Also renames all klix_SYM@klinfix to SYM@infix, this is fine since we're
always calling these symbols with @infix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Always respect the requested model to emulate. Before this change, a
device configured to run in TAP mode would ignore a user's requested
model and always emulate a e1000.
This worked on x86_64 where that driver is part of the kernel, but
that is not true for aarch64.
- Always supply a mactab. It was very confusing that the interface
names would change, in Infix, depending on the selected networking
mode.
- Remove old decoy variables that were assigned but never used
anywhere.
- Separately setup the host and target side of a nic (i.e. use a
-netdev/-device pair instead of the -nic shortcut). This lets us
share the host side setup across all modes.
This reverts an earlier change where nano was made the default editor in
a misguided attemt by yours truly to accomodate beginner users.
With the recent improvements of the CLI and the fact that the NETCONF
support has matured greatly, the need for a user-friendly editor have
diminished drastically. Editing system files is now limited to devs
and the core team prefers Mg over nano and vi.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, add a new `quick.md` that pops up when the user types `help`.
Very quick intro to get started. Useful when we add a factory-default
motd: "Welcome to the CLI, type 'help' for a quick overview."
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync sysrepo conf settings, lots of new settings added, one removed
- Check if help topic exists
- password encrypt arguments should be optional, add SWITCH
- show datetime argument should also be optional, add SWITCH
- Trial, output factory- and startup-config colorized
- Switch to srp_prompt v2 for configure context
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The upstream help system has improved greatly. We can now rely more on
it for generating the man-page like help texts for leaf nodes. There
is also a new srp_prompt symbol that overrides the default klish one,
srp_prompt adds a '%x' format specifier for an inline path instead of
the default [edit foo bar] JunOS style two-liner.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lots of changes upstream for parsing help texts, running as different
user, etc. Was getting too difficult to backport to tags/3.0.0, so this
resets the clock on top of (almost) the latest. Experienced issues with
the admin user in configure mode on the latest commits (e4f65d5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is needed for the bleeding edge klish + klish-plugin-sysrepo, which
the next couple of commits will add.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Preparing for a "show system-information" as well, which still needs to
be discussed to determine contents. Some data also still missing, e.g.,
article/serial/product number db.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit switches the klish package to use the kkit branch instead of
keeping a lot of patches from the v3.0.0 release.
Most of the changes made are for dragging tinyrl into the 21st century.
It now supports most of the basic features one have come to expect from
a readline replacement: line navigation, deleting words, erasing entire
line, kill and yank of lines/words and last argument on previous line.
The history has also gotten a bit of a stern talking to. It no longer
deletes lines matching existing old ones from the history, instead it
just checks if the previous command is repeated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the JunOS look of the CLI to something more akin to
a standard shell. To achieve this a %w format specifier to display the
path components is added to both klish and klish-plugin-sysrepo.
Before:
admin@infix-12-34-56:exec> configure
[edit]
admin@infix-12-34-56:configure> ediit interfaces interface eth0
[edit interfaces interface eth0]
admin@infix-12-34-56:configure> leave
admin@infix-12-34-56:exec>
After:
admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interfaces interface eth0
admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
admin@infix-12-34-56:/> leave
However, due to unforseen problems with the naming of VIEWs in klish,
the admin-exec level "path" is hard-coded to "/" for now.
Future imporovement: fold in calling prompt@klish from srp_prompt, and
figure out why the "main" VIEW cannot be changed to "exec" without klish
just bailing out starting up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out one of the reasons some keys did not work as they should in
certain commnands, most notably the Home/End in 'less', was due to the
default TERM variable being set to 'linux'. Changing to 'xterm' fixes
this issue, works with both console and ssh login, and from testing do
not seem to have any adverse effects on existing functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While spending the past couple of weeks actually trying to use the CLI,
I realized that it was very confusing to have a different behavior for
Ctrl-C than I was used to from regular shells (including the old clish
from $OLDJOB).
This change drops the Ctrl-C binding, restoring break/abort behavior,
and lets Ctrl-D be abort/exit. Pressing Ctrl-D in a sub-context in
configure calls exit, when in the top-most configure context we now
do an abort and return to admin-exec.
To apply the changes the user still has to type 'commit' or 'leave',
or tap Ctrl-Z as in the Cisco CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not just for online viewing, these markdown documents are also
made available in the CLI itself from admin-exec as:
help [introduction | keybindings | tutorial]
With this commit we also add lowdown and the real less application to
be the Infix help system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the srp_help_text() symbol. It allows us to
display the full description for a leaf in a YANG model. This has
been added to the 'help [foo]' configure context command.
A separate admin-exec level 'help' command will be added in a later
commit. It will only be an intro to the CLI, keybindings, etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This restores some of the original keybindings for line manipulation
that was part of the original CLISH. They had been disabled upstream
during the UTF8 conversion and never got reimplemented.
From branch kkit on https://github.com/kernelkit/klish, the kkit branch
is based off of the 3.0.0 release. The same patches are also available
on kkit-next, which is based on the latest upstream master.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With completion support. The log command has an optional last arg,
after FILE, tail NUM, which runs tail -n NUM FILE instead of cat.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An excellent example of how to define commands with optional subcommands
and optional parameters:
password encrypt [type <md5 | sha256 | sha512>] [salt STRING] [PASSWORD]
The tricks here are two:
1. mode="switch" in the top-level password command
2. min="0" in the encrypt subcommands
The first turns the COMMAND element into a SWITCH element (with command
matching), and the second makes a COMMAND optional. If an optional
command is input by the user, then the enclosed PARAM is mandatory.
Please note, due to limitations in the mkpasswd¹ utility, spaces are not
supported in PASSWORD, i.e., when read from CLI prompt. However, spaces
are allowed when using the interactive prompt, i.e., when omitting the
PASSWORD from the CLI prompt.
¹) mkpasswd does not look for any leading ' or " in the password arg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The documentation for klish mentions the file ptypes.xml, which defines
the ptype /STRING. So let's use that instead of defining our own types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Helper commands for quickly diagnosnig the networking subsystem after
making config changes. Should over time be replaced with operational
status from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An iana or infix interface type is derived from "ip link" data.
Such as loopback -> iana-if-type:softwareLoopback.
This patch adds support for the following types:
loopback, ethernetCsmacd, veth, l2vlan and bridge.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables a basic sanity check of usernames in BusyBox that by
default is disabled (!). The rules enabled by this are:
- the user or group name should consist only of letters, digits,
underscores, periods, and dashes¹, and not start with a dash (as
defined by IEEE Std 1003.1-2001), or periods²
- for compatibility with Samba machine accounts, $ is supported at the
end of names
- max length of user or group name is 256 chars
Changes in this commit also includes a sync with latest BusyBox 1.36,
which adds: tree, tsort, SHA hw acceleration, and a separate script
for udhcpc6.
_____
¹) The documentation actually mentions "and at-signs" as well, but that
has been explicitly removed from the source code.
²) The documentation does not mention that leading periods are not
allowed, though this is also explicitly mentioned in the source code.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Factor out a new helper function, change_get_user(), to do the bulk of
the work for the change callbacks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugin-sysrepo to get EnableNACM support. For
this to work as expected for the admin user we also need to change the
permission for the model in sysrepo.
Note: the srp_rollback() symbol has been renamed to srp_reset() upstram.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently netopeer2-server expects public keys for users to be in the
canonical place (~/.ssh/authorized_keys). Infix use a custom location
in /var/run, maintained by the ietf-system plugin, which OpenSSH knows
but netopeer2-server doesn't.
It seems to be possible to add some sort of "pattern" to netopeer2 to
indicate where to look for public keys. This is added when building it
but Buildroot does not expose this as a setting. So for now, this seem
to be the least intrusive way of handling it. The owner is root, so a
malicious user cannot change the link or contents without some other
form of privilege escalation first.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point in leaving unused home directories lingering on the system,
also a potential security problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Employ the new 'adduser -d' feature where users can be created with
password login disbled instead of creating them locked by default.
This allows us to create remote users that can only access the device
using public key SSH login, which until this point was not possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The login applet did not know about shadow passwords, and could thus not
determine if a user accont was locked or passwordless. This caused it
to return 'login: bad salt' instead of "Login incorrect", which is the
more secure path for handling brute force attempts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
