Actually a part of statd, but had to make
a separarate package to get it to work.
Statd helper-scripts are now pre-compiled instead of doing it
in runtime.
Fixes#379
Refactor mDNS service record generation for improved control of
announcing services. All to add support for modifying the cname
aliases we announce.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both IETF and POSIX allow longer hostname, 253 and 255, which Linux does
not support. Since Linux 1.0 the maximum has been 64 US-ASCII characters.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These callback are not the primary responisble for the property, but
want to be informed of any changes. E.g., /system/hostname changes
should also update the adminurl in all mDNS records.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate all nginx .conf files to board/common/rootfs/etc/nginx/ and
introduce available/*.conf with symlinks to enabled/*.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit implements Infix mDNS TXT records, version 1, for available
services. Hard coded for the moment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit includes a small prestudy, done over a period of two weeks,
to gather information about common txt records used by hosts. The most
well-documented is the Apple Printing Spec, which among other things
defines adminurl. A proposed version 1 of the Infix txt record spec is
included in the document. I'm recommending alternative 2:
"vv=1" "vendor=Qemu" "product=VM" "ty=x86-64" "vn=KernelKit" "on=Infix" "ov=v24.03.0"
Including this information would enable quickly scanning a network to
see if the latest version of the software has been deployed. Please
note, I've not included the U-Boot firmware version in this proposal,
but it could be included as "vs=2023.10-kkit3", or similar.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change also requires another restructure for netbrowse itself, hence
the relocation of files in the tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With an increase in requests to confine users to the CLI, access using
SSH/SCP/SFTP to the configuration is becoming more and more important.
The admin role in Infix is mapped to the UNIX group 'wheel', meaning we
want all users in that group to be able to read and write files with
that ownership.
This patch fixes the initial ownership of startup-config, and /cfg, and
ensures the copy command in the CLI retain wheel group permissions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The plain output mode prevents garbled JSON output due to the built-in
pretty-printer in mctl. Fixed in v2.1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both L2 and L3 is supported.
With VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge vlans vlan 1 multicast-filter 224.1.3.4 ports e0
Without VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge multicast-filter 224.1.2.3 ports e0
- Rename mdb -> multicast-filters
- Add support for L2 multicast groups
- Change vlan, multicast and mulitcast-filters containers to presence
containers. This will result in that snooping will be disabled when
creating a bridge (or a vlan if vlan-filtered)
- Force the user to choose between VLANs and Multicast on top level bridge configuration
- Force L2 multicast to be state permanent
If an absolute path contains '../' we disallow it because what are you
doing, possible security violation.
Built-ins for running, startup, etc. remain as-is.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On any change to a container network interface we should schedule a
restart of the container to activate the changes. This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.
This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.
Fixes#375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 4bfedf7a9 support for disabling IPv6/IPv4 link-local addresses was
added, which in turn caused this regression.
Regression in the v24.03 release cycle, not released -- low severity.
Fixes#353
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Translate LOWER-LAYER-DOWN -> LOWER-DOWN in "show interfaces" overview
and keep LOWER-LAYER-DOWN in detailed "show interfaces name eth0".
Issue #358
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a host interface setup, i.e., moving an interface from the host to a
container, often using VETH pairs, any route should only be set when an
IP address has been set. This because the CNI ipam plugin, which we
use, require routes be part of ipam, which in turn requires an address.
For details, see <https://www.cni.dev/plugins/current/ipam/static/>
Fixes#366
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg