A VyOS 1.2.0-alpha image with FRR instead of Quagga is available for testing (and we've found a GPL violation in VyOS)

FreeRangeRouting

Now that 1.1.8 release candidate is out and is (hopefully) being tested by community members, we can get back to building the future of VyOS.

It's been obvious that Quagga needs a replacement, and, since we've been using a Quagga fork inherited from Vyatta Core that includes features that never made it to the mainline quagga, even more so. The mainline Quagga still doesn't have usable commands for configuring multiple routing tables, nor they seem to actively accept patches that would be OS-specific.

The options were discussed many times and so far it seems FreeRangeRouting is the best option. It's a fork of Quagga that is being actively developed, actively accepts contributions, and already includes a number of features that Quagga lacks, such as support for network namespaces, PIM-SM, working IS-IS and more. There's also work being done on non-disruptive config reload.

While FRR is more or less a drop-in replacement for Quagga, it's not identical, and many CLI adjustments will be needed to make VyOS work with it. It needs a lot of testing. For this I've built a custom image that has vyatta-quagga replaced with FRR.

You can download the image here: http://dev.packages.vyos.net/tmp/vyos-1.2.0-alpha-frr-test.iso Please test it and report any issues in the routing protocols configuration you find. It's obviously experimental and you shouldn't use it in real routers, the best way to test is to load your production configs into test virtual machines.

GPL violation

Now to the GPL violation we've found. That violation in fact has been there for over five years and no one noticed it! Then again, it's relatively indirect and subtle.

Quagga is licensed under GPL (and so is FRR). In Vyatta/VyOS, Quagga has been built with SNMP support, so it links with net-snmp. In turn, net-snmp is built with SSL support and links with OpenSSL. This is where the problem is, OpenSSL is licensed under a four-clause BSD license that is not compatible with GPL.

Sadly, there is no easy way out, so it will take some time to fix this violation. The options are:

  • Build Quagga/FRR without SNMP support, which means routing protocol data will not be available through SNMP
  • Build net-snmp without SSL support, which means SNMPv3 will stop working
  • Patch net-snmp to support another cryptographic library that is GPL-compatible

The third option is hardest to implement, but it's the most appealing of all since all functionality will be preserved. We'd like to hear your suggestions regarding the libraries that would be license compatible and that can co-exist with OpenSSL.

13 responses
Well, mbed TLS is dual-licensed for GPLv2 and Apache, and I've been told the API is way, way better documented and easier to work with than OpenSSL.
Yuriy Andamasov upvoted this post.
OpenSSL is moving to Apache License v2.0, which is GPL-compatible, so don't necessarily have to switch. https://www.openssl.org/blog/blog/2017/03/22/li... later update post (which throws a server error for me at the moment, posting archive.org copy). https://web.archive.org/web/20170804003631/http...
Hi! Tried some routing protocols. - Multi-area OSPF with stubs, RIP, BGP - Redistributions (via one router) Diagram: https://imgur.com/3PqpIr1 All worked as expected, minus this one thing: when attempting to redistribute connected to ospf, using route-map, I kept getting this: vyos@VYOSALPHA12-1## set protocols ospf redistribute connected route-map REDISTCONN [edit] vyos@VYOSALPHA12-1# commit [ protocols ospf redistribute connected ] % Unknown command. [[protocols ospf]] failed Commit failed If I leave the route-map out, all is good. Also, few times got into this kind of slump after commit: vyos@vyos# save DEBUG vexit_internal: calling getEditResetEnv() without config session Saving configuration to '/config/config.boot'... Done [edit] vyos@vyos# exit exit There are stopped jobs. DEBUG vexit_internal: calling getEditResetEnv() without config session [edit]
Well done Antti! Joi us on https://phabricator.vyos.net.net i will be copying your report to https://phabricator.vyos.net/T306
Are other FRR protocols also available with VyOS 1.2 alpha Like IS-IS v4 and v6, that is not supported with VyOS stable builds with Quagga.
7 visitors upvoted this post.