Turn on OOPS-to-panic, soft/hard lockup panic, hung-task panic, and
extra workqueue watchdog reporting. This makes latent stalls visible
instead of silently freezing, improving diagnosis of issues like the
recent resource-pressure lockup.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backported from origin/main 5420fb01f2
Includes the latest DRAM ECC status, with/without sudo, and temperature.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of the following commits from origin/main: 3b24fabe6a04fb92e80b4ad969653e03ece21256a8b7d91e4d26e3110977ab4f83fbc6
---
cli: fix 'copy FILE running-config' use-case
When copying to the running datastore we cannot use sr_copy_config(),
instead we must use sr_replace_config(). This fix covers both the case
of 'copy startup-config running-config' and 'copy FILE running-config'.
Fixes#1203
---
cli: add 'validate', or '-n', dry run to copy command
This commit adds config file validation to the copy command, discussed
in #373. Allowing users to test their config files before restoring a
backup. The feature could also be used for the automatic rollback when
downgrading to an earlier version of the OS.
Fixes#373
---
cli: fix copy to missing startup-config file
Fixes#981
---
cli: restrict copy and erase commands
This is a follow-up to PR #717 where path traversal protection was
discussed. A year later and it's clear that having a user-friendly
copy tool in the shell is a good thing, but that we proably want to
restrict what it can do when called from the CLI.
A sanitize flag (-s) is added to control the behavior, when used in the
shell without -s, both commands act like traditional UNIX tools and do
assume . for relative paths, and allow ../, whereas when running from
the CLI only /media/ is allowed and otherwise files are assumed to be
in $HOME or /cfg
---
cli: sanitize regular file to file copy
The regular file-to-file copy, was missing calls to cfg_adjust(), this
commit fixes that and adds some helpful comments for each use-case.
Also, drop insecure mktemp() in favor of our own version which uses the
basename of the remote source file.
---
bin: add bash completion for copy command
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
---
bin: copy: Refactor
copy() made some...creative...use of control flow that made it quite
difficult to follow.
Take a first priciples approach to simplify the logic.
---
bin: copy: Always get startup from sysrepo
This will make sure to apply NACM rules for all the data. It also
makes it possible for a luser access a subset of the data, even if
they to do not have read access to /cfg/startup-config.cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prevent patch releases from stealing the "latest" tag from newer minor
versions. Only vXX.YY and vXX.YY.0 releases should be marked as latest.
Fixes#1187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Actually disable iitod on Styx DCP-SC-28p to work around #670, this
prohibits software control of LEDs, leaving the default HW control,
which has proven more stable on this platform.
Backported from origin/main b0dce8a05e
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
It should be possible to create test reports manually, so logically
the GitHub workflow should call a make rule in test.mk
Untested: branding, or any case where Infix is used as a BR2_EXTERNAL
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix a bug where systems with OSPF enabled on some, but not all,
interfaces would cause the OSPF iterator to fail when accessing
iface['area'], which was missing. This caused the ospf_status.py
tool to return {}, resulting in empty OSPF data in sysrepo.
Fixes#1169 Expected neighbors not shown in sysrepocfg
Signed-off-by: Richard Alpe <richard@bit42.se>
Add concurrency control to trigger workflow to cancel in-progress builds
when new events (like adding ci:main label) occur on the same PR. This
prevents resource waste from duplicate builds and handles the common
workflow where developers add the ci:main label after PR creation.
Fixes#1154
This branch can be used to test push events which is especially
useful when working on the CI infrastructure.
Signed-off-by: Richard Alpe <richard@bit42.se>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually the CNI bridge plugin "takes care" of enabling IPv4 forwarding
on all interfaces, see issue #1125, but when the container tests are run
in a different order from the infix_containers.yaml, Infix may reset the
IPv4 forwarding on this critical interface.
This change is both future proof and also ensures the test works as it
was intended even if tests are run out-of-order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As Infix matures as an operating system it is quickly becoming more and
more useful also for end-device use-cases. The README should reflect
this change in focus.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
