- Add x509-public-key-format identity to crypto-types
- Add certificate node to web services container
- Use certificate from ietf-keystore as web cert
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix technically does not need to start dbus and dnsmasq before confd
has loaded the system startup-config. So we move it in time to save
some CPU cycles for confd & C:o.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Increase Zebra NETLINK buffer to fix reported issues with zebra being
out of sync with kernel routes and interface changes.
Also, try '-a' option to allow other processes to delete zebra routes.
Other changes in this commit:
- Minor fixes to Finit service files for consistency
- Empty daemon.conf stub files to silence bogus mgmtd errors at startup
- Relocate all skeleton files from board/common to separate from files
that are actual Infix additions and what's package system integration
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename BR2_PACKAGE_NETD_FRR to BR2_PACKAGE_NETD_FRR_GRPC to match the
naming convention of the other FRR backends (VTYSH, CONF) and make the
intent self-evident.
Have the gRPC backend select BR2_PACKAGE_FRR_GRPC so FRR is built with
gRPC support when — and only when — this backend is chosen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a simpler approach than both grpc and watchfrr. Since we only
really need dynamic handling of static routes (for DHCP), we can track
changes made and maintain a "diff engine" for the resulting frr.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This includes adding a netd-daemon since FRR has gone towards all
daemons should be configured from mgmtd using YANG, netd uses gRPC to
reconfigure in mgmtd
Signed-off-by: Enable grpc
Previously the sys-cli group was for interactive shell access, but with
ever changing requirements this split has become necessary.
This commit introduces the 'sysrepo' group for low-level access to all
sysrepo commands, i.e., bootstrap only. For user-level shell access a
'klish' group is added which allows users to connect to the CLI. This
is now the only group users, including the default 'admin', are members
of, effectively making the new 'copy' tool the norm.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- dnsmasq:
- allow listening to all interfaces again to serve DHCP leases
- disable most of the default DHCP options, keep broadcast and
netmask because when dnsmasq can infer these they are better
than breaking networking for clients -- note, they can still
be overridden from global/subnet/host scope -- and for relay
setups they need to be supplied anyway
- confd:
- drop per-interface dnsmasq, although practical for many use-cases,
having a per-subnet focused server means improved integration with
future stand-alone dhcp relay setup
- implement suggested, simplified, yang model
Fixes#703
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change introduces the configuration of the tx-interval parameter
for the LLDP service, allowing control over the frequency of LLDP hello
messages. This improvement eliminates the need to toggle the interface
down and up to force the emission of LLDP packets in the test
environment.
The Avahi daemon needs to be restarted when changing its configuration
file in /etc/avahi/avahi-daemon.conf, not sufficient to SIGHUP.
Also, minor reformatting for new style.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The mDNS daemon, Avahi, is very verbose in its syslog output. So much
that it often overshadows other subsystems, and on switches and routers
with more than the "normal" amount of ports and interfaces, it quickly
becomes unbearable.
The patches consist of:
- Add -l LEVEL support to avahi-daemon
- Add missing casll to setlogmask() in libdaemon:daemon_set_verbosity()
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix lack of syslog messages from Zebra and add support to easily enable
debug logs for common Zebra subsystems.
Same change made to ospfd for symmetry.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows a user to specify a specific 169.254/16 address that
the zeroconf client starts with when probing for a free address. If the
probe fails it falls back to its default algorithm.
Fixes#628
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With this patch, users not in the NACM admin group and a login shell set
to clish can now log in to the CLI. Prior to this change only members
of the UNIX group 'wheel' could open the klishd socket.
The patch adds another group, 'sys-cli', which acts as a capability for
users. An admin user (member of the admin group) will now be member of
both the UNIX 'wheel' and 'sys-cli' groups. A non-admin user that has
shell set to 'clish' will only be member of the 'sys-cli' group. Other
users will not be mapped to any UNIX group and have only permissions set
in NACM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor setup to automatically redirect http -> https, dropping
the /browse location for now.
Also, log to syslog, which has log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On every system reconf (initctl reload) the .conf files are evaluated
again and log notices about skipping alternative syslogd enties are
logged.
We know that we run the udevd dependend syslogd entry, and everything
else basically in runlevel S depends on it, so not much else would work
if syslogd didn't start. So we can safely set 'nowarn'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Classic builds don't have udev but rather mdev or mdevd. This patch
imports support from myLinux for conditionally starting sysklogd on
classiic builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since watchdogd may need to run with SCHED_RR, when the supervisor is enabled,
which is not supported by cgroupsv2, we ask Finit to always runs it in the
root cgroup. We must also raise the limit for rtprio to all possible values
for SCHED_RR that a user can set in /etc/watchdogd.conf
Finally, add support for reading extra args from /etc/default/watchdogd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very limited part of the YANG model is implemented so far, basicly it is OSPFv2 with multiple areas and you can change timers
for the interfaces. Limited operational support.
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> leave
Normally, no logins are actually possible, but this will have two
desirable effects effects:
- /etc/issue will be printed when hitting return over the console,
allowing the user to see the bootstrapping errors again, without
having to reboot the system.
- On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can
login as root and debug issues.
When Infix Fail Secure Mode ends up in RMA state, runlevel 9, we should
not allow Finit to "time out" and give us a login prompt. Instead we
disable all login services in runlevels 7-9, reserving these extra
levels for future failure modes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd and BusyBox syslogd can not run at the same time. Since they
provide the same service we standardize on them providing <pid/syslogd>.
Also, ensure syslogd does not start until the fifth udevadm has completed.
This creates a barrier preventing other run/task/services from starting
too early. Thus guaranteeing a proper boot order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change addresses a problem accessing Infix over SSH. The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.
The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.
As before this change, the script starts by calling `sshd -t` to verify
they hostkeys. Unlike before we now check for 'invalid format' in the
output of that command. If any file with invalid format is found, we
remove them and regenerate the hostkeys.
In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.
Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, for usability, add `name:<SVC>` to each service declaration so they
can be located more easily and/or enabled/disabled using the service they
provide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops auto-enable of services we want to be able to control
via NETCONF/YANG. SSDP and mDNS/SD enable/disable configure support,
using native models, will be included in the same PR and LLDP+SNMP may
come later, using std. IEEE/IETF models, they are not critical atm.
Fix#118
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- allow custom options sourced from optional /etc/default/smcrouted
- don't enable smcrouted by default when enabled in Buildroot .config
because normal use-cases require an /etc/smcroute.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without --force-bind, the address is removed if another routable
address is added to the interface.
While this is likely something that should be configurable in the
future, we choose this mode as the default so that IPs used for
NETCONF connections are not dropped because other addresses are added.
