Instead of potentially blocking sysrepo, which has a 5 second timeout,
we move 'container delete' jobs to be run by the execd queue.
Fixes#479
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes sure execd calls KNN style scripts before SNN,
allowing confd to post teardown jobs that are guaranteed to run
before any jobs to create new resources run.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
ietf-system.c: In function ‘change_hostname’:
ietf-system.c:1722:9: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
1722 | system("initctl -nbq touch netbrowse");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ubuntu 22.04 (ubuntu-latest runner on GitHub) has a slightly earlier
version of libxcrypt. The only hard requirement we have is yescrypt
support, so we can relax the configure check slightly to be able to
run coverity scan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All typedefs and identities should be declared in the module that uses
them unless other modules need them. This change also makes it easier
to work with tools like yanglint and pyang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch silences the previously very verbose setup.sh script, and
crucially also fixes a bug in UPDATE_MODULE(). Missing closing '
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with UNKNOWN base mac address, and making it easier for
the user to actually notice the fault condition.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With this patch, users not in the NACM admin group and a login shell set
to clish can now log in to the CLI. Prior to this change only members
of the UNIX group 'wheel' could open the klishd socket.
The patch adds another group, 'sys-cli', which acts as a capability for
users. An admin user (member of the admin group) will now be member of
both the UNIX 'wheel' and 'sys-cli' groups. A non-admin user that has
shell set to 'clish' will only be member of the 'sys-cli' group. Other
users will not be mapped to any UNIX group and have only permissions set
in NACM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch simplifies the handling of factory default password for the
admin user by overloading the ietf-system password type. The new type,
$factory$, acts a system hint to use any device specific (or built-in
software/device-tree) default password hash.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugins-sysrepo to fix the annoying issue with
the CLI not supporting, e.g. "show hostname" in system config context.
Details: https://github.com/kernelkit/klish-plugin-sysrepo/issues/3
The problem was two-fold, first we used the wrong ptype for 'show'
(and 'diff') commands, so srp_show() was not even called. Then the
klish-plugin-sysrepo code did not account for show being called for
leaf nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix indentations:
- Corrected indentations in confd.mk to adhere to Buildroot coding
standards
- Relocate YANG Modules List Files:
- Moved the YANG modules list files (.inc) from package/confd to
src/confd
- Add Missing YANG Module:
- Included infix-interfaces@2024-01-15.yang in
yang_modules_confd.inc
- This module was missing in the non-containerized build and is now
correctly added
Let the ring-bearer^Wuser decide the policy around how VLAN PCP is
mapped to skb->priority on ingress, and back to PCP again on egress.
Either a fixed value is used for all packets, or a 1:1 mapping is done
between the two domains. By default, we follow Linux's defaults of a
fixed 0 value on both ingress and egress.
The interface in question might not exist at init:49 if some other
change requires it to be recreated from scratch, in which case it will
be removed in exit:50. Therefore, run the flush at exit:49, where it
should always still exist.
When timestamping of scripts was added, we unfortunately started to
record the exitstatus of `ts(1)`, rather than the script itself.
Refactor the metadata collection to use `time(1)` instead, which will
propagate the inferior's exitcode. This will also allow us to collect
other parameters in the future.
This enables access to /restconf on port 443 over HTTP/1.1 and HTTP/2
via rousette when enabled.
Also, slight refactor to allow including /restconf and /netbrowse as
optional locations in the main servier directive.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With increased use of augeas to manage users, groups, and permissions,
we seem to have reached peak complexity. Because when re-running the
same test[1] over and over, somtimes the aug_save() function fails to
actually save the changes to /etc/shadow to disk!
We have already experienced weird behavior with augeas, see comment in
deleted code, and these latest problems became the last straw. We have
decided to replace it with standard C APIs.
As a spin-off, thanks to the requried refactoring, the check_shell()
function, used by the change_nacm() callback, could be replaced with a
call to set_shell() for both "is-admin" and "non-admin" cases. This
means we now also restore Bash privileges (and not just take them away)
when modifying nacm group memberships.
Fixes#468
[1]: test/case/ietf_system/user_admin.py
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Checking if a user is an administratr we cannot rely solely on the
return value of sr_get_items() but also ensure at least one group
matches the search criteria.
Fixes#469
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg