Changelog of SSG BETA-version [Документация VAS Experts]
Документация VAS Experts Документация VAS Experts-mobile
in

Settings

  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks
  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks

    • Differences

    This shows you the differences between two versions of the page.

    Link to this comparison view

    Both sides previous revisionPrevious revision
    Next revision    		Previous revision
    en:dpi:dpi_components:platform:dpi_admin:testversion_install [2025/02/17 14:32] – elena.krasnobryzhen:dpi:dpi_components:platform:dpi_admin:testversion_install [2025/08/18 07:13] (current) – [Changes in version 14.0 BETA4.4] elena.krasnobryzh
    Line 2: Line 2:
     {{indexmenu_n>3}} {{indexmenu_n>3}}
      
    -====Changes in version 13.3 BETA1====+====Changes in version 14.0 BETA1====
      
    -  - [DPI] New protocols added: BIGOTV [49305], SAYHI [49306], AZARLIVE [49307]. +  - [BRAS] Support for L2TP termination 
    -  - Added: hot parameter ''smartdrop = 1''. If ''drop'' is set for the protocol, it will be deferred until the TLS is parsed or a TLS parsing error occurs. +  - [BRAS] Support for DHCP-Dual 
    -  - Fixed: Adding HTTP domains ending with '':'' (port number). +  - [DPI]  Migration to DPDK 24.11, support for new NICs (Intel E830 200G, Intel E630, Napatech SmartNIC) 
    -  - [Utils] Fixed: ''checkproto'' now considers MARK1 and checks if the port number is specified. For example, ''checkproto 8.8.8.8 443 www.google.com'' and ''checkproto 8.8.8.8 www.google.com'' may return different results. +  - [CLI] Added support for ''subs_id'' in commands: ''dhcp show'', ''dhcp reauth'', ''dhcp6 show'', ''dhcp6 reauth'', and ''dhcp disconnect''
    -  - Changed the path for loading ASNUM from VAS Cloud (cloud.vasexperts.ru). +
    -  - Blacklist blocking in GTP tunnel (with the ''detect_gtp_tunnel'' setting). +
    -  - Fixed: HTTPS blocking with the ''hard'' option.+
      
    -====Changes in version 13.3 BETA2====+====Changes in version 14.0 BETA2====
      
    -  - [DPI] Improved Viber recognition. +  - [DPI] New protocols added: AGORA_STREAMS(49314), AZAR_CALL(49315), WECHAT_CALL(49316), TEAMS_CALL(49317). [[en:dpi:dpi_options:protocols]] 
    -  - Support for reload of ''/etc/dpi/asnum6.bin''. +  - [DPI] Improved support for LINE_CALL, VYKE_CALL protocols. [[en:dpi:dpi_options:protocols]] 
    -  - [Utils] ''bin2as'' now accepts any number of input files as arguments. +  - [DPI] Fixed smartdrop behavior 
    -  - [Utils] ''ascheckip'' accepts addresses for batch verification via ''stdin''. +  - [DPI] Added validation for complex protocols. [[en:dpi:dpi_options:protocols]] 
    -  - [Utils] ''bgp2bin'' works similarly to ''as2bin'', but only accepts /24 or larger subnets. It recognizes the IP1-IP2 range format as in RIPE records (extracting /24 or larger subnets from it). Subsequent entries take precedence over previous ones, creating a slightly larger file than ''as2bin''. However, in this file, subnet ranges do not overlap (as less prioritized entries are filtered out). This allows the utility to process data from multiple sources in order of priority. +  - [DPDK] Increased the maximum number of dispatchers to 32 
    -  - [BRAS][PPP] Fixed: Heterogeneous dual-stack. One address (IPv4 or IPv6) is explicitly set, while the other (IPv6 or IPv4) is assigned via framed-pool.+  - [IPFIX/Netflow] Added the ability to change IPFIX/Netflow parameters without restarting fastDPI. A new config parameter ''ipfix_reserved'' has been added to reserve memory for enabling/changing IPFIX/Netflow parameters. If IPFIX/Netflow parameters are set in the configuration file, memory reservation for IPFIX/Netflow is automatically enabled and parameters/new exporter types can be changed without restarting fastDPI. 
     +  - [FastRadius] It is now possible to set both ''bind_ipv6_address'' and ''bind_ipv6_subnet''. If the Framed-IPv6-Prefix has a /128 mask, it is not checked against the ''bind_ipv6_subnet'' restriction. 
     +  - CLI command ''dev info'' now includes the name of the LAG that the port belongs to 
     +  - [PCRF][PPP][Framed-pool] Added: DHCP option ''Client-Id'' now includes ''tunnel-IP'' as part of the subscriber ID. Format of DHCP option ''Client-Id'' with fastpcrf.conf option ''dhcp_client_id=1'' is as follows: <code> 
     +     [conntype][subs_id][tunnel_ip]
      
    -====Changes in version 13.3 BETA3.2====+     conntype = 1 (1 byte) 
     +     subs_id  - 16 bytes 
     +     tunnel_ip - 4 bytes</code> Tunnel IP is available in L2TP; for PPPoE, tunnel IP = 0. 
     +  - [IPFIX] Message aggregation added for IPFIX streams: FullFlow/DNS/META/NAT 
     +  - [IPFIX] Added parameter ''ipfix_mtu_limit'' to restrict maximum message size for IPFIX UDP packets 
     +  - [IPFIX DNS] New elements added to IPFIX DNS: 224 (ipTotalLength) and 43823:3206 (DNS transaction id) 
     +  - [VRRP] Fixed proper handling of the ''vrrp_enable'' option change 
     +  - [BRAS][PPP] PPP session key is now compound: ''l2subs_id'' + ''tunnel-IP''. For PPPoE sessions, tunnel IP = 0. CLI commands that use ''subs_id'' as a key (''subs prop show'', ''l2tp show session'', ''l2tp term'', etc.) may now return multiple entries with the same ''l2subs_id''.
      
    -  - [DPI] Fixed: searching for both ''*'' and '':'' in HTTP domains simultaneously +====Changes in version 14.0 BETA3====
    -  - [DPI] Fixed: removal of addresses in virtual channels during reload +
    -  - [DPI] Fixed: ignoring drop when the ''smartdrop'' parameter is set in case of SSL parsing errors +
    -  - [BRAS][PPP] Fixed: consideration of the ''bras_pppoe_trace_mac'' option when saving DHCPv6 packets in pcap. Previously, only the ''bras_dhcp_trace_mac'' option was considered. Now, for DHCPv6 packets in the PPPoE tunnel, ''bras_pppoe_trace_mac'' is also taken into account +
      
    -====Changes in version 13.3 BETA3.3====+  - [DPI] Added cloud protocols with identifiers 55296..58367 
     +  - [IPFIX] Fixed IPFIX exporter reinitialization bugs 
     +  - [BRAS][subs_grooming] Fixed potential crash due to race condition during fastDPI shutdown 
     +  - [CLI] Added commands to display mempool properties and statistics<code> 
     +    hal mempool props 
     +    hal mempool stat</code>DPDK must be built with statistics collection enabled to display mempool stats 
     +  - [BRAS][DHCP] Fixed crash when parsing Framed-Pool Renew response if it contains no DHCP options 
     +  - [PCRF][Acct] Fixed: Interim-Update sending is now disabled when ''Acct-Interim-Interval = 0'' is explicitly set in the RADIUS response 
     +  - [VASE_CLI] Created a unified CLI for managing DPI, BRAS, DHCP (KEA), ROUTER (BIRD) with support for authorization and command logging via TACACS (VEOS 8.x required) 
     +  - [SNMP] Created a module for monitoring system components via SNMP
      
    -  - [DPI] Reduced the number of false positives for DPI TUNNEL +====Changes in version 14.0 BETA4==== 
    -  - [DPI] Fixed errors when assigning vchannel by IP/CIDR+  - [DPI] Added DOQ 49318 protocol (DNS-over-QUIC) 
     +  - [Router] Announcing subscriber white addresses for 1:1 NAT individually and after authentication 
     +  - [PCRF] Added support for service 19 "DNS spoofing", profile required. 
     +  - [DPDK] Added ''dpdk_engine=6'' (''mqrx-bridge'') — number of RSS dispatchers per bridge. Total number of dispatchers = ''dpdk_rss * number of bridges''. NIC configuration: RX queue count = ''dpdk_rss'', TX queue count = number of worker threads (''num_threads''). Intended for setups with many bridges (dev1:dev2:dev3:...) for 100G+ NICs, as a replacement for the cluster approach. On-stick devices are supported. 
     +  - [DPDK] Removed dedicated mempools. The fastdpi.conf option ''dpdk_emit_mempool_size'' is deprecated and no longer used. 
     +  - [VLAN-Rule] Moved vlan group data from UDR to SDR. Global rules for vlan drop/pass/hide/permit set by the previous CLI command ''vlan group'' were converted and moved from UDR to SDR, with removal from UDR. 
     +  - [VLAN] VLAN rules — added CLI commands: 
     +    - ''vlan rule add'' - add new rule to SDR 
     +    - ''vlan rule modify'' - modify existing rule in SDR 
     +    - ''vlan rule delete'' - delete rule from SDR 
     +    - ''vlan rule show'' - show all rules for the specified VLAN/QinQ 
     +    - ''vlan rule dump'' - dump all rules in SDR 
     +    - ''vlan rule purge vlan''/''qinq''/''all'' - clear SDR for VLAN/QinQ or both 
     +    - ''vlan rule apply'' - apply rules; by default, rules are applied 5 minutes after the last SDR modification 
     +  - [IPv6] Added direction detection in combined traffic (IN+OUT on one port) based on the local flag for IP addresses. Enabled via ''combined_io_direction_mode'' option
      
    -====Changes in version 13.3 BETA3.4====+====Changes in version 14.0 BETA4.1==== 
     +  - [BRAS] Fixed compatibility with the old format of service 18, where there were fewer protocols and both fields in the profile needed to be filled 
     +  - [DPI] Lowered detection priority for ''telegram_tls''
      
    -  - [DPI] Fixed: blocking by IP of DNS working over TCP +====Changes in version 14.0 BETA4.2==== 
    -  - [DPI] Increased packet inspection depth when searching for BIGOTV +  - [DPI] Improved detection of ''WECHAT'' and ''WECHAT_CALL'' 
    -  - [DPI Utils] Fixed ''checkproto'' for the case of an unknown IP protocol +  - [BRAS][Framed-Route] Fixed: possible crash when freeing memory 
    -  - Initial support for writing alert logs to syslog. Enabled with the ''syslog_level=7'' setting (defines the highest level of messages to be duplicated in syslog, default is off). Notes: +  - [BRAS] Refactored PCRF connectivity: in the new implementation, all connections are equal; an error on any triggers reconnection of all connections and a switch to another PCRF. Added CLI commands: 
    -    - By default, rsyslog replaces tab characters and newlines with their codes when writing to a text log. To disable this, create a file ''/etc/rsyslog.d/fastdpi.conf'' with the setting <code bash>global(parser.escapeControlCharactersOnReceive="off")</code> or use the ''journalctl'' utility. Example: <code bash>journalctl -t fastdpi -p 4 --since "1 hour ago" -o verbose --output-fields PRIORITY,MESSAGE</code> +    - ''pcrf connect show'' — show current status and accumulated statistics for PCRF connections. 
    -    - Logs can be redirected to a remote server. Example from ''/etc/rsyslog.conf'': +    - Force connection to the specified PCRF ''pcrf connect switch [<pcrf_index>]'', where ''<pcrf_indxed>'' is the index of the connection line in the ''auth_server'' parameter. If ''<pcrf_indxed>'' is not specified — defaults to 0. 
    -      - On the local server with fastdpi:<code bash>*.*  action(type="omfwd" target="192.0.0.1" port="10514" protocol="tcp" +  - [IPFIX DNS] Added the ability to send DNS MX responses via IPFIX. Enabled by setting bit 3 (4) of the ''ajb_save_dns'' parameter
    -            action.resumeRetryCount="100" +
    -            queue.type="linkedList" queue.size="10000")</code> +
    -      - On the remote server:<code bash>input(type="imptcp" port="10514" +
    -      ruleset="writeRemoteData") +
    -ruleset(name="writeRemoteData" +
    -        queue.type="fixedArray" +
    -        queue.size="250000" +
    -        queue.dequeueBatchSize="4096" +
    -        queue.workerThreads="4" +
    -        queue.workerThreadMinimumMessages="60000" +
    -       ) { +
    -    action(type="omfile" file="/var/log/fastdpi.log" +
    -           ioBufferSize="64k" flushOnTXEnd="off" +
    -           asyncWriting="on")</code>+
      
     +====Changes in version 14.0 BETA4.3====
     +  - [DPI] Added FakeTLS protocol (49319) with validation
     +  - [BRAS][DHCP] Changed: sliding window algorithm for rate limit
     +  - [BRAS] Fixed: time comparison error when loading ip_prop from UDR
     +  - [VLAN-Rule] Added support for 'any' instead of '*' when describing VLAN range <code>
     +'*.*' is interpreted in bash command line as a file search mask, so now instead of '*', you can specify 'any' ('*' is still supported):
     +'any.any' - equivalent to '*.*'
     +'any' - equivalent to '*'
     +'68.any' - equivalent to '68.any'
     +'any.78-90' - equivalent to '*.78-90' </code>
     +  - [BRAS] Removed support for DHCP-Dual (moved to next release)
     +  - [DPI][LOG] Messages about insufficient SSL parsers are written to the slave log not for every event, but at a frequency of 1/50000.
      
     +====Changes in version 14.0 BETA4.4====
     +  - [DPI] Added protocols ZALO_CALL(49320) and VK_CALL(49321)
     +  - [DPI] Fixed blocking in hard mode for SSL
     +  - [Acct] Added attribute ''VASExperts-Service-Type''. Radius acct start/interim/stop sends the authorization type in the ''VASExperts-Service-Type'' attribute.
     +  - [CLI] Added: ''stat flow ip6'' command to display IPv6 flow statistics
     +  - [CLI] Added: ''stat flow ip4'' command to display IPv4 flow statistics. Analogous to the output in ''fastdpi_stat.log''.
     +  - [IPFIX] Fixed ExportTime formation error in IPFIX Fullflow
     +  - [CLI] Added ''stat netflow'' command. Displays general statistics for Netflow/IPFIX (same as in ''fastdpi_stat.log'' under the "Statistics on NFLW_export" section)
     +  - [DNS] Added support for substitution/blocking/dropping of DNS requests A, AAAA, MX, HTTPS
     +  - [CLI] Added ''stat firewall'' command
     +
     +====Changes in Version 14.0 BETA4.5====
     +  - [DPI] Added BIGO_CDN protocol (49324)
     +  - [DPI] Added UDP support for BIGOTV
     +  - [PCRF][L2TP] Fixed: NAS attributes for L2TP during authorization
     +  - [BRAS][L2TP] Fixed: data race when closing sessions
     +  - [DPDK] Removed deprecated rx channels settings and related checks
     ====Update instructions==== ====Update instructions====
     You can check the current installed version with the command below You can check the current installed version with the command below
    Line 75: Line 120:
     </code> </code>
        
    -Downgrade to 13.1:+Downgrade to 13.3:
      
     <code bash> <code bash>
    -yum downgrade fastdpi-13.1 fastpcrf-13.1+yum downgrade fastdpi-13.3 fastpcrf-13.3 dpiutils-13.3 fastradius-13.3 
     </code> </code>