Adhere to our recommendations and avoid pseudorandom passwords which
are "easy to remember". Also increase password length to 13 chars.
Side notes:
Knowing that a password contains at least one char, one number and so
on, lowers the number of possible passwords to test when brute forcing.
The entropy for the pwgen "easy to remember" passwords isn't good
(naturally).
Signed-off-by: Richard Alpe <richard@bit42.se>
Add counters from Ethtool groups to the operational datastore. The
mapping from Linux / Ethtool to YANG is described in the included
document eth-counters.md.
Signed-off-by: Richard Alpe <richard@bit42.se>
A list of interfaces: x10 x9 x8 x7 x6 x5 x4 x1 x2 x3 should be sorted in
order with x10 last. Using the common 'sort -n' would generate: x1 x10
x2 ... so we use version sort. This way we can ensure that the order of
bridge ports is natural and what end users expect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Operational experience shows that the current Infix Fail Secure mode,
introduced in ca9daef, does not work in practice.
The factory datastore in sysrepo is created at boot with the YANG models
and the factory-config file. When the factory-config file is generated
from older versions of these models, the resulting datastore may fail to
pass the validation and system will end up in an unrecoverable state.
Instead, both the factory-config and failure-config must be created at
every boot to match the YANG models in the active Linux image. This
ensures loading the YANG models will always work and the system can
proceed to attempt to load startup-config to the running datastore.
If loading startup-config fails we can fall back to failure-config,
which like factory-config, will then provide a way to log in an dianose
the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This implements the new model infix-if-vlan.
The new CLI is:
root@infix-00-00-00:/config/interfaces/interface/vlan10/> set vlan id 10 lower-layer-if eth0
with an possible extra option for tag-type, default tag-type is c-vlan.
Without it, the offset generated will always be zero.
But over netconf it will still be correct, most likely
because due to how libyang handles the date-and-time type.
DSA ports such as pX has "link" (parent) set to dsaY. We don't see it
that way from an networking perspective. In this commit we avoid
adding parent to the statd data structure if the linkinfo -> info_kind
is dsa. This means the ports shows up as regular interfaces, which is
what we want.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds the framework for reading ethtool statistics and
inserting it into the operational datastore.
The ethtool data we rely on is "group data" such as "eth-mac" or
"rmon".
This data can be displayed using:
ethtool --json -S e0 --all-groups
The "group data" is still missing for most common drivers, so testing
this will require a firmware which has support for it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Regenerate if either factory-config.gen or failure-config.gen is missing.
This should not happen, but is better to check for the result rather than
the intermediate result.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Marvell mv88e6xxx switch driver currently used in active projects do
not support multicast router ports properly yet. Considering that Infix
do not yet have YANG support for configuring IGMP/MLD snooping, we have
decided to disable it in bridge setups by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Overzealous shellcheck application lead to gen-intefaces not creating a
bridge when GEN_IFACE_OPTS was uncommented in /etc/confdrc
Verified in customer br2-external.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New script 'error' that can be overridden by a br2-external
- Call 'error' if YANG model bootstap or factory-config.gen fails
- Call 'error' if loading startup-config or failure-config fails
The 'error' script calls syslog¹ to log the error messge:
The device has reached an unrecoverable error, please RMA.
____
¹ to get a timestamp log message, and send remote in case a
br2-external has somehow hard-coded network for remote syslog
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This rather huge change is a refactor of the factory-config generataion to add
support for also generating a failure-config.
The confd bootstrap script has been given an rc file. This both eases manual
testing, when modifying the script(s), and also makes it easier to override
from a br2-external. Infix default is router/end-device, but a br2-external
may be a switch firmware and want to default to all ports in a bridge.
The generated failure-config creates a fail-safe "do no harm" config to boot
with in case startup-config for some reason is broken or cannot be applied,
e.g., bug in confd. Meaning, for both the router and switch use-cases the
device will start up with all interfaces isolated¹, with an IPv6 SLAAC (EUI64)
address per interface.
Services enabled in this fail-safe mode are: LLDP, mDNS/SD, SSH, and NETCONF.
All to facilitate diagnostics, troubleshooting and device recovery.
Other noteworthy changes include:
- rename factory/failure directories again -> factory.d/failure.d. Use
same naming as we do on target for directories holding generated files
- The bootstrap script no longer regenerates /cfg/factory.d on each boot
- The bootstrap script copies all static templates to /cfg/factory.d in
case a newer image changes the contents of them. For troubleshooting
- Support for overriding the 20-interfaces.json generation by br2-external
- Support for additional 30-config.json (ovrride/extend) by br2-external
- Expand gen-interfaces to support bridge use-case.
_____
¹ For a switch this means "no switchport", i.e., no switching between ports
otherwise connected to a switchcore (or bridge) in startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only create a default startup-config from factory-config if one is missing.
Do not load an existing startup-config, that is handled by a later step in
the boot process, which needs to be monitored (and displayed) separately to
fail over to a Fail Secure mode on error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes to the system concerning access rights, like users, should always
be logged, in particular when creating new users or failure to create or
modify their properties.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle IPv6 Router Advertisement (RA) based addresses.
If the last 64 bits of a link-local address is generated using the
local MAC address of the interface, i.e. a EUI-64 based address. Then
the origin is set to "link-layer".
If the addrgenmode is set to "random" instead of "eui64", then the
device will generate the interface identifier portion of the address
(the last 64 bits) randomly rather than deriving it from the MAC
address using the EUI-64 process. This will result in a "random"
origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
Setting the link MTU in Linux changes the sysctl IPV6 MTU, so we have to
set the IPv6 MTU on each run in case the IPv4 MTU changes. Hence, this
also means the IPv6 MTU must be set *after* the IPv4 (link) MTU.
statd has been updated to read the sysctl setting for IPv6 MTU.
Notice how the loopback interface is unsupported for config + status.
Fixes issue #151
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting deviations of non-supported parts of ietf-ip
Idea is that "pyang -f tree ietf-ip.yang infix-ip.yang" should
show what we really support (and should make tests for).
Only physical interfaces have a permanent link address. So in order to
restore the default MAC generated by the kernel for interfaces such as
bridges, veth pairs, VLAN interfaces, and link aggregates, we recreate
them.
This patch adds support for checking if the phys-address attribute has
been deleted from bridge, vlan, and veth interfaces.
The netdag_must_del() function has been refactorored slightly so each
interface type is responsible for returning true if its condiitions are
satisfied.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Override read-only flag in YANG model
- Add support for setting custom MAC
- Add support for restoring permanent/original MAC
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable privacy feature, allows true random address instead of EUI64
- Allow global addresses to use router prefix
Fixes#136
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set the IP origin "random" for avahi IPv4LL addresses. The reason we
use random and not link-layer for link-local IPv4 addresses is the
fact that they are not based on link-layer info, such as IPv6 eui64
generated LL addresses.
Signed-off-by: Richard Alpe <richard@bit42.se>
Modify existing IPv4 code to also add IPv6 address data to the
operational datastore. Also add support for handling link-layer IPv6
address.
IPv6 LL addresses generated with eui64 has "link-layer" origin
and random/secure generated LL addresses has "random" origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
There might be more places in confd where this is needed. This works
for the most basic use case.
The proto set here is picked up by statd and converted into a YANG
origin, which is exposed to the user.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add protocol from ip route (kernel) as origin in YANG model.
Note, we control the names static and dhcp in the file rt_addrprotos.
Signed-off-by: Richard Alpe <richard@bit42.se>
