Previously, when the `proto://path` format of `bootfile` was used, the
transformed argument sent to either tftp or wget would also be stored
in `bootfile` overriding the original value set by the user.
If the first boot attempt failed for some reason, the protocol
information was stripped from `bootfile` and the second attempt would
then default to TFTP, even if the user had originally specified
`http://...`.
Therefore, store the transformed value in a separate variable.
For some reason, setexpr's parsing of regex escapes changes when this
mode is used, so we need double backslashes to fetch match groups
instead of 1. Yikes.
Fixes#724
This puts the responsibility on the user to set the appropriate static
parameters. On the plus side, we avoid requiring redundant information
when the `proto://path` format is used in `bootfile`
This patch fixes a upstream issue troglobit/finit#415, greatly reducing
the amount of service restarts, needlessly affecting, e.g., iitod when
services like syslogd¹ is reloaded.
____
¹) Traditional UNIX services that properly support SIGHUP.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The interface operational data was missing the 'admin-status' parameter,
which indicates whether an interface is administratively enabled or
disabled. To resolve this, the 'admin-status' was added to the yanger
Fixes#700
This refactor, and massive code simplification, is a follow-up to the
double free discovery in 3b4d2b3.
Beacuse a hostname in Linux can never be more than 64 chars, we can
safely use a stack buffer instead of calloc(), reducing complexity
and simplifying the code further with the use of strlcat().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix a double free in the memory minefield surrounding container
hostname provisioning. The hostnamefmt() function already does free()
on success.
This caused all sorts of mayhem when working with multiple containers.
However it mainly manifested itself by some containers not starting
due to there activation script being polluted with gibberish
name data. Your symptom might be different..
Example of polluted activation script:
container --hostname foobar --net veth0k -r always \
create ^S@`M-}^G docker://ghcr.io/kernelkit/curios:edge
Signed-off-by: Richard Alpe <richard@bit42.se>
Add information about test changes
Also remove "Other information" since I think that
should also go under Description and to lower the amount of
text in the template, to increase its use.
[skip ci]
This patch makes it possible to use format specifiers to "uniqiefy" a
container's hostname in the same way as with ietf-system hostname.
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlock setting a custom interface name inside the container. This aids
se-cases where this is needed and provide a better user experience, for
example when upgrading containers. Not having to reboot the host just
to activate an upgrated container.
Fixes#708
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Dummy interfaces are useful for configuring routes and testing network
services without having to allocate physical or virtual interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For products with a static factory-config, or customers generating with
an older syntax, attempt migration in case of bootstrap failure.
Refactor logging to drop '-s'. This prevents duplicate log messages
since bootstrap always runs after syslogd has started and all stdout
is always logged.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch relocates the 30-cfg-migrate init script to confd, where it
belongs, renaming it migrate and installing into /usr/sbin.
The script has been heavily modified to be more user friendly, as well
as useful for automated restore operations, to be able to refresh old
backups to modern .cfg file syntax.
Example (injected phys-address error):
admin@example:~$ migrate -c /etc/factory-config.cfg
/etc/factory-config.cfg: has syntax error, requires migrating.
Since backups are created with the old confd sytanx version in the name,
the backup functionality has been kept in the script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the ietf-interfaces deviation for phys-address,
used to set custom MAC address on interfaces, with a more flexible
approach which can calculate the new MAC address based on the device's
chassi MAC, with or without an added offset.
The regression test has been updated to test all variants.
Resolves: #680
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Declare that confd-test-mode depends on confd, otherwise with 'select',
a call to `make update-defconfig` will remove BR2_PACKAGE_CONFD=y, which
we feel is very confusing -- in particular when comparing any defconfig
that does not have test-mode package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
NETOPEER2 requries the OpenSSL backend of libssh. By default, except on
minimal builds, is to use GCrypt backend. Gcrypt is selected because of
Podman, which is not in the minimal builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In e373398 we restored statd suport for checking for faults in yanger at
runtime. This in turn broke CLI "show interfaces" support on the little
NanoPi R2S because ethtool cannot read counters in JSON format on it.
This patch catches the subprocess exception, allowing this particular
call to ethtool to fail with empty result. The only difference from
before e373398 is that run_json_cmd() will log an error that ethtool
failed, for every interface it is called on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync (make update-defconfig)
- test-mode selects confd
- gencert seclets openssl which in turn selects LIBSSH*_OPENSSL
- rest is relocaations according to Config.in
- Add LIBMNL to x86_64 targets, otherwise iproute2 does not install devlink
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the same uptime representation as FRR does.
Example output:
DESTINATION PREF NEXT-HOP PROTO UPTIME
>* 10.0.23.0/30 0/0 e6 direct 20:10:05
192.168.3.0/24 110/1 e2 ospfv2 5d13h05m
>* 192.168.3.0/24 0/0 e2 direct 01w1d13h
Signed-off-by: Richard Alpe <richard@bit42.se>
FRR prints uptime different based on how long it is. Prior to this
commit yanger expected uptime to be on the format HH:MM:SS which it is
as long as it's shorter than a day. If it's longer the format changes,
this commit handles this.
The commit also adds unit test data triggering the different formats
(<day, <week, >week).
Side note:
cli-pretty could be made to represent the data on "FRR format" again,
which is perhaps more human friendly.
Signed-off-by: Richard Alpe <richard@bit42.se>
Allow bundling dedicated nftables container in Infix images. With this
container, the /etc/nftables.conf can be kept as part of the device's
startup-config (base-64 coded binary format). Highly useful in advanced
setups, either with dedicated interfaces in the container, or when run
in host network mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Dagger did delete of the VLAN after it had configured it.
Resulting in that the new VLAN configuration was lost.
This will first delete all untagged/tagged ports that should be removed,
when they are removed, add the new or changed ports.
The ASCII art over the topology must be surrounded by .... and
is codeblock in ASCIIdoc. Since this is only used for ASCII arts
to help describe tests, border and background are white.
This major overhaul of the Contributing to Infix document is made both
for internal (scaling the core team) reasons and to make it easier for
external contributors to undertand what is expected:
- For bug reporting
- For feature requests
- When submitting a patch
- When adding a complete new subsystem
- Etc.
Resolves: #672
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Co-authored-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of renaming the yang-file instead we keep the yang file
with the actual content linear, easier to review and easier to
follow changes. This only applies on all infix models,deviations
and auguments.
The actual infix-system@2038-01-19.yang is just a symlink to
ietf-system.yang which contains all the code.
This can fail on two ways:
* Generate topology files
Unfortunatly the python-graphwiz has no way of detect faults
it just show 'Warning' on stderr, catch it and if != empty, exit 1
* Generate pdf
Here the default error level was FATAL, but for example a file
that is included does not exist it just show an error on stdout.
the error level is now INFO, it should always be silent.
Fix flaky ietf-routing unit tests.
Prior to this patch, there was a unit-test race between Yanger
(sysrepo emulator) and cli-pretty, where the local system time could
change between crafting the data and printing it. This caused the CLI
output to change and the ietf-routing unit test to fail.
Fixes#668
Signed-off-by: Richard Alpe <richard@bit42.se>
In "14128047e18d statd: remove nl code and improve speed" the handling
of all interfaces where moved from statd to Yanger. This means statd no
longer tracks interfaces using Netlink, but instead relies on Yanger
to recognise and list all interfaces in the system. In the midst of
this change the ignoring of "internal" interfaces where lost.
In this commit we reintroduce this logic in Yanger and add a test case
that ensures internal interfaces isn't listed.
Fixes: 14128047e1 statd: remove nl code and improve speed
Signed-off-by: Richard Alpe <richard@bit42.se>
Yanger now has the ability to loop all interfaces (based on ip link),
this means we can run once for all interfaces.
Signed-off-by: Richard Alpe <richard@bit42.se>
Run ip link and ip addr once and handle the interface selection in
Yanger. This should be faster on systems with many ports and it
simplifies the CLI test files.
Signed-off-by: Richard Alpe <richard@bit42.se>
Infix now supports static /etc/factory-config.cfg from a rootfs overlay
or /usr/share/product/<VPD.PRODUCT>/etc/factory-config.cfg in addition
to the autogenerated /run/confd/*-config.gen files.
Update the Branding & Releases document with a bit more information on
this rather complex topic.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a device is in developer mode, drop the user directly into the
shell instead of having to go via the bootmenu, since this is usually
what you want in that case. Emit a note about how to access the menu,
for the rare cases when that is needed.
Previously, the assumption was that the artifact could be found in the
first run of "Bob the Builder". This does not hold in the case when:
1. An initial run is aborted, and is re-run at a later date
2. When a release is built (by "Release General")
The test ensures that all interface types can be successfully created
and retrieved from the operational datastore. It also functions as a
regression test for issue #618 and will apply to all future interface
variants.
Fixes#622
Refactor 0f9d429 to first check if the .cfg file has any routing
protocol active before converting the type's value.
This fixes a regression in the release cycle that otherwise would
cause a fresh startup-config, created from a plain factory-config
from v24.08, to be converted to an empty file.
Inspired by this fix, the same mitigation, albeit highyl unlikely,
has been applied to the v1.0 user shell type migration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verify a VETH pair can be removed after a couple of dummy operations to
step the dagger generation past the initial where the pair is created.
NOTE: Infamy currenly lacks support for removing chunks of configuraion
e.g., a dut.del_config_dict(), or similar, and delete_xpath() is
not valid for configurations with dependencies like VETH pairs.
Issue #658
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding interfaces over NETCONF/RESTCONF, confd has a check to
ensure the peer end is skipped, since creating one end also create
the other.
This patch adds the corresponding skip when deleting a VETH pair.
Fixes#658
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch mainly updates the static routing chapter, and adds a new
section on route preferences, but it also makes slight touch-ups at
a few other places as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that all routes acquired from DHCP (and ZeroConf) are installed in
the kernel FIB via Frr (staticd -> zebra -> kernel), instead of directly
to the kernel FIB, let's extend this test slightly.
Add a canary static route that is installed before the DHCP client is
even started. This canary route should be installed along with the
DHCP (classless) route(s) when the interface comes up and acquires a
DHCP lease.
We take this opportunity to also verify that the route-preference is
properly carried over from test to operational RIB status.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable OSPF route metrics in RIB, only defined for OSPF
- Enable 'active' route flag for RIB, same as 'selected >' in FRR
- Enable 'last-updated' route field for RIB, used for uptime
- Augment route in RIB with 'installed' flag, same as 'FIB *' in FRR
The CLI "show ip route" command has been updated accordingly. The
classic Cisco style output has been kept instead of separating the
routes into Active and Backup, as discussed previously. Because
when inspecting large route sets you want to compare same prefix
vs distance/metric to understand why a certain route is selected.
admin@example:/> show ip route
PREFIX PREF NEXT-HOP PROTOCOL UPTIME
> 0.0.0.0/0 1/0 192.168.0.42 static 0h2m6s
* 192.168.122.1
0.0.0.0/0 5/0 192.168.122.1 static 0h2m6s
0.0.0.0/0 254/0 e1 static 0h2m6s
>* 169.254.0.0/16 0/0 e1 direct 0h2m6s
>* 192.168.0.0/24 1/0 192.168.122.1 static 0h2m6s
>* 192.168.122.0/24 0/0 e1 direct 0h2m12s
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the other IETF routing models, e.g., OSPF, let's
use the same model prefix for internal references.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not the most obvious patch, but let me explain -- there will always be a
conflict betweem usability and "maintainability". The ietf-interfaces
yang model already declares /interfaces-state as deprecated, so we don't
really need to add a deviation 'not-supported', for usability, however,
it may be useful since the deviation helps cut out that tree completely.
While working with ietf-routing and our companion models, I found that
since it relies on ietf-interfaces, it also breaks the reload/reimport
of infix-routing while developing extensions/changes:
$ lint.sh -f tree ieee802-* iana-if-type@2023-01-26.yang \
ietf-interfaces@2018-02-20.yang \
infix-interfaces@2024-01-15.yang \
ietf-routing@2018-03-13.yang \
ietf-ipv4-unicast-routing@2018-03-13.yang \
ietf-ospf@2022-10-19.yang \
infix-routing@2024-09-22.yang
libyang err : Not found node "interfaces-state" in path. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
libyang err : Target of leafref "interface" cannot be referenced because it is disabled. (Schema location "/ietf-routing:routing-state/interfaces/interface".)
YANGLINT[E]: Parsing schema module "ietf-routing@2018-03-13.yang" failed.
The only way to change/update models for a given build is to either, a)
surgically remove offending models from output/target/, then reinstall
all dependencies and hope it works better, or b) rebuild from distclean.
In most cases you end up with alternative b).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Latest YANG model change reverts back to using the IETF routing-protocol
type. Update tests to check for infix-routing:ospf -> ietf-ospf:ospfv2.
Also, refactor and extend infamy/route.py:_exist_route() slightly for
readability and PEP-8, as well as to use an optional model prefix also
for next-hop-list addresses.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Straighten out formatting issues in ospfd.conf (debug)
- Simplify and reduce code duplication
- Avoid 'restart zebra' errors in runlevel S
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch changes the way Infix DHCP and ZerocConf clients set their
routes in the system. Instead of setting them directly in the kernel
we ask FRR staticd to set them for us.
The reason for this change is to be able to override routes from these
protocols with locally set static routes. The routes are now set with
a distance of 5 and 254, respectively, while static routes by default
have a distance of 1. In contrast, kernel routes are always treated
by Frr as distance 0, i.e., they are preferred over static routes.
Finally, this patch drops the use of Linux legacy interface aliases, or
colon interfaces, in an effort to reduce confusion for end users. This
may give some odd results if using older tools like ifconfig, so we
recommend using 'show interfaces' or 'ipb a' instead.
Fixes#640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the redesign of the operational rib routes, using vtysh 'show ip route'
instead of the kernel 'ip route' as source, we no longer need the infix source
protocol.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The intention is to provide a similar set of commands as klish
admin-exec. However, instead of trying to make the Linux tools
more accessible, we now make the Infix tooling more accessible.
E.g., instead of "show ip route" mapping to "ip route show", we
map it to:
sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
/usr/libexec/statd/cli-pretty "show-routing-table"
As a spin-off we alos get a much more readable infix.xml for klish:
- Relocate logic to shell script wrapper 'show'
- Introduce Cisco style "show ip route" and "show ipv6 route"
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apply a distance adjustment to routes retrieved from IPv4LL/ZeroConf and
DHCP to ensure that Frr (Zebra) can compare other protocol routes, e.g.,
static. Without this Frr will consider all routes read from the kernel
to have a protocol distance of 0, meaning better than static routes that
have a distance of 1.
Initial proposal to fix issue #640
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since /etc is not retained across reboots, the sysrepo startup datastore
is not used to bootstrap the Infix. Instead, /cfg/startup-config.cfg is
used and loaded directly to the running datastore.
For some use-cases when operating directly on sysrepo this causes a lot
of confusion because startup == factory ds until any user calls the CLI
command `copy running-config startup-confg`.
This patch fixes this initial "glitch" by loading the starup datastore
at boot on successful loading of startup-config to unning.
To prevent any unintentional "auto-save" of, e.g., failure-config to
startup-config, we make confd aware of this "sync" operation during
bootstap.
Fixes#625
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove duplicate logs due to logger logging also to stderr
- Fix coding style in new test-override-startup code path
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In d616623a an attempt to silence bogus return values from mctl, when
multicast snooping is disabled on a bridge. That helped get data back
for operational to produce `show interfaces` *with* a bridge and ports
but still emitted bogus log warnings.
This patch addresses that by checking 'check' on JSONDcodeError as well
before emitting any log error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add check for specific 169.254/16 adddress (new feature)
- Add check for disabling autoconf on interface (regression test #638)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows a user to specify a specific 169.254/16 address that
the zeroconf client starts with when probing for a free address. If the
probe fails it falls back to its default algorithm.
Fixes#628
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- We know we always have iproute2 tools
- We only use one ipv4ll client per interface, so UNBIND can be
simplified to flush ifname:avahi
- Log all events handled by script for troubleshooting
Note: on BIND event we may be called without first getting UNBIND on
previous address, hence the flush there too.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is basically a functionally revert of:
435c5ca9 statd: allow ethtool --json to fail without breaking operational ds
Having a fail flag that hides all yanger faults is too big of a
hammer. If some hardware doesn't support a particular command such as
"ethtool --json" it should be handled gracefully by yanger. Perhaps by
catching the error and returning an empty dataset for that node.
Signed-off-by: Richard Alpe <richard@bit42.se>
A non functional change. The caller knows more about how to format the
args, so it makes more sense to build the Yanger cmdline from the
caller.
Signed-off-by: Richard Alpe <richard@bit42.se>
This is a major redesign of statd interface handling. The goal here is
to reduce the time it takes for statd to produce operational data for
all interfaces on larger iron. Which manifested itself most notably in
the CLI command "show interfaces".
This patch removes the netlink interface subscriptions done by the
statd c code. Instead statd now subscribes to the ietf-interfaces
base path which means it will be invoked for all interfaces.
If the user (sysrepo) has specified an explicit interface name such as
eth0, it will be extracted by statd and passed down to Yanger.
This patch also modifies Yanger to fit this new modus. No explicitly
passed interface name now means all interfaces.
Side note:
The main culprit of the slow operational interface data is the time it
takes to bootstrap python. Which prior to this patch was done for each
interface. On the HW system I'm testing this patch on, runtime is
reduced by a factor of 10.
Signed-off-by: Richard Alpe <richard@bit42.se>
- The test mode, introduced at the config/build phase (commit 241f3f2),
causes the device to start in test-mode when used in GNS3 (or other
environments). This has unintentionally become the default
configuration for the image, which is not desirable and is only
acceptable for the Infix test system. With this update, the original
configuration is preserved, and the test mode is applied only within
the test environment.
- Align the 'dual' topology to use the same template as 'quad'
Fixes#603
when migrate configs the yang data produced was this:
"infix-meta:meta": {
version: "1.0"
"infix-meta:version": "1.1"
},
duplicate node, resulting in failed migration of startup configuration, always replace
whole node.
Today Infix only support OSPFv2 and Static routes, this hides all other
protocols in the CLI and makes it clearar about what we support in the YANG
model.
In 0edc2d5 and afbe5ca, just prior to v24.06.0-rc1, support for deleting
containers in the background was added. However, this also broke support
for upgrading containers.
In afbe5ca the start script for containers was renamed from NAME.sh to
S01-NAME.sh, but the container wrapper script's upgrade command was not
updated. Neither was the cleanup and post-hook callbacks in confd! So
when a container had been added to the system, the cleanup callback just
simply deleted the script, preventing it from being recreated at ugprade
This patch fixes the container identification code and also refactors
the execd code to ensure that kill scripts (for deleting in background)
and start scripts are run in the proper order *and* ensuring that execd
also does not accidentally remove the container start script.
Some cosmetic changes to the output at upgrade have also been added.
Fixes#623
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With a basic bridge setup, which has multicast snooping disabled by
default, `show interfaces` cause the following bogus log messages:
Sep 13 07:08:35 yanger: Command '['mctl', 'show', 'igmp', 'json']' returned non-zero exit status 1
Sep 13 07:08:35 yanger: Command '['mctl', 'show', 'igmp', 'json']' returned non-zero exit status 1
Sep 13 07:08:35 yanger: Command '['mctl', '-p', 'show', 'igmp', 'json']' returned non-zero exit status 1
Add a quiet flag to the run methods and set quiet=True for all mctl
commands to silence these log messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before we add proper operational support for DNS and NTP, we can at
least improve on the built-in CLI commands.
Issue #510
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only administrators are allowed to work with containers, allow them to
perform tab completion of all admin-exec commands as well.
Fixes#613
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When multicast snooping is disabled on a bridge, mctl will exit with a
non-zero return code. Default to {} for these cases so that the bridge
and its ports are properly returned by yanger.
Fixes#618
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There's a case where the first query is lost due to the network just
starting up. To handle this we introduce a retry loop in the test case
that waits for a second query message to be sent.
In this commit we also lower the query interval to speed up the case
when the first message is lost. Ideally mcd (the underlying multicast
daemon) should implement a Startup Query Interval to send it even
faster.
Signed-off-by: Richard Alpe <richard@bit42.se>
To prevent the kernel from setting a random mac address on new bridges,
before we have added any bridge ports, we create bridges using the:
1. Custom mac address from the configuration (phys-address)
2. System base mac from /run/system.json
3. None, if there is no base mac address in system.json, e.g. r2s
Fixes#357
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit, querier multicast changes such as query-interval
where not applied to an existing multicast interface. The new initctl
touch makes finit send a sighup to mcd which causes it to re-load its
configuration files.
Signed-off-by: Richard Alpe <richard@bit42.se>
The test specifcation is written in Asciidoc and is autogenerated from the content
in the test scripts.
Fonts imported from https://github.com/adobe-fonts/source-code-pro/
To generate the test script:
$ make test-spec
Now that we have a unified timeout value that all front-ends should
honor, make sure to do so when loading startup-config and
failure-config during boot.
This fixes an issue where the system would fallback to failure-config
even though a legitimate startup-config was available, but took more
than 10s to apply.
While sysrepo's architecture places the responsibility of choosing a
timeout on each front-end, we want to control it centrally since the
majority of the time is spend actually applying the config to the
system - which is front-end agnostic.
Therefore, create a single definition of the timeout, which can be
included by all front-ends.
With the recent changes in Infix v24.08 to tighten up permissions, a
regression in the 'show ospf' family of commands was introduced.
This patch adds a 'doas' prefix to all vtysh commands. The 'doas' tool
wraps sudo in a way such than unauthorized users do not get a sudo error
thrown as result.
A better fix might be to either include all admin group users also in
the UNIX group 'frrvty', or even better, change the default group of
vtysh to 'wheel'. Affected files are /etc/frr/vtysh.conf and all
/run/frr/*.vty sockets, the latter are created at runtime by zebra,
ospfd, etc. This require modifying the buildroot/package/frr/frr.mk
file, which unfortunately have the group hard coded.
admin@R2:~$ ls -l /etc/frr/vtysh.conf
-rw-r----- 1 frr frrvty 32 Sep 3 05:27 /etc/frr/vtysh.conf
admin@R2:~$ ls -l /run/frr/*.vty
srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/ospfd.vty
srwxrwx--- 1 frr frrvty 0 Sep 5 04:37 /run/frr/zebra.vty
Fixes#601
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Passing $@ to sudo requires quoting to prevent splitting arguments like
this:
admin@R2:~$ doas vtysh -c 'show ip ospf routes'
% Command incomplete: show
After this patch:
admin@R2:~$ doas vtysh -c 'show ip ospf route'
============ OSPF network routing table ============
N 192.168.50.0/24 [1] area: 0.0.0.0
directly attached to e7
============ OSPF router routing table =============
R 192.168.100.1 [1] area: 0.0.0.0, ASBR
via 192.168.50.1, e7
============ OSPF external routing table ===========
N E2 192.168.10.0/24 [1/20] tag: 0
via 192.168.50.1, e7
N E2 192.168.100.1/32 [1/20] tag: 0
via 192.168.50.1, e7
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Always build the minimal flavor for branches != main, otherwise use the
default defconfigs so latest build has the correct image.
Issue #597
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
RESTCONF, or NETCONF, may not always be available. Break out and
refactor transport detection/reachability.
NOTE: The shared code paths between wait.py and util.py:wait_boot()
have been refactored as well to reduce code duplication.
Issue #597
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the addition of minimal defconfigs without RESTCONF support, detect
transport when 'make test' and 'make test-sh' are called.
We set the new variable INFAMY_TRANSPORT so Infamy can detect protocol
also when in interactive test mode ('make test-sh').
Issue #597
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The name 'minimal' was chosen after a long AFK discussion where names
like 'generic', 'reference', 'testing', 'mod', and others were tossed
around and quickly discarded.
The minimal name can also be extended upon in customer trees, e.g., a
aarch64_minimal_styx_defconfig would indicate something built on the
upstream minimal Aarch64 build of Infix, but with Styx additions.
Issue #597
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_get_str() function may return NULL, which goes unchecked in
both fxlate() and sxlate(), as well as the calls to free().
Found by Coverity Scan
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of copy factoy config to reset between tests,
use the new test-config.cfg.
Change the logic in the factory config since the default values have changed.
This intoduce a new sysrepo plugin to handle a new YANG
model 'infix-test'. Today only contains the actions.
This is required to run tests on infix using infamy.
This is a part of #561
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details. This caused all audit log messages to be logged in LOG_USER.
Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.
Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs. Only
needed when logging to stdout.
Follow-up to issue #521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
LOG_DAEMON is a facility not an option. Replace with NDELAY option and
set facility properly in call to openlog() instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes the following recurring login warning in syslog. (We cannot use
pam_lastlog.so since it does not rotate its /var/log/lastlog file.)
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so): /lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The backported patches to sysklogd now support the RFC facilities
natively, so we can focus on local facilities (and 'all').
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Minor adjustments have been made to enable calling infix tests from an
external project (i.e. 'make test' target).
This essentially allows running any external test (or a group of tests)
using the infix-9pm tool.
Add a must expression to limit invalid configurations.
Not belonging to VLAN when added to a multicast-filter in
that VLAN. Make sure multicast snooping is enabled when
using multicast filters.
This fixes#587
Signed-off-by: Mattias Walström <lazzer@gmail.com>
A fairly quick step that runs for all build targets, likely saving us a
lot of time for release weeks.
Fixes#574
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_get_changes() API, introduced in 18b5922, does not provide the
user with a delete yang:operation when the entire YANG tree is deleted.
Refactor syslog actions to use the srx_get_diff() API instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix has the catch-all /var/log/debug, and now also /var/log/routing
for debug messages from Frr.
The log file /var/log/syslog now catches *all* messages except auth*,
which may contain secrets, except debug messages. Contrast this with
/var/log/messages which only logs info/notice/warn -- i.e., no error
and above log messages.
Due to the way syslogd parses /etc/syslog.conf et al, we override the
default in Infix to disable the default /var/log/syslog, otherwise we
would get duplicates to the same log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When sysrepo-plugind is processing callback events, make sure to log the
error and exit(1) the entire process so the system can handle the problem.
For example, restart all dependent services.
Fixes#585
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As of KernelKit Klish @ 710a631 the script plugin has been refactored to
run all commands as the logged in user instead of as root. The default
admin user is member of the wheel group, which allows access to sysrepo
and sudo access to containers thanks to NOPASSWD rights.
The doas script is a dummy wrapper to silence 'sudo -n' output for users
without any privileges.
As of this commit, unprivileged users can no longer copy, show, or in
any other way manipulate the system configuraiton.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a refactor to ensure sysrepo functionality guarded by NACM works
as intended in Infix.
Relocate infix_rpc() to klish-plugin-sysrepo, ensuring unauthenticated
users are denied access.
Drop infix_commit() in favor of slightly modified srp_commit(), this to
ensure sysrepo audit trail logs are visible at all times.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces a new SECURITY() log macro that logs to facility
'audit' (sometimes called 'security') with severity set to 'alert'. It
is then used to instrument the single most important things to log; all
changes to users and their privileges.
We also add logging to sysrepo, which knows the username for changes to
running-config, copies to startup-config, and RPCs.
Fixes#521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- For consistency and clarity, rename format -> log-format
- Add must expression to ban 'bsd' format from file logging
Note: technically, sysklogd silently reverts back to rfc3164 for file
logging, but it's better to be clear with the user with what is
possible to configure and is going to be used.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As a bare minimum, all augments and deviations made to standard models
should have a description denoting *why* they exist.
In the case of ietf-syslog the base model is still a draft and carries
some odd defaults we want to disable, or replace with better ones. The
augments are global log rotation and and log format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor changes the callback subscription for log-file and remote
log actions to ensure they are called for *all* changes. Even changes
to deeply nested sub-trees like file-rotation when no other changes are
made. The previous attempt failed to address that.
The refactored callbacks replace sr_get_changes() with srx_get_changes()
for better control over what they iterate over. The callbacks always
regenerate the syslogd *.conf file snippets for each log action, so
there is no need for the overly granular sr_get_changes(), ever.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Reduces the overhead/repetition for module callbacks by combining the
forces of srx_get_diff() and lydx_get_descendant() into one API. The
resulting function supports both XPath and simplified paths to get the
subtree of changes applicable to the callback.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This augments ietf-syslog.yang with global file rotation settings which
are used when per-file rotation is not configured. The defaults chosen
match previously decided defaults for Infix: 1M:10, i.e., rotate every
file at 1 MiB and keep up to 10 gzipped aged-out archives.
The standard model includes a default value of 1 for the number of files
kept, which is removed (deviated). There is also a unit specified for
max-file-size, 'megabytes', replaced with 'kilobytes' in this change.
On smaller embedded systems, smaller sizes may be required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of sysklogd v2.6.0 support for log rotation settings
in the .conf file. Previously only supported on the command line.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a the type of a leaf node (of a list) is buried inside a union we
need to fish out the module prefix if one of the types in the union is
an identityref. It's all very simple really.
Also, when tab completing for possible identities, always make sure to
strip any leading module prefix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes mirror the changes made to the CLI in an attempt to create
a better user experience for working with log files even from the shell.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To support testing, the test-config.cfg file has been introduced in Infix.
Additionally, a "test mode" for the running image is required for this
configuration to be applied.
Basically the test-config will only be loaded when the device is in test mode,
which is determined by the presence of the /mnt/aux/test-mode file.
However, placing this file via the Qeneth system proved to be
inconvenient in the test environment. Therefore, it the entire image is
built in test mode, with the 'test-mode' file preloaded onto the disk
image (specifically in the auxiliary partition).
To support this, a new variable, (bool) DISK_IMAGE_TEST_MODE, has been
introduced:
enabled: the image will be built in the test mode;
disabled: the image will be built in the standard mode.
Part of issue #568
Currently, it's not possible to run infix tests from an external
project (based on infix) due to an incompatibility between the
configuration used in the tests (the default configuration
within the image generated by the external project) and the infix
base configuration expected by the test cases. Therefore, a simple
configuration specifically for testing purposes needs to be generated
within an image. This test-config should always be generated
but only loaded when the device is in test mode.
Part of issue #568
If a container has not yet stopped/started we may for proto RESTCONF get
"invalid URI" result back for some container actions. With this change
we allow the action to be retried up to three times before passing on
the error.
In tests on Qemu (x86_64) this happens very rarely and need at most one
retry before succeeding. Verified by iterating the same basic test over
night (9000+ iterations).
Fixes#558
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When unit tests run in CI we may not have a syslog daemon available, in
such cases we set up a dummy handler.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are intended to make yanger a bit more robust. Instead of
bailing out on command errors, we now return empty string or object back
to the callee in run_cmd() and run_json_cmd().
One example where yanger previously exited hard, and dragged with it the
entire session, is when inspecting container status or when attempting
to restart container instances which have yet to be created/stopped.
Fixes#558
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order for the probe logic to source product data from a VPD, it
must be marked as such. Otherwise we end up in a scenario where the
data is collected, but not hoisted up to the system level, leaving the
system without a defined base-MAC for instance.
Previous xpath may or may not been an xpath, we still called it xpath.
Remove the obscure function get_xpath() and instead transform to a
URI in restconf.py
This fix issue #490
Signed-off-by: Mattias Walström <lazzer@gmail.com>
When the interface is up and has a 'proto dhcp' address the WAN LED is
lit up. When the interface goes down, or loses its DHCP lease, the LED
is turned off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow reset button on the R2S to be used for factory reset at power-on.
See board README for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport pam-lastlog build fix from latest Buildroot master and enable
in all defconfigs to fix syslog warning:
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so)
Fixes#542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch greatly improves the security of the Infix factory reset by
replacing 'rm' with 'shred'. The shred tool overwrites the contents of
files three times. With the -z and -u options the last pass writes
zeroes and then uninks the files.
On the NanoPi R2S the factory-reset now takes 24 seconds:
Aug 11 16:00:34 infix mnt[121]: Resetting to factory defaults.
Aug 11 16:00:58 infix mnt[173]: Factory reset complete.
A visual aid is also added, setting *all* LEDs to on, that can be found
mounted on the device, before starting the file shredders. The LEDs are
reset back to off and SYS red blinking as soon as the wipe has completed
and iitod has been started.
Fixes#158
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This serves as an example of how a board specific builds in Infix can
carry a static factory-config. This will be extended upon as we add
support for DHCP server, WiFi access point, and firewall support.
For now the following features are added:
- Default hostname: r2s instead of infix-00-00-00
- LAN port always at 192.168.2.1/24, IPv6 SLAAC enabled
- WAN port has DHCP enabled for IPv4, IPv6 SLAAC disabled
- NTP client enabled, default server pool.ntp.org
- DHCP client is set up to request and allow ntp server
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the most important bridge and usb fixes have been ported in this
commit, and a new patch for the r8153 link/traffic LEDs, ported from
the FriendlyELEC/Rockchip kernel tree.
Fixes#274
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The R2S has a minimal set of system LEDs, all of which are single color.
This commit tries to distill and map the essence of the Infix functions
to available LEDs.
The SYS LED is turned on (fainy red) at power-on, when U-Boot has loaded
the kernel it turns the SYS LED bright red on. The idea is then to turn
the red SYS LED off as soon as the system has successfully loaded system
startup-config, and then turn the green LAN LED on. Indicating that the
both the device is operational and that the user can connect to the LAN
port.
The WAN LED is given a "wan-up" input condition, with the intention of
turning it on (green) when the device has acquired a DHCP address.
The failure modes, which in many ways is the essence of Infix signaling,
are fail-safe and panic, triggered by loading failure-config, or failing
to loadd failure-config, respectively. In fail-safe mode the SYS LED is
blinking red at 5 Hz and in panic mode *all* LEDs blink at 5 Hz.
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With new features & fixes, Infix grows. With the latest support for
rauc upgrades introduced with the VisionFive2, and now also for R2S,
we need to reserve room for future upgrades even when running from
an SD card.
This is a quick fix for genimge generated SD card imaages before we
get a proper installer in place that can be used both on the target
and host systems to partition and provision an eMMC, NVME, SSD, or
an SD card.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows modifying and saving the U-Boot environment to the
aux partition on the NanoPi R2S. Required to able to safely maintain
multiple R2S devices on the same LAN.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
U-Boot (2024.07) does not yet support the 'metadata_csum' feature flag
to Ext4 file systems. So let's disable it for now in mkaux.sh so we
can allow builds for, e.g., the R2S and VisionFive2 boards to modify
and save their U-Boot environment.
Needed on the NanoPi R2S to set ethaddr + eth1addr since it does not
have any VPD EEPROM mounted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.10.3
- Initial defconfig sync with aarch64
- Enable kprobes, ksyms, and function tracer
- Enable missing file systems for parity with Infix
- Enable bridging, netfilter, and other Infix requirements
- Initial virtion support for running in Qemu (untested)
- Enable device mapper, required for rauc bundle install
- Make dummy and tunnel drivers modules to be able to drop dummy0
and tunl0 interfaces that otherwise mess up "show interfaces"
- Disable suspend and hibernation, not supported in Infix
- Disable unused GPIO, PHY, MDIO, and USB drivers
- Disable RK3328 watchdog driver, cannot perform reset on R2S,
enablle softdog instead as a seamless replacement for Infix.
Even though not optimal (since it's software) reboot works
- Disable ethtool netlink support, does not work and breaks
interface configuration completely on R2S!
- Enable netdev LED triggers, for LAN and WAN LEDs
- Bump u-boot to 2024.07
- Hard code developer mode to allow shell access
- Disable factory reset button support (not yet supported)
- Bump ATF to v2.9
- Enable squashfs for rootfs image
- Enable signing of images
- Add secondary partition
- Add dedicated var partition
- Add aux partition for signatures and uboot env
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For systems with multiple paths to the network, different situations
may call for different paths to be used. Therefore, allow the user to
override the active interface via the environment on the auxiliary
partition.
The default (defined the bootloader's device tree) is still used in
cases when nothing else is specified in the environment.
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
~/src/infix/x-riscv(riscv)$ make
Makefile:574: *** nghttp2-asio is in the dependency chain of rousette that has added it to its _DEPENDENCIES variable without selecting it or depending on it from Config.in. Stop.
Fixes#536
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync defconfig with aarch64
- Sync linux_defconfig with aarch64
- ethtool w/ netlink not supported yet for the StarFice dwmac
- note, waaay too many unused drivers still
- Add aux/cfg/var partitions to sdcard, no rauc support yet
- Add factory-password-hash to device tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Switch to logger, with syslog backend, instead of print() for logging
errors. This way we can log errors/warnings yet still return partial
JSON data back to statd. For example, failing to read JSON counters
from ethtool should not break "show interfaces", just return empty
array and log failure to run command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Missing whitespace in assignments, before comments and methods
- Drop semicolons from end of statements
- Use 'if foo not in bar' instead of 'if not foo in bar'
- Some too long lines (not all, that would be painful)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On boards like the R2S and the VisionFive2 `ethtool --json -S ethX` is
not yet supported. This patch allows ethtool to fail, with a slightly
better log message, without breaking the operational datastore.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inference for an interface named vlanN can only guess C-VLAN and VID,
the base interface must be left to the user to fill in. This is also
mandatory in the model.
Fixes#531
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We cannot rely on time being correct. Password expiration need to be handled
by external mechanism, e.g., RADIUS.
Fixes#534
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Removing a user's password hash should be the same an empty password
hash. In the latter case we already allow login with SSH keys, this
change harmonizes the behavior by also allowing login with SSH keys
when the users's password hash is removed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Just like other packages we should version our Linux patches as well,
even though it may be painful and cause some extra overhead, in the
end it allows multi-kernel setups and compatibility with customer's
using Infix as a BR2_EXTERNAL.
Fixes#489
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When syncing interface defaults at boot, some settings are read-only and
some are write-only. Filter these out so sysctl does not log any bogus
Permission Denied messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
cp: cannot stat '/home/lazzer/Documents/addiva/infix/board/common/rootfs/bin/onieprom': No such file or directory
Signed-off-by: Mattias Walström <lazzer@gmail.com>
From https://en.wikipedia.org/wiki/exFAT:
... a file system optimized for flash memory such as USB flash
drives and SD cards.
... has been adopted by the SD Association as the default file
system for SDXC and SDUC cards larger than 32 GB.
The exfatprogs is also a default installed package on most modern
distros, compared to dosfstools (mkfs.vfat) which is not.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For netopeer2 we need to patch away local-users, since if it is enabled
netopeer2 requires all users that should be allowed to use netconf to
also be configured in ietf-netconf-server.
Also add some upstream patches.
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Abstract functions and common functions are located in transport.py
Some quirks has been required due to how rousette works,
these functions has been added to the abstract class
Can be removed when rousette behaves as expected.
This is the only way to delete with restconf so it it must also be
implemented in netconf. This replace the put_diff_dict function.
Also: how the xpath looks is different in restconf/netconf therefore
each protocl has a get_xpath() function as well.
Replaces:
Error: Illegal command
with:
Error: Command not found, or incomplete. Try ? for help or Tab for completion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of potentially blocking sysrepo, which has a 5 second timeout,
we move 'container delete' jobs to be run by the execd queue.
Fixes#479
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes sure execd calls KNN style scripts before SNN,
allowing confd to post teardown jobs that are guaranteed to run
before any jobs to create new resources run.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
ietf-system.c: In function ‘change_hostname’:
ietf-system.c:1722:9: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
1722 | system("initctl -nbq touch netbrowse");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ubuntu 22.04 (ubuntu-latest runner on GitHub) has a slightly earlier
version of libxcrypt. The only hard requirement we have is yescrypt
support, so we can relax the configure check slightly to be able to
run coverity scan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We recently dropped Augas from confd and this branch adds support for
$0$cleartext passwords, which require libxcrypt.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All typedefs and identities should be declared in the module that uses
them unless other modules need them. This change also makes it easier
to work with tools like yanglint and pyang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch silences the previously very verbose setup.sh script, and
crucially also fixes a bug in UPDATE_MODULE(). Missing closing '
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with UNKNOWN base mac address, and making it easier for
the user to actually notice the fault condition.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With this patch, users not in the NACM admin group and a login shell set
to clish can now log in to the CLI. Prior to this change only members
of the UNIX group 'wheel' could open the klishd socket.
The patch adds another group, 'sys-cli', which acts as a capability for
users. An admin user (member of the admin group) will now be member of
both the UNIX 'wheel' and 'sys-cli' groups. A non-admin user that has
shell set to 'clish' will only be member of the 'sys-cli' group. Other
users will not be mapped to any UNIX group and have only permissions set
in NACM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch simplifies the handling of factory default password for the
admin user by overloading the ietf-system password type. The new type,
$factory$, acts a system hint to use any device specific (or built-in
software/device-tree) default password hash.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugins-sysrepo to fix the annoying issue with
the CLI not supporting, e.g. "show hostname" in system config context.
Details: https://github.com/kernelkit/klish-plugin-sysrepo/issues/3
The problem was two-fold, first we used the wrong ptype for 'show'
(and 'diff') commands, so srp_show() was not even called. Then the
klish-plugin-sysrepo code did not account for show being called for
leaf nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix indentations:
- Corrected indentations in confd.mk to adhere to Buildroot coding
standards
- Relocate YANG Modules List Files:
- Moved the YANG modules list files (.inc) from package/confd to
src/confd
- Add Missing YANG Module:
- Included infix-interfaces@2024-01-15.yang in
yang_modules_confd.inc
- This module was missing in the non-containerized build and is now
correctly added
Unintended leak of Proxy-Authorization header in requests #1
Requests `Session` object does not verify requests after making first request with verify=False #2
- Moved setup.sh and yang_modules files from infix/src/confd/scripts/ to infix/utils/ to streamline the repository structure
- Updated confd.mk to correctly reference the new location of the setup script
- Introduced yang_modules_<type>.inc file to list all YANG modules for improved clarity and maintainability
- Modified the new setup script to dynamically source module lists from yang_modules_<type>.inc
Since a user has access to the shell in developer mode, we might as
well allow booting through the standard boot scripts as well. This
means that a product with a bootloader only accepting images signed by
Company A can now be configured to netboot a regular developer image
without any special user interaction.
We no longer need to set bootdelay on development platforms. You can
now always get to the bootmenu with a Ctrl-C, from there you can get
to the shell if developer mode is enabled. Therefore, override the
default dev-mode detection to statically enable it on the CRB.
If we receive an option 67 (bootfile) matching http://IP/rootfs.itb,
use U-Boot's wget implementation to download the file. The web server
must listen on port 80. tftp:// is also supported.
Without a protocol prefix, assume that the bootfile should be fetched
using TFTP from ${serverip}.
Generate a boot menu, accessible with C-c during a short window, where
a user can interactively select a custom boot source and/or trigger a
factory reset of the device.
With this in place, we should always be able to unbrick a device, as
the image can be fed over the network, and local data can be ignored
by opting in to a factory reset.
Before this change, this invocation...
make O=x-x64 x86_64_defconfig
...would use the output directory...
/path/to/infix/buildroot/x-x64
...which is not the expected behavior. This would happen because
Buildroot will, naturally, expand relative paths based on _its_ top
directory.
Therefore, translate any relative paths to absolute ones based on
_Infix's_ top directory, before handing control over to Buildroot,
such that the expected...
/path/to/infix/x-x64
...output directory is used.
This tries to improve on the existing sniffer in a couple of ways:
- In addition to being usable as a context manager, also allow
explicitly starting and stopping the capture.
- Try to synchronize the start of the capture by snooping stderr and
wait for tcpdump to start up. This should eliminate the need for
sleeps before starting to send packets.
- By default, execute a safety sleep when terminating the capture to
ensure that any straggling packets have had time to arrive at their
destination.
By default, ping(1) will use a random ID in the ICMP packet. Allow
setting it to a fixed value instead.
This makes it easy to identify that particular packet in a packet
capture later on.
Let the ring-bearer^Wuser decide the policy around how VLAN PCP is
mapped to skb->priority on ingress, and back to PCP again on egress.
Either a fixed value is used for all packets, or a 1:1 mapping is done
between the two domains. By default, we follow Linux's defaults of a
fixed 0 value on both ingress and egress.
The interface in question might not exist at init:49 if some other
change requires it to be recreated from scratch, in which case it will
be removed in exit:50. Therefore, run the flush at exit:49, where it
should always still exist.
When timestamping of scripts was added, we unfortunately started to
record the exitstatus of `ts(1)`, rather than the script itself.
Refactor the metadata collection to use `time(1)` instead, which will
propagate the inferior's exitcode. This will also allow us to collect
other parameters in the future.
By default, Linux will map an IP packet's TOS field into skb->priority
when acting as a router. Unfortunately this is only globally
configurable (per network namespace), which leaves us with the
following dilemma:
If we keep reclassification enabled, then a setup like this...
vlan1 vlan2
\ /
br0
/ \
e1 e2
...would likely not work as expected because any priority information
from hardware, that might be mapped to skb->priority via vlan1's
ingress-qos-map, would then be replaced by the standard TOS-mapping on
the routing boundary.
On the other hand, if we disable reclassification, then we won't be
able to source priority information from the TOS field when no other
source is available, as is the case when the source interface is a
regular NIC.
Given that the primary use-case is to run on switchdev ports, we will
most likely always have priority information available from hardware,
which is why we opt to disable the reclassification.
If this ever becomes configurable per interface, then we could open up
the configuration to let users define the policy of which layer's
priority should take precedence.
Opportunistically look for interfaces with multiple transmit queues
and hardware support for the mqprio queuing discipline. For every
matching interface, set up mappings from kernel-internal packet
priorities, via traffic classes, to transmit queues such that as many
high priorities as possible are scheduled on separate queues.
This makes it easier to add more scripts without having to update the
finit config file, and it clarifies which of the scripts in
/libexec/infix only execute at boot.
Sync after `make update-defconfig`:
- avahi selected by mdns-alias package (all)
- iptables and ca-certs selected by other packages (r2s)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Very simple tests work (hostname.py), more complex
tests (static_routing.py) failes due to the lack of
model prefix, for example. infix-ip:ipv4 instead of just
ipv4.
We need to fix this before you send your configuration, run
it through libyang for example and get the full model-name.
This enables access to /restconf on port 443 over HTTP/1.1 and HTTP/2
via rousette when enabled.
Also, slight refactor to allow including /restconf and /netbrowse as
optional locations in the main servier directive.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With increased use of augeas to manage users, groups, and permissions,
we seem to have reached peak complexity. Because when re-running the
same test[1] over and over, somtimes the aug_save() function fails to
actually save the changes to /etc/shadow to disk!
We have already experienced weird behavior with augeas, see comment in
deleted code, and these latest problems became the last straw. We have
decided to replace it with standard C APIs.
As a spin-off, thanks to the requried refactoring, the check_shell()
function, used by the change_nacm() callback, could be replaced with a
call to set_shell() for both "is-admin" and "non-admin" cases. This
means we now also restore Bash privileges (and not just take them away)
when modifying nacm group memberships.
Fixes#468
[1]: test/case/ietf_system/user_admin.py
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Checking if a user is an administratr we cannot rely solely on the
return value of sr_get_items() but also ensure at least one group
matches the search criteria.
Fixes#469
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since containers managed by docker runs as root, files created in bind
mounted volumes will be owned by root:root. This is a problem for
files generated during test execution, as the calling user does not
have permission to remove them.
Therefore, add a wrapper entrypoint that hooks up an exit handler that
will fixup the permissions before exiting the container.
Now that Reggie builds all supported archs there is no point in keeping
two separate (and now very similar) workflows. So we've decided to lay
off Reggie and let Bob, who has seniority, take over Reggie's tasks.
This simplification also means that jobs will no longer be started on
push to branches, only pull requests. For half-baked branches a draft
pull request can be used to auto-start builds, if needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This also adds support in sysrepot to install factory config on boot,
default is only to allow it when installing the module, we can not do
that anymore, since the modules is installed during build and the factory
config (or failure) can only be determed when booted.
This to hopefully speed up boot, do as little as possible
during boot.
* New modules needs to be added to src/confd/scripts/setup.sh
* Permission needs to be changed post-build for YANG files,
see CONFD_PERMISSIONS in confd.mk
Partial revert of 23469bbe3b. When running tests in a GitHub action,
we do not want to run as host root user. Therefore, restore podman as
the default runner, but make sure to prefer docker when attaching to
the host network namespace.
Update docs to match the recent developments in the test system.
Spin off the architecture description to its own document, and focus
testing.md on the day-to-day usage.
When interface naming switched to use 1-based indices instead of
0-based, the topology generation was overlooked thus breaking tests
against a `make run` instance.
Bring everything back in sync.
When testing in the host's namespace, only docker seems to offer the
required capabilities (due to its daemon/client architecture).
Qeneth tests can still be run in podman. Users will have to install
the docker wrappers for podman to make use of this.
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
- Avoid global variable references in set_static_multicast_filter()
In test cases, it is common that we want to verify that a certain type
of traffic reaches a namespace. This has, up to this point, been
solved by the generic sniffer.Sniffer.
Try to improve the two most common use-cases...
1. Test if a flow reaches a namespace
2. Ensure that a flow does not reach a namespace
...by always exiting as soon as the first packet is received.
This saves time on positive tests, and the synchronous API allows it
to compose well with infamy.parallel().
Support the familiar subprocess.run API, and runsh from netns.py.
This should only be used for debugging, or in the rare instances when
we want to test functionality that is not available via NETCONF.
QEMU systems seem work fine with the 5s timeout, whereas some physical
devices can't quite keep up with that.
Let the slower systems indicate that they need a bit more time without
punishing faster ones with a longer default.
This will let other Infamy submodules tune their behavior based on the
particular test system they are running on.
Attributes are defined by creating graph-global attributes with an
"ix_" prefix.
Rather than setting up and tearing down two identical namespaces,
create it once and use it for the duration of the test. (This is
probably a documentation issue with Infamy: there is no requirement
that test.steps are direct descendants of the test, but until this
point there was no example of this in the source base)
In the process of this, it was also discovered that no positive ping
test was done over v6, so that has been added.
Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We already have a pull request template. This is a propsal to add issue
templates as well. These yml templates change the behavior of reporting
issues to more a of a pre-formatted form with guard rails.
It is still possible to report blank issues the old way.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we don't have any VPD defined on this board, supply a default
password hash via the device tree instead.
Also, specify the path to external USB port, so that Infix will pick
it up in ietf-hardware.
Provide a patched device tree that:
- Uses the correct phy-mode for eth2, allowing it to be probed
properly
- Wires up the interrupt signal to the GPIO expander, so that the SFP
cage's I/O lines can be configured as interrupts, rather than having
to poll them
Assume that the caller always want to create a new partition table,
even in scenarios where one already exists. This allows devices to be
reprovisioned with a newer image, for example.
Fixes#394
This is not a production target, so we choose the more developer
friendly option of allowing the boot process to be interrupted.
Also, remove the old update cruft and rely on Marvell's `bubt`
instead.
The BootROM wants the bootloader to be located on LBA1, which is not
ideal when using a GPT to describe the partition table.
Make sure the `bubt` command targets SPI by default.
Buildroot's default ATF version changed from 2.9 to 2.10 when we
upgraded to 24.02.x. This meant that our patches were not applied,
which broke the build.
Take a conservative approach for now, and just pin the ATF version to
the known-good 2.9 series.
During the addition of multi-key support to RAUC and U-Boot, the
bootloader defconfig for CN9130 CRB was overlooked, which meant that
the Infix specific U-Boot hooks never ran, thereby ultimately breaking
the build.
Restore the required options to build in the dev-key by default.
The Buildroot 2024.02.x-kkit branch recently had uboot-tools upgraded
and the patches needed require bison to rebuild.
The recommendation is to also install flex, they always go together.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the salting being applied to Python's `hash()` (see [1]), the
hash of an object is not stable across different Python processes. As
a result, neither are the topology mappings generated by networkx.
The upside of this is randomness that we get better test coverage over
time, especially on physical devices where the underlying hardware
could differ between ports, for example.
On the other hand, it can be very frustrating to track down a bug when
locial nodes are suffled around between phyical nodes on each
invocation of a test case.
Therefore, use a random seed by default, but allow the user to specify
a fixed value if they so choose. We then add a meta test that logs the
seed being used for the current suite - which means we can simply
copy&paste that value to rerun the suite (or single test) with the
same topology mappings.
[1]: https://docs.python.org/3/reference/datamodel.html#object.__hash__
- Present the topologies to networkx as multigraphs, rather than
expaning each port of the record shape as a separate node.
- Create a topology mapping by locating a subgraph monomorphism of the
logical topology in the physical ditto.
This cuts down the time of finding a mapping by several orders of
magnitude. Example:
Before:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 13m1,213s
user 13m0,112s
sys 0m0,732s
After:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 0m0,153s
user 0m0,128s
sys 0m0,024s
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The dagger tool is a helper for scripts generated by confd and should
therefore be installed by confd instead of the rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order to make use of the DCB support in mv88e6xxx we also enable it
in the kernel config.
Fixes: 3a73ce3cfb ("kernel: Import EtherType based priority override support")
As mentioned previously, the NACM default ACLs in `factory-config` were
removed as part of the work on the nacm-basic branch.
Adjust text to not mention any pre-configured user levels, for now. A
future update may change the defaults when we've found resonable levels.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch helps silence kernel errors to console at boot. To fully
silence errors, enable emulated /var in your Qemu runs as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The fact that a USB device currently is not authorized is not an error.
This patch adjusts the log level to slip below 'quiet' to prevent logs
to console at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we do not yet have lldpTxFast, or similar, to enable on LLDP, we
tickle both services to resend their HELLO frames on link down/up event
instead.
+ Reduces turnaround times drastically
+ Restore regression test for mDNS, which we lost recently
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Our local runners do not allow sudo, e.g., when installing libyang and
the other dependencies.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the lifetime of Infix, so far, we've run into at least one customer
issue where we had qualms about our use of the local bit causing issues
with 3rd party software. In the end that was not the root cause of our
problems, but we spent way too much time worrying about it. Hence this
patch, which brings our virtual environments another step closer to the
real hardware that Infix runs on.
The OUI used is one of the "private" ones, taken completly at random.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The base mac address is used by bridges in Infix. This patch adds
support for extracting a base mac from the first interface "- 1",
e.g., if the mac address of e1 is 08:00:20:00:00:01, the base mac
will be 08:00:20:00:00:00.
This works with the Infamy test framework (Qeneth) and also with
the qemu script, included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even when `managed = "in-band-status";` was specified on a port,
mv88e6xxx would insist on forcing the values that were supposed to be
automatically picked up by the MAC via in-band signaling.
In the case of USXGMII links on 6393X, forcing the link bit would
sometimes, for reasons that are not understood, cause the SERDES to
reset its USXGMII link partner base page (register 4.0xf0a2) to 0,
which it would then interpret as 10M/half-duplex. As a result, the
SERDES would erroneously perform rate-matching to 10M on egress
towards the PHY (which is configured for 10G/full-duplex), leading to
nothing but dropped packets and much sadness.
This can most easily be reproduced by the following setup:
.------------.
| .-----. .-------.
| | p9 +---+ 3310P +--.
| 6393X :-----: :-------: | T- or X-Units looped via external cable
| | p10 +---+ 3310P +--'
| '-----' '-------'
'------------'
Make sure that neither p9 nor p10 are managed using in-band-status.
1. ip link set dev p9 up; ip link set dev p10 up
2. ip link set dev p9 down
3. ip link set dev p9 up
After step (3), p10 will experience the failure described above in
about 3/4 of the cases. In the cases where the issue does not arise,
simply repeat steps (2) and (3).
**Thank :heart: you for taking the time to fill out this bug report!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for the bug you encountered.
- type:textarea
attributes:
label:Current Behavior
description:|
A clear and concise description of the issue you're experiencing.
value:|
For code snippets, logs, commands, etc., please use triple backticks:
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-00-00-00 container[3192]: Failed creating container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Expected Behavior
description:|
A clear and concise description of what you expected to happen.
value:|
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-c0-ff-ee container[3192]: Successfully created container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Steps To Reproduce
description:|
Steps to reproduce the issue. For example:
1. Built from source
2. Upgrade to latest release, vYY.MM.P
3. Factory reset
4. Enable feature
5. Check the logs/show command/operational status
validations:
required:false
- type:textarea
attributes:
label:Additional information
description:|
- Relevant parts of `startup-config`
- Output from `show interfaces`, if applicable
- Other observations, screenshots, log files ...
**Tip:** You can attach images or log files by clicking this area to highlight it and then dragging files in.
description:Suggest a new feature, idea or improvement of the OS
labels:
- "feature"
- "triage"
body:
- type:markdown
attributes:
value:|
**Thank :heart: you for taking the time to fill out this feature request!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for your feature. We are also happy to accept contributions from our users. For details see [CONTRIBUTING](https://github.com/kernelkit/infix/blob/master/.github/CONTRIBUTING.md).
- type:textarea
attributes:
label:Description
description:|
A clear and concise description of the problem or missing feature.
**Example:** *I'm always frustrated when [...]*, or *I'd like to see support for [...]*
validations:
required:true
- type:textarea
attributes:
label:Additional Information
description:|
Any other related information, e.g. existing YANG model(s), or possibly screenshots about the feature request here.
validations:
required:false
- type:textarea
attributes:
label:General Information
description:|
Appended to all feature requests for future readers.
value:|
Anyone can help out by [sponsoring][1] development of new features or [contributing][2] pull requests.
Please use this issue for discussions related to the feature.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Joachim Wiberg