On May 10, 2023, @troglobit wrote:
> Initial proposal for factory-config, based on example from RFC8341.
This gives the admin user the ability to configure the device over
NETCONF.
This patch adds a new user "admin" with the password "admin". The
password is hashed with sha512 ($6) as a hint to new users attempting
to change the password (avoid the weakest algorithms).
Signed-off-by: Richard Alpe <richard@bit42.se>
Initial analysis of system default users gives that there is no real
need for a default 'factory' user to trigger a factory reset. On an
actual physical device we will have a reset button or a menu option in
the bootloader to trigger factory reset, and in both physical and
virtual (GNS3) devices a logged in admin user can call the factory
command.
A virtual device that cannot be logged in to will have to be removed and
have its persistent backing store deleted, but that is the only real
downside to removing this user. The idea is to set a kernel command
line flag from the bootloader, and that could also be done from, e.g.,
GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently only supports creating host-device profiles, e.g. from veth
pairs or physical interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The /var, and particularly /var/lib, directories are used for persistent
storage for various system daemons. While adding support for containers
it became clear we had to change how we make these directories writable.
Both LXC and Podman use OverlayFS for the writable layer, and you cannot
set up an overlay on top of another overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- package/libyang: Bump version to 2.1.55
- package/netopeer2: Bump version to 2.1.59
- package/sysrepo: Bump version to 2.2.60
- package/cni-plugins: partial backport to enable missing plugins
The libite v2.5.3 backport has been dropped from the kkit patches
since it's been merged in upstream Buildroot LTS branch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Podman (POD manager) is an open source tool for developing, managing,
and running containers on your Linux systems.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Conmon is an OCI container runtime monitor. It sits between container
runtimes, e.g., crun and runc, and userland managers, e.g., podman.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test is based on the 9pm framework, which supports execution
of test-cases written in any language. This test is written in
tcl/expect with help from the 9pm expect library. It's what I used to
test during development of the Infix basic authentication support.
The aim of this patch is to serve as an example of how the
interactiveness of the 9pm-expect library can be used.
9pm framework code is here:
https://github.com/rical/9pm
Signed-off-by: Richard Alpe <richard@bit42.se>
Rudimentary support for setting login shell for new users. Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.
Follow-up to f5866ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The writesf() API was hard coded to always open files in "r+" mode,
which fails if the file doesn't exist.
Add a mode option to writesf() and writedf().
Also, drop the default motd, we don't have one in NETCONF mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change drops -nographic in favor of the more flexible virtconsole,
fixing the problem with loss of terminal history and reset.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bringing down the current generation is a step of its own, so it makes
sense to let finit clear out all old services before setting up the
new ones.
For example, with avahi-autoipd, without this step, we would run the
following sequence when disabling it on an interface:
initctl disable zeroconf@iface
ip link set dev iface down
ip link set dev iface up
initctl reload
But we really want to stop the zeroconf service before the down/up
cycle on the interface, since that is likely to disrupt the
daemon. With this additional step, the sequence becomes:
initctl disable zeroconf@iface
initctl reload
ip link set dev iface down
ip link set dev iface up
initctl reload
Which means that finit won't try to restart zeroconf if it dies during
the down/up cycle, since the service is already gone at that point.
Saving running to startup follows the same pattern as config update of
candidate to running, so we must employ the same hook mechanism here.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor register_change() wrapper, for sr_module_change_subscribe(),
with an additional twist of setting up a commit DONE event catcher.
This creates a global event hook that ensures we call 'initctl reload'
after all module callbacks have completed, regardless of the xpath and
without having to have "shadow" subscriptions to all new modules being
added to confd.
Based on on ideas from https://github.com/sysrepo/sysrepo/issues/2188
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without --force-bind, the address is removed if another routable
address is added to the interface.
While this is likely something that should be configurable in the
future, we choose this mode as the default so that IPs used for
NETCONF connections are not dropped because other addresses are added.
