Reduces the overhead/repetition for module callbacks by combining the
forces of srx_get_diff() and lydx_get_descendant() into one API. The
resulting function supports both XPath and simplified paths to get the
subtree of changes applicable to the callback.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This augments ietf-syslog.yang with global file rotation settings which
are used when per-file rotation is not configured. The defaults chosen
match previously decided defaults for Infix: 1M:10, i.e., rotate every
file at 1 MiB and keep up to 10 gzipped aged-out archives.
The standard model includes a default value of 1 for the number of files
kept, which is removed (deviated). There is also a unit specified for
max-file-size, 'megabytes', replaced with 'kilobytes' in this change.
On smaller embedded systems, smaller sizes may be required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently, it's not possible to run infix tests from an external
project (based on infix) due to an incompatibility between the
configuration used in the tests (the default configuration
within the image generated by the external project) and the infix
base configuration expected by the test cases. Therefore, a simple
configuration specifically for testing purposes needs to be generated
within an image. This test-config should always be generated
but only loaded when the device is in test mode.
Part of issue #568
When unit tests run in CI we may not have a syslog daemon available, in
such cases we set up a dummy handler.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are intended to make yanger a bit more robust. Instead of
bailing out on command errors, we now return empty string or object back
to the callee in run_cmd() and run_json_cmd().
One example where yanger previously exited hard, and dragged with it the
entire session, is when inspecting container status or when attempting
to restart container instances which have yet to be created/stopped.
Fixes#558
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Switch to logger, with syslog backend, instead of print() for logging
errors. This way we can log errors/warnings yet still return partial
JSON data back to statd. For example, failing to read JSON counters
from ethtool should not break "show interfaces", just return empty
array and log failure to run command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Missing whitespace in assignments, before comments and methods
- Drop semicolons from end of statements
- Use 'if foo not in bar' instead of 'if not foo in bar'
- Some too long lines (not all, that would be painful)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On boards like the R2S and the VisionFive2 `ethtool --json -S ethX` is
not yet supported. This patch allows ethtool to fail, with a slightly
better log message, without breaking the operational datastore.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inference for an interface named vlanN can only guess C-VLAN and VID,
the base interface must be left to the user to fill in. This is also
mandatory in the model.
Fixes#531
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We cannot rely on time being correct. Password expiration need to be handled
by external mechanism, e.g., RADIUS.
Fixes#534
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Removing a user's password hash should be the same an empty password
hash. In the latter case we already allow login with SSH keys, this
change harmonizes the behavior by also allowing login with SSH keys
when the users's password hash is removed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For netopeer2 we need to patch away local-users, since if it is enabled
netopeer2 requires all users that should be allowed to use netconf to
also be configured in ietf-netconf-server.
Also add some upstream patches.
Instead of potentially blocking sysrepo, which has a 5 second timeout,
we move 'container delete' jobs to be run by the execd queue.
Fixes#479
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes sure execd calls KNN style scripts before SNN,
allowing confd to post teardown jobs that are guaranteed to run
before any jobs to create new resources run.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
ietf-system.c: In function ‘change_hostname’:
ietf-system.c:1722:9: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
1722 | system("initctl -nbq touch netbrowse");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ubuntu 22.04 (ubuntu-latest runner on GitHub) has a slightly earlier
version of libxcrypt. The only hard requirement we have is yescrypt
support, so we can relax the configure check slightly to be able to
run coverity scan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All typedefs and identities should be declared in the module that uses
them unless other modules need them. This change also makes it easier
to work with tools like yanglint and pyang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg