With the introduction of the -classic defconfigs we need to also make
sure to name the resulting artifacts accordingly:
- infix-$ARCH.{gns3a,img,pkg}
- infix-$ARCH-classic.{gns3a,img,pkg}
For release builds the version (-23.02-$REV) will be appended before
the file suffix, e.g., infix-x86-64-classic-23.02-3.img
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long standing internal debate comes to its logical conclusion. Arch
naming should follow GCC. The "native /etc" has also found a better
name: classic!
README and GitHub action has been updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop unused packages in NETCONF (default) mode
In the default build we will use the net tool instead of iupdown-ng,
p-net & Profeth will move to customer-specifc builds with another
licensing model.
- Split out NETCONF specific parts from board/common to board/netconf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This build is intended as a base reference and for use as a very simple
end device. The default starts DHCP and IPv4LL (ZeroConf) on eth0, but
can be configured by editing /etc/network/interfaces.d/*
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the new templating support in Finit, and this patch, we can now
very easily enable a ZeroConf service on, e.g., eth0:
$ initctl enable zeroconf@eth0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The root user is by default not allowed to log in over SSH, so we add an
admin user with limited root privileges for this purpose.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This means that:
- The full boot order is now respected, using the magic "fallback"
varible in GRUB. This means that if an entry fails to load, we move
on to the next one in the defined order.
- Netbooting is supported. In this mode, GRUB will acquire an IP
address using DHCP, after which it downloads an image using TFTP.
- If we run out of valid entries, we always make sure to reboot. This
ensures that, e.g., a temporary TFTP server outage does not cause an
Infix device to get stuck in GRUB.
At the moment, the image handling is excruciatingly inefficient when
netbooting, as the image is downloaded multiple times behind the
scenes. Ideally, downloads would be cached, but a quick investigation
indicates that an implementation of this would take more time than we
can spare at the moment. Therefore, we settle for the working, though
wasteful, implementation.
The per-interface and per-af setting in the ietf-ip yang module allow
the user to enable a more granular forwarding between interfaces, which
is disabled by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to rely on the kernel command line, we convert all the
kernel functionality in question into modules and rely on the auto-load
feature in the kernel and modprobe to add options at load time.
The fb_tunnels setting is a net core setting, for that we use sysctl.
This commit also syncs the kernel config between our two main archs,
disabling DRM and SOUND for the Amd64 build as a spin-off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds multi-nameserver support using openresolv (resolvconf)
and dnsmasq. This means that a DHCP client (dhcpcd) or VPN client can
be providers of nameservers to the system. Dnsmasq takes over as the
system resolver, except when the user has set up static configuration.
Static nameserver(s), as well as search and options, are always added
first by openresolv to /etc/resolv.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In managed NETCONF mode /etc is always based on the image's read-only
/etc with a read-writable overlay as a RAM disk. We control the image
and know the default rc.local is empty and the interfaces file only
list the loopback interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Only disable default services we don't need, prevents touching
services mid-air in runlevel S. Allow nginx now as well
- Enable fcgi based RESTCONF interface via nginx by default
- Enable auth:none for customer demo
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Chrony drops privs after startup to user chrony, when restarting it
writes its state in /var/lib/chrony, so the directory needs to have
the correct permissions for that user.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for firmware updates via RAUC on aarch64. The created RAUC
bundle (images/infix-$BR2_ARCH.pkg) is signed with the same key used
to sign the raw FIT image.
Similarly to how $(call IXMSG,"hello world") outputs a blue
information line from a makefile, provide `ixmsg` to accomplish the
same thing in shell scripts.
Use a different prefix (`#!:` vs `>>>`) to differentiate it from
makefile output.
On amd64, we use grub instead of U-Boot, because yours truly can't
figure out how to handle ACPI handover to the kernel.
The resulting image is now called disk.img instead of the old mmc.img,
since we can use it over any interface (e.g. virtio or SCSI).
- Adapt boot scripts to exepect the split FIT header/SquashFS image
layout.
- Make sure that we can boot from any kind of block device (most
importantly virtio for GNS3).
- Rename net -> dhcp as we might have more kinds of netboots in the
future (http).
Store FIT headers separately on aux, and place the raw SquashFS images
on primary/secondary. This removes the need to muck about with the
device mapper to setup the rootfs, and it allows us to boot using
syslinux files.
With the recent `if:<cond>` addition to Finit we can simplify a lot of
the logic for disabling and enabling features in Infix. Standardizing
on conditions that Finit provides.
We create boot/netconf, boot/etc, and boot/profinet conditions early,
after all filesystems have been mounted (and cleaned), so they are all
set before Finit loads its configuration files in runlevel S.
The default is still to boot into a managed NETCONF mode, since the end
goal remains to integrate PROFINET as yet another service. The other
mode, native /etc, should then be the only exception.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split tmpfiles config in two, one for snmpd and one for profeth.
Add logging and redirect profeth logs to /log/profinet.log with
default log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not the full environment used by U-Boot, just the bits needed
for U-Boot to know which slot to boot and for Infix to know how the
boot process went.
U-Boot will selectively import/export only these keys during boot,
which avoids a malicious user from altering the boot in a way that
might bypass signature validation.
Joachim Wiberg