Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We already have a pull request template. This is a propsal to add issue
templates as well. These yml templates change the behavior of reporting
issues to more a of a pre-formatted form with guard rails.
It is still possible to report blank issues the old way.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we don't have any VPD defined on this board, supply a default
password hash via the device tree instead.
Also, specify the path to external USB port, so that Infix will pick
it up in ietf-hardware.
