- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
If a extra infix feature require features to be added to an already
loaded module. Instead of have the exact module definition in multiple
places (with date), this will allow a much more flexible sytax:
MODULES=(
"infix-interfaces -e containers"
)
This require that the infix-interfaces is loaded *before* this file
is run.
This since the feature is called 'wifi' in Infix, this makes the naming
consistent over the system.
Also trigger start of a wpa_supplicant, for scanning in the background.
The scanning results is available operational.
If an invalid mount source path is specified, the container logs a
"file not found" error and subsequently crashes.
Adding a check inside the SR_EV_CHANGE event handler performs an
early validation of the mount source path, allowing to reject
configurations that reference non-existent or unreadable files before
they are committed to the datastore.
This change ensures configuration correctness by enforcing that each
container mount has either a source or content set. Without this, the
system may generate invalid runtime arguments (src=(null)), leading
to container startup failures.
Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
Sysrepo, netopeer etc are still responsible to install the modules in
target directory, this will make that we will discover quickly if something
is updated.
Also this enables rm -rf output/target/etc/sysrepo/data/* && make confd-rebuild
This will reinstall all modules again.
This allows a user to run in on any system which has the Infix source
code that contains the modification scripts.
Signed-off-by: Richard Alpe <richard@bit42.se>
Turns out the root cause for the odd log message in #896 was that the
system did not properly call `resolvconf -u` when starting in failure
mode.
This patch simplifies the code by moving all `resolvconf -u` calls to
the same Finit task. Ensuring it is first launched when confd has
successfully consumed any configuration at boot, and then every time
a static DNS server is added. (The udhcpc client script already call
`resolvconf -u` when dynamic DNS servers are learned.)
Fixes#896
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Enabled by user enabling IPv6 forwarding on any interface. This change
also enables net.ipv6.conf.all.accept_ra (=2) to accept any IPv6 route
advertisements even when acting as a router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For tasks like upgrade we need, e.g., the image URI. Instead of
guessing where on the container command line the image is, use a
meta-data field in the container shell script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Containers in Infix are read-only, any persistent data is either stored
in volumes or content mounts. To prevent lingering containers, as have
been seen on some test systems, we move cleanup stage from confd to use
the Finit cleanup:script mechanism.
The resulting code is simpler, shorter, and easier to debug and use.
As an added benefit, confd no longer prunes "unused" volumes by itself
on (any!) reconfiguration event, which with the new container life cycle
in Infix was quite fragile. Instead the CLI command 'container prune'
is extended with 'podman volume prune', which coincidentally the help
text already alluded to.
This patch requires Finit v4.10-rc1, or later.
Fixes#902
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Future Infix defconfigs for smaller system may exclude Frr and set all
routes directly in the kernel. So failing to add a user to the frrvty
group should not cause an error, hence the new group_exists().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some netdev drivers, e.g. the FEC found on many i.MX SoCs from NXP,
will detach from their PHYs when configured down.
This means that when confd tries to configure L1 settings for the link
before bringing it up, ethtool fails - since there is no PHY to talk
to.
For interfaces that behave this way, delay the configuration until
after NETDAG_INIT, when the interface is brought up. This is not
optimal, since we are generating needless noise for the link partner,
which is why we only fall back to it as a last resort.
Fix#951
Ideally, all drivers should behave the same. Alas, that is not the
world we live in. For quirks that we can not reliably probe for in any
other way, let products supply a JSON file that declares them.
CID 507415 from coverity was the origin for this change. As it turns
out, the unreachable MAC address generation for VXLANs was hidden by
the generic setup (netdag_gen_link_addr()) saving the day. That is
likely something we want to phase out though, so the VXLAN code should
stand on its own.
Align the GRE code while we're here, because why not? :)
Some callbacks may run twice, e.g., lag_gen_ports(). Check if the link
already exists, and is the same, then we can exit silently. However, in
case the link exists and does *not* point to the same target, we log an
error with current target for the post mortem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg