This patch introduces basic user authentication support via sysrepo.
Namely it adds:
* The ability to create or delete a UNIX user.
* The ability to set or delete a UNIX user password.
The password needs to be hashed and in a UNIX shadow format, such as
"$ALG$SALT$HASH". We want to avoid the handling of clear text
passwords as much as possible. In the meanwhile, passwords
can be generated in the infix shell using mkpasswd.
CLI Examples:
Add a user:
configure> set system authentication user foo
Delete a user:
configure> delete system authentication user foo
Set a user password:
configure> set system authentication user foo password ...
Signed-off-by: Richard Alpe <richard@bit42.se>
This is very ugly, what we really want is that the commit_done_hook()
runs when *all* DONE events have been processed in all models. The
side-effect of this hack is that the callback is run twice, both for
ietf-systm and ietf-interfaces if both are modified.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a first Infix model to augment ietf-ip with a node,
similar to the IPv6 'autoconf' node, also for IPv4. For IPv6 the
autoconf feature comes built-in, for IPv4 it is defined in RFC3927.
The setting behaves the same as for IPv6, but in the case of IPv4 we
enable avahi-autoipd per interface to acquire the 169.254/16 address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The init_next_gen() function moves us to the next generation, as well as
intialize all data files for expected interfaces in that generation.
However, bridge and lag interfaces have dependendcies that need to be
moved as well. It is only the test author that knows the expected new
state, so this function only sets up the desired state, without ever
looking at what any previous generation looked like.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With more advanced interface types we cannot use create_iface() to set
up the file structure in new generations. This commit adds a _data()
function that should be used instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The net tool traverses the graph and executes the scripts et al in
postorder, i.e., all leaves are evaluated first before the parent's
script is run. Hence, attaching ports to a bridge or link aggregate
is the responsibility of the parent, not the leaves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For instance, when adding ip command to the ip pipe we need the kernel
to execute those commands before the bridge command pipe is executed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Host tools and target are often out of sync, sometimes because we need
to run a newer version of iproute2 with more features. By installing
tests to target we can still verify basic functionality, provided the
tests verify their dependencies and exit 77 (SKIP).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Simplify build process, including cross compilation
- Add basic test framework, available as `make check`
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Run with unshare, as so:
make clean; make; cd test/
unshare -mrun ./three-independent.sh
This sets up a test directory in /tmp/net, creates three independtent
interface configs for dummy interfaces. Activates the config with a
call to `net -vd apply`, and then verifies the result using a mix of
ip link/addr and jq magic.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling net prevsiouly meant `net do`, the new separation is to be able
to add `net up` and `net down` commands, with optional interface args.
The idea is to support the same semantics as `ifup -a` of `ifup foo`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
