Pointer authentication emulation is expensive. By default, QEMU use the
standard cryptographic algorithm (QARMA5), which is very time consuming.
This commit switches to the fast implementation.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- dnsmasq:
- allow listening to all interfaces again to serve DHCP leases
- disable most of the default DHCP options, keep broadcast and
netmask because when dnsmasq can infer these they are better
than breaking networking for clients -- note, they can still
be overridden from global/subnet/host scope -- and for relay
setups they need to be supplied anyway
- confd:
- drop per-interface dnsmasq, although practical for many use-cases,
having a per-subnet focused server means improved integration with
future stand-alone dhcp relay setup
- implement suggested, simplified, yang model
Fixes#703
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Updating SSH information
- Adding Web services information (general, RESTCONF and Web Console)
- Adding Console information
Generic info, and some updates w.r.t specific boards (baudrate, etc)
By declaring the service as manually configured, we can control it
from dagger (confd) without the indirection via a condition.
This has the benefit of mstpd being in the "stopped", rather than the
somewhat confusing "waiting", state when not running.
Fixes#890
Before this change, setting `GIT_VERSION` in `make`'s environment was
intended to allow the user to specify a custom build id. As it turns
out, `test/test.mk` had duplicated the logic from
`board/common/post-build.sh` to unconditionally override any value set
in it. Because of the way `make` handles variables, where assignments
to variables inherited from the environment are exported back to
it[^1], this would mean that `test.mk` would always clobber any value
set by the user. Furthermore, there is also this file called
`buildroot/package/git/git.mk`, which also (reasonably) has opinions
about what the proper value of `GIT_VERSION` should be. In summary,
this was a bit of a mess.
Therefore: Make sure that there is one single place where we determine
the build id and version, and make sure that those variables are
scoped under the `INFIX_` prefix to avoid clashing with any other
component.
[^1]: https://www.gnu.org/software/make/manual/html_node/Environment.html
Introduce a new approach to dtb-building:
Old way: `rsync` an overlay containing our dt source to the kernel,
and then build via buildroot's `_INTREE_DTS_NAME`. This does not work
in recent kernels (at least since 6.12), which requires all dtb's to
be explicitly listed in a `Makefile`.
New way: Create a separate package for every board, and build the
device trees via the kernel's standard interface for building external
modules. This has two main advantages:
1. We can easily interpose a patched version of an upstream device
tree. E.g., we can easily set the factory password.
2. It is much easier to get an overview of which boards are enabled,
rather than scrolling back and forth in the `_INTREE_DTS_NAME` list.
Enable all fully supported boards in the defconfigs.
These changes are based on the sysctl recommendations by Frr [1].
Not all recommendations have been incorporated, e.g., ip forwarding is
not enabled per interface, because in Infix this is an opt-in feature.
A readme.txt has been added, documenting the various settings.
New for IPv4:
- Adjust IGMP max memberships: 20 -> 1000
- Use neighbor information on nexthop selection
- Use inbound interface address on ICMP errors
- Ignore routes with link down
- Disable rp_filter
ARP settings have been changed to better fit routers, i.e., systems
with multiple interfaces:
- Always use best local address when sending ARP
- Only reply to ARP if target IP is on the inbound interface
- Generate ARP requests when device is brought up or HW address changes
New for IPv6:
- Keep static global addresses on link down
- Ignore routes with link down
Fixes#829
[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The -S switch to less seemed at the time a good idea -- chop off too
long lines and allow horizontal scrolling -- however, the -F option, to
skip pager for content that fit the first screen is overridden by the -S
switch. This makes commands like "show containers", and similar that
normally have waaaaay too few lines for a pager to always page.
So let's drop -S to regain the original behavior. This will cause lines
to be wrapped, but with the new raw mode in the CLI this seems to work
without any weird screen artifacts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix lack of syslog messages from Zebra and add support to easily enable
debug logs for common Zebra subsystems.
Same change made to ospfd for symmetry.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a regression in v24.11.0, introduced in 46dd0c7, where line
drawing characters are not properly displayed in the CLI anymore.
admin@infix:/> show interfaces
INTERFACE PROTOCOL STATE DATA
lo ethernet UP 00:00:00:00:00:00
ipv4 127.0.0.1/8 (static)
ipv6 ::1/128 (static)
br0 bridge
<E2><94><82> ethernet UP 02:00:00:00:00:00
<E2><94><82> ipv4 169.254.1.3/16 (random)
<E2><94><82> ipv6 fe80::ff:fe00:0/64 (link-layer)
<E2><94><9C> swp1 bridge FORWARDING
<E2><94><9C> swp2 bridge FORWARDING
<E2><94><9C> swp3 bridge FORWARDING
<E2><94><9C> swp4 bridge FORWARDING
<E2><94><9C> swp5 bridge FORWARDING
<E2><94><9C> swp6 bridge FORWARDING
<E2><94><9C> swp7 bridge FORWARDING
<E2><94><9C> swp8 bridge FORWARDING
<E2><94><9C> swp9 bridge FORWARDING
<E2><94><94> swp10 bridge FORWARDING
This is because the raw tty from klish disables IUTF8 and the fact that
it does not source any environment, e.g., /etc/profile. (We do not have
any locale settings in the enviornment either, but that's a discussion
for another day.)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 0ee973b2b2.
Turns out that this workaround simply reduced the size of the window
where this issue can occur.
The previous change now ensures that the DSA tree is always fully
setup by the time nameif runs.
Before this change, we relied on `udevadm settle` to act as a barrier
which we could only cross after all devices had been probed. As it
turns out, when drivers defer probing due to missing dependencies,
`udevadm settle` may exit (as no events are generated for a period of
time) before all devices are set up. This was the root cause behind
issue #685, for which #752 was the initial attempt at a fix.
As we know that systems using mv88e6xxx will always have a device link
referencing the conduit interface, add a script to finit's system
runparts directory, which will block while any device link consumers
are still probing.
As a consequence of this, we can no longer rely on the sysklogd.conf
shipped with finit. Therefore, install an Infix specific one, which
will make sure that the aforementioned script has run before launching
the syslog daemon, which most other things depend on.
Fixes#685
This commit replaces the 'cfg' alias for 'sysrepocfg -f json' with a
small shell script. Currently only an 'edit' command, similar to the
CLI 'text-editor' command for modifying base64 encoded YANG nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Refactor logging to simplify code and get proper log level
- Clean up lingering directories from any extracted tarball on error
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows running the configure script manually to create and
delete containers. The normal flow via confd has additional handling
to ensure containers are started/stopped on inictl reload.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of using $HOME, which may be a ramdisk, use /var/tmp which
podman also uses by default. Also, make sure to clean up after
ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Disable the default "podman pull" retry value. We use execd to retry
"podman create" on failure. Wihtout this change, a single container
can block start of other containers by 3 * 20 seconds. Now we only
block max 20 seconds before we try starting the next container.
Modern versions of podman (>= 5.0) have this --retry option, but it
does not have CNI, so this is a temporary workaround.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to handle container restarts, incl. restart policy, at
runtime, most of the container data lives in /var/lib/containers,
which on most systems is backed by a persistent store.
As of issue #823 we no longer keep a writable layer for containers,
nor should we cache container state across reboots, all containers
are recreated at boot. This task cleans up any lingering state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Running 'shred' on files stored on eMMC is pointless since the writes
are spread out over other sectors rather than overwriting the content
of the files as it was supposed to on old rotating media.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These are basically the same flags as was passed to klish, but now we
use -R instead of -r to make sure only ANSI coloŕ escapes can affect
the behavior of less.
This change will make it posslbe to shop off too long lines and scroll
vertically on really long lines instead for them breaking output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we opportunistically set up mqprio on all interfaces, we pass over
interfaces without offloading support. Catch that error message and log
an informational message about which interfaces are skipped.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 0f410eb a patch was added to RAUC to allow native logging to syslog,
it was however never enabled. This patch enables logging to syslog.
Fix#809
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrapping a system with D-Bus using Finit will create the machine-id
file /var/lib/dbus/machine-id, this can be used as the unique machine-id
for services like RAUC, so let's set that as /etc/machine-id to reduce
the log spam we get otherwise:
Nov 7 06:18:08 test-05-25-f8 rauc[5512]: Failed to get machine-id: Failed to open file <E2>M-^@M-^\/etc/machine-id<E2>M-^@M-^]: No such file or directory
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the initial probe, set up all port leds:
- Disable all LEDs
- Enable netdev trigger for all green LEDs (tp + sfp)
- Enable link statux and rx/tx activity
- Skip all aux LEDs
Also in script, a neat little flash function that can be used both for a
production test, to verify all LEDs work, and at runtime to locate the
device in a rack of devicess.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On Rev. B, the second LED on the copper ports is green instead of yellow.
This patch renames them from yellow -> aux => <device>:aux:tp
Also on Rev. B, the second LED for SFP ports do not work at all. This
patch drops them from the device tree to avoid confusion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some services launched at bootstrap must be possible to override per
product. One such service is iitod, which manages the LEDs in Infix.
This change makes allows a product specific init script to clear the
led condtion, preventing Finit from lauching iitod. Also, rename the
ixinit-done condition to match the nomenclature used already.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg