Similar to the standard build workflow, with the following exceptions:
- Sets internal variable 'ver' to ${GITHUB_REF#refs/tags/v}, for filenames
and directories, ensuring the leading 'v' in the tag is dropped
- Sets INFIX_RELEASE variable, for post-image.sh, to '$ver' so it creates
the .img files with the same name as the tarball and directory. (RELEASE
clashes with OpenSSL's release handling, breaking builds completely.)
- Sets release directory + tarball to infix-$variant-$ver, where variant
is one of "classic" or "" (for NETCONF).
- *Skips the tests*, for now. We release from main, which should already
be tested. Future releases may run a release test suite here
- Each build step (matrix) uploads its artifacts, when all build steps
have completed we start the release job (depends on build), which then
downloads all the various artifacts before creating the GitHub release
- The release notes are derived from the file ChangeLog.md. Please note,
extraction of the first release notes will fail since there is no prior
release marker in the file
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch affects the various artiact file names in release tarballs.
The files /etc/os-release and /etc/version in the image use the actual
GIT commit (git describe), as per post-build.sh
Guiding principle: artifacts without release suffix are development or
"nightly" builds. Artifacts *with* release suffix are released ones.
This drops the $GITVER from .img files for consistency with the other
artifacts, e.g. .gns3a and .pkg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical data shows response times of over 10s for even simple config
changes on heavily loaded systems (non-accelerated VMs with lots of
stress on the host). So we choose a really large number, hoping that
we won't be back here for a while.
When/If dagger generations are abandoned we should not bail out if a
recovery generation finds an existing 'order' in the previous gen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Same as with creating veth pairs, we must not try to delete both ends
since the kernel does that for us. Ensure we check skip in the current
generation and not in the next.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should copy factory running, instead of using the factory-reset RPC
but for now we use startup since 'factory' is not yet supported as a
copy-from target.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 116, in put_config
except self.ncc.RpcError:
^^^^^^^^^^^^^^^^^
AttributeError: 'Manager' object has no attribute 'RpcError'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This one was a little bit tricky with the special yang union. To figure
out the integer value of enums one has to check the schema and deref the
correct subvalue within.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While running tests in GitHub action, the following[1] often happens.
From the timestamp it seems unlikely to be casused by timeout, which
from what I can tell is 120 sec in the library and 30 sec on our socket.
This never happens when running locally, so I've added a simple
try-catch to retry the operation, because some[2] jobs actually pass.
2023-06-18 09:18:17 # Traceback (most recent call last):
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/case/infix_interfaces/dual_bridge.py", line 18, in <module>
2023-06-18 09:18:17 # target.put_config_dict("ietf-interfaces", {
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 117, in put_config_dict
2023-06-18 09:18:17 # return self.put_config(lyd.print_mem("xml", with_siblings=True, pretty=False))
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 112, in put_config
2023-06-18 09:18:17 # self.ncc.edit_config(xml, default_operation='merge')
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 277, in edit_config
2023-06-18 09:18:17 # self._send_rpc(rpc_xml)
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 223, in _send_rpc
2023-06-18 09:18:17 # r = f.result(timeout=timeout)
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 456, in result
2023-06-18 09:18:17 # return self.__get_result()
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
2023-06-18 09:18:17 # raise self._exception
2023-06-18 09:18:17 # netconf_client.error.RpcError: EV ORIGIN: "rpc" ID 5 processing timed out.
2023-06-18 09:18:17 #
[1]: https://github.com/kernelkit/infix/actions/runs/5302735753/jobs/9597878647
[2]. https://github.com/kernelkit/infix/actions/runs/5302735946/jobs/9597878838
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A basic test should be just that, very basic test of a feature. So we
split out the more advanced ones, building up to the dual-bridge.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unsure if this is right, but existing nework test does not send loopback
or other interfaces in the networking configuration, so maybe merge?
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for uploading resulting image(s) from a job even though the
tests may have failed. This way we can inspect the image and see what
went wrong, or if it was a glitch in the matrix^W^Wazure.
Retain a symlink to images/ for test step.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The admin account is the superuser in Infix. The root account will soon
only be for running system daemons.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport upstream sysrepo support for initializing internal modules,
like ietf-netconf-acm, with factory-default data.
A local KernelKit patch on top is required for run-time loading from
/etc/sysrepo/factory-default.json instead of the upsream compile-time
support.
Renamed existing patches to maintain the proper patch order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The ietf-ip yang model has a global IPv4 and IPv6 'enabled' setting that
must be honored. E.g., when setting eth0 as a bridge port and disabling
IPv4 address on eth0, we must flush all addresses, including autoconf.
When detaching interface from the bridge and toggling the 'enabled' node
back on, we only get a "replaced" flag for that node, so we must restore
all addresses from the configure data. The same goes for 'autoconf'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When toggling settings like 'interfaces/interface/ipv6/enabled', which
guards both link-local and all static addresses, the operation is not
"create" or "delete", but "replace". Callback must take any "replace"
on an 'enabled' node into account since none of the other nodes will
be available in the diff.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for Linux veth pairs and is also a bit of a
cleanup of our native yang models, more on that below. The interesting
things are the use of submodule(s) for veth, and the addition of the
deviation for the deprecated /if:interfaces-state.
Unfortunately the `fprintf(ip, "link add dev %s down", ifname);` had to
be delagated from netdag_gen_afspec_add() because of this change. This
because we only know very late that the peer-end of the pair should be
skipped. Having a lingering `ip link add dev foo down` causes iproute2
to fail hard.
A note about Yang models. According to RFC they must follow the naming
standard; 'org-name' and use prefixes 'org-shortname'. So we've decided
to standardize on 'infix-modulename' and 'infix-mn', where 'modulename'
is the standard model we extend, and 'mn' is the prefix used by that
standard model. For example
- infix-interfaces extend ietf-interfaces and use infix-if
- infix-if-veth is a submodule extending infix with veth pairs
Upcoming bridge and lag models follow the same pattern. The use of
submodules require a patch to sysrepo, included earlier, and allows
us to have the same 'infix-if:', or 'infix-interfaecs:' prefix to
all ietf-interfaces extensions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When setting up veth pairs we only need to set up one end of the pair,
so the confd callback code need a way to remember to skip setting up
the peer interface.
The code added here is generic enough to handle other such transactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the coming support for veth pairs, bridge, and link aggregates, we
need to infer peer interfaces (veth), and similar more deeply nested
data nodes to aid the user. Thereforce we can no longer rely on the
xpath in the callbacks to always be "interfaces/interface[name='ifnm']".
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This changeset includes a patch to the upstream sysrepo that is a slight
refactor of the internal function sr_install_modules_prepare_mod() that
is used by sr_install_module2(). Meaning, the srx_require_module() can
now be simplified greatly and we now also support the include statement
with submodules in yang models.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Initial yang model cleanup:
- Use infix-foo@rev.yang for augments and deviations of each std-foo model
- Drop kernelkit-infix-deviations, moved to infix-system model
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running in the cloud, without KVM emulation, together with many
other tenants, it can take a very long time to boot the instances.
Therefore, add a meta test that will wait for all devices in the
physical topology to come up before exiting. This means that the
actual test cases that follow can assume that devices will answer
NETCONF requests.
Create topology objects that are tailored to represent topologies on
the expected format. This let's us make convenient accessors for
things like the controller node, infix devices, getting the ports used
to reach a certain device from another one, etc.
- Collect all test related targets under the test- prefix.
- Add target to run test suite against a `make run` instance. The
intended use-case is that you are testing out a new build with `make
run`, and then realize that you want to run some tests. With this
change, it is now possible to run `make infix-run-check` from a
separate terminal - which attaches to the running instance and runs
the tests.
- Provide -sh targets to spawn interactive environments, which is
useful during debugging.
- Allow the user to supply a custom suite or list of tests to be run
by 9PM.
This let's us check for timing issues in tests that arise when falling
back to TCG acceleration in QEMU.
While we're here, add a proper option to see the usage message.
busybox-extras contains an implementation of telnet, which is needed
for `qeneth console` to work. While we're updating, add tcpdump since
we'll need it sooner or later.
Add oper-status and if-index data to sysrepo for every existing
interface. The origin of the data is the "standard" ip tool with
JSON output.
Current implementation is limited to interfaces existing at startup.
Signed-off-by: Richard Alpe <richard@bit42.se>
We want Reggie to take most of the hits, then we sail in and build after
the PR has been merged so we can upload new "Nightly" images.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Keep build times low, use minimal defconfig and a single arch
- Focus on the regression testing
- Allow running on all branches for all users
Goal: when tests pass, reviews can start, if review is good, then merge
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea for this is to maintain a smallest-possible type build that can
be used to run regression tests in GitHub Actions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily intended for minimal/testing images, but likely also useful
for other use-cases as well.
Defaults remain to sign all images.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a new "statd" module to sysrepo. This module is intended to handle
operational status, i.e. R/O attributes.
In this state, the statd module only retrieves and answers to the
"oper-state" of "eth0". This will be replaced by proper interface
handling and json data processing in upcoming patches. The indent here
is to get the base logistics in place as soon as possible to make life
easier for developers.
Signed-off-by: Richard Alpe <richard@bit42.se>
Since qemu.sh is now tied to the directory it's ran from, it makes
sense to change into that directory before starting to resolve any
file paths. This let's us start the script from any directory without
the need for any (cd && qemu) subshell.
This change drops Qemu menuconfig from the regular 'make menuconfig' in
favor of full release tarball support. Meaning "make update-defconfig"
will not longer cause unwanted diffs for Qemu defaults checked in when
the defconfigs are updated.
Details:
- For "make run, run-menuconfig" and bootstrapping qemu.cfg we want to
use the Buildroot menuconfig system. However, we must set the proper
environment variables for it to not overwrite our product's .config,
so the calls to conf and mconf are not pretty.
- The qemu.sh script can probably be cleaned up further, I've just set
a CONFIG_ prefix to all variables and dropped any images/ prefix vs.
the original. The CONFIG_ prefix is to make the qemu.cfg compatible
with kconfig-mconf from the kconfig-frontends package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First basic step, we also want a menuconfig-like way of changing the
settings, e.g., networking options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding a new interface to the candidate, if the name matches
<BASE>.<VID>, infer that:
- The parent-interface is <BASE>
- The tag-type is c-vlan
- The vlan-id is <VID>
With this in place, from klish, the following sequence:
configure
set interfaces interface e0.10
leave
Will create a stacked VLAN interface, using VID 10, on top of e0.
- Make sure that when we need to delete an interface, this is done in
the exit phase of the generation we're exiting, i.e. it is treated
as a regular delete.
- When we need to delete and rebuild an interface, make sure that all
settings and addresses are applied again. This is done by swapping
out the diff for the configured data, which we just annotate with
enough metadata to make it look like a diff.
- Create a dagger dependency from the VLAN to it's parent interface.
This ensures that the parent interface is properly configured before
the VLAN is created, which is important when virtual interfaces are
stacked on top of each other. E.g. a VLAN on top of another VLAN.
- Recreate the VLAN when the parent is changed.
- Fix VLAN tag-type parsing
This makes the pattern
if (lydx_get_diff(lydx_get_child(diffnode, "attribute"), &nd)) {
/* Handle changes to "attribute" */
}
safe to use in the common case where "attribute" has not been
modified, and is therefore not present in `diffnode`.
When evolving to a new generation fails, users will typically abandon
it (so that a new attempt can be made). However, the generated
scripts and the logged output is very valuable from a debugging
perspective.
Therefore, keep the data around by just renaming the generation
directory.
Later, we can include these directories in the garbage collecting
process, if we want to.
Infix ships with a gdbserver configuration that listens on
/dev/hvc1. Connect this to gdbserver.sock on the host, so that we can
attach to or run Infix processes using GDB.
This adds support for VLAN sub-interfaces on physical interfaces, e.g.,
eth0.10 on eth0. There are no restrictions or sanity checks other than
what is defined in the YANG models.
Neither the ietf-if-extensions or the ietf-if-vlan-encapsulation model
have been ratified as standards and are thus experimental. As such, the
ietf-if-vlan-encapsulation model originally references a non-existing
revision of ieee802-dot1q-types, which has been modified to use the
latest release from IEEE.
How to set up, notice we do not use the l2vlan type:
interface eth0.10 {
type ethSubInterface;
encapsulation {
dot1q-vlan {
outer-tag {
tag-type s-vlan;
vlan-id 10;
}
}
}
parent-interface eth0;
ipv6 {
autoconf {
create-global-addresses true;
}
}
}
Unfortunately, we have to create the VLAN interface on a separate line
since adding VLAN interfaces does not allow setting addrgenmode at the
same time, hence the introduction of the new line `link set %s down`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These packages are not (yet) used in the NETCONF build, only make sense
in the Classic Infix builds. SMCRoute will be needed later on, but not
right now, so also remove.
The dhcpcd package is only used by ifupdown-ng in Classic, in NETCONF we
use avahi-autoipd and udhcpc.
iproute2 is selected by the net tool, so collapsed by menuconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Keys stored in system specific directory /var/run/sshd/$USER.keys
- Keys are regenerated on each corresponding reconfiguration event
- Deletion of key(s) or user remove all keys
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Flip 'enabled' logic, if attribute is missing => 'enabled: false'
- Release lease on udhcpc exit
- Call initctl with -f (force) when deleting dhcp-$iface.conf otherwise
in interactive mode, waiting for (y/N)? question
- Also, always use -batch and -quiet modes with initctl
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On May 10, 2023, @troglobit wrote:
> Initial proposal for factory-config, based on example from RFC8341.
This gives the admin user the ability to configure the device over
NETCONF.
This patch adds a new user "admin" with the password "admin". The
password is hashed with sha512 ($6) as a hint to new users attempting
to change the password (avoid the weakest algorithms).
Signed-off-by: Richard Alpe <richard@bit42.se>
Initial analysis of system default users gives that there is no real
need for a default 'factory' user to trigger a factory reset. On an
actual physical device we will have a reset button or a menu option in
the bootloader to trigger factory reset, and in both physical and
virtual (GNS3) devices a logged in admin user can call the factory
command.
A virtual device that cannot be logged in to will have to be removed and
have its persistent backing store deleted, but that is the only real
downside to removing this user. The idea is to set a kernel command
line flag from the bootloader, and that could also be done from, e.g.,
GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently only supports creating host-device profiles, e.g. from veth
pairs or physical interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The /var, and particularly /var/lib, directories are used for persistent
storage for various system daemons. While adding support for containers
it became clear we had to change how we make these directories writable.
Both LXC and Podman use OverlayFS for the writable layer, and you cannot
set up an overlay on top of another overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- package/libyang: Bump version to 2.1.55
- package/netopeer2: Bump version to 2.1.59
- package/sysrepo: Bump version to 2.2.60
- package/cni-plugins: partial backport to enable missing plugins
The libite v2.5.3 backport has been dropped from the kkit patches
since it's been merged in upstream Buildroot LTS branch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Podman (POD manager) is an open source tool for developing, managing,
and running containers on your Linux systems.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Conmon is an OCI container runtime monitor. It sits between container
runtimes, e.g., crun and runc, and userland managers, e.g., podman.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test is based on the 9pm framework, which supports execution
of test-cases written in any language. This test is written in
tcl/expect with help from the 9pm expect library. It's what I used to
test during development of the Infix basic authentication support.
The aim of this patch is to serve as an example of how the
interactiveness of the 9pm-expect library can be used.
9pm framework code is here:
https://github.com/rical/9pm
Signed-off-by: Richard Alpe <richard@bit42.se>
Rudimentary support for setting login shell for new users. Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.
Follow-up to f5866ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The writesf() API was hard coded to always open files in "r+" mode,
which fails if the file doesn't exist.
Add a mode option to writesf() and writedf().
Also, drop the default motd, we don't have one in NETCONF mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change drops -nographic in favor of the more flexible virtconsole,
fixing the problem with loss of terminal history and reset.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bringing down the current generation is a step of its own, so it makes
sense to let finit clear out all old services before setting up the
new ones.
For example, with avahi-autoipd, without this step, we would run the
following sequence when disabling it on an interface:
initctl disable zeroconf@iface
ip link set dev iface down
ip link set dev iface up
initctl reload
But we really want to stop the zeroconf service before the down/up
cycle on the interface, since that is likely to disrupt the
daemon. With this additional step, the sequence becomes:
initctl disable zeroconf@iface
initctl reload
ip link set dev iface down
ip link set dev iface up
initctl reload
Which means that finit won't try to restart zeroconf if it dies during
the down/up cycle, since the service is already gone at that point.
Saving running to startup follows the same pattern as config update of
candidate to running, so we must employ the same hook mechanism here.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor register_change() wrapper, for sr_module_change_subscribe(),
with an additional twist of setting up a commit DONE event catcher.
This creates a global event hook that ensures we call 'initctl reload'
after all module callbacks have completed, regardless of the xpath and
without having to have "shadow" subscriptions to all new modules being
added to confd.
Based on on ideas from https://github.com/sysrepo/sysrepo/issues/2188
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without --force-bind, the address is removed if another routable
address is added to the interface.
While this is likely something that should be configurable in the
future, we choose this mode as the default so that IPs used for
NETCONF connections are not dropped because other addresses are added.
A generic replacement for src/net with some advantages:
- Shell script is well-suited to these kinds of tasks, making this
implementation much simpler.
- Allow arbitrary number of actions (not just init/exit), this can be
used to implement things like `dagger exec up/down`.
- Allow arbitrary number of scripts for each action/node tuple. This
will let us handle more complex scenarios in confd without having to
fiddle about with src/net.
finit is not ready to accept the messages anyway, so we end up waiting
for the 2s timeout (2 times). Since finit won't setup a utmp entry
until it leaves runlevel S, we use that as the sync point for when
finit is ready to receive reloads.
This allows you to define a single "logical" config that can be
tailored to the specific system based on the available interfaces,
base MAC address etc.
This patch introduces basic user authentication support via sysrepo.
Namely it adds:
* The ability to create or delete a UNIX user.
* The ability to set or delete a UNIX user password.
The password needs to be hashed and in a UNIX shadow format, such as
"$ALG$SALT$HASH". We want to avoid the handling of clear text
passwords as much as possible. In the meanwhile, passwords
can be generated in the infix shell using mkpasswd.
CLI Examples:
Add a user:
configure> set system authentication user foo
Delete a user:
configure> delete system authentication user foo
Set a user password:
configure> set system authentication user foo password ...
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables support for running custom startup scripts at boot,
allowing a mix of a NETCONF-based system and Classic /etc. For example,
use NETCONF to set up network interfaces, users, etc. and runparts for
enabling and configuring the device as an OSPF router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some critical services must never be stopped, and with the unfortunate
separation of runlevel S and 0 in Finit recently, all affected service
definitions must be updated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For each build there is an infix-$ARCH-$VARIANT.img -> rootfs.squash
that we want to be a real file when extracting it. This to ease the
integration with testing frameworks like Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the introduction of the -classic defconfigs we need to also make
sure to name the resulting artifacts accordingly:
- infix-$ARCH.{gns3a,img,pkg}
- infix-$ARCH-classic.{gns3a,img,pkg}
For release builds the version (-23.02-$REV) will be appended before
the file suffix, e.g., infix-x86-64-classic-23.02-3.img
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long standing internal debate comes to its logical conclusion. Arch
naming should follow GCC. The "native /etc" has also found a better
name: classic!
README and GitHub action has been updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop unused packages in NETCONF (default) mode
In the default build we will use the net tool instead of iupdown-ng,
p-net & Profeth will move to customer-specifc builds with another
licensing model.
- Split out NETCONF specific parts from board/common to board/netconf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This build is intended as a base reference and for use as a very simple
end device. The default starts DHCP and IPv4LL (ZeroConf) on eth0, but
can be configured by editing /etc/network/interfaces.d/*
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Still ways to go here, eth0 should be in a bridge with a vlan1 interface
on top, which in turn should have this config. But let's start here, it
works! :-)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to, as a plain Infix default, start up devices with DHCP and
IPv4LL/ZeroConf and IPv6 link-local address. Using mDNS the user can
then and push a NETCONF configuration over SSH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is very ugly, what we really want is that the commit_done_hook()
runs when *all* DONE events have been processed in all models. The
side-effect of this hack is that the callback is run twice, both for
ietf-systm and ietf-interfaces if both are modified.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a first Infix model to augment ietf-ip with a node,
similar to the IPv6 'autoconf' node, also for IPv4. For IPv6 the
autoconf feature comes built-in, for IPv4 it is defined in RFC3927.
The setting behaves the same as for IPv6, but in the case of IPv4 we
enable avahi-autoipd per interface to acquire the 169.254/16 address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the new templating support in Finit, and this patch, we can now
very easily enable a ZeroConf service on, e.g., eth0:
$ initctl enable zeroconf@eth0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The root user is by default not allowed to log in over SSH, so we add an
admin user with limited root privileges for this purpose.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling 'make skeleton-init-finit-rebuild' to (re)install any new
or modified services, we cannot remove everything installed already.
That breaks what other packages may have installed already and is not
the Buildroot way.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The init_next_gen() function moves us to the next generation, as well as
intialize all data files for expected interfaces in that generation.
However, bridge and lag interfaces have dependendcies that need to be
moved as well. It is only the test author that knows the expected new
state, so this function only sets up the desired state, without ever
looking at what any previous generation looked like.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With more advanced interface types we cannot use create_iface() to set
up the file structure in new generations. This commit adds a _data()
function that should be used instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The net tool traverses the graph and executes the scripts et al in
postorder, i.e., all leaves are evaluated first before the parent's
script is run. Hence, attaching ports to a bridge or link aggregate
is the responsibility of the parent, not the leaves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For instance, when adding ip command to the ip pipe we need the kernel
to execute those commands before the bridge command pipe is executed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Host tools and target are often out of sync, sometimes because we need
to run a newer version of iproute2 with more features. By installing
tests to target we can still verify basic functionality, provided the
tests verify their dependencies and exit 77 (SKIP).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Simplify build process, including cross compilation
- Add basic test framework, available as `make check`
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Run with unshare, as so:
make clean; make; cd test/
unshare -mrun ./three-independent.sh
This sets up a test directory in /tmp/net, creates three independtent
interface configs for dummy interfaces. Activates the config with a
call to `net -vd apply`, and then verifies the result using a mix of
ip link/addr and jq magic.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling net prevsiouly meant `net do`, the new separation is to be able
to add `net up` and `net down` commands, with optional interface args.
The idea is to support the same semantics as `ifup -a` of `ifup foo`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Naming the actions after their executing entity, e.g., foo.sh when it is
executed by /bin/sh, is a tried and true paradigm.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When taking down a network setup, it needs to be deconstructed using the
foo.exit rules of the previous generation, and in reverse dependency
order.
This patch adds support for generating the deps when bringing up the
network setup, and saving an rdeps file in that generation, which can
be used later when moving leafs between nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This means that:
- The full boot order is now respected, using the magic "fallback"
varible in GRUB. This means that if an entry fails to load, we move
on to the next one in the defined order.
- Netbooting is supported. In this mode, GRUB will acquire an IP
address using DHCP, after which it downloads an image using TFTP.
- If we run out of valid entries, we always make sure to reboot. This
ensures that, e.g., a temporary TFTP server outage does not cause an
Infix device to get stuck in GRUB.
At the moment, the image handling is excruciatingly inefficient when
netbooting, as the image is downloaded multiple times behind the
scenes. Ideally, downloads would be cached, but a quick investigation
indicates that an implementation of this would take more time than we
can spare at the moment. Therefore, we settle for the working, though
wasteful, implementation.
The per-interface and per-af setting in the ietf-ip yang module allow
the user to enable a more granular forwarding between interfaces, which
is disabled by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to rely on the kernel command line, we convert all the
kernel functionality in question into modules and rely on the auto-load
feature in the kernel and modprobe to add options at load time.
The fb_tunnels setting is a net core setting, for that we use sysctl.
This commit also syncs the kernel config between our two main archs,
disabling DRM and SOUND for the Amd64 build as a spin-off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling sr_get_time() for an xpath that has no data causes sysrepo to
always log the access as an error. With sr_get_items() it is left to
the callee to determine if the missing data should cause an error.
This patch is a refactor that silences the syslog message and also
fixes one or tow memory leaks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some users still prefer the old netmask style to set up an interface.
This patch enables the corresponding model feature and checks for a
netmask only if prefix-length is unset.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All value functions, except the new srx_enabled(), now return clear
error indication, with the value as a separate argument.
The srx_enabled() predicate function is for cases where the default
value is disabled and code checks enable a subsystem or flag. I.e.,
when an error can safely be returned as 'false'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note: new API, srx_get_bool() returns -1 on error, leaving 0 and 1 as
false and true, respectively.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unfortunately, sysrepo considers it an error to load a module that is
already loaded, ruling out using `sr_install_modules`.
Therefore, provide `require_modules` instead, which ensures that a
given set of modules are loaded, or loads them otherwise.
Things we really want later, but don't use right now:
- MRP
- MSTP
Neat to have in a networking product, but not used at all by us atm:
- ttyd
- tmux
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add the ability to set and delete system MotD (Message Of The Day)
using the cli.
This patch augments the standard ietf-system yang schema with
a new infix-system schema which contains a new motd leaf.
The default value is hard coded in two places, confd and the rootfs
file /etc/motd. The intention is to fix this in upcoming patches.
Introduces:
exec> configure> set system motd STRING
exec> configure> delete system motd
This is needed to confirm the new system configuration generation and
reload all affected services. E.g., when configuring an NTP server
and committing the candidate to running, the ietf-system plugin has
only enabled the service, as a last step we need to tell Finit to
actually start it.
This hook needs to run last since the enabled service(s) may depend on
other service(s), or networking, to be enabled in the proper order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Really ugly handling here, needs to be reworked into sr_uint8() etc.,
adding as-is for big upcoming demo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Declare deviation for /ietf-system:system/clock/timezone-utc-offset,
which we currently do not support.
Please note, when setting out to add support for timezone-utc-offset,
you need to ensure the user does not input both, that should be a
validation error. It's an either-or thing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
How to verify, use the following command and paste the XML below:
$ sysrepocfg -R
<sys:set-current-datetime xmlns:sys="urn:ietf:params:xml:ns:yang:ietf-system">
<sys:current-datetime>2022-01-12T14:29:00-02:00</sys:current-datetime>
</sys:set-current-datetime>
Reuse code from mech, verified and working.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When researching the systemd tmpfiles.d implementation I discovered the
effort to standarize on /usr/share/factory as a generic factory defaults
for Linux systems. This patch adds a small example factory.cfg file
that is installed as /usr/share/factory/cfg/startup-config.cfg. The
tmpfiles.d backend will then install it as /cfg/startup-config.cfg if
that file is missing at boot. Confd does the rest to bootstrap our
(by default) empty sysrepo db with this startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds a hook to the startup datastore, we use the ietf-system
module because the module argument is mandatory. The hook runs when all
changes have been saved to the internal store. Since sysrepo has many
startup files in /etc/sysrepo, we saving a JSON copy of all these files
in /cfg/startup-config.cfg, which is persistent. On system bootstrap
this file is merged into the (empty) running datastore, which is what
the sysrepo maintainers recommend to be independent of any yang model
updates that might occur on image upgrades.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Call external programs safely with run()
- Use augeas to update /etc/hostname and /etc/hosts
- Add support for generating /etc/chrony.conf
- Update license copyright due to significant contrib.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default is to use -d (debug), which changes logging to stdout, which
we do not want with Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix integration of klish and klish-plugin-sysrepo.
Initially we add:
More flexible management of running vs. startup: Instead of always
committing changes both to running and startup, commit only modifies
running. To persist changes to startup, the copy command is
introduced. This lets the user copy from factory/startup/running to
startup/running at any time.
Well-known verbs like abort, leave, end, etc.
Drop the shortname yang aliases, installed they become copies of
their versioned counterpart, which is not the intention, but also,
no other yang consumer does this.
We'd like to use ly_ctx_load_module() directly, or a slim sysrepo
wrapper of the same, but no such API (load by yang module *name*
with optional revision) exists currently.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Extended evaluation of sysrepo due to problems parsing yang v1.1 models
with the built-in yang parser in Clixon. Problems not seen with libyang
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes compared to original project:
- installs into the sysrepo-plugind plugin directory, so no need
for calling sysrepoctl to load the plugin
- the plugin loads its yang module, so no need for calling sysrepoctl
to load the module before starting sysrepo-plugind
- bug fix ERROR() macro
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds multi-nameserver support using openresolv (resolvconf)
and dnsmasq. This means that a DHCP client (dhcpcd) or VPN client can
be providers of nameservers to the system. Dnsmasq takes over as the
system resolver, except when the user has set up static configuration.
Static nameserver(s), as well as search and options, are always added
first by openresolv to /etc/resolv.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First example of how to implement supoort for ro/state-data.
Only oper-status and phys-address per interface currently.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In managed NETCONF mode /etc is always based on the image's read-only
/etc with a read-writable overlay as a RAM disk. We control the image
and know the default rc.local is empty and the interfaces file only
list the loopback interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Only disable default services we don't need, prevents touching
services mid-air in runlevel S. Allow nginx now as well
- Enable fcgi based RESTCONF interface via nginx by default
- Enable auth:none for customer demo
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Chrony drops privs after startup to user chrony, when restarting it
writes its state in /var/lib/chrony, so the directory needs to have
the correct permissions for that user.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For observability. All transactions that reach ietf-system are logged
with LOG_DEBUG log level. See /var/log/debug for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To facilitate linking and circumvent any possible legal problems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
- Example of optional args (show log [FILE])
- Example of dynamic expansion
- Example of how to re-enable signals for external commands
- Example of hidden commands
- Add basic 'help' command for the current level
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for firmware updates via RAUC on aarch64. The created RAUC
bundle (images/infix-$BR2_ARCH.pkg) is signed with the same key used
to sign the raw FIT image.
Similarly to how $(call IXMSG,"hello world") outputs a blue
information line from a makefile, provide `ixmsg` to accomplish the
same thing in shell scripts.
Use a different prefix (`#!:` vs `>>>`) to differentiate it from
makefile output.
On amd64, we use grub instead of U-Boot, because yours truly can't
figure out how to handle ACPI handover to the kernel.
The resulting image is now called disk.img instead of the old mmc.img,
since we can use it over any interface (e.g. virtio or SCSI).
- Adapt boot scripts to exepect the split FIT header/SquashFS image
layout.
- Make sure that we can boot from any kind of block device (most
importantly virtio for GNS3).
- Rename net -> dhcp as we might have more kinds of netboots in the
future (http).
Store FIT headers separately on aux, and place the raw SquashFS images
on primary/secondary. This removes the need to muck about with the
device mapper to setup the rootfs, and it allows us to boot using
syslinux files.
These changes allow profeth to pass the Automatic RT Tester's first
behavior tests: Scenario 1-9.
- Explorative changes to the GSD file to appease the conformance tool
- Fix mismatch in installed submodules vs advertised ports in GSD file
Note: changes in GSD file only match the amd64 virtual build. Must be
updated for the final product.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent `if:<cond>` addition to Finit we can simplify a lot of
the logic for disabling and enabling features in Infix. Standardizing
on conditions that Finit provides.
We create boot/netconf, boot/etc, and boot/profinet conditions early,
after all filesystems have been mounted (and cleaned), so they are all
set before Finit loads its configuration files in runlevel S.
The default is still to boot into a managed NETCONF mode, since the end
goal remains to integrate PROFINET as yet another service. The other
mode, native /etc, should then be the only exception.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split tmpfiles config in two, one for snmpd and one for profeth.
Add logging and redirect profeth logs to /log/profinet.log with
default log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the old p-net API for querying the interface address, netmask
and gateway with the new ones that use getifaddrs() and inspect the
kernel routing table.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An Infix build with PROFINET gears Net-SNMP heavily towards acting as a
servant to profeth (p-net stack). This will be hard-coded for now until
we've integrated it all better in Clixon.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use ael fork with not-yet upstreamed fixes for now.
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not the full environment used by U-Boot, just the bits needed
for U-Boot to know which slot to boot and for Infix to know how the
boot process went.
U-Boot will selectively import/export only these keys during boot,
which avoids a malicious user from altering the boot in a way that
might bypass signature validation.
The blkmap patches were not included in the original U-Boot Secure
Boot changeset.
Fixes: d243c80 ("aarch64: Convenience target to configure a QEMU compatible U-Boot")
Now that the uncut FIT is stored in primary/secondary, we don't create
any FIT header files.
Fixes: 499a8f7 ("common: Create (e)MMC image with redundant root filesystems")
- Drop unused com32 modules
- Fix duplicate prompt output (serial not needed)
- Reduce timeout before booting default to 0.5 sec
- UI or DEFAULT must be set, otherwise isolinux complains
so replace ONTIMEOUT with DEFAULT
- Increase user-walked-away timeout to 5 minutes
- Always show the prompt
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On rebuild (without distclean) the getty.conf contained two tty lines
for the same TTY, causing Finit to believe the command line args had
been changed between each reload -- and thus kicking out the logged
in console user who just typed `initctl reload`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Need to rsync the whole skeleton since we provide more than just the
finit.d files, e.g. /etc/fstab, which we also modify in this .mk.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we have dialog on target we can add a user-friendly factory
reset dialog. The new `yorn` script handles any form of yes-or-no
question, with or without dialog, to call a command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we only support mmc and squash in `make run` we should make
sure the reference platform works as well as aarch64.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for setting the system boot mode to native /etc
style for systems where it's difficult, or close to impossible, to set
the Finit boot condition to 'etc'.
Note: this also moves the check for factory reset before we check if we
should use_etc, rather than NETCONF. This to allow clearing out any of
the state files (.use_etc) before proceeding to boot in the default mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. Use same naming standard for quagga and frr
2. Only one of quagga and frr can be used at the same time
3. Subdirectories in available/ only in the skeleton, not on target
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only install the corresponding Finit svc if the package is selected in
the Buildroot menuconfig. Some packages cannot be enabled by default
though, since they require a daemon configuration file, e.g. in the
case of ulogd it requires a valid /etc/ulogd.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This image contains:
- A partition to hold bootloader config ("aux").
- Two redundant copies of the FIT framed rootfs (which will be
upgradable by RAUC from within Infix).
- A partition to store critical configuration data ("cfg")
- A partition to store data created dynamically by Infix ("var")
mkimage will generate an FIT image containing a signature of the
rootfs, where the data is kept out of the DTB data structure, i.e.:
.---------.
| DTB |
:---------:
| Padding |
:---------:
| |
| |
| rootfs |
| |
| |
'---------'
This is the on-disk format of Infix. At boot, we extract kernel and
device trees from the rootfs, and then use Linux's device mapper to
create a virtual block device that exposes the rootfs (squash).
This ensures that U-Boot images that we build can always:
- Rely on the environment extensions in env.dtsi being available
- Access the configured signing keys
- Use SD/eMMC cards
- Extract files from SquashFS filesystems
All of which are foundations that we intend to design our image
loading around.
Ensure that whenever U-Boot is built:
- The chosen signing key and is converted to the expected format and
installed in the build tree.
- Infix's environment extensions are installed in the build tree
Keep a shared in-tree key that can be used to sign Infix images during
development. The idea is that this will also be included in developer
builds of U-Boot.
This is likely the last before v4.4-rc1. Last remaining thing is a very
basic tmpfiles.so plugin that replaces a lot of what bootmisc.so hs been
(ab)used for.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also add libcurl so all Clixon utility functions and apps are build with
full support for RESTCONF.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This introduces a dependency on /run/clixon to exist when starting up.
Requires a patch to Finit panding the upcoming tempfiles.so plugin.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also needs /var/cache/nginx when starting up. Requires separate patch
for now, but will be added a tmpflies.so plugn to Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily for evaluating OSPF in customer's use-case. Preparing for
some (static) multicast routing tests as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Keep the transient files in the system's /mnt/tmp, and only persist
startup_db in /cfg.
This design (with a symlink) means that /cfg/startup_db _must_ exist
in order for clixon to start properly. Therefore run
/lib/infix/prep-db to take care of this.
At the moment, this just creates an empty factory config, and copies
it to startup if it doesn't exist. In the future, prep-db could select
a factory config based on some hardware identifier, or even build one
dynamically, based on available ports etc.
This reverts commit 2ddf9448fe.
Two reasons:
1. We will move to a debian-style /etc/ssh/ssh_config.d/ structure
soon.
2. In a managed scenario, NETCONF could be disabled, so mech should be
responsible for activating it at boot.
The allows remote NETCONF access to the Clixon example (for now). This
will be replaced later with the Clixon Infix system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Use the more common .pid format for the PID file
- Use an existing directory for the XML db, /var/lib/misc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Double quoting to prevent word splitting
- local keyword is undefined in POSIX sh
- `-m 0755` only applies to deepest directory (ignore)
- Useless cat
- Redirect to null, lilke the other mount_rw statements
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the new model, we have three sources of storage:
- /mnt/var: Mountpoint for a disk with the label "var"
- /mnt/cfg: Mountpoint for a disk with the label "cfg"
- /mnt/tmp: Mountpoint for a ramdisk
These sources are used for the following overlays:
- **/cfg, /home, /root**: /mnt/cfg if available, else /mnt/tmp
- **/etc**: /mnt/cfg if available and the boot/etc finit condition is
set, else /mnt/tmp
- **/var**: /mnt/var if available, else /mnt/tmp
- **/var/lib**: /mnt/var if available, else /mnt/cfg if available,
else /mnt/tmp
See board/common/rootfs/lib/infix/mnt for more information.
The nano editor has been shown, over and over again, to be more
user-friendly to complete UNIX/Linux beginners than even Mg.
Also, change the default pager/less to be less (again), it was
very confusing to have less be most and more just be more. We
recommend scripts to use pager and edit/editor to call system
safe defaults.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Regrettably, the latest additions of functionality to Infix have also
incresed the size of the ramdisk. We expect it to go down slightly
before v1.0, but considering we'll add Frr before then it's better to
be realistic of our needs when run in GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The previous fix, setting 'rm: false' to prevent the parallel builds
from replacing each other, caused the latest tag to not be updated.
Very confusing, not just to end-users, but also for devs.
This patch changes the workflow to use a separate release step that
runs in sequence, waiting for the build to finish, before it moves
the latest tag.
The trick to solving this is to use upload/download artifact. It is the
recommended way of sharing files between independent jobs in a workflow.
Notice the lack of 'name:' in both and 'path:' in the latter, it means
"don't care" just upload and then download everything to the artifact/
directory. Making the job of the releaser action quite simple.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- pdmenu for the made-easy management tool for Infix
- neofetch is just for demo purposes, we can add KernelKit logo
- pwgen is for basic help, like netcalc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- fping is better for checking multiple hosts
- OpenBSD netcat has more features and is generally better for multiple
network testing scenarios
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Default to start pager (most), fall back to less/more/cat
- Drop : from sub-headings
- Repeat 'See Also' section
- Relocate network section's Interesting Files to end
- Add dhcpcd.conf to list of interesting files
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops our use of mdnsd and mdev in regular Infix builds, yet
keeping them in the config and repo for smaller builds, e.g. endpoints.
Also, enable dbus to increase level of integration between compoents.
The dbus-test-tool is included for debugging connections.
Since it's about the tenth time I've been missing strace on target, it
too is added in this commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The whole of /var may be read-only, while /run is a newstyle ramdisk.
The /run/lock directory is created by the Finit bootmisc.so plugin at
boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Support modprobe for hotplugged devices
- Allow writable /dev/{null,zero,...} by all users
- Correct TTY and console permissions
- Adapt groups to Buildroot standard (Debian)
https://github.com/slashbeast/mdev-like-a-boss
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Replace ISC dhclient with dhcpcd => IPv4 link-local address
- Enable openresolv to handle /etc/resolv.conf for us
- iproute2 was a dependency of ifupdown2, but now we need to
enable it explicitly
- Ensure we have the same default system interface in infix
- Reenable BusyBox applets disabled when enabling ifupdown2, for
infix derivatives that may prefer a smaller base image.
Note: ifupdown-ng prefers dhcpcd over udhcpc, so no risk for conflict by
reenabling udhcpc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With two parallel builds (amd64, aarch64) we have contention of who last
uploads their artifact, meaning aarch currently removes the amd64 build.
This change should fix that.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds a `factory` tool, and login shell, that schedules a
reset of all writable (overlay) filesystems. The tool is set up with
the suid gid flag to allow all members of the wheel group to perform
the reset.
The login method only allows reset from /dev/console, to prevent any
malicious reset over SSH. This should be further constrained later
when PAM is introduced.
To initiate factory reset from the login prompt, use login/pass:
factory/reset
To initiate factory reset from the shell, call
factory
Both methods are interactive by default, but two command line options
can be used to modify the behavior:
-r Skip reboot, and "reboot now?" question
-y Assume yes to all questions, for non-interactive use
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Needed by, e.g., new swup script, but also everything else we might want
to do with jq in any sane way.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change checks¹ if the system does not have a br0 interface, creates
a default one consisting of all switch ports in VLAN 1 of br0.
On top of br0 a vlan1 management interface is created with DHCP address.
For emulation and test purposes, a way to supply tap interfaces from
Qemu, and pass off as if they were regular switch ports, is added.
____
¹ obviously a better way to detect a factory-reset device is needed,
not all systems running infix will need or want a br0 interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Do not wait for dhclient to acquire first release, this will cause
unnecessary delays when booting, and not provide any real value in our
system. Because we will never have any service that depends on a
network address being set when starting up, this is a feature that
Finit can provide for us as a condition when starting such services.
Also, never set global "README" in multiple policy files, this will
cause ifupdown2 to crash in horrific ways.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default policy for management interface prefix in ifupdown2 is
"eth", which currently clashes with Infix default switch port names.
Changing our naming policy of switch ports to "swpN", mimicing the
naming using in Cumulus Linux, would also help. To be discussed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We will not use features like batman, vxrd, or openvswitch. Also, the
clagd and vxrd addons are not in ifupdown2, so likely proprietary ext.
by Cumulus. Dropping them makes "unknown addon" warnings go away.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Various scripts and tools search for the ip command in different
places. Most distros install it to /bin/ip and symlink to /sbin
and /usr dito, but Buildroot only installs to /sbin/ip
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a workaround for the following code in ifupdown/template.py:37
that throw the exception with python-mako >= 1.2.0:
try:
self.logger.debug('setting template lookuppath to %s'
template_lookuppath)
lc = utils.importName('mako.lookup', 'TemplateLookup')
self.tclassargs['lookup'] = lc(
directories=template_lookuppath.split(':'))
except Exception as e:
self.logger.warning('unable to set template lookup path'
' %s (%s): are you sure \'python3-mako\''
'is installed?'
% (template_lookuppath, str(e)))
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The ifupdown2 package is incompatible with python-mako >= v1.2.0. So as
a workaround we add the old one as a local override.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlike debugfs, cfgfs is currently an optional feature in Infix, so
let's set it to noauto for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Westermo querierd is an IGMP querier daemon for use on top of a
standard Linux VLAN-aware bridge.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Latest Buildroot now has mdio-tools in mainline. This is useful when
debugging devices attaced over MDIO interfaces, eg. switches.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change replaces the BusyBox ifup/ifdown applets with the full-blown
ifupdown2 package. To get it fully working we also need to enable a few
missing kernel features: ipv4 + ipv6, multiple routing tables, and some
netfilter features. We take the opportunity to sync kernel features in
between the two archs as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is the next generation ifupdown from Cumulus Networks (now NVIDIA).
The idea is to use this to set up everything port/lag/vlan/interface
related in the system.
This first import uses the kkit branch from the KernelKit fork, becuase
of, amongst other things, integration problems with upstream packages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The qemu.sh script can fail, due to misconfiguration or other problems,
before it actually starts qemu. Therefore, move the help text to right
before starting the emulator.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop Cortex A72 in favor of more general A53 images
- Enable device trees for all supported EspressoBIN models
- Bump kernel to latest 6.0
- Currently only starts from SD card, so add genimage to post-build
- Create Ext2/4 disk image for SD card
- Add infix-rw partition to sd-card image
- The genimage tool needs genext2fs to create rw.ext4
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Upstream device trees specify regular PSCI support for SparX-5i, but
the U-Boot that Microchip ships does not actually support it.
Therefore, wrap the upstream version to disable PSCI and revert to
spin tables for SMP bringup.
OpenSSH also enable OpenSSL and ZLIB, both of which we'll need later.
This in turn means Net-SNMP no longer needs its built-in OpenSSL stub.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds Finit support for starting chronydy and mstpd, as well as
an update to inadyn supporting env file for custom args.
Also included is a patch to the start script of mstpd for BusyBox pidof,
which don't have the '-c' option.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- chrony will be used as NTP v3/v4 server
- dnsmasq will serve as a DNS forwarder and DHCP server when the
very basic BusyBox DHCP server is insufficient
- mstpd provides RSTP support
- ssdp-responder provides device discovery in Windows
- watchdogd provides basic system supervision and reset cause logging
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Preparing for the upcoming Finit v4.4 which takes system information
from /etc/os-release -- reduces branding efforts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set up bridge first:
root@infix:~# ip link set dev eth0 up
root@infix:~# ip link set dev eth1 up
root@infix:~# ip link set dev eth2 up
root@infix:~# ip link set dev eth3 up
root@infix:~# ip link add name br0 type bridge
root@infix:~# ip link set dev eth0 master br0
root@infix:~# ip link set dev eth1 master br0
root@infix:~# ip link set dev eth2 master br0
root@infix:~# ip link set dev eth3 master br0
Start MRP server and add a configuration:
root@infix:~# mrp_server &
root@infix:~# mrp addmrp bridge br0 ring_nr 1 pport eth0 sport eth1 ring_role mrm
root@infix:~# mrp addmrp bridge br0 ring_nr 2 pport eth2 sport eth3 ring_role mrm
root@infix:~# mrp getmrp
bridge: br0 ring_nr: 1 pport: eth0 sport: eth1 ring_role: MRM ring_state: CHK_RO
bridge: br0 ring_nr: 2 pport: eth2 sport: eth3 ring_role: MRM ring_state: CHK_RC
Once all rings are set up:
root@infix:~# ip link set dev br0 up
For more information, see:
- https://github.com/microchip-ung/mrp
- https://lwn.net/Articles/809089/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Buildroot linux_defconfig doesn't have CONFIG_OVERLAY_FS, which we
need for our shared rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The virtualized system is configured through kconfig under "External
Options"->"QEMU Virtualization".
To launch the system, simply run "make run". This works both from
output directories, and from the infix root with O= set.
Allow networking config to be supplied from multiple fragmens in
/etc/network/interfaces.d. This way, a user can customize their setup
without having to override /etc/network/interfaces.
For some reason, the ATF build system does not deem an mv-ddr-marvell
archive to be valid unless it versioned using GIT. This is obviously
not the case when building from a tarball downloaded from GitHub.
Therefore, remove the check.
Despite the ominous warning above the removed line, the lack of a .git
directory does not seem to have any detrimental effect on the
generated artifact - at least not on a Marvell CN9130 build.
Turns out its real easy to get this wrong, ending up with a "" as your
default fstab. Since this is an advanced option let's mark it as such.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
"description": "Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
"vendor_name": "KernelKit",
"vendor_url": "https://github.com/kernelkit/",
"product_name": "Infix",
"registry_version": 6,
"status": "stable",
"maintainer": "KernelKit",
"maintainer_email": "kernelkit@googlegroups.com",
"usage": "Default console login is 'root', no password. For remote login, default user/pass: admin/admin also works.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
