Fix flaky ietf-routing unit tests.
Prior to this patch, there was a unit-test race between Yanger
(sysrepo emulator) and cli-pretty, where the local system time could
change between crafting the data and printing it. This caused the CLI
output to change and the ietf-routing unit test to fail.
Fixes#668
Signed-off-by: Richard Alpe <richard@bit42.se>
In "14128047e18d statd: remove nl code and improve speed" the handling
of all interfaces where moved from statd to Yanger. This means statd no
longer tracks interfaces using Netlink, but instead relies on Yanger
to recognise and list all interfaces in the system. In the midst of
this change the ignoring of "internal" interfaces where lost.
In this commit we reintroduce this logic in Yanger and add a test case
that ensures internal interfaces isn't listed.
Fixes: 14128047e1 statd: remove nl code and improve speed
Signed-off-by: Richard Alpe <richard@bit42.se>
Run ip link and ip addr once and handle the interface selection in
Yanger. This should be faster on systems with many ports and it
simplifies the CLI test files.
Signed-off-by: Richard Alpe <richard@bit42.se>
Refactor 0f9d429 to first check if the .cfg file has any routing
protocol active before converting the type's value.
This fixes a regression in the release cycle that otherwise would
cause a fresh startup-config, created from a plain factory-config
from v24.08, to be converted to an empty file.
Inspired by this fix, the same mitigation, albeit highyl unlikely,
has been applied to the v1.0 user shell type migration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding interfaces over NETCONF/RESTCONF, confd has a check to
ensure the peer end is skipped, since creating one end also create
the other.
This patch adds the corresponding skip when deleting a VETH pair.
Fixes#658
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable OSPF route metrics in RIB, only defined for OSPF
- Enable 'active' route flag for RIB, same as 'selected >' in FRR
- Enable 'last-updated' route field for RIB, used for uptime
- Augment route in RIB with 'installed' flag, same as 'FIB *' in FRR
The CLI "show ip route" command has been updated accordingly. The
classic Cisco style output has been kept instead of separating the
routes into Active and Backup, as discussed previously. Because
when inspecting large route sets you want to compare same prefix
vs distance/metric to understand why a certain route is selected.
admin@example:/> show ip route
PREFIX PREF NEXT-HOP PROTOCOL UPTIME
> 0.0.0.0/0 1/0 192.168.0.42 static 0h2m6s
* 192.168.122.1
0.0.0.0/0 5/0 192.168.122.1 static 0h2m6s
0.0.0.0/0 254/0 e1 static 0h2m6s
>* 169.254.0.0/16 0/0 e1 direct 0h2m6s
>* 192.168.0.0/24 1/0 192.168.122.1 static 0h2m6s
>* 192.168.122.0/24 0/0 e1 direct 0h2m12s
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the other IETF routing models, e.g., OSPF, let's
use the same model prefix for internal references.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not the most obvious patch, but let me explain -- there will always be a
conflict betweem usability and "maintainability". The ietf-interfaces
yang model already declares /interfaces-state as deprecated, so we don't
really need to add a deviation 'not-supported', for usability, however,
it may be useful since the deviation helps cut out that tree completely.
While working with ietf-routing and our companion models, I found that
since it relies on ietf-interfaces, it also breaks the reload/reimport
of infix-routing while developing extensions/changes:
$ lint.sh -f tree ieee802-* iana-if-type@2023-01-26.yang \
ietf-interfaces@2018-02-20.yang \
infix-interfaces@2024-01-15.yang \
ietf-routing@2018-03-13.yang \
ietf-ipv4-unicast-routing@2018-03-13.yang \
ietf-ospf@2022-10-19.yang \
infix-routing@2024-09-22.yang
libyang err : Not found node "interfaces-state" in path. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
libyang err : Target of leafref "interface" cannot be referenced because it is disabled. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
YANGLINT[E]: Parsing schema module "ietf-routing@2018-03-13.yang" failed.
The only way to change/update models for a given build is to either, a)
surgically remove offending models from output/target/, then reinstall
all dependencies and hope it works better, or b) rebuild from distclean.
In most cases you end up with alternative b).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Straighten out formatting issues in ospfd.conf (debug)
- Simplify and reduce code duplication
- Avoid 'restart zebra' errors in runlevel S
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the redesign of the operational rib routes, using vtysh 'show ip route'
instead of the kernel 'ip route' as source, we no longer need the infix source
protocol.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The intention is to provide a similar set of commands as klish
admin-exec. However, instead of trying to make the Linux tools
more accessible, we now make the Infix tooling more accessible.
E.g., instead of "show ip route" mapping to "ip route show", we
map it to:
sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
/usr/libexec/statd/cli-pretty "show-routing-table"
As a spin-off we alos get a much more readable infix.xml for klish:
- Relocate logic to shell script wrapper 'show'
- Introduce Cisco style "show ip route" and "show ipv6 route"
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since /etc is not retained across reboots, the sysrepo startup datastore
is not used to bootstrap the Infix. Instead, /cfg/startup-config.cfg is
used and loaded directly to the running datastore.
For some use-cases when operating directly on sysrepo this causes a lot
of confusion because startup == factory ds until any user calls the CLI
command `copy running-config startup-confg`.
This patch fixes this initial "glitch" by loading the starup datastore
at boot on successful loading of startup-config to unning.
To prevent any unintentional "auto-save" of, e.g., failure-config to
startup-config, we make confd aware of this "sync" operation during
bootstap.
Fixes#625
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove duplicate logs due to logger logging also to stderr
- Fix coding style in new test-override-startup code path
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In d616623a an attempt to silence bogus return values from mctl, when
multicast snooping is disabled on a bridge. That helped get data back
for operational to produce `show interfaces` *with* a bridge and ports
but still emitted bogus log warnings.
This patch addresses that by checking 'check' on JSONDcodeError as well
before emitting any log error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows a user to specify a specific 169.254/16 address that
the zeroconf client starts with when probing for a free address. If the
probe fails it falls back to its default algorithm.
Fixes#628
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is basically a functionally revert of:
435c5ca9 statd: allow ethtool --json to fail without breaking operational ds
Having a fail flag that hides all yanger faults is too big of a
hammer. If some hardware doesn't support a particular command such as
"ethtool --json" it should be handled gracefully by yanger. Perhaps by
catching the error and returning an empty dataset for that node.
Signed-off-by: Richard Alpe <richard@bit42.se>
A non functional change. The caller knows more about how to format the
args, so it makes more sense to build the Yanger cmdline from the
caller.
Signed-off-by: Richard Alpe <richard@bit42.se>
This is a major redesign of statd interface handling. The goal here is
to reduce the time it takes for statd to produce operational data for
all interfaces on larger iron. Which manifested itself most notably in
the CLI command "show interfaces".
This patch removes the netlink interface subscriptions done by the
statd c code. Instead statd now subscribes to the ietf-interfaces
base path which means it will be invoked for all interfaces.
If the user (sysrepo) has specified an explicit interface name such as
eth0, it will be extracted by statd and passed down to Yanger.
This patch also modifies Yanger to fit this new modus. No explicitly
passed interface name now means all interfaces.
Side note:
The main culprit of the slow operational interface data is the time it
takes to bootstrap python. Which prior to this patch was done for each
interface. On the HW system I'm testing this patch on, runtime is
reduced by a factor of 10.
Signed-off-by: Richard Alpe <richard@bit42.se>
Today Infix only support OSPFv2 and Static routes, this hides all other
protocols in the CLI and makes it clearar about what we support in the YANG
model.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With a basic bridge setup, which has multicast snooping disabled by
default, `show interfaces` cause the following bogus log messages:
Sep 13 07:08:35 yanger: Command '['mctl', 'show', 'igmp', 'json']' returned non-zero exit status 1
Sep 13 07:08:35 yanger: Command '['mctl', 'show', 'igmp', 'json']' returned non-zero exit status 1
Sep 13 07:08:35 yanger: Command '['mctl', '-p', 'show', 'igmp', 'json']' returned non-zero exit status 1
Add a quiet flag to the run methods and set quiet=True for all mctl
commands to silence these log messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before we add proper operational support for DNS and NTP, we can at
least improve on the built-in CLI commands.
Issue #510
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only administrators are allowed to work with containers, allow them to
perform tab completion of all admin-exec commands as well.
Fixes#613
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When multicast snooping is disabled on a bridge, mctl will exit with a
non-zero return code. Default to {} for these cases so that the bridge
and its ports are properly returned by yanger.
Fixes#618
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To prevent the kernel from setting a random mac address on new bridges,
before we have added any bridge ports, we create bridges using the:
1. Custom mac address from the configuration (phys-address)
2. System base mac from /run/system.json
3. None, if there is no base mac address in system.json, e.g. r2s
Fixes#357
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit, querier multicast changes such as query-interval
where not applied to an existing multicast interface. The new initctl
touch makes finit send a sighup to mcd which causes it to re-load its
configuration files.
Signed-off-by: Richard Alpe <richard@bit42.se>
With the recent changes in Infix v24.08 to tighten up permissions, a
regression in the 'show ospf' family of commands was introduced.
This patch adds a 'doas' prefix to all vtysh commands. The 'doas' tool
wraps sudo in a way such than unauthorized users do not get a sudo error
thrown as result.
A better fix might be to either include all admin group users also in
the UNIX group 'frrvty', or even better, change the default group of
vtysh to 'wheel'. Affected files are /etc/frr/vtysh.conf and all
/run/frr/*.vty sockets, the latter are created at runtime by zebra,
ospfd, etc. This require modifying the buildroot/package/frr/frr.mk
file, which unfortunately have the group hard coded.
admin@R2:~$ ls -l /etc/frr/vtysh.conf
-rw-r----- 1 frr frrvty 32 Sep 3 05:27 /etc/frr/vtysh.conf
admin@R2:~$ ls -l /run/frr/*.vty
srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/ospfd.vty
srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/zebra.vty
Fixes#601
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_get_str() function may return NULL, which goes unchecked in
both fxlate() and sxlate(), as well as the calls to free().
Found by Coverity Scan
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
