Three more RESTCONF wrappers assume the response to a keyed GET is the
bare node, when the server nests it under the full parent path: the
container resource-usage stats always read zero, the WireGuard listen
port never populated, and resetting advertised link modes silently
re-enabled auto-negotiation on links where it was forced off.
Same class of bug as the firewall zone reset fix: the decode matches
nothing and the zero value is used as if valid. Model the full nesting
in all three wrappers, reusing the existing container list wrapper.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Resetting a zone's services (or interfaces) wiped the entire zone:
action, interfaces, address-sets, everything but the name.
The keyed zone GET decodes into a wrapper expecting the node bare, but
the server nests it under the full parent path:
{"infix-firewall:firewall": {"zone": [ ... ]}}
The decode silently matched nothing, so the reset handler rebuilt the
zone from an empty struct and PUT only the zone name. The same
mismatch also broke network preservation when saving a zone.
Clear leaf-lists by deleting each instance instead of rebuilding the
zone with PUT, so a reset cannot touch anything else. Fix the wrapper
shape, document the nesting convention on the RESTCONF client Get, and
log a warning when a non-empty response decodes to a zero-valued
wrapper. When saving zones, omit empty leaf-lists and a defaulted
action. Refresh the firewall page after resets and update the handler
tests to mock the real response shape.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add firewall address-sets: named sets of IP addresses and networks,
usable as zone sources for per-IP access control, issue #1189. Static
entries are part of the configuration; dynamic entries are managed at
runtime with new add/remove/flush actions, from the CLI or over
NETCONF/RESTCONF. Dynamic entries survive firewall configuration
changes but are not saved to the configuration. Sets with a timeout
expire their entries automatically.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verify that the device's factory-default configuration boots cleanly and
that the device remains usable afterwards -- i.e. it does not fall back to
the fail-secure failure-config.
The test exercises the device's own first-boot bootstrap path: it clears
the startup-config and reboots with the test-mode startup override set, so
confd initialises running from the factory-config (its first-boot path).
That mirrors a factory-fresh / factory-reset device and avoids applying a
full config swap over the live management session -- confd cannot replace
the whole running datastore from within an RPC without timing out, and a
factory config may reconfigure the very transport we are connected over.
The test is image-generic, using whatever factory-config the running image
was built with, so it covers both the stock Infix factory config and any
spin factory config. A single-node (1x1) topology is used on purpose: a
factory config is not written with a lab full of peers in mind, so booting
it across a multi-node topology could trigger broadcast storms or similar.
NETCONF only, as it is the one management transport present in every
factory config.
Signed-off-by: Richard Alpe <richard@bit42.se>
gen-hostname baked the last three MAC octets straight into the generated
hostname, so the actual MAC ended up stored in the configuration. Copy
that config to another device and its hostname no longer matched the
hardware.
Emit the %h and %m format specifiers and let confd expand them when the
config is applied, so the MAC is resolved per device and never written
to a saved config. This also drops the /run/system.json lookup.
Closes#1554
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On weekly builds INFIX_RELEASE is "latest", and it fed straight into
INFIX_VERSION, so the keyword showed up as VERSION, VERSION_ID and
PRETTY_NAME in /etc/os-release, in /etc/version (show version), in the
ietf-system os-version operational leaf, and in the mDNS advertisement.
None of those pinned down the source revision; only BUILD_ID did.
Tie INFIX_VERSION to INFIX_BUILD_ID (git describe). INFIX_RELEASE now
only labels the release channel (IMAGE_VERSION) and names the published
artifacts.
Also exclude the moving 'latest*' tags from git describe, so the build
id can never resolve to "latest" should that tag land on, or nearest to,
the built commit.
Fixes#1524
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In netdag_gen_ethtool_autoneg() the unmapped and "exactly one entry"
checks already guarantee a forced PMD link mode is selected, but
Coverity cannot see the correlation and flags the later deref. Fold
!forced into the entry-count guard to make the invariant explicit.
Fixes Coverity CID 561388.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
lydx_get_cattr() yields NULL for an absent leaf or a failed radio
component lookup; that NULL was passed straight to strcmp() on several
WiFi paths (wifi_chan_to_freq, the wifi_gen_mesh width branches,
wifi_find_higher_band_twin, dep_radio_components), risking a crash.
Guard each value before use.
Fixes Coverity CID 561387, 561389, 561390, 561391, 561392.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.
The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end. Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.
Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.
Fixes: #1546
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
crond shipped auto-enabled in finit (symlinked into enabled/), so it ran
on every boot. With no cron jobs /var/spool/cron/crontabs does not exist
and 'crond -f' exits non-zero, which finit then crash-loops until it gives
up ("Service crond keeps crashing, not restarting").
Ship crond available-only and let confd manage it: the schedule plugin
already rebuilds the crontab on every change, so enable + touch crond when
at least one consumer is active and disable it otherwise. No jobs, no
crond, no crash loop.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Previously at least one end of a veth pair had to remain in the host
namespace, because that end created and destroyed the pair. Assigning
both ends to containers left no one to create it.
Select a deterministic primary end so exactly one side creates the pair.
When the primary is itself a container interface, create the pair in the
host namespace before the container starts; CNI host-device then moves
each end into its container. Teardown is deferred to the container
removal script so the pair does not linger and block re-creation.
Drop the now-obsolete limitation notes from the documentation and YANG,
and add a regression test connecting two containers over a veth pair.
Fixes: #941
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The per-port PHY temperature sensors on Marvell DSA switches show up in
'show hardware' with the name the kernel derives from the full device
tree path, e.g. cp0busbusf2000000mdio12a200switch2mdio01, which honestly
is completely unreadable and also overruns the value column. Name each
sensor after the front-panel port it serves (e1, e2, ...) by matching
the PHY's device-tree phandle against each interface's phy-handle.
Also:
- show system: report a representative SoC temperature on CN913x by
matching the ap-* and cp<N>-* thermal zones, hottest wins.
- cli-pretty: truncate over-long sensor names so they can never spill
into the value column again.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Reorder the README so newcomers see the product before the philosophy:
CLI demo and web UI up top, a "Try it in 5 minutes" section linking the
GNS3 and build-from-source guides, then hardware and the rest. Tone
down the remaining marketing prose in the hardware and use-case lists.
Rename CODE-OF-CONDUCT.md to CODE_OF_CONDUCT.md so GitHub recognises it
as the community code of conduct, and link the .github/ health files
from the README.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GitHub now publishes a sha256 checksum for each release asset, so the
separately generated .sha256 files are redundant.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor to use a dummy interface instead of wasting a dut. This not
only simplifies the test but also increases test coverage on test rigs
with a single DUT.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg