Instead of publishing A/AAAA records for $(hostname).loocal with a CNAME
infix.local, we flip it around to take advantage of the mDNS conflict
resolution rules. This gives us infix.local for one device ont the LAN
and infix-2.local for the next.
Update all service records to *not* advertise hostname, but instead to
let Avahi imply that from the advertised A/AAAA and CNAME records.
Fixes#1387
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org),
so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A
www subdomain can carry a CNAME pointing directly to kernelkit.github.io,
giving GitHub full control over the mapping and making the redirect work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The weird `if env | grep -q 'reset-volumes'` construct is due to Klish
not sanitizing names before constructing variables, which leads to env
variables with '-' in them, not allowed in POSIX sh.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename BR2_PACKAGE_NETD_FRR to BR2_PACKAGE_NETD_FRR_GRPC to match the
naming convention of the other FRR backends (VTYSH, CONF) and make the
intent self-evident.
Have the gRPC backend select BR2_PACKAGE_FRR_GRPC so FRR is built with
gRPC support when — and only when — this backend is chosen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a simpler approach than both grpc and watchfrr. Since we only
really need dynamic handling of static routes (for DHCP), we can track
changes made and maintain a "diff engine" for the resulting frr.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest backported fixes to Finit, we no longer need to remove
/run/netd.pid to trigger a reload (restart) of staticd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This includes adding a netd-daemon since FRR has gone towards all
daemons should be configured from mgmtd using YANG, netd uses gRPC to
reconfigure in mgmtd
Signed-off-by: Enable grpc
This update brings new support for editing cleartext-symmetric-keys with
the 'change' command. The cleartext-symmetric-key is of type binary and
its use differs between different key-formats.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Environment variables are stored in a separate .env file from the main
container script. The config SHA256 checksum only covered the script
file, so changes to env vars went undetected -- the container was not
recreated and kept running with stale values.
Include the env file contents in the config checksum calculation so that
any change to environment variables triggers a proper container restart.
Fixes#1313
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
RSSI is a vendor-specific relative index (0-255), while dBm is an
absolute power measurement. Since we report dBm values from iw,
rename the leaf to signal-strength for accuracy.
The trick to starting the scanner mode is to have a dummy network that
cannot associate with anything.
Fixes#1193
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Was set to informational, and Zebra to debug, which is mostly useful for
developers when debugging the integration of Frr daemons.
Example of before this patch:
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: staticd[4366], stopping, sending SIGTERM ...
Nov 4 13:44:09 infix-6f-05-e1 staticd[4366]: Terminating on signal
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [N5M5Y-J5BPG][EC 4043309121] Client 'static' (session id 0) encountered an error and is shutting down.
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [KQB7H-NPVW9] zebra/zebra_ptm.c:1333 failed to find process pid registration
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [JPSA8-5KYEA] client 26 disconnected 1 static routes removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [S929C-NZR3N] client 26 disconnected 0 static nhgs removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: Starting staticd[5529]
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [V98V0-MTWPF] client 26 says hello and bids fair to announce only static routes vrf=0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want the command to show the entire log file, but fast forward to and
tail at the end, handling any file rotations from syslogd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit bf1eca0567.
This mess up order if having more than 1 phy, have not been
reproduce the error that got me to introduce this fix from
the beginning.
The sysrepocfg tool does not set up nacm based on $USER, and we now have
the shell 'copy' tool which does. So drop 'cfg' and while we're at it
we also drop the 'edit' alias.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace BusyBox udhcpc6 with OpenWrt's odhcp6c for improved DHCPv6
functionality and better integration with Router Advertisements (RA).
The primary motivation is support for a common ISP deployment scenario
where IPv6 addresses are assigned via SLAAC (from Router Advertisements)
and DHCPv6 is used in stateless/information-only mode to provide DNS
servers and other configuration options. This hybrid RA+DHCPv6 setup is
standard practice for many ISPs but was not supported by udhcpc6, which
treats RA and DHCPv6 as separate, non-integrated mechanisms.
Additional benefits of odhcp6c:
- Better IPv6 Prefix Delegation (IA-PD) support with proper handling
of delegated prefix lifetimes and renewal
- Native integration of RA-provided configuration (DNS servers, routes,
addresses) with DHCPv6-provided options
- Support for stateless DHCPv6 via information-only mode
To verify stateless DHCPv6 integration with SLAAC addresses - the ISP
scenario that motivated this migration, a new test case has been added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Example usage:
./src/statd/python/yanger/yanger -p wifi0 -x "ixll -A ssh enp195s0f0 sudo" ietf-hardware | ./board/common/rootfs/usr/libexec/infix/wifi-channel-map.py
Show the congestion in the 2.4 band.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
* Add support for AP (list connected stations)
* Add scan-mode (Scan without create a fully configured station)
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Finit is capable of setting up all basic file systems, even /run but
Infix relies on it allowing executing scripts (dagger and container)
so leave that for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add resource-limit and resource-usage containers to YANG model. Podman,
and later conmon, enforce CPU and memory limits in a delegated cgroupsv2
hierarchy managed by Finit.
Resource usage is queried from 'podman inspect', which has more nodes
than what is currently possible to limit.
Requires Finit 4.15, or later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate keys in gen_hostkey() before passing empty keys to shell scripts,
preventing:
Nov 04 2024 10:54:25 confd[2697]: SSH key (genkey) does not exist, generating...
Nov 04 2024 10:54:25 confd[2697]: writing RSA key
Nov 04 2024 10:54:26 confd[2697]: do_convert_from_pkcs8: /tmp/tmp.FH1Hr1 is not a recognised public key format
Also, fix base64 content formatting with proper 64-character line wrapping
using printf+fold instead of echo.
Use PKCS#1 RSA format for public keys as required by netopeer2-server, while
keeping PKCS#8 format for private keys. Use proper ssh-keygen format flag
(PKCS8) for correct conversion.
Fixes#1289
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify fallback MAC detection to return lowest valid MAC address.
This is the easiest to document and explain to end users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set LANG=C.UTF-8 in finit.conf for system-wide coverage, in profile.d
for login shells, and in bash.bashrc for interactive shells to ensure
comprehensive Unicode support across all user interactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This allows us to gather better product information in /run/system.json
also for x86 based systems. For Qemu x86_64 systems the 'product-name'
changes from 'VM' to 'Standard PC (i440FX + PIIX, 1996)'.
Also, add new 'product-version' field for, e.g., board revisions, and add
missing 'serial-number' value for systems like Rasperry Pi that inject it
in the device tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate that DHCP options were requested in the parameter request
list before applying them. This prevents malicious or misconfigured
DHCP servers from forcing unwanted configuration changes.
Validates: hostname (12), DNS (6), domain (15), search (119),
router (3), static routes (121), and NTP (42).
Fail-safe behavior: rejects options if config file unavailable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Resolve race condition between DHCP and configured hostname by introducing
priority-based hostname management using /etc/hostname.d/ directory pattern.
Priority order (highest wins):
90-dhcp-<iface> - DHCP assigned hostname
50-configured - YANG /system/hostname config
10-default - Bootstrap/factory default
The new /usr/libexec/infix/hostname helper reads all sources and applies the
highest priority hostname. It exits early if hostname unchanged, preventing
unnecessary service restarts.
Fixes#1112
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After some discussion we agreed that this operation is the domain of
confd (or dagger) and any DHCP client should not mess with the admin
state of the interface it runs on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Basic DHCPv6 support as a per-interface ipv6 setting, not in line with
the IETF YANG model, which has this as a root container.
Note, this also fixes DHCPv4 option inference after the relocation of
/dhcp-client to /interfaces, in 764bd8e.
Fixes#1110
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if partition/LABEL is available before trying to run tune2fs and
mount commands on it. This change masks the kernel output:
LABEL=var: Can't lookup blockdev
commne when running `make run` on x86_64 builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 45efa94 we introduced new mount options for the: 'aux', 'cfg', and
'var' partitions. To save boot time, we also disabled the periodic fsck
check, which does not affect journal replay or other Ext4 safety or
integrity checks. The latter involved calling tune2fs at runtime, but
this caused the following to appear for the 'aux' partition, which is a
reduced ext4 for systems that need to change U-Boot settings, e.g., to
set MAC address on systems without a VPD.
EXT4-fs: Mount option(s) incompatible with ext2
Note, this is a "bogus" warning, setting the fstypt to ext2 in fstab is
not the way around this one. That's been tried.
To make matters worse, the new mount option(s), e.g., 'commit=30', gave
us another set of warnings from the kernel. This was due to the fstype
being 'auto', so the kernel objected to options not being applicable to
every filesystem it tried before ending up with extfs:
squashfs: Unknown parameter 'commit'
vfat: Unknown parameter 'commit'
exfat: Unknown parameter 'commit'
fuseblk: Unknown parameter 'commit'
btrfs: Unknown parameter 'errors'
This commit explicitly sets cfg and var to ext4, leaving mnt as auto, we
also check before calling tune2fs that the partition/disk image is ext4.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg