Release Notes

Release Notes for Okapi Installer and LiveCD

Release 7.000

1. Grub dual boot bug. FIXED.
2. "show running-configuration bridge" cmd added.
3. Quagga package is upgraded to 0.99.16.
4. Failure of kernel package upgration using auto patch. FIXED.
5. Interface problems on realtek network cards. FIXED.
6. Backup and restore also support backup of openvpn keys.
7. "set pfs" command added in crypto maps.
8. "crypto isakmp keepalive" cmd added to set connection teardown timeout and delay for IPSec Dead Peer Detection(DPD) module.
9. IPSec ISAKMP pre shared key was case insensitive. FIXED.
10. "ip nat inside/outside source/destination list .." cmds have been extended to support extended access lists.
11. Underlying IPSec implementation is changed from openswan to strongswan.
12. Priority Queue bugs. FIXED.
    • Dynamic updation of rules was problematic earlier
13. New Features
    • Adblocker
    • IPS/IDS
    • Loadbalance and failover
    • Support for Virtual Router Redundancy Protocol(VRRP) added.

Release 6.000

1. Direct root login in Okapi is disabled.
2. Okapi Kernel is upgraded to 2.6.26.
3. Initramfs is used instead of initrd. It is now generated at installation time, rather than having a static image for all systems.
4. Because of Kernel up gradation and initramfs generation, Okapi is now able to support a larger number of disk drives which are supported by debian lenny 5.01.
5. Commands for selective printing of running configuration for different features added like "show running-config dhcp/httpproxy/access-list" etc.
6. Added the command "show running-config" to list down the possible keywords to complete the command.
7. "show log settings snort" and "show logging snort" cmds added.
8. If a user does'nt type anything for 60 secs then the "session locked" message will be printed on executing the command and user will be logged out.

Release 5.004

1. DNS slave support added - Slave servers running on different machine can synchronize with master server running on Okapi
2. Openvpn logging was erased on every boot. FIXED.
3. Support for named access-list is removed. Standard numbered acl are now supported at all the places where named acl were used.
4. A runtime change in ACL was not effective at places where they were used. FIXED in port-map, QoS? .
5. Inconsistant state of vtysh after giving "start-shell" cmd and "show running-config zebra". FIXED.
6. LSI logic supports added.
7. Sometimes the daemon launch status shown at boot time was failed, even if it was successfully launched. FIXED.
8. "no ppp ipcp-accept local/remote" cmds were not effective. FIXED.
9. Okapi Installation on standard i386 based system is supported now.

Release Notes for Okapi LiveCD

Release 5.003

1. Enabled support for sata disk drives.
2. Command "no url-filter define-acl" had bug. FIXED.
3. Software Upgrade is changed from binary patch to apt-get package management using okapi mirror at address "ftp://kritikalsolutions.com/pub".
4. Support for Intel D945GCLF? network card added.
5. Syntax of "no ip prefix-list LIST_NAME" cmd changed to "no ip prefix-list name LIST_NAME", because it was ambiguous with "no ip prefix-list sequence-number".
6. DHCP commands and Bridge commands on interface nodes are only available for Fastethernet and vlan interfaces.
7. "ip nat inside/outside.." command which initially only accepted ethernet interface extended to other interfaces.
8. Commands added * show auto_patch * openvpn remove client-key CLIENT_NAME * auto-patch undo openvpn_keys * no ppp passive * no dialer pool
9. Commands removed
   • apply_patch PATCH_NAME PATCH_VERSION
   • "no interface Fastethernet|Loopback|.."
10. New Features
    • IPS/IDS
    • Backup and Restore

Release 5.002

1. Configuration write was not proper for snmp community cmds. FIXED.
2. Protocol field in extended access-list was ineffective. FIXED.
3. Crash in PAT commands. FIXED.
4. DNS server
   • Check included for valid domain-name in "ip domain-name" command.
   • no zone command added to remove a zone from dns config file.
   • mail server setting made optional during creation of a dns domain.
   • addition if PTR records now not supported in a forward zone, such records may now be put in a reverse lookup zone.
   • MX record now has to be specified seperately if an entry for the same is required in a zone.
   • "no zone zone-name" crashed zebra if zone is not configured. FIXED.
   • "zone {WORD} addRR hostname CNAME value" duplication removed, if the same hostname is configured before.
   • no form of commands implimented.
   • and lots of other bugs
5. Standard access-lists and extended access-lists
   • "host" keyword has been made compulsary if you want to specify a single host
   • access extended lists for tcp|udp have been expanded to accept "new established related"
   • access extended lists for icmp have been expanded to accept "echo-reply" which is the icmp packet type.
   • access extended lists having neq in port specification were ineffective. FIXED.
   • configuration write of extended lists having range in port specification was improper. FIXED.
   • configuration write "ip nat inside source static tcp .." form of commands implimented.
6. "ip port-map" cmd is added.
7. Commands added
   • "ip nat outside destination static/list"
8. New Features
   • Openvpn
   • Httpproxy
   • NTP client

Release 5.001

1. pimd-sm when running on an interface, was crashing on reboot. FIXED.
2. "route-map" cmd on RIP Mode was always taking eth0.
3. Inconsistent behavior after exiting from Policy Class Configuration Mode fixed now.
4. Vtysh crash on pressing "?" when there is no matching command. FIXED.
5. When an interface is added to a bridge, it must not have any ip address assigned. This rule is now enforced while the bridge is being created.
6. Class-map cmds and "match interface" cmds on Route-map Mode had configuration write bugs. FIXED.
7. "dialer string" cmd is no longer mandatory for ISDN bri.
8. "class class-default" cmd removed.
9. "ppp auth/require-pap/chap/refuse-pap/chap" cmds removed. This is now configurable by "ppp authentication pap/chap" cmd.
10. "pseudowire-class abc" makes vtysh inconsistant. FIXED.
11. Interface tunnel configuration write had problems. FIXED.
12. "show history" cmd was not working. FIXED.
13. Broadcast address for ethernet interfaces was always 255.255.255.255. FIXED.
14. "show running-config zebra" cmd will display all the ip inspect commands now.
15. Range overlap in DHCP pools is not permitted now.
16. "show ip nat translations" cmd. FIXED.
17. "username YOUR_USERNAME password YOUR_PASSWORD" cmd configuration write implimented.
18. "ip nat outside source static global-ip local-ip" was ineffective. FIXED.
19. Zebra was crashing while applying QoS on interfaces. FIXED.
20. At a time only ingress or egress QoS policy will be effective on an interface.
21. "show startup-config zebra/bgpd/ospfd/ripd/vtysh" cmds added.
22. "area AREA_NUMBER nssa" was crashing OSPF, a number of other commands in bgpd, ripd having the same behavior. FIXED.
23. "set metric" command for routemap was giving "argument malformed". FIXED.
24. Ospf virtual-link interface is not configured by user. so removed from CLI. This interface is created automatically by ospf virtual-link command
25. Route-map or distribute lists in ripd/ospfd/bgpd for redistribution, which make use of acls, were not working. FIXED.
26. "show ip prefix-list {WORD}" is now changed to "show ip prefix-list typical {WORD}" ie "typical" added in most of the cmds of prefix-lists.
27. Cmds Removed
    • "show l2tun"
28. New Features
    • DHCP Relay, client
    • DNS server, client
    • PPPoe

Release 5.000

1. "debug rip events" command in RIP doesn't crash RIP now.
2. Username password command added on config node to specify remote hostname for pap/chap authentication.
3. Earlier dialer string was mandatory on isdn interface, which is not now. so that we can work in listening mode also.
4. Netmask {N.N.N.N} extended to accept 0.0.0.0 as netmask.
5. Pppd "no shutdown" was appearing in configuration by default and was ineffective. FIXED.

Release 4.020

1. Slight change in "show bridge" command output format.
2. "no ppp defaultroute" used to write "ppp nodefaultroute" in configuration which would make zebra crash on reboot. FIXED.
3. "no bridge-group BRG_NUMBER" cmd doesn't crash zebra now.
4. PPP over UART(AsyncSerial Interface) now works.
5. Support for Virtual-template interface is removed.

Release 4.019

1. List of root name servers IP addresses removed from IPSec configuration with which IPSec encrypted link cannot be established.
2. In PPP, remote IP address proposed by peer was always accepted. FIXED.
3. No form of various PPP configuration commands added.
4. SNMP command is now "service snmp" instead of snmp-server.

Release 4.018

1. Repeating "network IFNAME" command in RIP doesn't crash RIP now.
2. Messages printed on startup reduced.
3. Now if we apply an access-group on an already applied access-group it gives message to first remove the previous access group.
4. Earlier, if the corresponding access list was empty, then "no ip access-group" command was not working. FIXED.
5. Proper message for "show logging" when corresponding quagga daemon is not running.
6. UART communication with WAN card in reference to serial configuration used to fail frequently. Now, we wait for the operation to complete ensuring reliability.
7. group_prefix command in case of pim-sm now saved in configuration save and restore.
8. PIM-SM used to lose configuration whenever a new configuration entry was added. FIXED.
9. Crypto map save used to fail, if the access-list was undefined. FIXED.
10. "ip dvmrp boundary A.B.C.D/M" command changed to "ip dvmrp boundary M.M.M.M netmask N.N.N.N". Earlier it couldn't accept the multicast IP addresses that were expected.
11. In DHCP, the client address format check is now done properly. Earlier, badly formatted client address was also accepted.
12. In DHCP pool, earlier only one of static or dynamic binding was accepted. Choice between the two was made silently and user wasn't reported failures properly. Now, we support both of them simultaneously as in CISCO.
13. Hostname setting now preserves case.
14. Configuration restore of dvmrp and pim-sm now works properly. Many bugs fixed.
15. In many commands, if we typed partial command e.g. "sh run ze" instead of "show running-config zebra", the command wasn't executed properly. FIXED.
16. Command generation order in configuration save changed to better handle "configuration save and restore" functionality.
17. "ip pim-sm scoped A.B.C.D/M" changed to "ip pim-sm scoped M.M.M.M netmask N.N.N.N". Earlier it couldn't accept the multicast IP addresses that were expected.
18. Route handling for serial point-to-point interfaces improved significantly. In HDLC, it is still not perfect when IP address is received from the peer. But, PPP should work properly.
19. If a route was configured targetted to an ip address, which was not available at that time and that ip address information comes from kernel later, the route was not applied. Because of this, the routes for serial interfaces' peer address, in saved configuration were not being applied during reboot. FIXED now.
20. no ip address command now working for serial interfaces.
21. PPP over RS232 now supported(AsyncSerial ).

Release 4.017

1. pppd path was incorrect. Fixed.
2. ip name-server and ip domain-name commands now appear in show running-config zebra. Earlier impl. had many limitations.
3. Similar problems with "ppp hostname" command fixed.
4. ppp interfaces not being deleted when shut command is given. They always persist and preserve the route, filter, qos etc. configuration.
5. Tonnnes of changes under the hood.

Release 4.016

1. In IPSec, the groups 1, 2 and 5 now work correctly.
2. In IPSec, DES now works in addition to AES and 3DES. Warning printed on its use.
3. In IPSec, sequence number support added in crypto map configuration.

1. encapsulation 802.1Q command now appears in VLAN configuration only and not ethernet configuration.
2. Prompt in case of VLAN interface configuration is config-subif-eth>
3. Better handling of unknown interfaces discovered by the system automatically.
4. In DHCP, lease configuration now persists across reboots.

1. In NAT/Firewall, ping will resume if we change the NAT or firewalll configuration.
2. In firewall, ip access-group command configuration save now works.
3. Access Group semantics updated to match CISCO more closely.
   1. By default, permit all is used on an interface. a If an access-list is applied then it will permit that and deny all.
   2. If it has to be denied, that will be done using ICMP-HOST-UNREACHABLE packet back, rather than a silent packet drop.
4. no access-list command now works. Previously, it wasn't checking protocol and ports.

1. The all protocol option support in access-lists. This is equivalent to ip protocol in CISCO in the command "access-list 100 permit ip". Our system would require "access-list 100 permit all" instead.
2. In dhcp, after we give the network {A.B.C.D} {N.N.N.N} command, we have to give the range commands for the exact ip addresses that we want to distribute. This helps in fixing dhcp problems, when the network was too large for dhcp to distribute.
3. ip route command with interface as target now generating config correctly.

1. Support for ppp over asynchronous serial interfaces now supported.
2. Package groff added. So man commands can be launched from shell correctly.

Release 4.015

1. IP address labels now associated with all modes of IP address commands
2. SNMP bug which caused the system to disconnect with snmpd frequently, fixed.
3. Multiple SNMP traps bug fixed.
4. Now, we use net-snmp version 5.4.2-pre1
5. Multiple DNS servers can now be configured in DHCP.
6. In IPSec, both phase1 and phase2 encryption and hash algorithm configuration is now reflected in ipsec.conf.
7. In IPSec, support for both ESP and AH in phase2.
8. Unknown interfaces discovered automatically now handled better.

Release 4.014

1. In IPSec, missing help strings added for commands.
2. Repetitions now suppressed in command descriptions.
3. Multiple name servers now supported in CLI.
4. Tonnes of changes under the hood

Release 4.013

1. Kernel is now based upon 2.6.16.60.
2. New interface called serial interface added.
3. snmp community command added.
4. DHCP Nameserver command now works.
5. Hostname configuration now connects with OS hostname information.
6. Wildcards W.W.W.W now supported in CLI.
7. Tonnes of changes under the hood

Release 4.012

1. Improved support for Policy Maps.
2. Improved support for SNMP.
3. No need to reboot the router to change multicast routing protocol.
4. Log messages for interface up and down fixed.
5. Default Kernel debugging in Zebra disabled.
6. Added Valgrind and Electric Fence packages. Not being used though.
7. Help string ambiguities for various commands fixed.
8. Tonnes of updates under the hood.

Release 4.011

1. Multicast feature released. This includes pimd-dm, pimd-sm and dvmrp.
2. SNMP issues fixed in this release. SNMP trap CLI should now work.
3. show running-config command modified to be daemon specific. It now prints better.
4. Bootup messages cleaned up a bit.
5. Tonnes of changes under the hood, including IPSec, Squashfs file system version now 3.3, etc.

For release prior to 4.011

Not Maintained. See the svn log for more information.

Release Notes for PowerPC Router

Release 1.003

1. Serial link on WAN interfaces used to break frequently. FIXED.
2. Serial links were not able to detect link up/down status eg "network cable unplugged". FIXED.
3. Package "netstat-nat" required for "show ip nat translations" was not getting integrated in binary image. FIXED.
4. Command "show ip nat translations" was sometimes causing CLI to hang. Also it was displaying Host IP address and port numbers resolved to names, making the display clumsy. FIXED.
5. Package "log_router" was not getting integrated in binary image and had to be installed explicitly. FIXED.
6. Command "interface serial 0/1" was failing with error message "Error in initialization". FIXED.
7. Support for "n_hdlc" required by PPPoE? added in kernel.
8. Command "description ..." at interface node was causing vtysh to crash. FIXED.
9. Support for "RIPngd", "OSPF6d" and all IPv6 commands disabled.
10. Command "rate-limit input" and "service-policy input" were causing an error "RTNETLINK: no such file or directory". FIXED.
11. Command "no custom-queue" was causing an error "iptables : no matching target/chain". FIXED.
12. Zebra daemon used to crash with an error "Too many open files". FIXED.
13. Zebra daemon was receiving an abort signal with log message "zebra : aborting ...". FIXED.
14. Command "show start-up configuration" will now show start-up configuration per daemon, same as "show running-configuration .."
15. Command "address-family ipv4" on bgp configuration node was causing CLI to enter in an inconsistent state. FIXED.
16. Command "show ip ospf interface .." was causing OSPFd and OSPF6d to crash. FIXED.
17. Command "ip rip authentication mode" was displaying improper options at "?" on CLI. FIXED.
18. Command "area 1 nssa" was causing OSPFd to crash. FIXED
19. Command "neighbor A.B.C.D version 4|4+" was not accepted at CLI. FIXED.
20. OSPF virtual-link now functional.

Release 1.002

1. Multicast routing functional on ppc architecture as well.
2. "show ip nat translations" command displays proper output.
3. Configuration write for "username .. password .." command added.
4. Config write for "pseudowire class ..." is added on interface node.
5. Overlapping ip address ranges are not allowed across two or more different dhcp pools.
6. Show logging command will now show logging for Async-serial and Serial interfaces as well.
7. Only one ip address is now accepted at ppp and tunnel interfaces. Multiple ip address on these interfaces are no longer supported.
8. An invalid IP address was also accepted at CLI. FIXED now.
9. Some kernel routes were getting added in route table and were causing network problems. FIXED now.

Release 1.001

1. RT_NETLINK error messages during boot up. FIXED.
2. CLI bugs of commands route-map, distribute-list, offset-list along with some other bugs are FIXED.
3. vtysh crashed on pressing "?" when there was no matching command (e.g giving number when string was expected). FIXED.
4. In order to get ip address of bridge effective and available for routing, its required to remove individual ip addresses of all its member interfaces.
5. CLI bugs for vty node are FIXED now.
6. access-list messages "chain already exists" are FIXED now.
7. Appropriate warning messages will appear during NAT configurations.
8. "Show histroy" command displays proper output.
9. "ip inspect ..." configurations will now appear in running-configuration.
10. Debugging disabled in all packages. This release has the optimized code compilation at level -O3.

Release 1.000

1. Added boot-up messages during start up of routing daemons.
2. Command "username _name password _pwd" added on global configuration node to specify remote hostname and password required for pap/chap authentication.
3. Earlier dialer string was mandatory on ISDN BRI interface, because of which it was not working in passive mode. FIXED now. Now it can work in listen/passive mode also.

Release 0.018

1. WAN interfaces (ie V.35) on PMC card are now operational with hdlc as well.
2. Now onwards to delete a bridge by no bridge command, one has to first shutdown the bridge interface.
3. "show bridge" commands are now functional and display appropriate output.
4. Frequently system was crashing after "skb_over_panic" error caused by ISDN driver. FIXED.
5. Problem of routes targeted to serial and ISDN bri interfaces being lost on reboot is now FIXED.

Release 0.017

1. Two BRI interfaces are supported now.
2. For Bri interface, no shut was working only for once. FIXED.
3. Configuration write is now supported for Bridge.
4. Changes done through CLI were not changing bridge parameters. FIXED.
5. WAN interfaces (ie V.35) on PMC card are now operational with ppp encapsulation.

Release 0.016

1. List of root name servers IP addresses removed from IPSec configuration with which IPSec encrypted link cannot be established.
2. In PPP, remote IP address proposed by peer was always accepted. FIXED.
3. No form of various PPP configuration commands added.
4. SNMP command is now "service snmp" instead of snmp-server.
5. ISDN support added. Now, an ISDN ppp link can be established with Airtel ISP.

Release 0.015

1. Peer IP address is now discovered automatically in CISCO HDLC encapsulated interfaces. We periodically send CISCO_ADDR_REQ for achieving that.
2. no ip address command now working for serial interfaces.
3. WAN driver settings are now refreshed everytime encapsulation is changed. This enables correct operation when WAN encapsualtion changes.
4. If a route was configured targetted to an ip address, which was not available at that time and that ip address information comes from kernel later, the route was not applied. Because of this, the routes for serial interfaces' peer address, in saved configuration were not being applied during reboot. FIXED now.
5. In "timeslot" command, the start timeslot range is now 1..31 instead of 1..30 and end timeslot range is 1..31 instead of 2..31.

Release 0.014

1. Messages printed on startup reduced.
2. Now if we apply an access-group on an already applied access-group it gives message to first remove the previous access group.
3. Earlier, if the corresponding access list was empty, then "no ip access-group" command was not working. FIXED.
4. Proper message for "show logging" when corresponding quagga daemon is not running.
5. UART communication with WAN card in reference to serial configuration used to fail frequently. Now, we wait for the operation to complete ensuring reliability.
6. group_prefix command in case of pim-sm now saved in configuration save and restore.
7. PIM-SM used to lose configuration whenever a new configuration entry was added. FIXED.
8. Crypto map save used to fail, if the access-list was undefined. FIXED.
9. "ip dvmrp boundary A.B.C.D/M" command changed to "ip dvmrp boundary M.M.M.M netmask N.N.N.N". Earlier it couldn't accept the multicast IP addresses that were expected.
10. In DHCP, the client address format check is now done properly. Earlier, badly formatted client address was also accepted.
11. In DHCP pool, earlier only one of static or dynamic binding was accepted. Choice between the two was made silently and user wasn't reported failures properly. Now, we support both of them simultaneously as in CISCO.
12. Hostname setting now preserves case.
13. Configuration restore of dvmrp and pim-sm now works properly. Many bugs fixed.
14. In many commands, if we typed partial command e.g. "sh run ze" instead of "show running-config zebra", the command wasn't executed properly. FIXED.
15. Command generation order in configuration save changed to better handle "configuration save and restore" functionality.
16. Nand flash is now scrubbed before being used in the initial installation. Should help fixing problems installing the system that we faced.
17. "ip pim-sm scoped A.B.C.D/M" changed to "ip pim-sm scoped M.M.M.M netmask N.N.N.N". Earlier it couldn't accept the multicast IP addresses that were expected.
18. Route handling for serial point-to-point interfaces improved significantly. In HDLC, it is still not perfect when IP address is received from the peer. But, PPP should work properly.

Release 0.013

1. ip name-server and ip domain-name commands now appear in show running-config zebra. Earlier impl. had many limitations.
2. Similar problems with "ppp hostname" command fixed.
3. ppp interfaces not being deleted when shut command is given. They always persist and preserve the route, filter, qos etc. configuration.
4. Tonnnes of changes under the hood.

Release 0.012

1. PPPD path fixed. Now, ppp interface actually works.
2. Internal changes: We avoid using system to launch external programs now in zebra.

Release 0.011

1. The all protocol option support in access-lists.This is equivalent to ip protocol in CISCO in the command "access-list 100 permit ip". Our system would require "access-list 100 permit all" instead.
2. In dhcp, after we give the network {A.B.C.D} {N.N.N.N} command, we have to give the range commands for the exact ip addresses that we want to distribute. This helps in fixing dhcp problems, when the network was too large for dhcp to distribute.
3. ip route command with interface as target now generating config correctly.
4. Support for ppp over asynchronous serial interfaces now supported.
5. Number of improvements in WAN interfaces. Now Serial-HDLC and Serial-PPP interfaces are two different type of interfaces internally.

Release 0.010

1. In IPSec, the groups 1, 2 and 5 now work correctly.
2. In IPSec, DES now works in addition to AES and 3DES. Warning printed on its use.
3. In IPSec, sequence number support added in crypto map configuration.

1. WAN1 and WAN2 now work for framed E1, unframed E1 and V.35.
2. In case of serial interfaces(WAN1 and WAN2), the ip address configuration save now works.
3. encapsulation 802.1Q now appears in VLAN configuration only and not ethernet configuration.
4. Prompt in case of VLAN interface configuration is config-subif-eth>
5. Better handling of unknown interfaces discovered by the system automatically.
6. In DHCP, lease configuration now persists across reboots.

1. In NAT/Firewall, ping will resume if we change the NAT or firewalll configuration.
2. In firewall, ip access-group command configuration save now works.
3. Access Group semantics updated to match CISCO more closely. a By default, permit all is used on an interface. a If an access-list is applied then it will permit that and deny all. a If it has to be denied, that will be done using ICMP-HOST-UNREACHABLE packet back, rather than a silent packet drop.
4. no access-list command now works. Previously, it wasn't checking protocol and ports.

Release 0.009

1. Save configuration for the nat command "ip nat inside source list {NUMBER} interface {INTERFACE_NAME} fixed.
2. SNMP bug which caused multiple traps fixed.
3. DHCP configuration save now works.
4. DHCP critical bug which caused it to not restart after reboot fixed.
5. In IPSec, support for both ESP and AH in phase2. IKE negotiation now works properly.
6. CLI for PPP and HDLC encapsulation over V.35 interface now supported. At the moment, only WAN 2 is working.
7. Support for multiple DNS servers in DHCP configuration.