This reverts commit 0ee973b2b2.
Turns out that this workaround simply reduced the size of the window
where this issue can occur.
The previous change now ensures that the DSA tree is always fully
setup by the time nameif runs.
Before this change, we relied on `udevadm settle` to act as a barrier
which we could only cross after all devices had been probed. As it
turns out, when drivers defer probing due to missing dependencies,
`udevadm settle` may exit (as no events are generated for a period of
time) before all devices are set up. This was the root cause behind
issue #685, for which #752 was the initial attempt at a fix.
As we know that systems using mv88e6xxx will always have a device link
referencing the conduit interface, add a script to finit's system
runparts directory, which will block while any device link consumers
are still probing.
As a consequence of this, we can no longer rely on the sysklogd.conf
shipped with finit. Therefore, install an Infix specific one, which
will make sure that the aforementioned script has run before launching
the syslog daemon, which most other things depend on.
Fixes#685
This commit replaces the 'cfg' alias for 'sysrepocfg -f json' with a
small shell script. Currently only an 'edit' command, similar to the
CLI 'text-editor' command for modifying base64 encoded YANG nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Refactor logging to simplify code and get proper log level
- Clean up lingering directories from any extracted tarball on error
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows running the configure script manually to create and
delete containers. The normal flow via confd has additional handling
to ensure containers are started/stopped on inictl reload.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of using $HOME, which may be a ramdisk, use /var/tmp which
podman also uses by default. Also, make sure to clean up after
ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Disable the default "podman pull" retry value. We use execd to retry
"podman create" on failure. Wihtout this change, a single container
can block start of other containers by 3 * 20 seconds. Now we only
block max 20 seconds before we try starting the next container.
Modern versions of podman (>= 5.0) have this --retry option, but it
does not have CNI, so this is a temporary workaround.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to handle container restarts, incl. restart policy, at
runtime, most of the container data lives in /var/lib/containers,
which on most systems is backed by a persistent store.
As of issue #823 we no longer keep a writable layer for containers,
nor should we cache container state across reboots, all containers
are recreated at boot. This task cleans up any lingering state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Running 'shred' on files stored on eMMC is pointless since the writes
are spread out over other sectors rather than overwriting the content
of the files as it was supposed to on old rotating media.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These are basically the same flags as was passed to klish, but now we
use -R instead of -r to make sure only ANSI coloŕ escapes can affect
the behavior of less.
This change will make it posslbe to shop off too long lines and scroll
vertically on really long lines instead for them breaking output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we opportunistically set up mqprio on all interfaces, we pass over
interfaces without offloading support. Catch that error message and log
an informational message about which interfaces are skipped.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 0f410eb a patch was added to RAUC to allow native logging to syslog,
it was however never enabled. This patch enables logging to syslog.
Fix#809
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrapping a system with D-Bus using Finit will create the machine-id
file /var/lib/dbus/machine-id, this can be used as the unique machine-id
for services like RAUC, so let's set that as /etc/machine-id to reduce
the log spam we get otherwise:
Nov 7 06:18:08 test-05-25-f8 rauc[5512]: Failed to get machine-id: Failed to open file <E2>M-^@M-^\/etc/machine-id<E2>M-^@M-^]: No such file or directory
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some services launched at bootstrap must be possible to override per
product. One such service is iitod, which manages the LEDs in Infix.
This change makes allows a product specific init script to clear the
led condtion, preventing Finit from lauching iitod. Also, rename the
ixinit-done condition to match the nomenclature used already.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch use the new compatible array in /run/system.json, installing
in order, least to most significant product overrides.
We also introduce a new way to run product specific scripts at init, to
override default behavior in Infix, e.g., LED control.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sometimes the interface creation are done, but
the sysfs is not, this gap we sometimes finds
in the nameif script. Wait out the sysfs creation
if running a DSA switch.
Fix#685
Signed-off-by: Mattias Walström <lazzer@gmail.com>
This patch relocates the 30-cfg-migrate init script to confd, where it
belongs, renaming it migrate and installing into /usr/sbin.
The script has been heavily modified to be more user friendly, as well
as useful for automated restore operations, to be able to refresh old
backups to modern .cfg file syntax.
Example (injected phys-address error):
admin@example:~$ migrate -c /etc/factory-config.cfg
/etc/factory-config.cfg: has syntax error, requires migrating.
Since backups are created with the old confd sytanx version in the name,
the backup functionality has been kept in the script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The intention is to provide a similar set of commands as klish
admin-exec. However, instead of trying to make the Linux tools
more accessible, we now make the Infix tooling more accessible.
E.g., instead of "show ip route" mapping to "ip route show", we
map it to:
sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
/usr/libexec/statd/cli-pretty "show-routing-table"
As a spin-off we alos get a much more readable infix.xml for klish:
- Relocate logic to shell script wrapper 'show'
- Introduce Cisco style "show ip route" and "show ipv6 route"
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apply a distance adjustment to routes retrieved from IPv4LL/ZeroConf and
DHCP to ensure that Frr (Zebra) can compare other protocol routes, e.g.,
static. Without this Frr will consider all routes read from the kernel
to have a protocol distance of 0, meaning better than static routes that
have a distance of 1.
Initial proposal to fix issue #640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- We know we always have iproute2 tools
- We only use one ipv4ll client per interface, so UNBIND can be
simplified to flush ifname:avahi
- Log all events handled by script for troubleshooting
Note: on BIND event we may be called without first getting UNBIND on
previous address, hence the flush there too.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
when migrate configs the yang data produced was this:
"infix-meta:meta": {
version: "1.0"
"infix-meta:version": "1.1"
},
duplicate node, resulting in failed migration of startup configuration, always replace
whole node.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While sysrepo's architecture places the responsibility of choosing a
timeout on each front-end, we want to control it centrally since the
majority of the time is spend actually applying the config to the
system - which is front-end agnostic.
Therefore, create a single definition of the timeout, which can be
included by all front-ends.
Passing $@ to sudo requires quoting to prevent splitting arguments like
this:
admin@R2:~$ doas vtysh -c 'show ip ospf routes'
% Command incomplete: show
After this patch:
admin@R2:~$ doas vtysh -c 'show ip ospf route'
============ OSPF network routing table ============
N 192.168.50.0/24 [1] area: 0.0.0.0
directly attached to e7
============ OSPF router routing table =============
R 192.168.100.1 [1] area: 0.0.0.0, ASBR
via 192.168.50.1, e7
============ OSPF external routing table ===========
N E2 192.168.10.0/24 [1/20] tag: 0
via 192.168.50.1, e7
N E2 192.168.100.1/32 [1/20] tag: 0
via 192.168.50.1, e7
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix has the catch-all /var/log/debug, and now also /var/log/routing
for debug messages from Frr.
The log file /var/log/syslog now catches *all* messages except auth*,
which may contain secrets, except debug messages. Contrast this with
/var/log/messages which only logs info/notice/warn -- i.e., no error
and above log messages.
Due to the way syslogd parses /etc/syslog.conf et al, we override the
default in Infix to disable the default /var/log/syslog, otherwise we
would get duplicates to the same log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As of KernelKit Klish @ 710a631 the script plugin has been refactored to
run all commands as the logged in user instead of as root. The default
admin user is member of the wheel group, which allows access to sysrepo
and sudo access to containers thanks to NOPASSWD rights.
The doas script is a dummy wrapper to silence 'sudo -n' output for users
without any privileges.
As of this commit, unprivileged users can no longer copy, show, or in
any other way manipulate the system configuraiton.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes mirror the changes made to the CLI in an attempt to create
a better user experience for working with log files even from the shell.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch greatly improves the security of the Infix factory reset by
replacing 'rm' with 'shred'. The shred tool overwrites the contents of
files three times. With the -z and -u options the last pass writes
zeroes and then uninks the files.
On the NanoPi R2S the factory-reset now takes 24 seconds:
Aug 11 16:00:34 infix mnt[121]: Resetting to factory defaults.
Aug 11 16:00:58 infix mnt[173]: Factory reset complete.
A visual aid is also added, setting *all* LEDs to on, that can be found
mounted on the device, before starting the file shredders. The LEDs are
reset back to off and SYS red blinking as soon as the wipe has completed
and iitod has been started.
Fixes#158
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Tobias Waldekranz