Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix has the catch-all /var/log/debug, and now also /var/log/routing
for debug messages from Frr.
The log file /var/log/syslog now catches *all* messages except auth*,
which may contain secrets, except debug messages. Contrast this with
/var/log/messages which only logs info/notice/warn -- i.e., no error
and above log messages.
Due to the way syslogd parses /etc/syslog.conf et al, we override the
default in Infix to disable the default /var/log/syslog, otherwise we
would get duplicates to the same log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split tmpfiles config in two, one for snmpd and one for profeth.
Add logging and redirect profeth logs to /log/profinet.log with
default log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg