As it turns out, the setup with a 802.1D bridge in combination with
VLAN uppers stacked on the bridge ports is not possible to support
on mv88e6xxx ports.
Enable VLAN filtering to ensure proper isolation of the locally
terminated VLANs.
This will fail on a system running a vanilla kernel, where the dut's
ports are backed by mv88e6xxx, because:
1. The ports are attached to the same bridge, and are thus in the same
PVT group.
2. Creation of the VLAN uppers causes the DSA layer to add both ports
to the same VTU entry.
As a result, hardware behaves as if both ports had been configured as
tagged members of VLAN 10, instead of just terminating incoming
traffic locally.
Add this test to catch hardware which behaves in this way.
This patch drops a needless restriction of IP addresses on VLAN filtering
bridges from 2024-03-06. The obvious use-case is when the bridge is an
untagged member of a VLAN and only ony management VLAN is required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the FRR upgrade to 9.1.2, OSPF sometimes reports neighbors
without reporting the routerDesignatedId and routerDesignatedBackupId
attributes. Ensure that these attributes are available before trying
to copy them to the output.
During development of the upcoming ospf_container test, an issue was
discovered where zebra's view of the system drifted from the kernel's
ditto. Specifically: when transitioning from test-config to one with
many virtual interfaces (VLANs VETH pairs etc.), zebra would not
process events for all interfaces, which meant OSPF would not pick
them up.
Our experience matches very well with a bug reported upstream in:
https://github.com/FRRouting/frr/issues/13630
> If we delete kernel interface and create it and set its ip in a
> short time, in rare cases, interface ip will be lost in zebra which
> can be confirmed by vtysh show interface brirf command. This will
> lead to abnormal behavior of other protocol daemons, for example,
> bgpd does not announce the route corresponding to interface ip even
> it was specified by network command.
The issue was marked as fixed by PR 13396, which was merged in the 9.0
cycle:
https://github.com/FRRouting/frr/pull/13396
Therefore, upgrade FRR to the latest patch release from that major.
During debugging of a reconfiguration issue, one hypothesis was that
the tracking of callbacks used to determine when a transaction has
completed (as sysrepo has no hooks for this) was out of sync, causing
us to call `initctl reload` prematurely. This was not the case, but if
it ever occurs in the future, make sure that it is a fatal error that
won't go unnoticed.
- Verify that broadcast packets are also properly moved accross the
bridge, i.e. the broadcast packets sent from vlan interface VLAN10
do not reach VLAN20
Fixes#773
This reverts commit 0ee973b2b2.
Turns out that this workaround simply reduced the size of the window
where this issue can occur.
The previous change now ensures that the DSA tree is always fully
setup by the time nameif runs.
Before this change, we relied on `udevadm settle` to act as a barrier
which we could only cross after all devices had been probed. As it
turns out, when drivers defer probing due to missing dependencies,
`udevadm settle` may exit (as no events are generated for a period of
time) before all devices are set up. This was the root cause behind
issue #685, for which #752 was the initial attempt at a fix.
As we know that systems using mv88e6xxx will always have a device link
referencing the conduit interface, add a script to finit's system
runparts directory, which will block while any device link consumers
are still probing.
As a consequence of this, we can no longer rely on the sysklogd.conf
shipped with finit. Therefore, install an Infix specific one, which
will make sure that the aforementioned script has run before launching
the syslog daemon, which most other things depend on.
Fixes#685
- No more default writable layer
- Don't mention read-only (deprecated, and always on now)
- Use ghfm note highlights
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds latest symlinks to the curiOS containers to make system
upgrades easier. I.e., a user can now reference the bundled image with:
set image oci-archive:/lib/oci/curios-httpd-latest.tar.gz
So that when they upgrade to the latest Infix, which might include an
update of curiOS httpd, they will get a seamless upgrade also of the
container(s) running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the 'cfg' alias for 'sysrepocfg -f json' with a
small shell script. Currently only an 'edit' command, similar to the
CLI 'text-editor' command for modifying base64 encoded YANG nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Refactor logging to simplify code and get proper log level
- Clean up lingering directories from any extracted tarball on error
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows running the configure script manually to create and
delete containers. The normal flow via confd has additional handling
to ensure containers are started/stopped on inictl reload.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of using $HOME, which may be a ramdisk, use /var/tmp which
podman also uses by default. Also, make sure to clean up after
ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Disable the default "podman pull" retry value. We use execd to retry
"podman create" on failure. Wihtout this change, a single container
can block start of other containers by 3 * 20 seconds. Now we only
block max 20 seconds before we try starting the next container.
Modern versions of podman (>= 5.0) have this --retry option, but it
does not have CNI, so this is a temporary workaround.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an Infix device is connected to a LAN where the gateway has yet to
connect to the Internet, the container script will fail pulling images
from any remote server.
Nov 16 12:48:13 infix container[3490]: Error: initializing source docker://ghcr.io/kernelkit/curios:edge: pinging container registry ghcr.io: Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on 127.0.0.1:53: read udp 127.0.0.1:55422->127.0.0.1:53: i/o timeout
Nov 16 12:48:13 infix container[3641]: Error: failed creating container fw, please check the configuration.
Nov 16 12:48:13 infix execd[3490]: /run/containers/queue/S01-fw.sh failed, exit code: 1
Since execd until now only retries on netlink/inotify events, or manual
SIGUSR1, jobs would get stuck even though Internet connectivity had been
established. This patch fixes that with the addition of a retry timer
which runs while there are pending jobs in the queue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #815 detail issues found running the Clixon Controllar and
Cisco Yangsuite. The errors and warnings listed are very similar
to pyang, which the undersigned has, the following changes fixes
the pyang errors:
- relocate 'feature containers' to submodule
- drop already deviated ospf:database deviations
- drop unused imports
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
