Preparing for a "show system-information" as well, which still needs to
be discussed to determine contents. Some data also still missing, e.g.,
article/serial/product number db.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the JunOS look of the CLI to something more akin to
a standard shell. To achieve this a %w format specifier to display the
path components is added to both klish and klish-plugin-sysrepo.
Before:
admin@infix-12-34-56:exec> configure
[edit]
admin@infix-12-34-56:configure> ediit interfaces interface eth0
[edit interfaces interface eth0]
admin@infix-12-34-56:configure> leave
admin@infix-12-34-56:exec>
After:
admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interfaces interface eth0
admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
admin@infix-12-34-56:/> leave
However, due to unforseen problems with the naming of VIEWs in klish,
the admin-exec level "path" is hard-coded to "/" for now.
Future imporovement: fold in calling prompt@klish from srp_prompt, and
figure out why the "main" VIEW cannot be changed to "exec" without klish
just bailing out starting up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While spending the past couple of weeks actually trying to use the CLI,
I realized that it was very confusing to have a different behavior for
Ctrl-C than I was used to from regular shells (including the old clish
from $OLDJOB).
This change drops the Ctrl-C binding, restoring break/abort behavior,
and lets Ctrl-D be abort/exit. Pressing Ctrl-D in a sub-context in
configure calls exit, when in the top-most configure context we now
do an abort and return to admin-exec.
To apply the changes the user still has to type 'commit' or 'leave',
or tap Ctrl-Z as in the Cisco CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not just for online viewing, these markdown documents are also
made available in the CLI itself from admin-exec as:
help [introduction | keybindings | tutorial]
With this commit we also add lowdown and the real less application to
be the Infix help system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the srp_help_text() symbol. It allows us to
display the full description for a leaf in a YANG model. This has
been added to the 'help [foo]' configure context command.
A separate admin-exec level 'help' command will be added in a later
commit. It will only be an intro to the CLI, keybindings, etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With completion support. The log command has an optional last arg,
after FILE, tail NUM, which runs tail -n NUM FILE instead of cat.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An excellent example of how to define commands with optional subcommands
and optional parameters:
password encrypt [type <md5 | sha256 | sha512>] [salt STRING] [PASSWORD]
The tricks here are two:
1. mode="switch" in the top-level password command
2. min="0" in the encrypt subcommands
The first turns the COMMAND element into a SWITCH element (with command
matching), and the second makes a COMMAND optional. If an optional
command is input by the user, then the enclosed PARAM is mandatory.
Please note, due to limitations in the mkpasswd¹ utility, spaces are not
supported in PASSWORD, i.e., when read from CLI prompt. However, spaces
are allowed when using the interactive prompt, i.e., when omitting the
PASSWORD from the CLI prompt.
¹) mkpasswd does not look for any leading ' or " in the password arg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The documentation for klish mentions the file ptypes.xml, which defines
the ptype /STRING. So let's use that instead of defining our own types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Helper commands for quickly diagnosnig the networking subsystem after
making config changes. Should over time be replaced with operational
status from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An iana or infix interface type is derived from "ip link" data.
Such as loopback -> iana-if-type:softwareLoopback.
This patch adds support for the following types:
loopback, ethernetCsmacd, veth, l2vlan and bridge.
Signed-off-by: Richard Alpe <richard@bit42.se>
Factor out a new helper function, change_get_user(), to do the bulk of
the work for the change callbacks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugin-sysrepo to get EnableNACM support. For
this to work as expected for the admin user we also need to change the
permission for the model in sysrepo.
Note: the srp_rollback() symbol has been renamed to srp_reset() upstram.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently netopeer2-server expects public keys for users to be in the
canonical place (~/.ssh/authorized_keys). Infix use a custom location
in /var/run, maintained by the ietf-system plugin, which OpenSSH knows
but netopeer2-server doesn't.
It seems to be possible to add some sort of "pattern" to netopeer2 to
indicate where to look for public keys. This is added when building it
but Buildroot does not expose this as a setting. So for now, this seem
to be the least intrusive way of handling it. The owner is root, so a
malicious user cannot change the link or contents without some other
form of privilege escalation first.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point in leaving unused home directories lingering on the system,
also a potential security problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Employ the new 'adduser -d' feature where users can be created with
password login disbled instead of creating them locked by default.
This allows us to create remote users that can only access the device
using public key SSH login, which until this point was not possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This ensures that the operstate is defined for all interface
types. Without supplying this, virtual interfaces (e.g. loopback,
dummies, tunnels) will report an "UNKNOWN" operstate. For ports backed
by physical (or virtualized) hardware, this option has no effect.
- add debug flag to trigger DEBUG() statements
- DEBUG() macro needs 'path' argument
For statd we can add support for an optional '-d' command line option to
trigger, and SIGUSR1 to toggle, debug mode. TBD for confd which still
remains to be refactored into the same standalone daemon as statd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to 1) map debug/error macros to syslog(), which does not
need \n, and 2) when stdout logging is used, let the macro add a \n.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows us to verify common RPC commands from within the
CLI, starting with the poweroff and reboot commands.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use timezone names defined in iana-timezones.yang, replacing
the type 'string' in standard ietf-system.yang
This enables CLI (tab complete) and NETCONF clients (dropdown)
to view available timezone strings, and the yang engine to
validate the input.
Deviation in ietf-system.yang
'replace' username type from general string to a string
with length and pattern restrictions inline with the
BusyBox 'adduser' tool.
Note, chk_sr_user_update is more restrictive, which should
be handled.
Declaring deviations for optional features for clarity regaring
extent of support.
New revision and file of infix-systems created, as earlier version
was included in infix-2023.06 release.
Please see infix-systems@2023-04-11 for history.
Support and deviations has not been checked for the included
'sub-yang-module' infix-systems-software, thus there may be
more updates to come.
This patch does two main things:
1) Breaks "statd" free from "confd".
2) Introduces netlink monitoring of interfaces for sysrepo data.
Prior to this patch, sysrepo operation status was handled by code
named "statd" inside "confd". (Where confd is a sysrepo-plugin and
not a real daemon, which its name implies)
In this patch, we break out the interface part of the operational
sysrepo status, previously "statd", into a new daemon, also called
"statd".
The main reason for doing this is to avoid sysrepo threading, which
allows the new "statd" to have control over sysrepo events in the
same event pool as netlink events from the kernel. This in turn allows
statd to subscribe and unsubscribe dynamically to interfaces that
comes and goes during runtime (such as vlans).
It also makes sense that "statd" is in fact a finit daemon.
Signed-off-by: Richard Alpe <richard@bit42.se>
We were now at the point where it was completely impossible to see
which files are actually built.
Bring back some order, making future diffs easier to understand.
To reproduce regression, before fix, in CLI from factory-default:
> configure
> set interfaces interface e0 ipv4 autoconf enable true
> leave
> shell
$ ps; ip -br a
Turns out, for some reason I cannot figure out, that we cannot use the
same pattern as for ipv6 with lydx_get_descendant(). Manually fetching
the node works though.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use new APIs runbg() and run_status() to call 'reboot' or 'poweroff' in
the background. This allows sysrepo + netopeer to reply to remote RPCs
before networking goes down.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this patch, every new call to lydx_new_path() where "first"
was set to 1 resulted in a memory leak of 72 bytes. Typically at least
once for each sysrepo query.
The memory was allocated deep down in the lyd library, but as the
parent node wasn't set (NULL) it wasn't found by sysrepo when
cleaning up.
In this patch we mitigate this by simply removing the "first" concept,
as it doesn't appear to be needed.
Signed-off-by: Richard Alpe <richard@bit42.se>
