Hello, Community
VyOS 1.3.1 release is now available:
subscribers (customers and contributors) can download binary images from the support portal, and everyone can build it from the source.
The driving force for this release is CVE-2022-0778, but it features a whole bunch of bug fixes and a few new features in addition to it.
If you missed it, CVE-2022-0778 is a vulnerability in OpenSSL that potentially allows any remote attacker to cause an infinite loop in OpenSSL and hang the process by sending a malformed certificate. We still haven't seen a working PoC for exploiting it in the wild, but since it's remotely exploitable, it would be irresponsible to wait for a working exploit to take action.
We have been planning to make a 1.3.1 release for a while anyway but wanted to complete some work on fixes and features before releasing it. Since VyOS 1.3.0 was released in late December 2021, many could argue that this release is already overdue and we've been holding useful improvements back for no reason. In any case, now it's released, we will start working on 1.3.2 and keep working on 1.4.0.
First, there's now Telegraf monitoring agent configuration CLI! You can find it under set service monitoring telegraf. It's fairly intuitive, but we will document it, and meanwhile feel free to ask if you get any problems with it.
It was impossible to set multiple remotes for unicase VXLAN, but now there is:
set interfaces vxlan vxlan0 remote 192.0.2.23 set interfaces vxlan vxlan0 remote 203.0.113.23
It was also impossible to make the web proxy listen on all addresses because it wouldn't accept 0.0.0.0 as its listen-address, but now it's a valid value.
VRRP transition scripts would stop working when sync-groups were configured. That's not a common configuration, but that was an unfortunate bug nonetheless, and now it's no longer an issue.
Overall, there are just over 50 resolved issues though, mostly small but still significant. You will find a complete changelog below. Now let's talk about deprecations...
The loadkey command was quite an oddity in our CLI. It parsed SSH public keys and ran set commands behind the scenes to add the user's public key to the config. We've been planning to rectify that irregularity for a long time, but we needed an alternative.
Now the new, better (we think) way to configure user keys is the op mode command run generate public-key-command. This is how it works:
generate public-key-command user jrandomhacker path /tmp/id_rsa.pub # To add this key as an embedded key, run the following commands: configure set system login user jrandomhacker authentication public-keys jrandomhacker@host.example.com key AAAAB3NzaC1yc2EAAAADAQABAAABAQDQvwU34xJjCqkU1KOM+Ep7LLlswVXRbTjoileJmR3YLIpVXrP/gSPgd7RY5AC2Zp/JjcFnaMZCyVDUM+NU9rF1I7yWeoXE98BQ1jcCWROwfPjVh/LzGJvSXIQDhVAiarrXV90fiFe4VPYmf4JfXjbElCxH669YLw7QLovvXUqwWWI09POrp/zjdImEBDUUanCkGGJZCD3QuYtBPzz+fyiNuTnt3mTKZoCIKcwiMUDve/mn4OuOzCtoWGM8++K072KDwU8jq8Sq+3MSiudY5JACIbfwY3uIvKIQkBite0/+Dodw6m7QW12ZLMVcGLzMXvZSin05uxfDNdimIXgvu/vv set system login user jrandomhacker authentication public-keys jrandomhacker@host.example.com type ssh-rsa
That command also accepts URLs, not only local paths.
Of course, the loadkey command isn't going anywhere right now. It will only issue deprecation warnings and will remain available throughout the 1.3.x branch lifetime. In 1.4.0 we will remove the old command and the new way will become the only way.
VyOS 1.2.x, by a lucky coincidence, wasn't affected by the OpenSSL vulnerability, so it didn't trigger an emergency release. However, we are still planning to make a 1.2.9 release before putting 1.2.x in a "deep maintenance" mode where it will only receive updates for critical bugs and security vulnerabilities.
VyOS 1.3.2 may receive more backports from the 1.4.0/Sagitta branch, and definitely more bug fixes. Stay tuned for updates!