This patch drops a needless restriction of IP addresses on VLAN filtering
bridges from 2024-03-06. The obvious use-case is when the bridge is an
untagged member of a VLAN and only ony management VLAN is required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
During debugging of a reconfiguration issue, one hypothesis was that
the tracking of callbacks used to determine when a transaction has
completed (as sysrepo has no hooks for this) was out of sync, causing
us to call `initctl reload` prematurely. This was not the case, but if
it ever occurs in the future, make sure that it is a fatal error that
won't go unnoticed.
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #815 detail issues found running the Clixon Controllar and
Cisco Yangsuite. The errors and warnings listed are very similar
to pyang, which the undersigned has, the following changes fixes
the pyang errors:
- relocate 'feature containers' to submodule
- drop already deviated ospf:database deviations
- drop unused imports
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A sane interface name is at least two characters long, and in Linux the
interface name (using ip link) is at most 15 characthers long.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if the "usb-ports" key exists in /run/system.json before calling jq,
otherise we get the following error message:
Nov 8 05:11:45 ix bootstrap[3349]: jq: error (at <stdin>:0): Cannot iterate over null (null)
Also, minor whitespace cleanup and bashisms fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Make show interfaces container aware. This is done by looking though
all podman containers for interfaces and looking up there info from
network namespaces on the main system / hypervisor.
Interfaces controlled by containers are clearly marked in the "show
interfaces" output, with a single gray row. Telling the user that they
belong to one or more named containers. The user can then run "show
interface name NAME" on interfaces owned by containers, which provided
some additional info, such as mac address and stat counters.
The patch also add support for printing veth peers which are owned by
containers.
Lastly, the patch also adds test cases for this functionality.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds support for setting the free form description string as
the interface alias. This can be read from /sys/class/net/*/ifalias, or
using the 'ip link show' command. The ifalias is reported by SNMP and
LLDP by default, and now also in the operational datastore.
Linux supports 250 characters in ifalias, but the IF-MIB is restricted
to 64 characters, so we add a local deviation to limit the type.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor, and massive code simplification, is a follow-up to the
double free discovery in 3b4d2b3.
Beacuse a hostname in Linux can never be more than 64 chars, we can
safely use a stack buffer instead of calloc(), reducing complexity
and simplifying the code further with the use of strlcat().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix a double free in the memory minefield surrounding container
hostname provisioning. The hostnamefmt() function already does free()
on success.
This caused all sorts of mayhem when working with multiple containers.
However it mainly manifested itself by some containers not starting
due to there activation script being polluted with gibberish
name data. Your symptom might be different..
Example of polluted activation script:
container --hostname foobar --net veth0k -r always \
create ^S@`M-}^G docker://ghcr.io/kernelkit/curios:edge
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch makes it possible to use format specifiers to "uniqiefy" a
container's hostname in the same way as with ietf-system hostname.
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlock setting a custom interface name inside the container. This aids
se-cases where this is needed and provide a better user experience, for
example when upgrading containers. Not having to reboot the host just
to activate an upgrated container.
Fixes#708
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Dummy interfaces are useful for configuring routes and testing network
services without having to allocate physical or virtual interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For products with a static factory-config, or customers generating with
an older syntax, attempt migration in case of bootstrap failure.
Refactor logging to drop '-s'. This prevents duplicate log messages
since bootstrap always runs after syslogd has started and all stdout
is always logged.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch relocates the 30-cfg-migrate init script to confd, where it
belongs, renaming it migrate and installing into /usr/sbin.
The script has been heavily modified to be more user friendly, as well
as useful for automated restore operations, to be able to refresh old
backups to modern .cfg file syntax.
Example (injected phys-address error):
admin@example:~$ migrate -c /etc/factory-config.cfg
/etc/factory-config.cfg: has syntax error, requires migrating.
Since backups are created with the old confd sytanx version in the name,
the backup functionality has been kept in the script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the ietf-interfaces deviation for phys-address,
used to set custom MAC address on interfaces, with a more flexible
approach which can calculate the new MAC address based on the device's
chassi MAC, with or without an added offset.
The regression test has been updated to test all variants.
Resolves: #680
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Dagger did delete of the VLAN after it had configured it.
Resulting in that the new VLAN configuration was lost.
This will first delete all untagged/tagged ports that should be removed,
when they are removed, add the new or changed ports.
Instead of renaming the yang-file instead we keep the yang file
with the actual content linear, easier to review and easier to
follow changes. This only applies on all infix models,deviations
and auguments.
The actual infix-system@2038-01-19.yang is just a symlink to
ietf-system.yang which contains all the code.
Refactor 0f9d429 to first check if the .cfg file has any routing
protocol active before converting the type's value.
This fixes a regression in the release cycle that otherwise would
cause a fresh startup-config, created from a plain factory-config
from v24.08, to be converted to an empty file.
Inspired by this fix, the same mitigation, albeit highyl unlikely,
has been applied to the v1.0 user shell type migration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding interfaces over NETCONF/RESTCONF, confd has a check to
ensure the peer end is skipped, since creating one end also create
the other.
This patch adds the corresponding skip when deleting a VETH pair.
Fixes#658
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable OSPF route metrics in RIB, only defined for OSPF
- Enable 'active' route flag for RIB, same as 'selected >' in FRR
- Enable 'last-updated' route field for RIB, used for uptime
- Augment route in RIB with 'installed' flag, same as 'FIB *' in FRR
The CLI "show ip route" command has been updated accordingly. The
classic Cisco style output has been kept instead of separating the
routes into Active and Backup, as discussed previously. Because
when inspecting large route sets you want to compare same prefix
vs distance/metric to understand why a certain route is selected.
admin@example:/> show ip route
PREFIX PREF NEXT-HOP PROTOCOL UPTIME
> 0.0.0.0/0 1/0 192.168.0.42 static 0h2m6s
* 192.168.122.1
0.0.0.0/0 5/0 192.168.122.1 static 0h2m6s
0.0.0.0/0 254/0 e1 static 0h2m6s
>* 169.254.0.0/16 0/0 e1 direct 0h2m6s
>* 192.168.0.0/24 1/0 192.168.122.1 static 0h2m6s
>* 192.168.122.0/24 0/0 e1 direct 0h2m12s
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the other IETF routing models, e.g., OSPF, let's
use the same model prefix for internal references.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not the most obvious patch, but let me explain -- there will always be a
conflict betweem usability and "maintainability". The ietf-interfaces
yang model already declares /interfaces-state as deprecated, so we don't
really need to add a deviation 'not-supported', for usability, however,
it may be useful since the deviation helps cut out that tree completely.
While working with ietf-routing and our companion models, I found that
since it relies on ietf-interfaces, it also breaks the reload/reimport
of infix-routing while developing extensions/changes:
$ lint.sh -f tree ieee802-* iana-if-type@2023-01-26.yang \
ietf-interfaces@2018-02-20.yang \
infix-interfaces@2024-01-15.yang \
ietf-routing@2018-03-13.yang \
ietf-ipv4-unicast-routing@2018-03-13.yang \
ietf-ospf@2022-10-19.yang \
infix-routing@2024-09-22.yang
libyang err : Not found node "interfaces-state" in path. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
libyang err : Target of leafref "interface" cannot be referenced because it is disabled. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
YANGLINT[E]: Parsing schema module "ietf-routing@2018-03-13.yang" failed.
The only way to change/update models for a given build is to either, a)
surgically remove offending models from output/target/, then reinstall
all dependencies and hope it works better, or b) rebuild from distclean.
In most cases you end up with alternative b).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Straighten out formatting issues in ospfd.conf (debug)
- Simplify and reduce code duplication
- Avoid 'restart zebra' errors in runlevel S
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the redesign of the operational rib routes, using vtysh 'show ip route'
instead of the kernel 'ip route' as source, we no longer need the infix source
protocol.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since /etc is not retained across reboots, the sysrepo startup datastore
is not used to bootstrap the Infix. Instead, /cfg/startup-config.cfg is
used and loaded directly to the running datastore.
For some use-cases when operating directly on sysrepo this causes a lot
of confusion because startup == factory ds until any user calls the CLI
command `copy running-config startup-confg`.
This patch fixes this initial "glitch" by loading the starup datastore
at boot on successful loading of startup-config to unning.
To prevent any unintentional "auto-save" of, e.g., failure-config to
startup-config, we make confd aware of this "sync" operation during
bootstap.
Fixes#625
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove duplicate logs due to logger logging also to stderr
- Fix coding style in new test-override-startup code path
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows a user to specify a specific 169.254/16 address that
the zeroconf client starts with when probing for a free address. If the
probe fails it falls back to its default algorithm.
Fixes#628
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today Infix only support OSPFv2 and Static routes, this hides all other
protocols in the CLI and makes it clearar about what we support in the YANG
model.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To prevent the kernel from setting a random mac address on new bridges,
before we have added any bridge ports, we create bridges using the:
1. Custom mac address from the configuration (phys-address)
2. System base mac from /run/system.json
3. None, if there is no base mac address in system.json, e.g. r2s
Fixes#357
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Tobias Waldekranz