Temporary fix to prevent odd log messages. The fix is to add RAW VLAN
support to mcd so it can run as a proxy querier even if there is no
upper VLAN interface or IP address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds validation of bridge port VLAN memberships and IP
addressing for VLAN filtering bridges:
1. Ports must be a member of this bridge
2. Ports cannot be tagged and untagged member at the same time
3. A VLAN filtering bridge does not support IP addressing
A VLAN filtering bridge can only be a tagged member of a VLAN. Any IP
addressing needs to be done using an upper VLAN interface.
NOTE: while technically possible break up these long must expressions
into multiple must expressions per node (split at 'and'), it will
break libyang in interesting ways that in turn make the confd
inference functionality stop working. E.g., creating VETH pairs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port in a VLAN filtering bridge should be possible to configure
as "tagged only", i.e., to not assign ingressing untagged frames a VLAN
and instead drop them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch prevents statd from failing and logging errors on interfaces
currently in another network namespace.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes a runtime error triggered by modifying an interface
currently used by a container. The CNI code must always return the
CNI status (reserved for container or not).
How to trigger:
- Create veth pair
- Make one end container-network and add to container
- Leave
- Return to configure and set an IP address on container interface
- Leave - BOOM
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify interface generation by collapsing eth_ and ethlike_ifaces to a
single list. Let gen_iface_json() determine interface type by querying
each interface. This allows us to create bridge setups also for qemu
use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a VLAN filtering bridge setup we want to be able to support an
external IGMP/MLD querier running from userspace, because the bridge
multicast code can only generate proxy/NULL querys per VLAN.
This patch is a refactor to allow just that. If a VLAN on the bridge
has an upper interface, matching the bridge name and VID, we generate
a profile for querierd and enable the service.
For all other cases we try to disable any running querierd. It is up
to the daemon to figure out if it has a usable IP address to use as
the query source IP or use 0.0.0.0.
Since the logic for selecting a proper IP address must be handled by
the daemon in the per-VLAN setup, we revert back to also use it for
the stand-alone unfiltered bridge case as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An RFC conforming multicast snooping bridge should forward all unknown
multicast (IP & MAC) on ports where the mcast_flood flag is set. The
upstream kernel does not (yet) support this, but the KernelKit branch
of the kernel and iproute2 now support it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port cannot communicate on layer-3 while acting as a bridge
port. Removing the port from the bridge re-enables the link-local
addresses, if any, from the configuration.
Fix#327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, no VLAN id, or other VLAN specific information is contained in the
MDB entries, only forwarding information and per-port state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With VLAN filtering on a bridge we cannot use the mcast_query_use_ifaddr
mechanism. This because even if the bridge may have an address it is
likely not on the same subnet as that of the VLAN, and the multicast
code in the kernel does not look at VLAN interfaecs on top of bridge
for a relevant adddress.
For these cases we have to use querierd, or a multicast router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
This reverts commit f5e37bba58 because it
causes a regression in setting up VLAN filtering bridges. The bridge
itself, e.g., br0 currently does not have a bridge-port context at the
same time as it being bridge. The model does not account for that and
thus srx_get_int() for the br0 PVID will always fail.
Reverting this commit allows br0 to be tagged member in all VLANs by
default, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_*() family of APIs are for some callbacks in confd used to check
if a setting exists or not. The root helper function srx_vaget() always
logged an error if sr_get_items() failed. This has now been fixed and
only the srx_enabled() function still triggers this, because it has no
way of determining an error condition -- otoh it should never fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by openconfig-system[1], except the infix-system type is binary
to allow encoding an entire file, with optional control characters.
The openconfig-system model also carries login-banner, which is displayed
before login. This could be added later to infix-system to let the user
set an OpenSSH login Banner.
[1]: https://openconfig.net/projects/models/schemadocs/yangdoc/openconfig-system.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling strlen() returns a size that's one byte less than what's needed
to store the string, so when comparing with sizeof(), which returns the
number of available bytes, we must compare >= and not just >.
Found by GCC using 'make check'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When building for cppcheck/coverity we may get a stupid linker that can
wind up not finding, e.g., fexist() in libite (-lite) if it's not added
last in the list of libraries.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds out-good-octets and in-good-octets as augment in
the infix-ethernet-interface yang model. These counters represents
OctetsTransmittedOK and OctetsReceivedOK from ethtool.
Signed-off-by: Richard Alpe <richard@bit42.se>
Some customers do not need, or do not want, to be able to run
containers, so all NETCONF related daemons and applications
need to take this into consideration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds the optional 'user name' argument to the 'copy' command,
enabling using curl scp/sftp protocols for fetching and uploading files.
Changes to cfg_adjust() allow saving and referencing files in the user's
home directory. Useful for both fetching upgrade bundles and container
images.
The 'dir' command now lists files in both $HOME and /cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new klish symbol, shell@infix, which performs proper
droprivs before calling the configured shell.
Fix#298: track user id so shell command gets correct user
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers don't want unprivileged CLI users to be able to exit to
a shell. The shell is currently hard-coded to bash, but should be one
of the ietf-system shells, configurable --with-shell=foo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor is basically only an extra step after
copy source-ds -> dest-ds
to also
copy source-file -> dest-file
Which in the case of factory-config and startup-config is relevant. We
want to update the startup datastore, in case of additional commands,
but also the file /cfg/startup-config.cfg in case of consecutive reboot.
Fix#259 copy factory-config startup-config
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mattias Walström