination any
set policy access-list 100 rule 1 action permit
set interface ethernet eth1 address 203.0.113.1/24
set protocols mpls ldp discovery transport-ipv4-address 203.0.113.1
set protocols mpls ldp interface eth1
set protocols mpls ldp router-id 203.0.113.1
commit

Access list is present:

vyos@r4-epa2# vtysh -c "show run" | grep access
access-list 100 seq 5 permit ip any any
[edit]

Add hello interval:

set protocols mpls ldp discovery hello-ipv4-interval 1

There is no access-list anymore

vyos@r4-epa2# commit
[edit]
vyos@r4-epa2# vtysh -c "show run" | grep access
[edit]
vyos@r4-epa2#

As mentioned I'm running: VyOS 1.3.0-rc6

PR https://github.com/vyos/vyos-1x/pull/1100

PR:
https://github.com/vyos/vyos-1x/pull/1098

PR https://github.com/vyos/vyos-1x/pull/1097

We definitely have to delete enable_script_security from https://github.com/vyos/vyos-1x/blob/current/data/templates/vrrp/keepalived.conf.tmpl#L10

I have the same problem. I created a script, but it doesn't work. VRRP Log write that the skript is unsecure.

It may be related to T4033 ???

I checked it on these versions of VYOS. (VyOS 1.3.0-epa3, VyOS 1.3-beta-202112010443 , VyOS 1.4-rolling-202112021432)

It is working only for TCP right now

set system syslog host 192.168.122.1 facility all protocol 'tcp'
set system syslog host 192.168.122.1 format octet-counted
set system syslog host 192.168.122.1 port '1514'

Config:

vyos@r4-epa2# cat /etc/rsyslog.d/vyos-rsyslog.conf 
## generated by syslog.py ##
## file based logging
$outchannel global,/var/log/messages,262144,/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog
*.info;local7.debug :omfile:$global
## console logging
## remote logging
*.err @@(o)192.168.122.1:1514;RSYSLOG_SyslogProtocol23Format
[edit]
vyos@r4-epa2#

PR https://github.com/vyos/vyos-build/pull/206

vyos@vyos:~$ show version all | match cloud
ii  amazon-cloudwatch-agent              1.247349.0b251399-1                 amd64        Amazon CloudWatch Agent
ii  cloud-init                           20.4-404-g0a9f4841-1~bddeb          all          Init scripts for cloud instances
vyos@vyos:~$

The plan is to weaken this to a warning in 'verify'; as summarized above, validators are pass/fail and warnings are not an appropriate response for a validator

I would not call this a bug as this is produced on intention.

Duplicate T1292

This brings up an interesting issue: validate_value.ml could easily be modified to print warnings, while maintaining T2759 (namely, only print fatal errors if _all_ validators fail for a given setting), however, is this reasonable behaviour ? One would think that a 'validator' is either pass or fail, and if it is just giving a warning, it is no longer a validator.

I will take a look; thanks for the report !

From what I understand this looks to be due to https://github.com/vyos/vyos-utils/blob/master/src/validate_value.ml catching both stdout and stderr output from the validators and only printing the captured output if the validator exit status is 0 so there isn't a way to print warnings unless it always prints the output or handling for a special 'warning' exit code was added.

This doesn't seem to help, whatever is calling the validator script seems to hide the output unless the exit status is non-zero.

Try to restart vyos-configd after changing script file

Just want to know, did you try rfc3768-compatibility?

It probably works that way.
Unfortunately that breaks other parts of our setup.

I don't see any option like "source address"
https://manpages.debian.org/testing/isc-dhcp-relay/dhcrelay.8.en.html