Instead of running initctl reload, which also prematurely enables
services which are not supposed to be started until we have run
through the netdag and evolved to the next generation.
Handle the original use-case of disabling zeroconf is managed by
asking finit to stop the service immediately in the exit action, and
deferring the cleanup of the service until we call `initctl reload`
after the init action of the new generation.
In ye olde confd, we basically had `50-init.ip` - and that was fine.
Then came containers, VLANs, bridges, etc.; and with it: a whole
forest of setup/teardown scripts - and it was not fine anymore.
For example: if found an init script running at 61, you would have to
grep the source tree and look at _all_ other call sites to get a sense
of what runs before and/or after it.
Therefore: create enums for the init/exit actions where the order is
explicitly stated, and use those for all interface scripts.
Clean up bridge-port config generation to align with the bridge upper
code.
- Remove lots of unnecessary guards that we model guaratees are always
met (existance of containers and leafs). This reduces indentation
depth and increases readability, IMHO.
- Split the generation into smaller pieces, each with a clear purpose.
- Try to include all edge cases around the tricky subject of PVID
migrations, with the actions running in either exit or init, as
appropriate.
TL;DR:
> New code, all bugs removed ;)
Incremental reconfiguration of bridge related settings had lots of
ordering issues.
This change tries to remedy that by:
- Introducing the concept of "snippets": Instead of having to run C
code in the correct order (which is doomed to fail since teardowns
typically need to run in reverse), collect related settings in a
snippet. Later on, we can then concatenate snippets into a larger
file in the proper order.
- Refactoring the bridge setup to take advantage of snippets. Now we
can call out to functions that _both_ generate the VLAN config _and_
sets some bridge global options, for example. This gets us out of
having to pass back settings to the main generation function.
- Ensuring that deleted objects are always removed - in the proper
order - in the exit action of the previous generation. This was
previously not true for VLANs, fix#869.
- Generating `mcd`:s config orthogonally from the bridge setup. Since
we need to keep track of _all_ bridges, figure out when VLAN uppers
exist etc., it becomes _very_ messy to generate the configuration
from the diff of a single interface. There were lots of cases here
where disabling the querier service on one bridge would disable the
whole daemon, thereby disabling the service for other bridges that
still had it enabled.
Fact: ietf-interface.c has become too unwieldy.
Therefore, split it, roughly based on the YANG structure, into
multiple files.
There is much more to do here, like cleaning up the naming (which is
all over the place), moving more system commands into dagger, etc. But
I wanted to keep this change to a strict code reshuffle.
Previously, the generation number was only increased for successful
evolutions. This led to a confusing state in /run/net where multiple
<N>-ABANDONED-<date> directories could exist, with the same value of
N.
Move to a scheme where the generation increments every time we evolve,
even if the evolution fails. If multiple consecutive evolutions fail,
we can now unabiguously determine the order in which they were
executed.
When reconfiguring the system many times (seen during regression
testing), the RAM usage of keeping all generations around starts to
add up.
A tmpfs file, no matter how small, will always consume at least one
full page (4k). So one generation of tiny setup scripts and log files
can end up locking a 1 MB (!) of memory.
Therefore: Once we're done with a generation, archive it in a
compressed tarball, which typically fits inside a single 4k
page. Limit the total number of archives to 10. This should give full
visibility into the history of a system in all normal situations,
while still allowing hammering systems with reconfig cycles in testing
scenarios.
Use container for interface allow/deny and for reflector settings.
Hopefully there will be more settings in the future, e.g., control
reflector interfaces independently.
Fix#678
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduce a new approach to dtb-building:
Old way: `rsync` an overlay containing our dt source to the kernel,
and then build via buildroot's `_INTREE_DTS_NAME`. This does not work
in recent kernels (at least since 6.12), which requires all dtb's to
be explicitly listed in a `Makefile`.
New way: Create a separate package for every board, and build the
device trees via the kernel's standard interface for building external
modules. This has two main advantages:
1. We can easily interpose a patched version of an upstream device
tree. E.g., we can easily set the factory password.
2. It is much easier to get an overview of which boards are enabled,
rather than scrolling back and forth in the `_INTREE_DTS_NAME` list.
Enable all fully supported boards in the defconfigs.
In the OSPF(v2) context, there is an "address-family" setting available.
However, since only IPv4 routes are supported in OSPF, currently
this setting is not relevant.
Fixes#813
When disabling a container in the configuration we should not remove it,
because then any volumes used by it may be lost. Instead, we now simply
disable the service to prevent it from starting, or stopping it, if it
was running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When deleting interfaces we skip a lot of steps in netdag_gen_iface(),
this patch ensures we at least call netdag_gen_ipv4_autoconf() to drop
any running zeroconf agent in the same generation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to scroll to the end (Shift G, or page down til end),
let's instead start at the end now that we have control over paging in
the CLI ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops a needless restriction of IP addresses on VLAN filtering
bridges from 2024-03-06. The obvious use-case is when the bridge is an
untagged member of a VLAN and only ony management VLAN is required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the FRR upgrade to 9.1.2, OSPF sometimes reports neighbors
without reporting the routerDesignatedId and routerDesignatedBackupId
attributes. Ensure that these attributes are available before trying
to copy them to the output.
During debugging of a reconfiguration issue, one hypothesis was that
the tracking of callbacks used to determine when a transaction has
completed (as sysrepo has no hooks for this) was out of sync, causing
us to call `initctl reload` prematurely. This was not the case, but if
it ever occurs in the future, make sure that it is a fatal error that
won't go unnoticed.
When an Infix device is connected to a LAN where the gateway has yet to
connect to the Internet, the container script will fail pulling images
from any remote server.
Nov 16 12:48:13 infix container[3490]: Error: initializing source docker://ghcr.io/kernelkit/curios:edge: pinging container registry ghcr.io: Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on 127.0.0.1:53: read udp 127.0.0.1:55422->127.0.0.1:53: i/o timeout
Nov 16 12:48:13 infix container[3641]: Error: failed creating container fw, please check the configuration.
Nov 16 12:48:13 infix execd[3490]: /run/containers/queue/S01-fw.sh failed, exit code: 1
Since execd until now only retries on netlink/inotify events, or manual
SIGUSR1, jobs would get stuck even though Internet connectivity had been
established. This patch fixes that with the addition of a retry timer
which runs while there are pending jobs in the queue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #815 detail issues found running the Clixon Controllar and
Cisco Yangsuite. The errors and warnings listed are very similar
to pyang, which the undersigned has, the following changes fixes
the pyang errors:
- relocate 'feature containers' to submodule
- drop already deviated ospf:database deviations
- drop unused imports
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A sane interface name is at least two characters long, and in Linux the
interface name (using ip link) is at most 15 characthers long.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With interactive mode (out="tty") klish puts the tty in raw mode which
fixes all weird issues reported around paged output in the CLI.
Fixes#659
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if the "usb-ports" key exists in /run/system.json before calling jq,
otherise we get the following error message:
Nov 8 05:11:45 ix bootstrap[3349]: jq: error (at <stdin>:0): Cannot iterate over null (null)
Also, minor whitespace cleanup and bashisms fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Make show interfaces container aware. This is done by looking though
all podman containers for interfaces and looking up there info from
network namespaces on the main system / hypervisor.
Interfaces controlled by containers are clearly marked in the "show
interfaces" output, with a single gray row. Telling the user that they
belong to one or more named containers. The user can then run "show
interface name NAME" on interfaces owned by containers, which provided
some additional info, such as mac address and stat counters.
The patch also add support for printing veth peers which are owned by
containers.
Lastly, the patch also adds test cases for this functionality.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds support for setting the free form description string as
the interface alias. This can be read from /sys/class/net/*/ifalias, or
using the 'ip link show' command. The ifalias is reported by SNMP and
LLDP by default, and now also in the operational datastore.
Linux supports 250 characters in ifalias, but the IF-MIB is restricted
to 64 characters, so we add a local deviation to limit the type.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mattias Walström