Backported from origin/main 5420fb01f2
Includes the latest DRAM ECC status, with/without sudo, and temperature.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of the following commits from origin/main: 3b24fabe6a04fb92e80b4ad969653e03ece21256a8b7d91e4d26e3110977ab4f83fbc6
---
cli: fix 'copy FILE running-config' use-case
When copying to the running datastore we cannot use sr_copy_config(),
instead we must use sr_replace_config(). This fix covers both the case
of 'copy startup-config running-config' and 'copy FILE running-config'.
Fixes#1203
---
cli: add 'validate', or '-n', dry run to copy command
This commit adds config file validation to the copy command, discussed
in #373. Allowing users to test their config files before restoring a
backup. The feature could also be used for the automatic rollback when
downgrading to an earlier version of the OS.
Fixes#373
---
cli: fix copy to missing startup-config file
Fixes#981
---
cli: restrict copy and erase commands
This is a follow-up to PR #717 where path traversal protection was
discussed. A year later and it's clear that having a user-friendly
copy tool in the shell is a good thing, but that we proably want to
restrict what it can do when called from the CLI.
A sanitize flag (-s) is added to control the behavior, when used in the
shell without -s, both commands act like traditional UNIX tools and do
assume . for relative paths, and allow ../, whereas when running from
the CLI only /media/ is allowed and otherwise files are assumed to be
in $HOME or /cfg
---
cli: sanitize regular file to file copy
The regular file-to-file copy, was missing calls to cfg_adjust(), this
commit fixes that and adds some helpful comments for each use-case.
Also, drop insecure mktemp() in favor of our own version which uses the
basename of the remote source file.
---
bin: add bash completion for copy command
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
---
bin: copy: Refactor
copy() made some...creative...use of control flow that made it quite
difficult to follow.
Take a first priciples approach to simplify the logic.
---
bin: copy: Always get startup from sysrepo
This will make sure to apply NACM rules for all the data. It also
makes it possible for a luser access a subset of the data, even if
they to do not have read access to /cfg/startup-config.cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Actually disable iitod on Styx DCP-SC-28p to work around #670, this
prohibits software control of LEDs, leaving the default HW control,
which has proven more stable on this platform.
Backported from origin/main b0dce8a05e
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix a bug where systems with OSPF enabled on some, but not all,
interfaces would cause the OSPF iterator to fail when accessing
iface['area'], which was missing. This caused the ospf_status.py
tool to return {}, resulting in empty OSPF data in sysrepo.
Fixes#1169 Expected neighbors not shown in sysrepocfg
Signed-off-by: Richard Alpe <richard@bit42.se>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit yanger looked at the running system using
os.path..., this meant that the static reply / capture data wasn't
used properly. This resulted in strange behavior during unit testing
on GitHub runners where USB ports are missing.
Signed-off-by: Richard Alpe <richard@bit42.se>
The execd runner has not been used since Nov, 2024, ca0e54b. This
weekend it started triggering a warning from Coverity Scan, so let
us drop it for good this time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
If a extra infix feature require features to be added to an already
loaded module. Instead of have the exact module definition in multiple
places (with date), this will allow a much more flexible sytax:
MODULES=(
"infix-interfaces -e containers"
)
This require that the infix-interfaces is loaded *before* this file
is run.
This since the feature is called 'wifi' in Infix, this makes the naming
consistent over the system.
Also trigger start of a wpa_supplicant, for scanning in the background.
The scanning results is available operational.
Some CLI commands where inadvertently moved from the global CLI
context into the show context.
For example the upgrade command.
As a result, commands like upgrade were unavailable at the top-level
prompt:admin@ix-00-00-00:/> upgrade ?
Error: Command not found, or incomplete.
However, these commands remained accessible under the "show" context
as a temporary workaround:
admin@ix-00-00-00:/> show upgrade ?
URI [(ftp|tftp|http|https|ftp)://(dns.name | ip.address)/path/to/]upgrade-bundle.pkg
This patch restores the affected commands to the global CLI context so
that commands like upgrade function as intended at the root prompt.
Fixes: 9c0a8e39 klish-plugin-infix: fix indentation in infix.xml
Signed-off-by: Richard Alpe <richard@bit42.se>
If an invalid mount source path is specified, the container logs a
"file not found" error and subsequently crashes.
Adding a check inside the SR_EV_CHANGE event handler performs an
early validation of the mount source path, allowing to reject
configurations that reference non-existent or unreadable files before
they are committed to the datastore.
This change ensures configuration correctness by enforcing that each
container mount has either a source or content set. Without this, the
system may generate invalid runtime arguments (src=(null)), leading
to container startup failures.
Libyang is smart, it "fixes" the timezone for you, this was overriden by a
hack in netconf.py and restconf.py, but what you really want is to see
in operational what the current timezone is.
Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
When running a DHCP test `resolvconf -l` looked like this:
admin@client:~$ resolvconf -l
search example.com # e5
admin@client:~$
This resulted in broken result when reading operational data from
system-state (which used resolvonf -l)
Joachim Wiberg