Refactor 0f9d429 to first check if the .cfg file has any routing
protocol active before converting the type's value.
This fixes a regression in the release cycle that otherwise would
cause a fresh startup-config, created from a plain factory-config
from v24.08, to be converted to an empty file.
Inspired by this fix, the same mitigation, albeit highyl unlikely,
has been applied to the v1.0 user shell type migration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding interfaces over NETCONF/RESTCONF, confd has a check to
ensure the peer end is skipped, since creating one end also create
the other.
This patch adds the corresponding skip when deleting a VETH pair.
Fixes#658
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable OSPF route metrics in RIB, only defined for OSPF
- Enable 'active' route flag for RIB, same as 'selected >' in FRR
- Enable 'last-updated' route field for RIB, used for uptime
- Augment route in RIB with 'installed' flag, same as 'FIB *' in FRR
The CLI "show ip route" command has been updated accordingly. The
classic Cisco style output has been kept instead of separating the
routes into Active and Backup, as discussed previously. Because
when inspecting large route sets you want to compare same prefix
vs distance/metric to understand why a certain route is selected.
admin@example:/> show ip route
PREFIX PREF NEXT-HOP PROTOCOL UPTIME
> 0.0.0.0/0 1/0 192.168.0.42 static 0h2m6s
* 192.168.122.1
0.0.0.0/0 5/0 192.168.122.1 static 0h2m6s
0.0.0.0/0 254/0 e1 static 0h2m6s
>* 169.254.0.0/16 0/0 e1 direct 0h2m6s
>* 192.168.0.0/24 1/0 192.168.122.1 static 0h2m6s
>* 192.168.122.0/24 0/0 e1 direct 0h2m12s
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the other IETF routing models, e.g., OSPF, let's
use the same model prefix for internal references.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not the most obvious patch, but let me explain -- there will always be a
conflict betweem usability and "maintainability". The ietf-interfaces
yang model already declares /interfaces-state as deprecated, so we don't
really need to add a deviation 'not-supported', for usability, however,
it may be useful since the deviation helps cut out that tree completely.
While working with ietf-routing and our companion models, I found that
since it relies on ietf-interfaces, it also breaks the reload/reimport
of infix-routing while developing extensions/changes:
$ lint.sh -f tree ieee802-* iana-if-type@2023-01-26.yang \
ietf-interfaces@2018-02-20.yang \
infix-interfaces@2024-01-15.yang \
ietf-routing@2018-03-13.yang \
ietf-ipv4-unicast-routing@2018-03-13.yang \
ietf-ospf@2022-10-19.yang \
infix-routing@2024-09-22.yang
libyang err : Not found node "interfaces-state" in path. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
libyang err : Target of leafref "interface" cannot be referenced because it is disabled. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
YANGLINT[E]: Parsing schema module "ietf-routing@2018-03-13.yang" failed.
The only way to change/update models for a given build is to either, a)
surgically remove offending models from output/target/, then reinstall
all dependencies and hope it works better, or b) rebuild from distclean.
In most cases you end up with alternative b).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Straighten out formatting issues in ospfd.conf (debug)
- Simplify and reduce code duplication
- Avoid 'restart zebra' errors in runlevel S
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the redesign of the operational rib routes, using vtysh 'show ip route'
instead of the kernel 'ip route' as source, we no longer need the infix source
protocol.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since /etc is not retained across reboots, the sysrepo startup datastore
is not used to bootstrap the Infix. Instead, /cfg/startup-config.cfg is
used and loaded directly to the running datastore.
For some use-cases when operating directly on sysrepo this causes a lot
of confusion because startup == factory ds until any user calls the CLI
command `copy running-config startup-confg`.
This patch fixes this initial "glitch" by loading the starup datastore
at boot on successful loading of startup-config to unning.
To prevent any unintentional "auto-save" of, e.g., failure-config to
startup-config, we make confd aware of this "sync" operation during
bootstap.
Fixes#625
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove duplicate logs due to logger logging also to stderr
- Fix coding style in new test-override-startup code path
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows a user to specify a specific 169.254/16 address that
the zeroconf client starts with when probing for a free address. If the
probe fails it falls back to its default algorithm.
Fixes#628
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today Infix only support OSPFv2 and Static routes, this hides all other
protocols in the CLI and makes it clearar about what we support in the YANG
model.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To prevent the kernel from setting a random mac address on new bridges,
before we have added any bridge ports, we create bridges using the:
1. Custom mac address from the configuration (phys-address)
2. System base mac from /run/system.json
3. None, if there is no base mac address in system.json, e.g. r2s
Fixes#357
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit, querier multicast changes such as query-interval
where not applied to an existing multicast interface. The new initctl
touch makes finit send a sighup to mcd which causes it to re-load its
configuration files.
Signed-off-by: Richard Alpe <richard@bit42.se>
The srx_get_str() function may return NULL, which goes unchecked in
both fxlate() and sxlate(), as well as the calls to free().
Found by Coverity Scan
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This intoduce a new sysrepo plugin to handle a new YANG
model 'infix-test'. Today only contains the actions.
This is required to run tests on infix using infamy.
This is a part of #561
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details. This caused all audit log messages to be logged in LOG_USER.
Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.
Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs. Only
needed when logging to stdout.
Follow-up to issue #521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
LOG_DAEMON is a facility not an option. Replace with NDELAY option and
set facility properly in call to openlog() instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The backported patches to sysklogd now support the RFC facilities
natively, so we can focus on local facilities (and 'all').
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a must expression to limit invalid configurations.
Not belonging to VLAN when added to a multicast-filter in
that VLAN. Make sure multicast snooping is enabled when
using multicast filters.
This fixes#587
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The srx_get_changes() API, introduced in 18b5922, does not provide the
user with a delete yang:operation when the entire YANG tree is deleted.
Refactor syslog actions to use the srx_get_diff() API instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces a new SECURITY() log macro that logs to facility
'audit' (sometimes called 'security') with severity set to 'alert'. It
is then used to instrument the single most important things to log; all
changes to users and their privileges.
We also add logging to sysrepo, which knows the username for changes to
running-config, copies to startup-config, and RPCs.
Fixes#521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- For consistency and clarity, rename format -> log-format
- Add must expression to ban 'bsd' format from file logging
Note: technically, sysklogd silently reverts back to rfc3164 for file
logging, but it's better to be clear with the user with what is
possible to configure and is going to be used.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As a bare minimum, all augments and deviations made to standard models
should have a description denoting *why* they exist.
In the case of ietf-syslog the base model is still a draft and carries
some odd defaults we want to disable, or replace with better ones. The
augments are global log rotation and and log format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor changes the callback subscription for log-file and remote
log actions to ensure they are called for *all* changes. Even changes
to deeply nested sub-trees like file-rotation when no other changes are
made. The previous attempt failed to address that.
The refactored callbacks replace sr_get_changes() with srx_get_changes()
for better control over what they iterate over. The callbacks always
regenerate the syslogd *.conf file snippets for each log action, so
there is no need for the overly granular sr_get_changes(), ever.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg