Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
Sysrepo, netopeer etc are still responsible to install the modules in
target directory, this will make that we will discover quickly if something
is updated.
Also this enables rm -rf output/target/etc/sysrepo/data/* && make confd-rebuild
This will reinstall all modules again.
Turns out the root cause for the odd log message in #896 was that the
system did not properly call `resolvconf -u` when starting in failure
mode.
This patch simplifies the code by moving all `resolvconf -u` calls to
the same Finit task. Ensuring it is first launched when confd has
successfully consumed any configuration at boot, and then every time
a static DNS server is added. (The udhcpc client script already call
`resolvconf -u` when dynamic DNS servers are learned.)
Fixes#896
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the new dhcp-server model, which has an option
value 'name', options are now referred to as id's or identifiers.
This means bumping the confd syntax version 1.3 -> 1.4 and adding a
migration script for existing dhcp-client configuration files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix indentations:
- Corrected indentations in confd.mk to adhere to Buildroot coding
standards
- Relocate YANG Modules List Files:
- Moved the YANG modules list files (.inc) from package/confd to
src/confd
- Add Missing YANG Module:
- Included infix-interfaces@2024-01-15.yang in
yang_modules_confd.inc
- This module was missing in the non-containerized build and is now
correctly added
- Moved setup.sh and yang_modules files from infix/src/confd/scripts/ to infix/utils/ to streamline the repository structure
- Updated confd.mk to correctly reference the new location of the setup script
- Introduced yang_modules_<type>.inc file to list all YANG modules for improved clarity and maintainability
- Modified the new setup script to dynamically source module lists from yang_modules_<type>.inc
This to hopefully speed up boot, do as little as possible
during boot.
* New modules needs to be added to src/confd/scripts/setup.sh
* Permission needs to be changed post-build for YANG files,
see CONFD_PERMISSIONS in confd.mk
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently we only advertise SSH+SFTP services over mDNS-SD, which are
the default services from the avahi package. This patch adds support
for _netconf-ssh._tcp as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything else is named confd, even syslog messages are logged as
confd, and we've talked about not using sysrepo-plugind one day, so
let's prepare for a world where everthing is like that.
Also, and even more importantly, fix the sysrepo-plugind condition.
We cannot use <pid/syslogd>, because it can be restarted and thus
consequently Finit will stop sysrepo-plugind. This first caused a
bit of head scratching because it cause a lot of very odd errors in
the execution of sysrepo-plugind, transactions being abruptly aborted
for instace.
Whatt we can do, however, is use a static condition, which Finit has
support for since a few releases now. We want to guard the start of
our sysrepo-plugind service behind YANG /usr/libexec/confd/bootstrap.
So we can use <run/bootstrap/success>. In case the bootstrap fails,
we catch that in the row before using if:<run/bootstrap/failure> to
trigger the /usr/libexec/confd/error script (described previously).
The other run/task/services can be guarded behind <pid/confd> and now
everything suddenly makes sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running `make legal-info` Buildroot will collect source and
licenses for all packages, which generates a few warnings for our
local packages. Local packages are skipped.
> The source code for packages that set <PKG>_REDISTRIBUTE = NO will not
> be saved. Patches that were applied are also saved, along with a file
> named series that lists the patches in the order they were applied.
Hence, setting 'foo_REDISTRIBUTE = NO' disables the warning, which seems
like a good idea to reduce the number of unnecessary questions we might
otherwise get.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything (!) potentially shared with other sysrepo plugins/daemons and
helper functions (not yet in libite) that can be used by other daemons
have been relocated to libsrx.
Fix#116
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This further locks down confd to fall back to /bin/false as login shell
in case of internal errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some reason, the `make license-info` target complained klinfix
needed a hash file, but not the other local repos. Issue #67 tracks
adding license-info to releases, which will need some looking into,
for now this fixes the most glaring packaging oversights.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This script has some seriously sharp edges. Today two devs cut their
fingers on it trying to get new functionality in place. One when, in a
attempt at, adding an innocent status daemon, and another setting up a
client repository with a custom, enabled-by-default, daemon. In both
instances this script happily cleaned out the deamons from enabled/.
A better alternative, as described in issue #74, is to be stricter on
what is enabled by default, and for things we feel provide value in the
Classic build, maintain a separate list of symlinks in its meta board
definitiion instead.
Also, clean out previous attempt at factory-config. Now that we have
the auto-factory support in place we don't need this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rudimentary support for setting login shell for new users. Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.
Follow-up to f5866ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When researching the systemd tmpfiles.d implementation I discovered the
effort to standarize on /usr/share/factory as a generic factory defaults
for Linux systems. This patch adds a small example factory.cfg file
that is installed as /usr/share/factory/cfg/startup-config.cfg. The
tmpfiles.d backend will then install it as /cfg/startup-config.cfg if
that file is missing at boot. Confd does the rest to bootstrap our
(by default) empty sysrepo db with this startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
