This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The intention is to provide a similar set of commands as klish
admin-exec. However, instead of trying to make the Linux tools
more accessible, we now make the Infix tooling more accessible.
E.g., instead of "show ip route" mapping to "ip route show", we
map it to:
sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
/usr/libexec/statd/cli-pretty "show-routing-table"
As a spin-off we alos get a much more readable infix.xml for klish:
- Relocate logic to shell script wrapper 'show'
- Introduce Cisco style "show ip route" and "show ipv6 route"
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apply a distance adjustment to routes retrieved from IPv4LL/ZeroConf and
DHCP to ensure that Frr (Zebra) can compare other protocol routes, e.g.,
static. Without this Frr will consider all routes read from the kernel
to have a protocol distance of 0, meaning better than static routes that
have a distance of 1.
Initial proposal to fix issue #640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- We know we always have iproute2 tools
- We only use one ipv4ll client per interface, so UNBIND can be
simplified to flush ifname:avahi
- Log all events handled by script for troubleshooting
Note: on BIND event we may be called without first getting UNBIND on
previous address, hence the flush there too.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
when migrate configs the yang data produced was this:
"infix-meta:meta": {
version: "1.0"
"infix-meta:version": "1.1"
},
duplicate node, resulting in failed migration of startup configuration, always replace
whole node.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While sysrepo's architecture places the responsibility of choosing a
timeout on each front-end, we want to control it centrally since the
majority of the time is spend actually applying the config to the
system - which is front-end agnostic.
Therefore, create a single definition of the timeout, which can be
included by all front-ends.
Passing $@ to sudo requires quoting to prevent splitting arguments like
this:
admin@R2:~$ doas vtysh -c 'show ip ospf routes'
% Command incomplete: show
After this patch:
admin@R2:~$ doas vtysh -c 'show ip ospf route'
============ OSPF network routing table ============
N 192.168.50.0/24 [1] area: 0.0.0.0
directly attached to e7
============ OSPF router routing table =============
R 192.168.100.1 [1] area: 0.0.0.0, ASBR
via 192.168.50.1, e7
============ OSPF external routing table ===========
N E2 192.168.10.0/24 [1/20] tag: 0
via 192.168.50.1, e7
N E2 192.168.100.1/32 [1/20] tag: 0
via 192.168.50.1, e7
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix has the catch-all /var/log/debug, and now also /var/log/routing
for debug messages from Frr.
The log file /var/log/syslog now catches *all* messages except auth*,
which may contain secrets, except debug messages. Contrast this with
/var/log/messages which only logs info/notice/warn -- i.e., no error
and above log messages.
Due to the way syslogd parses /etc/syslog.conf et al, we override the
default in Infix to disable the default /var/log/syslog, otherwise we
would get duplicates to the same log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As of KernelKit Klish @ 710a631 the script plugin has been refactored to
run all commands as the logged in user instead of as root. The default
admin user is member of the wheel group, which allows access to sysrepo
and sudo access to containers thanks to NOPASSWD rights.
The doas script is a dummy wrapper to silence 'sudo -n' output for users
without any privileges.
As of this commit, unprivileged users can no longer copy, show, or in
any other way manipulate the system configuraiton.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes mirror the changes made to the CLI in an attempt to create
a better user experience for working with log files even from the shell.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch greatly improves the security of the Infix factory reset by
replacing 'rm' with 'shred'. The shred tool overwrites the contents of
files three times. With the -z and -u options the last pass writes
zeroes and then uninks the files.
On the NanoPi R2S the factory-reset now takes 24 seconds:
Aug 11 16:00:34 infix mnt[121]: Resetting to factory defaults.
Aug 11 16:00:58 infix mnt[173]: Factory reset complete.
A visual aid is also added, setting *all* LEDs to on, that can be found
mounted on the device, before starting the file shredders. The LEDs are
reset back to off and SYS red blinking as soon as the wipe has completed
and iitod has been started.
Fixes#158
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When syncing interface defaults at boot, some settings are read-only and
some are write-only. Filter these out so sysctl does not log any bogus
Permission Denied messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By default, Linux will map an IP packet's TOS field into skb->priority
when acting as a router. Unfortunately this is only globally
configurable (per network namespace), which leaves us with the
following dilemma:
If we keep reclassification enabled, then a setup like this...
vlan1 vlan2
\ /
br0
/ \
e1 e2
...would likely not work as expected because any priority information
from hardware, that might be mapped to skb->priority via vlan1's
ingress-qos-map, would then be replaced by the standard TOS-mapping on
the routing boundary.
On the other hand, if we disable reclassification, then we won't be
able to source priority information from the TOS field when no other
source is available, as is the case when the source interface is a
regular NIC.
Given that the primary use-case is to run on switchdev ports, we will
most likely always have priority information available from hardware,
which is why we opt to disable the reclassification.
If this ever becomes configurable per interface, then we could open up
the configuration to let users define the policy of which layer's
priority should take precedence.
Opportunistically look for interfaces with multiple transmit queues
and hardware support for the mqprio queuing discipline. For every
matching interface, set up mappings from kernel-internal packet
priorities, via traffic classes, to transmit queues such that as many
high priorities as possible are scheduled on separate queues.
This makes it easier to add more scripts without having to update the
finit config file, and it clarifies which of the scripts in
/libexec/infix only execute at boot.
This enables access to /restconf on port 443 over HTTP/1.1 and HTTP/2
via rousette when enabled.
Also, slight refactor to allow including /restconf and /netbrowse as
optional locations in the main servier directive.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Assume that the caller always want to create a new partition table,
even in scenarios where one already exists. This allows devices to be
reprovisioned with a newer image, for example.
Fixes#394
Joachim Wiberg