When disabling a container in the configuration we should not remove it,
because then any volumes used by it may be lost. Instead, we now simply
disable the service to prevent it from starting, or stopping it, if it
was running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When deleting interfaces we skip a lot of steps in netdag_gen_iface(),
this patch ensures we at least call netdag_gen_ipv4_autoconf() to drop
any running zeroconf agent in the same generation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to scroll to the end (Shift G, or page down til end),
let's instead start at the end now that we have control over paging in
the CLI ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops a needless restriction of IP addresses on VLAN filtering
bridges from 2024-03-06. The obvious use-case is when the bridge is an
untagged member of a VLAN and only ony management VLAN is required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the FRR upgrade to 9.1.2, OSPF sometimes reports neighbors
without reporting the routerDesignatedId and routerDesignatedBackupId
attributes. Ensure that these attributes are available before trying
to copy them to the output.
During debugging of a reconfiguration issue, one hypothesis was that
the tracking of callbacks used to determine when a transaction has
completed (as sysrepo has no hooks for this) was out of sync, causing
us to call `initctl reload` prematurely. This was not the case, but if
it ever occurs in the future, make sure that it is a fatal error that
won't go unnoticed.
When an Infix device is connected to a LAN where the gateway has yet to
connect to the Internet, the container script will fail pulling images
from any remote server.
Nov 16 12:48:13 infix container[3490]: Error: initializing source docker://ghcr.io/kernelkit/curios:edge: pinging container registry ghcr.io: Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on 127.0.0.1:53: read udp 127.0.0.1:55422->127.0.0.1:53: i/o timeout
Nov 16 12:48:13 infix container[3641]: Error: failed creating container fw, please check the configuration.
Nov 16 12:48:13 infix execd[3490]: /run/containers/queue/S01-fw.sh failed, exit code: 1
Since execd until now only retries on netlink/inotify events, or manual
SIGUSR1, jobs would get stuck even though Internet connectivity had been
established. This patch fixes that with the addition of a retry timer
which runs while there are pending jobs in the queue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #815 detail issues found running the Clixon Controllar and
Cisco Yangsuite. The errors and warnings listed are very similar
to pyang, which the undersigned has, the following changes fixes
the pyang errors:
- relocate 'feature containers' to submodule
- drop already deviated ospf:database deviations
- drop unused imports
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A sane interface name is at least two characters long, and in Linux the
interface name (using ip link) is at most 15 characthers long.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With interactive mode (out="tty") klish puts the tty in raw mode which
fixes all weird issues reported around paged output in the CLI.
Fixes#659
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if the "usb-ports" key exists in /run/system.json before calling jq,
otherise we get the following error message:
Nov 8 05:11:45 ix bootstrap[3349]: jq: error (at <stdin>:0): Cannot iterate over null (null)
Also, minor whitespace cleanup and bashisms fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Make show interfaces container aware. This is done by looking though
all podman containers for interfaces and looking up there info from
network namespaces on the main system / hypervisor.
Interfaces controlled by containers are clearly marked in the "show
interfaces" output, with a single gray row. Telling the user that they
belong to one or more named containers. The user can then run "show
interface name NAME" on interfaces owned by containers, which provided
some additional info, such as mac address and stat counters.
The patch also add support for printing veth peers which are owned by
containers.
Lastly, the patch also adds test cases for this functionality.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds support for setting the free form description string as
the interface alias. This can be read from /sys/class/net/*/ifalias, or
using the 'ip link show' command. The ifalias is reported by SNMP and
LLDP by default, and now also in the operational datastore.
Linux supports 250 characters in ifalias, but the IF-MIB is restricted
to 64 characters, so we add a local deviation to limit the type.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The interface operational data was missing the 'admin-status' parameter,
which indicates whether an interface is administratively enabled or
disabled. To resolve this, the 'admin-status' was added to the yanger
Fixes#700
This refactor, and massive code simplification, is a follow-up to the
double free discovery in 3b4d2b3.
Beacuse a hostname in Linux can never be more than 64 chars, we can
safely use a stack buffer instead of calloc(), reducing complexity
and simplifying the code further with the use of strlcat().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix a double free in the memory minefield surrounding container
hostname provisioning. The hostnamefmt() function already does free()
on success.
This caused all sorts of mayhem when working with multiple containers.
However it mainly manifested itself by some containers not starting
due to there activation script being polluted with gibberish
name data. Your symptom might be different..
Example of polluted activation script:
container --hostname foobar --net veth0k -r always \
create ^S@`M-}^G docker://ghcr.io/kernelkit/curios:edge
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch makes it possible to use format specifiers to "uniqiefy" a
container's hostname in the same way as with ietf-system hostname.
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlock setting a custom interface name inside the container. This aids
se-cases where this is needed and provide a better user experience, for
example when upgrading containers. Not having to reboot the host just
to activate an upgrated container.
Fixes#708
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Dummy interfaces are useful for configuring routes and testing network
services without having to allocate physical or virtual interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For products with a static factory-config, or customers generating with
an older syntax, attempt migration in case of bootstrap failure.
Refactor logging to drop '-s'. This prevents duplicate log messages
since bootstrap always runs after syslogd has started and all stdout
is always logged.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch relocates the 30-cfg-migrate init script to confd, where it
belongs, renaming it migrate and installing into /usr/sbin.
The script has been heavily modified to be more user friendly, as well
as useful for automated restore operations, to be able to refresh old
backups to modern .cfg file syntax.
Example (injected phys-address error):
admin@example:~$ migrate -c /etc/factory-config.cfg
/etc/factory-config.cfg: has syntax error, requires migrating.
Since backups are created with the old confd sytanx version in the name,
the backup functionality has been kept in the script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the ietf-interfaces deviation for phys-address,
used to set custom MAC address on interfaces, with a more flexible
approach which can calculate the new MAC address based on the device's
chassi MAC, with or without an added offset.
The regression test has been updated to test all variants.
Resolves: #680
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In e373398 we restored statd suport for checking for faults in yanger at
runtime. This in turn broke CLI "show interfaces" support on the little
NanoPi R2S because ethtool cannot read counters in JSON format on it.
This patch catches the subprocess exception, allowing this particular
call to ethtool to fail with empty result. The only difference from
before e373398 is that run_json_cmd() will log an error that ethtool
failed, for every interface it is called on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the same uptime representation as FRR does.
Example output:
DESTINATION PREF NEXT-HOP PROTO UPTIME
>* 10.0.23.0/30 0/0 e6 direct 20:10:05
192.168.3.0/24 110/1 e2 ospfv2 5d13h05m
>* 192.168.3.0/24 0/0 e2 direct 01w1d13h
Signed-off-by: Richard Alpe <richard@bit42.se>
FRR prints uptime different based on how long it is. Prior to this
commit yanger expected uptime to be on the format HH:MM:SS which it is
as long as it's shorter than a day. If it's longer the format changes,
this commit handles this.
The commit also adds unit test data triggering the different formats
(<day, <week, >week).
Side note:
cli-pretty could be made to represent the data on "FRR format" again,
which is perhaps more human friendly.
Signed-off-by: Richard Alpe <richard@bit42.se>
Dagger did delete of the VLAN after it had configured it.
Resulting in that the new VLAN configuration was lost.
This will first delete all untagged/tagged ports that should be removed,
when they are removed, add the new or changed ports.
Instead of renaming the yang-file instead we keep the yang file
with the actual content linear, easier to review and easier to
follow changes. This only applies on all infix models,deviations
and auguments.
The actual infix-system@2038-01-19.yang is just a symlink to
ietf-system.yang which contains all the code.
Joachim Wiberg