This patch adds support for small incremental changes to bridge ports.
Changes where the libyang diff does not include a bridge reference so
that it will have to be synthesized from the current configuration.
For example, forgetting to set a port's PVID in a VLAN filtering bridge
setup, changing a bridge port's multicast flooding properties, or any
other per-bridge-port setting after the fact.
Fixes#349.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Temporary fix to prevent odd log messages. The fix is to add RAW VLAN
support to mcd so it can run as a proxy querier even if there is no
upper VLAN interface or IP address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds validation of bridge port VLAN memberships and IP
addressing for VLAN filtering bridges:
1. Ports must be a member of this bridge
2. Ports cannot be tagged and untagged member at the same time
3. A VLAN filtering bridge does not support IP addressing
A VLAN filtering bridge can only be a tagged member of a VLAN. Any IP
addressing needs to be done using an upper VLAN interface.
NOTE: while technically possible break up these long must expressions
into multiple must expressions per node (split at 'and'), it will
break libyang in interesting ways that in turn make the confd
inference functionality stop working. E.g., creating VETH pairs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port in a VLAN filtering bridge should be possible to configure
as "tagged only", i.e., to not assign ingressing untagged frames a VLAN
and instead drop them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes a runtime error triggered by modifying an interface
currently used by a container. The CNI code must always return the
CNI status (reserved for container or not).
How to trigger:
- Create veth pair
- Make one end container-network and add to container
- Leave
- Return to configure and set an IP address on container interface
- Leave - BOOM
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify interface generation by collapsing eth_ and ethlike_ifaces to a
single list. Let gen_iface_json() determine interface type by querying
each interface. This allows us to create bridge setups also for qemu
use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a VLAN filtering bridge setup we want to be able to support an
external IGMP/MLD querier running from userspace, because the bridge
multicast code can only generate proxy/NULL querys per VLAN.
This patch is a refactor to allow just that. If a VLAN on the bridge
has an upper interface, matching the bridge name and VID, we generate
a profile for querierd and enable the service.
For all other cases we try to disable any running querierd. It is up
to the daemon to figure out if it has a usable IP address to use as
the query source IP or use 0.0.0.0.
Since the logic for selecting a proper IP address must be handled by
the daemon in the per-VLAN setup, we revert back to also use it for
the stand-alone unfiltered bridge case as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An RFC conforming multicast snooping bridge should forward all unknown
multicast (IP & MAC) on ports where the mcast_flood flag is set. The
upstream kernel does not (yet) support this, but the KernelKit branch
of the kernel and iproute2 now support it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port cannot communicate on layer-3 while acting as a bridge
port. Removing the port from the bridge re-enables the link-local
addresses, if any, from the configuration.
Fix#327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, no VLAN id, or other VLAN specific information is contained in the
MDB entries, only forwarding information and per-port state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With VLAN filtering on a bridge we cannot use the mcast_query_use_ifaddr
mechanism. This because even if the bridge may have an address it is
likely not on the same subnet as that of the VLAN, and the multicast
code in the kernel does not look at VLAN interfaecs on top of bridge
for a relevant adddress.
For these cases we have to use querierd, or a multicast router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
This reverts commit f5e37bba58 because it
causes a regression in setting up VLAN filtering bridges. The bridge
itself, e.g., br0 currently does not have a bridge-port context at the
same time as it being bridge. The model does not account for that and
thus srx_get_int() for the br0 PVID will always fail.
Reverting this commit allows br0 to be tagged member in all VLANs by
default, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by openconfig-system[1], except the infix-system type is binary
to allow encoding an entire file, with optional control characters.
The openconfig-system model also carries login-banner, which is displayed
before login. This could be added later to infix-system to let the user
set an OpenSSH login Banner.
[1]: https://openconfig.net/projects/models/schemadocs/yangdoc/openconfig-system.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds out-good-octets and in-good-octets as augment in
the infix-ethernet-interface yang model. These counters represents
OctetsTransmittedOK and OctetsReceivedOK from ethtool.
Signed-off-by: Richard Alpe <richard@bit42.se>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Because sysrepo callbacks are threaded and factory-default RPC is called
from a separate subscription (to prevent blocking), we cannot prevent
ietf-intefaces.c from being called before infix-containers.c, regardless
of the priority we set for our subscriptions.
When assigning a physical network interface this becomes a bit of a pain
during factory-default RPC since the physical interface is hidden from
the host network namespace.
So, when applying factory to running, we check each interface if it was
a container-network previously, if so we call on the container script in
the exit of the current dagger generation to move the interface back to
the host netns.
This affects all other functions that assume interfaces only live in the
host netns. To that end a set of new helper functions have been added
to wrap iproute2 commands in nsenter when the interface lives elsewhere.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The interface name is already a unique qualifier, so we can simplify CNI
network naming to ease the burden when debugging.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
"Sloppy" because, for some reason, we don't get sysrepo update callbacks
for presence containers. I.e., when calling 'set container-network'
compared to 'edit container-network'.
Yes, I've gone over klish-plugins-sysrepo with a fine-toothed comb to
see if it's the culprit, but no, it seems to be sysrepo. Hence the
defaulting of the type also in the change path.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Review found quite a few strings that could be given an obvious pattern
or specialized sub-type, e.g. inet:ip-address, to restrict the input
data validation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the deprecation of CNI i Podman[1], and its upcoming removal in
Podman v5.0, we decided to cut our losses and modify all documentation
and models to become backend neutral. We will continue to use CNI as
long as possible -- it gives us host interfaces, for instance, that is
not part of netawark yet, it seems.
Also, sync mount and volume documentation with YANG model changes.
[1]: https://blog.podman.io/2023/11/cni-deprecation-and-removal-from-podman-5-0/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After discussions in the development team, and an external demo, we
decided to rename file mounts to just mounts and adopt established
nomenclature.
With this change we now allow mounting any type of file or directory
from the host to the container, for regular files/directories a bind
mount is used. We also introduce 'source' and 'type', to support
mounting of host files and directories, the destination path has been
renamed to 'target'. The mount cousin, 'volume', which basically is a
specialized mount, has also been updated to use 'target'.
The 'source' and 'content' are now hidden behind a YANG choice to ensure
users can only use them the intended way (either/or not both).
Initial models had 'destination' (path) as mandatory, with this change
we can reintroduce that to ensure this proper configurations.
The documentation in both YANG model and markdown has been updated,
significantly, to provide lots of examples.
Please note, glob style mounts have not been tested, at all.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When container configurations are not saved to startup-config and the
user reboot the system (or lose power) we will have lingering active
containers cached on persistent storage.
This patch adds a cleanup() function to the post hook, right before
we try to launch any new containers. This callback must be run for
all cases, even if the running-config has no containers configured.
Also, a minor amendment to volume pruning.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. add support for extracting, and finding the directory holding the
index.json metadata file in, OCI images. An archive in Infix is either
a .tar or .tar.gz archive, which we need to unpack for this version of
podman to be able to load them.
2. new RPC '/infix-containers:oci-load' calls 'container load' of an
OCI archive (tarball), optionally gzipped. The resulting image uses
the directory name of the unpacked tarball, so the container script
offers a way to retag the image after loading it.
First class citizens in container transport are docker:// and the OCI
family of URI:s. A docker:// URL, or a local docker-archive:path, is
assumed to be well formed, in which case we leave it up to podman to
handle.
Note: 'podman import' does not fully understand OCI formats. It drops
ENTRYPOINT and COMMAND, while 'podman load' handles things a lot
better. Only letdown is it does not support nameing the image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Rename container/container -> containers/container
- Collapse containers-state into containers
- Complete refactor of network/host-network for improved UX. A new
must expression ensure mutual exclusion between host and networks
- Rename entrypoint -> command, for consistency (overrides ENTRYPOINT)
- Move nodes around a bit for more logical placement in model
- Clean out all traces of a container on removal
- Rename container image_id -> image-id for consistency
The active queue is for tracking currently running containers, ensuring
only relevant changes are applied, and also for container image upgrade,
at the end of which these scripts are re-run to activate the new image
Also, fix misplaced '-f' when pruning unused volumes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop debug logs
- no need to restart upgraded containers, they restart automatically
- fix ordering in volume prune (when containers are removed)
- skip directories in container activation (inbox -> execd queue)
- Fix 'container pull IMG creds USER[:PASS]' bug, extra '=' variable
assignment inside infix.xml
- Fix 'container run IMG CMD ARGS' to actually put the CMD in
ENTRYPOINT and append ARGS to image. The podman run and create
commands are *not* behaving the same way
- Rename 'attach' to 'exec', execute command inside an running container
- Add 'container [shell | connect]' to start shell in -- " -- " -- " --
- Add 'container [stat | cleanup | usage stats]' commands
- Add in="tty" to commands thay may end up being interactive
- Split <ACTION> line into multiple lines for readability
- Fix container shift logic:
root@infix-00-00-00:/> show container
/usr/sbin/container: line 361: shift: shift count out of range
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
