Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change, the system would move to runlevel 9 as soon as
startup-config failed to load, in which no getty is allowed to run.
Instead, we want to reserve that runlevel for when failure-config
itself also fails to load, since the system will have no valid login
credentials at that point.
Currently we only advertise SSH+SFTP services over mDNS-SD, which are
the default services from the avahi package. This patch adds support
for _netconf-ssh._tcp as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Operational experience shows that the current Infix Fail Secure mode,
introduced in ca9daef, does not work in practice.
The factory datastore in sysrepo is created at boot with the YANG models
and the factory-config file. When the factory-config file is generated
from older versions of these models, the resulting datastore may fail to
pass the validation and system will end up in an unrecoverable state.
Instead, both the factory-config and failure-config must be created at
every boot to match the YANG models in the active Linux image. This
ensures loading the YANG models will always work and the system can
proceed to attempt to load startup-config to the running datastore.
If loading startup-config fails we can fall back to failure-config,
which like factory-config, will then provide a way to log in an dianose
the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to run "resolvconf -u" at boot we need dnsmasq up and running
and startup-config having been loaded successfully. (No point when we
hare in fail secure mode.)
If this bugs out it can be pinpointed by an empty /etc/resolv.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We should only call 'error' in case loading failure-config fails, not if
loading startup-config fails. Unclear how this passed testing, must have
been a last minute change that got untested.
Found during integration in customer's br2-external.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything else is named confd, even syslog messages are logged as
confd, and we've talked about not using sysrepo-plugind one day, so
let's prepare for a world where everthing is like that.
Also, and even more importantly, fix the sysrepo-plugind condition.
We cannot use <pid/syslogd>, because it can be restarted and thus
consequently Finit will stop sysrepo-plugind. This first caused a
bit of head scratching because it cause a lot of very odd errors in
the execution of sysrepo-plugind, transactions being abruptly aborted
for instace.
Whatt we can do, however, is use a static condition, which Finit has
support for since a few releases now. We want to guard the start of
our sysrepo-plugind service behind YANG /usr/libexec/confd/bootstrap.
So we can use <run/bootstrap/success>. In case the bootstrap fails,
we catch that in the row before using if:<run/bootstrap/failure> to
trigger the /usr/libexec/confd/error script (described previously).
The other run/task/services can be guarded behind <pid/confd> and now
everything suddenly makes sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New script 'error' that can be overridden by a br2-external
- Call 'error' if YANG model bootstap or factory-config.gen fails
- Call 'error' if loading startup-config or failure-config fails
The 'error' script calls syslog¹ to log the error messge:
The device has reached an unrecoverable error, please RMA.
____
¹ to get a timestamp log message, and send remote in case a
br2-external has somehow hard-coded network for remote syslog
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running `make legal-info` Buildroot will collect source and
licenses for all packages, which generates a few warnings for our
local packages. Local packages are skipped.
> The source code for packages that set <PKG>_REDISTRIBUTE = NO will not
> be saved. Patches that were applied are also saved, along with a file
> named series that lists the patches in the order they were applied.
Hence, setting 'foo_REDISTRIBUTE = NO' disables the warning, which seems
like a good idea to reduce the number of unnecessary questions we might
otherwise get.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything (!) potentially shared with other sysrepo plugins/daemons and
helper functions (not yet in libite) that can be used by other daemons
have been relocated to libsrx.
Fix#116
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This further locks down confd to fall back to /bin/false as login shell
in case of internal errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some reason, the `make license-info` target complained klinfix
needed a hash file, but not the other local repos. Issue #67 tracks
adding license-info to releases, which will need some looking into,
for now this fixes the most glaring packaging oversights.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This script has some seriously sharp edges. Today two devs cut their
fingers on it trying to get new functionality in place. One when, in a
attempt at, adding an innocent status daemon, and another setting up a
client repository with a custom, enabled-by-default, daemon. In both
instances this script happily cleaned out the deamons from enabled/.
A better alternative, as described in issue #74, is to be stricter on
what is enabled by default, and for things we feel provide value in the
Classic build, maintain a separate list of symlinks in its meta board
definitiion instead.
Also, clean out previous attempt at factory-config. Now that we have
the auto-factory support in place we don't need this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical data shows response times of over 10s for even simple config
changes on heavily loaded systems (non-accelerated VMs with lots of
stress on the host). So we choose a really large number, hoping that
we won't be back here for a while.
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rudimentary support for setting login shell for new users. Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.
Follow-up to f5866ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This allows you to define a single "logical" config that can be
tailored to the specific system based on the available interfaces,
base MAC address etc.
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Still ways to go here, eth0 should be in a bridge with a vlan1 interface
on top, which in turn should have this config. But let's start here, it
works! :-)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to, as a plain Infix default, start up devices with DHCP and
IPv4LL/ZeroConf and IPv6 link-local address. Using mDNS the user can
then and push a NETCONF configuration over SSH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When researching the systemd tmpfiles.d implementation I discovered the
effort to standarize on /usr/share/factory as a generic factory defaults
for Linux systems. This patch adds a small example factory.cfg file
that is installed as /usr/share/factory/cfg/startup-config.cfg. The
tmpfiles.d backend will then install it as /cfg/startup-config.cfg if
that file is missing at boot. Confd does the rest to bootstrap our
(by default) empty sysrepo db with this startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds a hook to the startup datastore, we use the ietf-system
module because the module argument is mandatory. The hook runs when all
changes have been saved to the internal store. Since sysrepo has many
startup files in /etc/sysrepo, we saving a JSON copy of all these files
in /cfg/startup-config.cfg, which is persistent. On system bootstrap
this file is merged into the (empty) running datastore, which is what
the sysrepo maintainers recommend to be independent of any yang model
updates that might occur on image upgrades.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
