Even though dnsmasq only listened to requests from 127.0.0.1, port 53
was visible using nmap. We only use dnsmasq as a local resolver, so
we can safely change the config to bind to loopback instead, and at
the same time get less noise from nmap scans.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds a landing page, generated from the top README.md. It
is a temporary fix before adding a proper web ui.
Run ./gen.sh from the directory to update index.html using the template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate all nginx .conf files to board/common/rootfs/etc/nginx/ and
introduce available/*.conf with symlinks to enabled/*.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Align both qemu targets for 'make run' to use kvm with tcg as fallback
and -cpu max instead of guessing. This allows running Infix on systems
that do not have, or do not allow, kvm acceleration.
This is a temporary fix before we refactor 'make run', see issue #388
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor setup to automatically redirect http -> https, dropping
the /browse location for now.
Also, log to syslog, which has log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit implements Infix mDNS TXT records, version 1, for available
services. Hard coded for the moment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With Classic builds out of the way we can move everything back to common
again to simplify and reduce our collective cognitive overhead a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Classic builds served for a while as an introduction to classic
embedded systems, with a user managed read-writable /etc. Today we
decided to firmly take the plunge into the future with NETCONF and
focus on our core platforms aarch64 and x86_64 (for Qemu).
The reasons are several: reduce overhead, simplify build and release
work, as well as manual testing, since Classic builds do not have any
automated regression testing.
The Classic builds may be resurrected later in a dedicated project.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On any change to a container network interface we should schedule a
restart of the container to activate the changes. This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.
This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.
Fixes#375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, log the actual `podman create` arguments to the container log so
we can see what the script actually does when customers report bizarre
happenings with containers.
Fixes#370
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add exception for local images, the "pull" step must be handled by the
operator, i.e., wget of the latest image to the same location as set up
in the image configuration, e.g., for oci-archive:/tmp/foo.tar.gz that
/tmp/foo.tar.gz exists when issuing the upgrade command.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only port 2 has an SGMII compatible SERDES. When referencing the
SERDES (comphy), the second argument must contain the port number in
order for the comphy driver to pick the correct configuration.
While __get_phandle_array returns the empty set when the property is
not available, str_array would return None, unless instructed
otherwise. Make sure that it also returns the empty set.
With the changes in 9847a8f we can keep the /etc/motd file with a proper
newline at EOF so that also Classic builds make sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With a self-hosted runner we get the following classic error when
calling `make test-unit`:
make[1]: Entering directory '/home/runner/_work/infix/infix/buildroot'
/home/runner/_work/infix/infix/test/env /home/runner/_work/infix/infix/test/9pm/9pm.py /home/runner/_work/infix/infix/test/case/all-repo.yaml /home/runner/_work/infix/infix/test/case/all-unit.yaml
the input device is not a TTY
make[2]: *** [/home/runner/_work/infix/infix/board/x86_64/board.mk:14: test-unit] Error 1
This patch drops interactive from all non-interactive docker sessions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify the code a bit by passing the test file to the runner
function instead of checking it in every caller.
Signed-off-by: Richard Alpe <richard@bit42.se>
As of 4768cae6, we can use conserver/telnet to connect to the docker0
bridge IP:90XX, where XX is DUTXX. This was a great UX improvement
and this patch set aims to further the experience by:
- allow running Infamy (infix-test container) completely rootless¹
- reduce the expsed port range 50->10 (can be improved further)
- use 'podman --publish-all' ports, which allocates ten random
ports for the exposed Qemu telnet ports
- add Quick Start Guide to doc/testing.md
This restores the possiblity of running multiple "make test-sh"
instances, e.g., when multiple users share the same server.
The 'console' script included in this commit uses 'podman inspect' to
find the port number for a given DUT, and optional instance. It takes
either the console/dut number (1-N), or the dut name from the topology.
Also in this commit:
- set hostname for easy identification (for console script)
- set conatainer --name to hostname
- adjust workdir from buildroot to infix/test
- simplify PS1 and add time to prompt (when did the test finish?)
When running 'make test-sh' the prompt now tells you which instance you
are running, e.g., infmay10. Calling 'console 1 infamy10' connects to
console 1 (port 9001) on the infamy10 instance.
For more information, see the Quick Start Guide in doc/testing.md. It
shows how to use the new helper scripts: console and shell.
Fix#227
_______
¹) devs using podman, instead of docker, with slirp4netns installed, can
run the infix-test container completely rootless. We like this, and
as of today podman is our recommendation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Because sysrepo callbacks are threaded and factory-default RPC is called
from a separate subscription (to prevent blocking), we cannot prevent
ietf-intefaces.c from being called before infix-containers.c, regardless
of the priority we set for our subscriptions.
When assigning a physical network interface this becomes a bit of a pain
during factory-default RPC since the physical interface is hidden from
the host network namespace.
So, when applying factory to running, we check each interface if it was
a container-network previously, if so we call on the container script in
the exit of the current dagger generation to move the interface back to
the host netns.
This affects all other functions that assume interfaces only live in the
host netns. To that end a set of new helper functions have been added
to wrap iproute2 commands in nsenter when the interface lives elsewhere.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Tobias Waldekranz