For tasks like upgrade we need, e.g., the image URI. Instead of
guessing where on the container command line the image is, use a
meta-data field in the container shell script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Containers in Infix are read-only, any persistent data is either stored
in volumes or content mounts. To prevent lingering containers, as have
been seen on some test systems, we move cleanup stage from confd to use
the Finit cleanup:script mechanism.
The resulting code is simpler, shorter, and easier to debug and use.
As an added benefit, confd no longer prunes "unused" volumes by itself
on (any!) reconfiguration event, which with the new container life cycle
in Infix was quite fragile. Instead the CLI command 'container prune'
is extended with 'podman volume prune', which coincidentally the help
text already alluded to.
This patch requires Finit v4.10-rc1, or later.
Fixes#902
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Future Infix defconfigs for smaller system may exclude Frr and set all
routes directly in the kernel. So failing to add a user to the frrvty
group should not cause an error, hence the new group_exists().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some netdev drivers, e.g. the FEC found on many i.MX SoCs from NXP,
will detach from their PHYs when configured down.
This means that when confd tries to configure L1 settings for the link
before bringing it up, ethtool fails - since there is no PHY to talk
to.
For interfaces that behave this way, delay the configuration until
after NETDAG_INIT, when the interface is brought up. This is not
optimal, since we are generating needless noise for the link partner,
which is why we only fall back to it as a last resort.
Fix#951
Ideally, all drivers should behave the same. Alas, that is not the
world we live in. For quirks that we can not reliably probe for in any
other way, let products supply a JSON file that declares them.
CID 507415 from coverity was the origin for this change. As it turns
out, the unreachable MAC address generation for VXLANs was hidden by
the generic setup (netdag_gen_link_addr()) saving the day. That is
likely something we want to phase out though, so the VXLAN code should
stand on its own.
Align the GRE code while we're here, because why not? :)
When reading lag status, like LACP actor system prio, port key,
etc., we need CAP_NET_ADMIN. See net/bonding/bond_netlink.c
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some callbacks may run twice, e.g., lag_gen_ports(). Check if the link
already exists, and is the same, then we can exit silently. However, in
case the link exists and does *not* point to the same target, we log an
error with current target for the post mortem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The management of custom-phys-address was made more complicated by the
fact that physical interfaces require restoring the permanent address
when a custom setting is removed.
Simplify this by moving the restoration to the delete path, so we only
have to worry about if there is a custom mac or not during interface
setup.
Also:
- Fix some legacy naming on *_gen() functions
- Fix custom-phys-address on dummy interfaces
Fix#938
Before this change, interface dependencies were only setup when
interfaces were created. This led to problems in flows like this:
1.
configure
set interface br0
set interface br0.10
leave
2.
configure
set interface dummy0
leave
2.
configure
no interface br0
no interface br0.10
leave
Since neither br0 nor br0.10 was created in (2), no dependencies were
setup. Because of that, when the deletion scripts from generation (2)
are generated when entering (3), dagger is free to execute them in any
order. This means that it may choose to remove br0 before br0.10,
which will mean that br0.10 is already gone when we try to remove it.
Therefore, make sure that we generate the full dependency graph on
every iteration.
Also, get rid of the need to keep on-disk state for VETH pairs, and
use the name as a descriminator for which side to create/delete.
With the new iftype enum, we see that configuring an existing dummy or
gre interface types was wrongly classified as an error rather than as
a NOP.
Example, before this change, this was OK:
configure
set interface foo
set interface foo ipv4 address 10.0.0.1 prefix-length 24
leave
However, this was not:
configure
set interface foo
+leave
+configure
set interface foo ipv4 address 10.0.0.1 prefix-length 24
leave
+<KABOOM>
This has multiple advantages:
- Less chances of typos is repeated "infix-if-type:foo" strings
scattered throughout the code
- We can lean on GCC's `-Werror=switch` to make sure that iface
specific logic always handles all types (which was not always the
case - see follow-up commits)
- We can potentially create a `struct afspec_ops` in the future, which
could then be indexed by this enum
The only interfaces that would be in difs, but not in cifs, are
deleted interfaces. But these will be removed from the exit action of
the previous generation, and will never be referenced in the new
generation.
Counters should follow the format from ieee802-ethernet-interface
model, which use:
- in/out for Rx/Tx
- plural from
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of encoding hex data in regular strings, using an 'id:' prefix,
or guessing based on pattern in C code, we have decided for a breaking
change in the DHCP client model.
This commit introduces string and hex values for client-id in the models
for both DHCP client and server. The *breaking* part of the changes are
strictly related to how a user pass binary data as colon-separated hex
digits. The dedicated leaf node `client-id` is now reserved for string
values and the generic `list option` can be used to input user defined
string or hex values. Even non-conformant client-id options can now be
encoded. All described in detail in infix-dhcp-client.yang
The server model has been updated to be able to send generic options in
hex format, and the static host lease matcher for client-id now require
a 'str' or 'hex' modifier.
Note: dnsmasq is RFC compliant and will not match non-conforming option
61 (client-id) even though the client can send such payload.
To increase test coverage, the server_host test has been updated to
check both string and hex client-id. Matching on hostname is already
covered by other test(s).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- dnsmasq:
- allow listening to all interfaces again to serve DHCP leases
- disable most of the default DHCP options, keep broadcast and
netmask because when dnsmasq can infer these they are better
than breaking networking for clients -- note, they can still
be overridden from global/subnet/host scope -- and for relay
setups they need to be supplied anyway
- confd:
- drop per-interface dnsmasq, although practical for many use-cases,
having a per-subnet focused server means improved integration with
future stand-alone dhcp relay setup
- implement suggested, simplified, yang model
Fixes#703
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The hostname leaf in ietf-system.yang defines it as an fqdn. This patch
adds support for splitting the host and domain parts to set them in
Linux according to hosts(5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A DHCP client should be able to request a DHCP server assigned hostname,
*and* advertise its current hostname (as a client-id). This change lets
the client do either, instead of always assuming the latter.
Alt 1)
option id:hostname => request hostname
Alt 2)
option id:hostname, value:<STRING | auto> => advertise hostname
This also fixes a bug where the hostname sent to the server could be the
old hostname. The fix picks up any new hostname directly from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the new dhcp-server model, which has an option
value 'name', options are now referred to as id's or identifiers.
This means bumping the confd syntax version 1.3 -> 1.4 and adding a
migration script for existing dhcp-client configuration files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch introduces a new yang yang model for DHCP server and relay,
using dnsmasq to provide the functionality on a per-interface basis.
Available DHCP options will be queried by confd on startup and can
then be configured in a flexible manner.
The DHCP option 82 feature has been realized by patching dnsmasq
(see patches/dnsmasq/2.90/0000-relay-agent-info.patch).
Signed-off-by: Stefan Schlosser <sgs@grmmbl.org>
Skip the password node in operational data for entries that have locked
or empty password, otherwise the YANG validation (regexp) will fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_item() function logs an error: "No data found for ..." in
case the referenced XPatjh does not exist, causing unnecessarily scary
log message about missing genkey elements in /ietf-keystore:keystore/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg