Initial analysis of system default users gives that there is no real
need for a default 'factory' user to trigger a factory reset. On an
actual physical device we will have a reset button or a menu option in
the bootloader to trigger factory reset, and in both physical and
virtual (GNS3) devices a logged in admin user can call the factory
command.
A virtual device that cannot be logged in to will have to be removed and
have its persistent backing store deleted, but that is the only real
downside to removing this user. The idea is to set a kernel command
line flag from the bootloader, and that could also be done from, e.g.,
GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long standing internal debate comes to its logical conclusion. Arch
naming should follow GCC. The "native /etc" has also found a better
name: classic!
README and GitHub action has been updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop unused packages in NETCONF (default) mode
In the default build we will use the net tool instead of iupdown-ng,
p-net & Profeth will move to customer-specifc builds with another
licensing model.
- Split out NETCONF specific parts from board/common to board/netconf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This build is intended as a base reference and for use as a very simple
end device. The default starts DHCP and IPv4LL (ZeroConf) on eth0, but
can be configured by editing /etc/network/interfaces.d/*
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the new templating support in Finit, and this patch, we can now
very easily enable a ZeroConf service on, e.g., eth0:
$ initctl enable zeroconf@eth0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This means that:
- The full boot order is now respected, using the magic "fallback"
varible in GRUB. This means that if an entry fails to load, we move
on to the next one in the defined order.
- Netbooting is supported. In this mode, GRUB will acquire an IP
address using DHCP, after which it downloads an image using TFTP.
- If we run out of valid entries, we always make sure to reboot. This
ensures that, e.g., a temporary TFTP server outage does not cause an
Infix device to get stuck in GRUB.
At the moment, the image handling is excruciatingly inefficient when
netbooting, as the image is downloaded multiple times behind the
scenes. Ideally, downloads would be cached, but a quick investigation
indicates that an implementation of this would take more time than we
can spare at the moment. Therefore, we settle for the working, though
wasteful, implementation.
Things we really want later, but don't use right now:
- MRP
- MSTP
Neat to have in a networking product, but not used at all by us atm:
- ttyd
- tmux
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix integration of klish and klish-plugin-sysrepo.
Initially we add:
More flexible management of running vs. startup: Instead of always
committing changes both to running and startup, commit only modifies
running. To persist changes to startup, the copy command is
introduced. This lets the user copy from factory/startup/running to
startup/running at any time.
Well-known verbs like abort, leave, end, etc.
Extended evaluation of sysrepo due to problems parsing yang v1.1 models
with the built-in yang parser in Clixon. Problems not seen with libyang
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for firmware updates via RAUC on aarch64. The created RAUC
bundle (images/infix-$BR2_ARCH.pkg) is signed with the same key used
to sign the raw FIT image.
On amd64, we use grub instead of U-Boot, because yours truly can't
figure out how to handle ACPI handover to the kernel.
The resulting image is now called disk.img instead of the old mmc.img,
since we can use it over any interface (e.g. virtio or SCSI).
This is not the full environment used by U-Boot, just the bits needed
for U-Boot to know which slot to boot and for Infix to know how the
boot process went.
U-Boot will selectively import/export only these keys during boot,
which avoids a malicious user from altering the boot in a way that
might bypass signature validation.
- Drop unused com32 modules
- Fix duplicate prompt output (serial not needed)
- Reduce timeout before booting default to 0.5 sec
- UI or DEFAULT must be set, otherwise isolinux complains
so replace ONTIMEOUT with DEFAULT
- Increase user-walked-away timeout to 5 minutes
- Always show the prompt
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we only support mmc and squash in `make run` we should make
sure the reference platform works as well as aarch64.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
mkimage will generate an FIT image containing a signature of the
rootfs, where the data is kept out of the DTB data structure, i.e.:
.---------.
| DTB |
:---------:
| Padding |
:---------:
| |
| |
| rootfs |
| |
| |
'---------'
This is the on-disk format of Infix. At boot, we extract kernel and
device trees from the rootfs, and then use Linux's device mapper to
create a virtual block device that exposes the rootfs (squash).
This ensures that U-Boot images that we build can always:
- Rely on the environment extensions in env.dtsi being available
- Access the configured signing keys
- Use SD/eMMC cards
- Extract files from SquashFS filesystems
All of which are foundations that we intend to design our image
loading around.
Also add libcurl so all Clixon utility functions and apps are build with
full support for RESTCONF.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily for evaluating OSPF in customer's use-case. Preparing for
some (static) multicast routing tests as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- pdmenu for the made-easy management tool for Infix
- neofetch is just for demo purposes, we can add KernelKit logo
- pwgen is for basic help, like netcalc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- fping is better for checking multiple hosts
- OpenBSD netcat has more features and is generally better for multiple
network testing scenarios
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
