This (new) test sometimes fail on HW, so let's hold off a while before
sending our log messages. Ths should allow the DUTs to settle.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's drop the leading IETF or Infix prefixes from tests. Initially the
idea was to mimnic the YANG models, but it's difficult to navigate and
does not provide any real benefit to developers or end-users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Basic DHCPv6 client, request a lease and verify Linux installs a
default route from the Router Advertisements (option not included
in DHCPv6), hence the 'enable-ra' option to dnsmasq. Also verify
DNS resolution over IPv6, including the resolvconf dance
- Prefix delegation, verifies that the client can actually request
and receives a prefix from a DHCPv6 server. We don't do anything
with it today though
Two new DHCP server implementations, the basic test relies on dnsmasq
and the prefix delegation test requires an ISC based dhcp server with
server side support for ipv6 prefix delegation. We could reuse the
latter for both tests, but this way we get compatibility testing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Send 10 pings, expect at least one. The GRE test passes with two
received ICMP messages on the Styx test rig, while the VXLAN test
fails with -c 3, so try waiting a bit longer.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Neither the IPv6 autonconf container, nor the recently moved DHCP client
container have an 'enabled' flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The xPi's usually don't have a VPD so the chassis mac-address probed at
boot is usually null in /run/system.json. This commit adds a fallbkack
mechanism to populate this field so it can be used for unique hostnames
even on these boards.
Ths ietf-hardware.yang model does not have a notion of physical address,
so we augment one tht is generic enought to be used for other hardware
components than Ethernet, similar to what ietf-interfaces.yang use.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds operational data support for system services. The
data is in a generic format but is intended to be able to represent
finit information (initctl) nicely.
The reason for augmenting this to ietf-system and not to
infix-services is that we consider this generic system information
which is totally disconnected from what ever services infix might
provide.
In this first state we only support pid, name, description and state.
Making the data look something like:
"infix-system:services": {
"service": [
{
"pid": 1185,
"name": "udevd",
"status": "running",
"description": "Device event daemon (udev)"
}]
Signed-off-by: Richard Alpe <richard@bit42.se>
Rename test directories in infix_containers/ to remove the redundant
'container_' prefix since they already live under infix_containers/:
container_basic -> basic
container_bridge -> bridge
container_enabled -> enabled
container_environment -> environment
container_firewall_basic -> firewall_basic
container_host_commands -> host_commands
container_phys -> phys
container_veth -> veth
container_volume -> volume
Also update references in all.yaml and Readme.adoc files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds four (small) container images to the Infamy test container
which are used in the new container upgrade test. The test verifies that a
mutable container can be upgraded and that old images are properly cleaned
up from the container store.
Fixes#624
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container instances that run with mutable images, e.g., tagged with `:latest`
or similar non-versioned tags, can be upgraded without changing the config.
This commit fixes two issues found with this support:
- force container image re-fetch on upgrade, even if the file exists locally
- surgically remove old image from container store after upgrade
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop 'local', not available in POSIX shell scripts
- Check for an assortment of backup file combos
- Simplify nested if-statements, skip whitelist first
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To reduce the duplication of effort between 9pm and the Infamy framework
this change consolidates the move from local 'infamy: title:' extension
to 9pm 'name:'.
For the parameterized tunnel tests we leverage the 9pm dynamic test-spec
variable, which looks for a correspodning <case>.adoc instead of static
Readme.adoc, when generating the test report.
Each test documentation should cover all aspects of the test, much like
the usage text of a UNIX program. To this end, the tunnel test docs are
now more spelled out, including all invariants.
Some refactoring of these tests were also necessary, e.g., replacing any
reserved Python keywords like 'type', and other PEP-8 fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Import new 9pm version for improved test report generation. With this
in place we can take the opportunity to also refactor and simplify the
test spec. generation.
Fixes#1129
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit greatly simplifies AsciiDoc image references in generated
Readme.adoc files. The two focused use-cases that remain after this
change are working references in:
- Generated output/images/test-report.pdf
- Viewing test's Readme.adoc from GitHub
Previously we aimed to have working images also when the test's Readme
was included in the parent directory's Readme.adoc. This, however, is
not supported as of this commit. It seems unlikely also to ever be a
supported feature of AsciiDoc on GitHub, for details, see the following
issue: <https://github.com/github/markup/issues/1095>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg