Material's defaults (Roboto, bluish slate dark mode) looked dull next
to the Chirpy-based kernelkit.org blog. Match its typography and colors
via extra.css, no engine change:
- Lato headings + Source Sans 3 body + system monospace for code
- Dark mode: neutral near-black background, soft-gray text, darker code
blocks, Chirpy blue links (replacing Material's high-contrast slate)
- Light mode: warmer body text, blue links, tinted sidebars
- Keep the orange brand on the masthead; links use Chirpy blue
Set theme.font: false so Material no longer also fetches Roboto.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Extend the existing 'show <running|startup|factory>-config' family with an
optional 'path /XPATH' argument that maps straight to the underlying 'copy
-x' flag, and add 'show operational [path /XPATH]' for symmetry with the
configuration datastores.
admin@example:/> show running-config path /ietf-interfaces:interfaces
admin@example:/> show operational path /ietf-system:system-state
Also, improve error feedback from the copy command slightly.
Before:
admin@example:~$ copy running -x /foo
Error: (null) (5)
Error: failed retrieving running-config data
After:
admin@example:~$ copy running -x /foo
Error: Couldn't parse path "/foo": Prefix "foo" not defined. (5)
Error: failed retrieving running-config data
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
cli-pretty prints a friendly message on stdout before any sys.exit(1)
— 'Interface "w" not found', 'Error, top level "ietf-routing:routing"
missing', etc. The wrapper used subprocess.run(..., check=True) and
on non-zero exit caught CalledProcessError, throwing away the captured
stdout and printing the generic exception message instead.
Drop the check=True / try-except dance, always relay stdout, and only
fall back to the generic 'Error running cli-pretty' line when the
subprocess crashed without producing any output.
Before:
admin@bpi:/> show interface w
Error running cli-pretty: Command '['/usr/libexec/statd/cli-pretty',
'show-interfaces', '-n', 'w']' returned non-zero exit status 1.
After:
admin@bpi:/> show interface w
Interface "w" not found
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Ethernet packet/RMON counters at the bottom of 'show interface
<name>' were appended with a wider label column than the operational
data above them, breaking visual alignment. Group them under an
"Ethernet Statistics" section heading (Decore.title), same convention
as 'Available Networks' in the wifi scan view.
Narrow the operational-data label column from 20 to 19 chars so the
title bar exactly matches the heading text — a tighter and more
deliberately aligned look. All labels in pr_iface fit within 19
chars except 'lacp system priority' (20); rename it to 'lacp sys
priority' for consistency with the other 'lacp ...' labels (lacp
aggregate id, lacp partner mac, ...) so the new field width works
universally.
Refresh CLI snapshots and doc samples to match.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix#1506: restore the VLAN interface documentation that was lost when
networking.md was split into per-topic pages. Content adapted from the
v25.11.0 networking.md VLAN section, plus a new "Stacked (Q-in-Q)"
section showing `eth0.10.20`-style nesting and the layered `show
interface` rendering of the parent chain.
Update the interface-type table in networking.md to point at the new
vlan.md instead of the dangling ethernet.md#vlan-interfaces anchor.
ChangeLog: document the user-facing changes on this branch (YANG model
upgrade, layered show interface output, auto-negotation typo fix) and
the new VLAN documentation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Update CLI samples across the documentation to the new layered
presentation: physical-medium row when linked (1000baseT/...), bare
MACs, and key: value DATA tokens. Add a short prose block in
ethernet.md and iface.md explaining the layering.
Drop the historical 'show interfaces' (plural) form — removed from
klish years ago — from all user-facing examples and the landing page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Import ieee802-ethernet-interface@2025-09-10.yang, from IEEE 802.3.2-2025,
and companion ieee802-ethernet-phy-type.yang, replacing the 2019 revision.
Operational interface speed moves to ietf-interfaces:speed, RFC 8343,
eth:speed is now obsolete. Bump infix-interfaces.yang revision to track
the upgrade.
The CLI 'show interface' command renders interfaces as bottom-up layered
protocol rows. Ethernet interfaces a new IEEE link-mode row (1000baseT,
10GbaseLR, ...) is added with 'duplex: full|half' in the DATA column.
Without link the ethernet row is the first row. Tunnels and wifi follow
the same layering: gre/vxlan rows carry remote:/vni: tokens with optional
ethernet sub-row for the L2-bearing variants; wifi rows carry 'station' or
'access-point' ssid:, signal:, stations: tokens.
admin@bpi-76-8f-c2:/> show interface
⚑ INTERFACE PROTOCOL STATE DATA
⇅ lo loopback UP
ipv4 127.0.0.1/8 (static)
ipv6 ::1/128 (static)
⇅ br0 bridge DOWN
│ ethernet 32:2e:3f:76:8f:c2
│ ipv4 192.168.0.1/24 (static)
⇅ ├ lan0 bridge LOWER-DOWN
⇅ ├ lan1 bridge LOWER-DOWN
⇅ ├ lan2 bridge LOWER-DOWN
⇅ └ lan3 bridge LOWER-DOWN
⇅ gre0 gre UP remote: 198.51.100.7
ipv4 10.255.0.1/30 (static)
⇅ sfp1 ethernet DOWN ca:59:f0:77:80:5b
⇅ wan 1000baseT UP duplex: full
ethernet 32:2e:3f:76:8f:c2
ipv4 192.168.0.235/24 (dhcp)
ipv6 fe80::302e:3fff:fe76:8fc2/64 (link-layer)
⇅ wan.10 vlan UP vid: 10
│ ipv4 10.0.10.1/24 (static)
└ wan
⇅ wan.10.20 vlan UP vid: 20
│ ipv4 10.0.10.20/28 (static)
└ wan.10
⇅ wifi0 wifi UP station ssid: corp-net signal: good
ethernet dc:a6:32:00:11:22
ipv4 192.168.7.42/24 (dhcp)
yanger populates phy-type and pmd-type from a static ETHTOOL link-mode
identity table keyed on (port, speed, duplex). Both leaves are populated
for unambiguous media (copper, DAC, copper-T); for generic fiber where
the (port, speed, duplex) tuple can map to multiple PMDs (SR vs LR vs
ER, etc.) only the phy-type family identity is emitted — guessing the
PMD would be misleading. cli_pretty prefers pmd-type (specific) and
falls back to phy-type (family) for display.
yanger also emits ietf-interfaces:speed and fixes a long-standing
'auto-negotation' typo (yanger had never matched ethtool's correctly-
spelled JSON field, so operational auto-negotiation always read
'unknown').
Filling the WG's gap on fixed-speed config
------------------------------------------
IEEE Std 802.3.2-2025 obsoleted the eth:speed leaf without providing a
config-true replacement; the standards-correct way to express what
older Infix configurations called 'fixed speed' is to restrict the set
of PMDs auto-negotiation may advertise. Augment auto-negotiation with
two leaf-lists:
auto-negotiation/advertised-pmd-types config-true, leaf-list of pmd-type
ethernet/supported-pmd-types config-false, leaf-list of pmd-type
Pinning a port to a single mode is now expressed as a single-entry
advertised-pmd-types list. The kernel-supported set is exposed as
operational state for diagnosis — SFP/SFP+ cages report the inserted
module's capabilities, narrowing the list to a single PMD when the
optic only supports one mode (as suggested by @wkz in PR review).
When the supported list collapses to a single entry, yanger uses it
to refine the operational pmd-type leaf — more accurate than the
(port, speed, duplex) lookup for fiber.
confd C apply path (src/confd/src/ieee802-ethernet-interface.c)
translates each advertised pmd-type identity to the corresponding
ETHTOOL_LINK_MODE_*_BIT_*, ORs them into a mask, and emits
'ethtool --change <if> autoneg on advertise 0x<mask>'. An empty
list keeps the historical default of advertising every supported
mode. The (legacy) 'auto-negotiation/enable = false' + speed/duplex
branch is removed — it has no model representation any more.
cli_pretty's detail view gains 'advertised' and 'supported' rows
listing the PMDs in each set. A new _pr_label_list() helper unifies
multi-row rendering across these new rows and the pre-existing
ipv4/ipv6 address rows.
The detailed interface view also gains a 'link mode' row carrying the
pmd-type / phy-type-derived label.
Migration of existing startup configurations
--------------------------------------------
Bump confd version 1.8 → 1.9 to trigger the migration on upgrade.
share/migrate/1.9/10-ethernet-advertise.sh translates old configs of
the form
ethernet { auto-negotiation { enable false; } speed S; duplex D; }
into
ethernet { auto-negotiation { advertised-pmd-types [PMD]; } duplex D; }
mapping (S, D) → PMD via a static lookup covering the copper-T speeds
the deprecated speed leaf historically supported (10/100/1000/2.5G/
5G/10G). Interfaces that don't disable auto-negotiation, or that
lack a speed leaf, are passed through untouched.
Closes#530Closes#805
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
bridge -j vlan global show can return VLAN ranges as
{"vlan": 1, "vlanEnd": 3} instead of individual entries.
The vlans dict was only keyed on the start value, causing
port VLANs 2 and 3 to be reported as "Unexpected".
Also fix typo in error message (brpvlans -> brpvlan).
Move the hostname-triggers-dhcp-client logic from dhcp-client.c into
the centralized dep_hostname() dependency tracker. When the hostname
changes, all interfaces with DHCP client configured are now added to
the diff by the core dependency resolver, so dhcp_client_change() picks
them up through its normal diff-based interface iteration.
When keystore keys change, trigger regeneration of wireguard
interfaces that reference them:
- Asymmetric key change: triggers interfaces using it as private-key
- Symmetric key change: triggers interfaces using it as preshared-key
(both at peers bag-level and individual peer-level)
The 'command' leaf is config, with a strict pattern that doesn't allow
'&', quotes or pipes. Yanger was populating it from podman's full,
untruncated container command -- so any container whose entrypoint
uses shell metacharacters (e.g. sh -c "... && ...") failed YANG
validation.
The symptom: every operational read of /infix-containers:containers
returns SR_ERR_INTERNAL, which in turn fails the whole get-data on
the operational datastore. This breaks case/misc/operational_all and
any RESTCONF/NETCONF read that touches containers.
This was introduced in 59028c4 ("Fix #1466: 'show container' shows no
output"), which added the operational, pattern-less 'cmdline' leaf
but left the old 'command' assignment in place. Drop it -- 'cmdline'
already carries the full command line, and 'command' belongs to
running config.
Note: the failure can look intermittent across test runs because
podman storage is persistent. It only triggers once a container with
a bad-pattern command ends up in 'podman ps -a', including stale or
exited leftovers from earlier runs.
Signed-off-by: Richard Alpe <richard@bit42.se>
Was not correct handled before, a few assumptions was made,
but did not work in reality.
* Fix correct channels for WiFi 6E
* Add missing parameters required for 6ghz to work
Summary of Changes:
bfdd:
- cap IPv6 echo reflection to declared length
- account for FP offset in echo length checks
- fix recv errno filter logic in a few places
- tighten SBFD reflector packet sanity checks
- gate IPv6 echo reflection on known sessions
- tighten auth header parsing skeleton
- validate control packet length before session lookup
bgpd:
- Fix memleak when configuring rd
- Validate if NHC BGPID TLV value is non-zero
- Avoid having a dangling pointer after we free NHC attribute
- Check if BGPID NHC TLV exists when IPv6 next-hop is link-local
- Do not allocate NHC TLV with an extra trailer
- migrate timers during peer_xfer_conn to fix stale route cleanup
- honor 'no activate' for dynamic neighbors in peer-group
- Return immediately when dynamic capability action is not valid
- Validate BGP role capability when handling it dynamically
- fix neighbor IP comparison for IPv6 memcmp return values
- Don't mark nexthop as changed if a set next-hop unchanged is applied
- Return BGP_PEER_INTERNAL when first peer's as type is set to auto
- Update peer sort cache when remote-as auto is used and AS number changed
- Check dynamic capability action before validating ENHE capability
- Do not allocate stream if route-refresh capability is not received
- Move rpki strict check to bgp_accept()
- Fix memory leak for nhc attribute if ipv6 is link-local address
- Fix compilation for Debian 11 when printing uint64 values
- Return zero labels if no BOS found and it's not a withdraw label
- Fix signed overflow in hexstr2num()
- Check the length also when parsing ENCAP attr sub-TLVs
- Validate prefixlen before subtracting when parsing labeled unicast NLRI
- Reset the stream to attr_start + attribute_len when WITHDRAWN
- Revalidate locally originated routes against RPKI changes
- Check if prefixlen is not 0 when parsing flowspec stuff
- Prevent len_string going negative when trying to display flowspec entries
- fix import vrf on non existing vrf
- fix no vrf import command
- Free hostname for FQDN capability if the parsing goes wrong
- Validate MP_REACH_NLRI attribute against incorrect next-hop
- Fix dynamic FQDN capability handling
- Check if the remaining length for subtracting TLV length is enough
- Fix the end pointer boundaries for dynamic graceful restart capability
- Add missing returns when parsing enhanced route-refresh
- Return original as-path when reconciling AS versus AS4
- Do not process route-refresh for AFI/SAFI if it's not negotiated
- Check if we are not overusing error_data buffer when unknown cap received
- fix NHT for explicit link-local BGP peers
- improve packet parsing for EVPN and ENCAP/VNC
- Prevent heap use-after-free for tunnel encapsulation attribute
- Return 0 if AS4 capability is malformed
- close dynamic peer socket in ttl error path
- fix logic handling EVPN_FLAG_DEFAULT_GW
- avoid early return in MPLSVPN NLRI processing
- remove unneeded asserts in packet reads
eigrpd:
- fix byte order in Hello TLV decode functions
- Handling for malformed update packets
- enforce minimum TLV length in Hello handler
- reject invalid prefix mask len
- skip unknown and ignored TLVs
- Improve packet validation
isisd:
- Reject SRv6 Locator TLV with Loc-Size of zero
- consume leftover bytes after FAD sub-sub-TLV loop
- use correct min size values for srv6 subtlvs
- improve validation of flex-algo decoder
- Fix missing neighbor address Sub-TLVs after link-params change
- add unit test for remove_excess_adjs() memory leak fix
- fix memory leak in remove_excess_adjs()
- fix edge condition in max_lsp_count computation
ldpd:
- improve tlv validation in several places
lib:
- Report IPv6 MTU and not IPv4 for if_update_state_mtu6
- disable warning in zlog.c to match master
nhrpd:
- stop debugging auth credentials
- fix byte-order when comparing error code in shortcut path
- guard against zbuf_pulln NULL on truncated packets
- require auth for all received packet types
- harden debug packet parsing against malformed input
- validate AFI index in extension replies
ospf6d:
- move log call out of priv block
- remove asserts in packet-handling paths
- fix issues in ospf6 auth trailer code
ospfd:
- add LSA validation in the apiserver path
- add validation in several places before accessing
pceplib:
- validate during of_list TLV decoding
pimd:
- fix NOCACHE MFC resync detection log, add vrf name too
- use upstream-owned pim pointer in register and upstream timers
- use upstream-owned pim pointer in MSDP update paths
- avoid JP build deref through channel OIL
- guard RP RPF-failure mroute delete on detached OIL
- avoid null deref in upstream delete debug path
- guard channel OIL detach against stale pointers
- fix crash due to double free
- Ensure igmp message is of proper size
- Reject pim packets with a malformed header length
- Fix out of bounds read in AutoRP code
- igmpv3 never checks packet length and trusts the num-sources field
- Do not allow a register-stop message if not received from the RP
- Prevent received msg length from being larger than buffer
- Remove unnecessary asserts
- When receiving a register stop ensure we have enough data to read
- Ensure a register packet has enough space to read S,G data
- Ensure that header has space on packet
ripngd:
- fix data handling in several places
tests:
- Check if route-map with set nexthop unchanged does not prevent outgoing
- Check if mixed peer-group remote-as types can be used with auto
- Verify neighbor addr Sub-TLVs after link-params reset
- Expect return code being 0, not -1 when AS4 is empty or ASN is 0
vrrpd:
- replace some asserts
- only support ethernet in GARP code
- limit advertised timers to 12-bits
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Backport two fixes addressing a critical failure reported by a customer:
an unclean dbus-daemon exit leaves a lingering /run/messagebus.pid, the
daemon then refuse to start, and Finit's restart loop gives up.
0001 service: clean stale pidfile after unclean daemon exit
Drop a daemon-owned (pid:!) pidfile when it still names the
just-reaped PID and that PID is no longer alive.
0002 service: log signal name and core dumps in death message
"by signal: 9" -> "killed by SIGKILL", with ", core dumped"
when applicable. Stronger breadcrumb for sudden deaths.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The \r-overwrite of an in-progress line breaks when something else
writes to stderr between conout(3) and the final call, leaving blank
"[ OK ]" lines. Cache the description and reprint it whole, so the
final status line is robust to intervening output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an interface has been handed off to a container it lives in
another netns, so `ip neigh/addr flush dev FOO` fails on the host.
The failure aborts dagger, and since interfaces_change() runs before
containers_change() in change_cb(), the container delete path is
never reached -- the stale container keeps the interface trapped in
its netns, breaking the next reconfiguration.
Guard both the neighbor and address flush exit scripts with
`if_nametoindex(ifname)` -- true exactly when the interface is in
the host netns, false for both "in a container" and "already gone".
This replaces the pre-existing `!cni_find(ifname) && if_nametoindex(
ifname)` guard at the addr site: cni_find() added no information
for this check and would popen(container find) for nothing when the
interface had been deleted entirely.
Also harden wrap() in /usr/sbin/container so a stale setup pidfile
doesn't short-circuit Finit's stop attempt -- kill the setup PID and
still ask podman to stop the container.
Fixes#1493
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
