This rather huge change is a refactor of the factory-config generataion to add
support for also generating a failure-config.
The confd bootstrap script has been given an rc file. This both eases manual
testing, when modifying the script(s), and also makes it easier to override
from a br2-external. Infix default is router/end-device, but a br2-external
may be a switch firmware and want to default to all ports in a bridge.
The generated failure-config creates a fail-safe "do no harm" config to boot
with in case startup-config for some reason is broken or cannot be applied,
e.g., bug in confd. Meaning, for both the router and switch use-cases the
device will start up with all interfaces isolated¹, with an IPv6 SLAAC (EUI64)
address per interface.
Services enabled in this fail-safe mode are: LLDP, mDNS/SD, SSH, and NETCONF.
All to facilitate diagnostics, troubleshooting and device recovery.
Other noteworthy changes include:
- rename factory/failure directories again -> factory.d/failure.d. Use
same naming as we do on target for directories holding generated files
- The bootstrap script no longer regenerates /cfg/factory.d on each boot
- The bootstrap script copies all static templates to /cfg/factory.d in
case a newer image changes the contents of them. For troubleshooting
- Support for overriding the 20-interfaces.json generation by br2-external
- Support for additional 30-config.json (ovrride/extend) by br2-external
- Expand gen-interfaces to support bridge use-case.
_____
¹ For a switch this means "no switchport", i.e., no switching between ports
otherwise connected to a switchcore (or bridge) in startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd and BusyBox syslogd can not run at the same time. Since they
provide the same service we standardize on them providing <pid/syslogd>.
Also, ensure syslogd does not start until the fifth udevadm has completed.
This creates a barrier preventing other run/task/services from starting
too early. Thus guaranteeing a proper boot order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit fixes a regression introduced in 15572e9e where /bin/bash
was unintentionally set as the defalt /bin/sh in the system. This cause
several warnings and errors when a Bash-based /bin/sh tries to sources
/etc/profile because $SHELL identifies it as /bin/bash.
The ietf-system.yang model, with the infix-system.yang extensions,
declare a per-user SHELL that allow /bin/clish, /bin/bash, /bin/sh
and /bin/false. There should be a clear distinction between them.
This change also helps us keep bashisms away. If a script needs
Bash features, declare: #!/usr/bin/env bash
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit drops sulogin from BusyBox, as well as the Finit replacement,
in the NETCONF builds. The classic builds retain the Finit sulogin.
Furthermore, the Finit rescue mode is disabled (which uses sulogin), so
in case of trouble at boot, e.g. missing fstab or failure to fsck, the
system will no longer go to sulogin but instead log error to console and
reboot.
NOTE: the bootloader still needs to be locked down, otherwise a user
could just as easily change kernel cmdline to 'shell=/bin/sh'
Misc. reshuffle and defaults updated are due to make foo-update-defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- with conditional execution support
- fixes to udevd and udevadm calls in renamed 10-hotplug.conf
- support for overriding internal services, e.g. dbus, keventd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only create a default startup-config from factory-config if one is missing.
Do not load an existing startup-config, that is handled by a later step in
the boot process, which needs to be monitored (and displayed) separately to
fail over to a Fail Secure mode on error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes to the system concerning access rights, like users, should always
be logged, in particular when creating new users or failure to create or
modify their properties.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change addresses a problem accessing Infix over SSH. The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.
The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.
As before this change, the script starts by calling `sshd -t` to verify
they hostkeys. Unlike before we now check for 'invalid format' in the
output of that command. If any file with invalid format is found, we
remove them and regenerate the hostkeys.
In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.
Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We only want Bob to run when PR's have been merged to main, this means
when something is pushed to main. (Took a while to figure this one out
actually.) See the following community discussion for details:
https://github.com/orgs/community/discussions/26724#discussioncomment-3253102
Also, we've seen that moving the 'latest' tag messes up any push/pull/sync
operation between clones and forks, so let's skip it and see how that works.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle IPv6 Router Advertisement (RA) based addresses.
If the last 64 bits of a link-local address is generated using the
local MAC address of the interface, i.e. a EUI-64 based address. Then
the origin is set to "link-layer".
If the addrgenmode is set to "random" instead of "eui64", then the
device will generate the interface identifier portion of the address
(the last 64 bits) randomly rather than deriving it from the MAC
address using the EUI-64 process. This will result in a "random"
origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
Setting the link MTU in Linux changes the sysctl IPV6 MTU, so we have to
set the IPv6 MTU on each run in case the IPv4 MTU changes. Hence, this
also means the IPv6 MTU must be set *after* the IPv4 (link) MTU.
statd has been updated to read the sysctl setting for IPv6 MTU.
Notice how the loopback interface is unsupported for config + status.
Fixes issue #151
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the new fancy result-gh.md file which as github emojis. Also,
split result publishing to its own run command to simplify the YAML
file.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result file with github emojis
> 9pm.py: expose ROOT_PATH to tests via env
> lib_tcl: improve handling of extra ssh args from test
> 9pm: fix evaluation of <base> option in nested suite
> .github: publish test result md in github
> 9pm: resolve <scratch> in suite option
Signed-off-by: Richard Alpe <richard@bit42.se>
Collecting pyyaml==5.4.1 (from -r /root/pip-requirements.txt (line 6))
Downloading PyYAML-5.4.1.tar.gz (175 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 175.1/175.1 kB 16.2 MB/s eta 0:00:00
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'error'
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> [68 lines of output]
/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/config/setupcfg.py:293: _DeprecatedConfig: Deprecated config in `setup.cfg`
!!
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
!!
parsed = self.parsers.get(option_name, lambda x: x)(value)
running egg_info
writing lib3/PyYAML.egg-info/PKG-INFO
writing dependency_links to lib3/PyYAML.egg-info/dependency_links.txt
writing top-level names to lib3/PyYAML.egg-info/top_level.txt
Traceback (most recent call last):
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 335, in main
json_out['return_val'] = hook(**hook_input['kwargs'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 118, in get_requires_for_build_wheel
return hook(config_settings)
^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 355, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=['wheel'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 325, in _get_build_requires
self.run_setup()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 341, in run_setup
exec(code, locals())
File "<string>", line 271, in <module>
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/__init__.py", line 103, in setup
return distutils.core.setup(**attrs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 185, in setup
return run_commands(dist)
^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 201, in run_commands
dist.run_commands()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 969, in run_commands
self.run_command(cmd)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/dist.py", line 989, in run_command
super().run_command(command)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 988, in run_command
cmd_obj.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 318, in run
self.find_sources()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 326, in find_sources
mm.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 548, in run
self.add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 586, in add_defaults
sdist.add_defaults(self)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/sdist.py", line 113, in add_defaults
super().add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 251, in add_defaults
self._add_defaults_ext()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 336, in _add_defaults_ext
self.filelist.extend(build_ext.get_source_files())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.
note: This error originates from a subprocess, and is likely not a problem with pip.
The command '/bin/sh -c ~/init-venv.sh ~/pip-requirements.txt' returned a non-zero code: 1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Improved "show interfaces" information is now
reflected in IP address examples
- source info added
- IPv6 addresses shown
Also added an example with IPv6 privacy for stateless autoconfig
Manually merge PR #137, with minor updates to the YANG deviations, and
complete relocation of the new user-guide. The idea is to keep all the
documentation generic and use the docgen package later to include all
relevant parts into a PDF user guide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Like the Developer's Guide the User's Guide should be a single file on
top-level (at least for now), where it references certain sections in
other files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting deviations of non-supported parts of ietf-ip
Idea is that "pyang -f tree ietf-ip.yang infix-ip.yang" should
show what we really support (and should make tests for).
Only physical interfaces have a permanent link address. So in order to
restore the default MAC generated by the kernel for interfaces such as
bridges, veth pairs, VLAN interfaces, and link aggregates, we recreate
them.
This patch adds support for checking if the phys-address attribute has
been deleted from bridge, vlan, and veth interfaces.
The netdag_must_del() function has been refactorored slightly so each
interface type is responsible for returning true if its condiitions are
satisfied.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
