Also, update docker/README, because after last confusing update I
couldn't follow my own instructions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Send 10 pings, expect at least one. The GRE test passes with two
received ICMP messages on the Styx test rig, while the VXLAN test
fails with -c 3, so try waiting a bit longer.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The put_config() retry loop was catching and printing RpcError
exceptions but never re-raising them after exhausting retries.
This caused tests to silently continue despite configuration
failures, masking validation errors.
Now properly propagates errors after all retries are exhausted,
matching the error handling behavior of the RESTCONF backend.
Fixes#1250
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Neither the IPv6 autonconf container, nor the recently moved DHCP client
container have an 'enabled' flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If ping succeed but fail to check if netconf port is open,
the testsystem will hang forever.
This will allow totally broken images to be loaded at the device.
The xPi's usually don't have a VPD so the chassis mac-address probed at
boot is usually null in /run/system.json. This commit adds a fallbkack
mechanism to populate this field so it can be used for unique hostnames
even on these boards.
Ths ietf-hardware.yang model does not have a notion of physical address,
so we augment one tht is generic enought to be used for other hardware
components than Ethernet, similar to what ietf-interfaces.yang use.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds operational data support for system services. The
data is in a generic format but is intended to be able to represent
finit information (initctl) nicely.
The reason for augmenting this to ietf-system and not to
infix-services is that we consider this generic system information
which is totally disconnected from what ever services infix might
provide.
In this first state we only support pid, name, description and state.
Making the data look something like:
"infix-system:services": {
"service": [
{
"pid": 1185,
"name": "udevd",
"status": "running",
"description": "Device event daemon (udev)"
}]
Signed-off-by: Richard Alpe <richard@bit42.se>
Rename test directories in infix_containers/ to remove the redundant
'container_' prefix since they already live under infix_containers/:
container_basic -> basic
container_bridge -> bridge
container_enabled -> enabled
container_environment -> environment
container_firewall_basic -> firewall_basic
container_host_commands -> host_commands
container_phys -> phys
container_veth -> veth
container_volume -> volume
Also update references in all.yaml and Readme.adoc files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds four (small) container images to the Infamy test container
which are used in the new container upgrade test. The test verifies that a
mutable container can be upgraded and that old images are properly cleaned
up from the container store.
Fixes#624
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container instances that run with mutable images, e.g., tagged with `:latest`
or similar non-versioned tags, can be upgraded without changing the config.
This commit fixes two issues found with this support:
- force container image re-fetch on upgrade, even if the file exists locally
- surgically remove old image from container store after upgrade
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The xpath_to_uri() method only processed the first predicate in XPath
expressions with multiple [key='value'] patterns. Each re.sub() call
was performed on the original xpath instead of the result the previous
substitutions, causing subsequent predicates to be ignored.
Example XPath that would fail:
/infix-firewall:firewall/zone[name='untrusted']/interface[.='e2']
Would incorrectly convert to:
/infix-firewall:firewall/zone[name='untrusted']/interface=e2
Instead of the correct RESTCONF URL:
/infix-firewall:firewall/zone=untrusted/interface=e2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:33:00)
# Traceback (most recent call last):
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# AssertionError: Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
After this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:35:00)
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
Slightly shorter and arguably easier to read for a non-pythonic human.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very common pattern in our tests is:
if (condition):
print(f"the condition failed with {output}")
test.fail()
This change allows us to write:
if (condition):
test.fail(f"the condition failed with {output}")
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop 'local', not available in POSIX shell scripts
- Check for an assortment of backup file combos
- Simplify nested if-statements, skip whitelist first
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To reduce the duplication of effort between 9pm and the Infamy framework
this change consolidates the move from local 'infamy: title:' extension
to 9pm 'name:'.
For the parameterized tunnel tests we leverage the 9pm dynamic test-spec
variable, which looks for a correspodning <case>.adoc instead of static
Readme.adoc, when generating the test report.
Each test documentation should cover all aspects of the test, much like
the usage text of a UNIX program. To this end, the tunnel test docs are
now more spelled out, including all invariants.
Some refactoring of these tests were also necessary, e.g., replacing any
reserved Python keywords like 'type', and other PEP-8 fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg