The LOG_SECURITY facility was set wrong (1 << 13) instead of (13 << 3), see
https://github.com/kernelkit/sysklogd/blob/0fc6656/src/syslog.h#L120 for
details. This caused all audit log messages to be logged in LOG_USER.
Also, rename LOG_SECURITY -> LOG_AUDIT and log macro SECURITY() -> AUDIT()
to match RFC5424 terminology.
Similar fix to sysrepo, LOG_AUDIT facility instead of daemon + WARNING.
Additionally, drop the leading [severity] prefix to sysrepo logs. Only
needed when logging to stdout.
Follow-up to issue #521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
LOG_DAEMON is a facility not an option. Replace with NDELAY option and
set facility properly in call to openlog() instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes the following recurring login warning in syslog. (We cannot use
pam_lastlog.so since it does not rotate its /var/log/lastlog file.)
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so): /lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The backported patches to sysklogd now support the RFC facilities
natively, so we can focus on local facilities (and 'all').
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Minor adjustments have been made to enable calling infix tests from an
external project (i.e. 'make test' target).
This essentially allows running any external test (or a group of tests)
using the infix-9pm tool.
Add a must expression to limit invalid configurations.
Not belonging to VLAN when added to a multicast-filter in
that VLAN. Make sure multicast snooping is enabled when
using multicast filters.
This fixes#587
Signed-off-by: Mattias Walström <lazzer@gmail.com>
A fairly quick step that runs for all build targets, likely saving us a
lot of time for release weeks.
Fixes#574
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_get_changes() API, introduced in 18b5922, does not provide the
user with a delete yang:operation when the entire YANG tree is deleted.
Refactor syslog actions to use the srx_get_diff() API instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Frr logs to the local2 syslog facility to allow sorting all
Frr (staticd, ospfd) logs into a dedicated /var/log/routing log file.
We activate OSPF debugging, but keep log level at 'informational' for
the time being. The YANG model needs some sort of "knob" to toggle
debug messages when troubleshooting OSPF.
Fixes#541
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix has the catch-all /var/log/debug, and now also /var/log/routing
for debug messages from Frr.
The log file /var/log/syslog now catches *all* messages except auth*,
which may contain secrets, except debug messages. Contrast this with
/var/log/messages which only logs info/notice/warn -- i.e., no error
and above log messages.
Due to the way syslogd parses /etc/syslog.conf et al, we override the
default in Infix to disable the default /var/log/syslog, otherwise we
would get duplicates to the same log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When sysrepo-plugind is processing callback events, make sure to log the
error and exit(1) the entire process so the system can handle the problem.
For example, restart all dependent services.
Fixes#585
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As of KernelKit Klish @ 710a631 the script plugin has been refactored to
run all commands as the logged in user instead of as root. The default
admin user is member of the wheel group, which allows access to sysrepo
and sudo access to containers thanks to NOPASSWD rights.
The doas script is a dummy wrapper to silence 'sudo -n' output for users
without any privileges.
As of this commit, unprivileged users can no longer copy, show, or in
any other way manipulate the system configuraiton.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a refactor to ensure sysrepo functionality guarded by NACM works
as intended in Infix.
Relocate infix_rpc() to klish-plugin-sysrepo, ensuring unauthenticated
users are denied access.
Drop infix_commit() in favor of slightly modified srp_commit(), this to
ensure sysrepo audit trail logs are visible at all times.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces a new SECURITY() log macro that logs to facility
'audit' (sometimes called 'security') with severity set to 'alert'. It
is then used to instrument the single most important things to log; all
changes to users and their privileges.
We also add logging to sysrepo, which knows the username for changes to
running-config, copies to startup-config, and RPCs.
Fixes#521
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- For consistency and clarity, rename format -> log-format
- Add must expression to ban 'bsd' format from file logging
Note: technically, sysklogd silently reverts back to rfc3164 for file
logging, but it's better to be clear with the user with what is
possible to configure and is going to be used.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As a bare minimum, all augments and deviations made to standard models
should have a description denoting *why* they exist.
In the case of ietf-syslog the base model is still a draft and carries
some odd defaults we want to disable, or replace with better ones. The
augments are global log rotation and and log format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor changes the callback subscription for log-file and remote
log actions to ensure they are called for *all* changes. Even changes
to deeply nested sub-trees like file-rotation when no other changes are
made. The previous attempt failed to address that.
The refactored callbacks replace sr_get_changes() with srx_get_changes()
for better control over what they iterate over. The callbacks always
regenerate the syslogd *.conf file snippets for each log action, so
there is no need for the overly granular sr_get_changes(), ever.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Reduces the overhead/repetition for module callbacks by combining the
forces of srx_get_diff() and lydx_get_descendant() into one API. The
resulting function supports both XPath and simplified paths to get the
subtree of changes applicable to the callback.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This augments ietf-syslog.yang with global file rotation settings which
are used when per-file rotation is not configured. The defaults chosen
match previously decided defaults for Infix: 1M:10, i.e., rotate every
file at 1 MiB and keep up to 10 gzipped aged-out archives.
The standard model includes a default value of 1 for the number of files
kept, which is removed (deviated). There is also a unit specified for
max-file-size, 'megabytes', replaced with 'kilobytes' in this change.
On smaller embedded systems, smaller sizes may be required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest sysklogd backports syslogd now supports log rotation
settings in the .conf files, which we'll add yang support for later in
this patch series.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a backport of sysklogd v2.6.0 support for log rotation settings
in the .conf file. Previously only supported on the command line.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a the type of a leaf node (of a list) is buried inside a union we
need to fish out the module prefix if one of the types in the union is
an identityref. It's all very simple really.
Also, when tab completing for possible identities, always make sure to
strip any leading module prefix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes mirror the changes made to the CLI in an attempt to create
a better user experience for working with log files even from the shell.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To support testing, the test-config.cfg file has been introduced in Infix.
Additionally, a "test mode" for the running image is required for this
configuration to be applied.
Basically the test-config will only be loaded when the device is in test mode,
which is determined by the presence of the /mnt/aux/test-mode file.
However, placing this file via the Qeneth system proved to be
inconvenient in the test environment. Therefore, it the entire image is
built in test mode, with the 'test-mode' file preloaded onto the disk
image (specifically in the auxiliary partition).
To support this, a new variable, (bool) DISK_IMAGE_TEST_MODE, has been
introduced:
enabled: the image will be built in the test mode;
disabled: the image will be built in the standard mode.
Part of issue #568
Currently, it's not possible to run infix tests from an external
project (based on infix) due to an incompatibility between the
configuration used in the tests (the default configuration
within the image generated by the external project) and the infix
base configuration expected by the test cases. Therefore, a simple
configuration specifically for testing purposes needs to be generated
within an image. This test-config should always be generated
but only loaded when the device is in test mode.
Part of issue #568
If a container has not yet stopped/started we may for proto RESTCONF get
"invalid URI" result back for some container actions. With this change
we allow the action to be retried up to three times before passing on
the error.
In tests on Qemu (x86_64) this happens very rarely and need at most one
retry before succeeding. Verified by iterating the same basic test over
night (9000+ iterations).
Fixes#558
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When unit tests run in CI we may not have a syslog daemon available, in
such cases we set up a dummy handler.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These changes are intended to make yanger a bit more robust. Instead of
bailing out on command errors, we now return empty string or object back
to the callee in run_cmd() and run_json_cmd().
One example where yanger previously exited hard, and dragged with it the
entire session, is when inspecting container status or when attempting
to restart container instances which have yet to be created/stopped.
Fixes#558
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order for the probe logic to source product data from a VPD, it
must be marked as such. Otherwise we end up in a scenario where the
data is collected, but not hoisted up to the system level, leaving the
system without a defined base-MAC for instance.
Previous xpath may or may not been an xpath, we still called it xpath.
Remove the obscure function get_xpath() and instead transform to a
URI in restconf.py
This fix issue #490
Signed-off-by: Mattias Walström <lazzer@gmail.com>
When the interface is up and has a 'proto dhcp' address the WAN LED is
lit up. When the interface goes down, or loses its DHCP lease, the LED
is turned off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow reset button on the R2S to be used for factory reset at power-on.
See board README for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport pam-lastlog build fix from latest Buildroot master and enable
in all defconfigs to fix syslog warning:
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so)
Fixes#542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch greatly improves the security of the Infix factory reset by
replacing 'rm' with 'shred'. The shred tool overwrites the contents of
files three times. With the -z and -u options the last pass writes
zeroes and then uninks the files.
On the NanoPi R2S the factory-reset now takes 24 seconds:
Aug 11 16:00:34 infix mnt[121]: Resetting to factory defaults.
Aug 11 16:00:58 infix mnt[173]: Factory reset complete.
A visual aid is also added, setting *all* LEDs to on, that can be found
mounted on the device, before starting the file shredders. The LEDs are
reset back to off and SYS red blinking as soon as the wipe has completed
and iitod has been started.
Fixes#158
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This serves as an example of how a board specific builds in Infix can
carry a static factory-config. This will be extended upon as we add
support for DHCP server, WiFi access point, and firewall support.
For now the following features are added:
- Default hostname: r2s instead of infix-00-00-00
- LAN port always at 192.168.2.1/24, IPv6 SLAAC enabled
- WAN port has DHCP enabled for IPv4, IPv6 SLAAC disabled
- NTP client enabled, default server pool.ntp.org
- DHCP client is set up to request and allow ntp server
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the most important bridge and usb fixes have been ported in this
commit, and a new patch for the r8153 link/traffic LEDs, ported from
the FriendlyELEC/Rockchip kernel tree.
Fixes#274
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The R2S has a minimal set of system LEDs, all of which are single color.
This commit tries to distill and map the essence of the Infix functions
to available LEDs.
The SYS LED is turned on (fainy red) at power-on, when U-Boot has loaded
the kernel it turns the SYS LED bright red on. The idea is then to turn
the red SYS LED off as soon as the system has successfully loaded system
startup-config, and then turn the green LAN LED on. Indicating that the
both the device is operational and that the user can connect to the LAN
port.
The WAN LED is given a "wan-up" input condition, with the intention of
turning it on (green) when the device has acquired a DHCP address.
The failure modes, which in many ways is the essence of Infix signaling,
are fail-safe and panic, triggered by loading failure-config, or failing
to loadd failure-config, respectively. In fail-safe mode the SYS LED is
blinking red at 5 Hz and in panic mode *all* LEDs blink at 5 Hz.
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With new features & fixes, Infix grows. With the latest support for
rauc upgrades introduced with the VisionFive2, and now also for R2S,
we need to reserve room for future upgrades even when running from
an SD card.
This is a quick fix for genimge generated SD card imaages before we
get a proper installer in place that can be used both on the target
and host systems to partition and provision an eMMC, NVME, SSD, or
an SD card.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows modifying and saving the U-Boot environment to the
aux partition on the NanoPi R2S. Required to able to safely maintain
multiple R2S devices on the same LAN.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
U-Boot (2024.07) does not yet support the 'metadata_csum' feature flag
to Ext4 file systems. So let's disable it for now in mkaux.sh so we
can allow builds for, e.g., the R2S and VisionFive2 boards to modify
and save their U-Boot environment.
Needed on the NanoPi R2S to set ethaddr + eth1addr since it does not
have any VPD EEPROM mounted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.10.3
- Initial defconfig sync with aarch64
- Enable kprobes, ksyms, and function tracer
- Enable missing file systems for parity with Infix
- Enable bridging, netfilter, and other Infix requirements
- Initial virtion support for running in Qemu (untested)
- Enable device mapper, required for rauc bundle install
- Make dummy and tunnel drivers modules to be able to drop dummy0
and tunl0 interfaces that otherwise mess up "show interfaces"
- Disable suspend and hibernation, not supported in Infix
- Disable unused GPIO, PHY, MDIO, and USB drivers
- Disable RK3328 watchdog driver, cannot perform reset on R2S,
enablle softdog instead as a seamless replacement for Infix.
Even though not optimal (since it's software) reboot works
- Disable ethtool netlink support, does not work and breaks
interface configuration completely on R2S!
- Enable netdev LED triggers, for LAN and WAN LEDs
- Bump u-boot to 2024.07
- Hard code developer mode to allow shell access
- Disable factory reset button support (not yet supported)
- Bump ATF to v2.9
- Enable squashfs for rootfs image
- Enable signing of images
- Add secondary partition
- Add dedicated var partition
- Add aux partition for signatures and uboot env
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For systems with multiple paths to the network, different situations
may call for different paths to be used. Therefore, allow the user to
override the active interface via the environment on the auxiliary
partition.
The default (defined the bootloader's device tree) is still used in
cases when nothing else is specified in the environment.
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
~/src/infix/x-riscv(riscv)$ make
Makefile:574: *** nghttp2-asio is in the dependency chain of rousette that has added it to its _DEPENDENCIES variable without selecting it or depending on it from Config.in. Stop.
Fixes#536
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync defconfig with aarch64
- Sync linux_defconfig with aarch64
- ethtool w/ netlink not supported yet for the StarFice dwmac
- note, waaay too many unused drivers still
- Add aux/cfg/var partitions to sdcard, no rauc support yet
- Add factory-password-hash to device tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Switch to logger, with syslog backend, instead of print() for logging
errors. This way we can log errors/warnings yet still return partial
JSON data back to statd. For example, failing to read JSON counters
from ethtool should not break "show interfaces", just return empty
array and log failure to run command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Missing whitespace in assignments, before comments and methods
- Drop semicolons from end of statements
- Use 'if foo not in bar' instead of 'if not foo in bar'
- Some too long lines (not all, that would be painful)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On boards like the R2S and the VisionFive2 `ethtool --json -S ethX` is
not yet supported. This patch allows ethtool to fail, with a slightly
better log message, without breaking the operational datastore.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inference for an interface named vlanN can only guess C-VLAN and VID,
the base interface must be left to the user to fill in. This is also
mandatory in the model.
Fixes#531
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We cannot rely on time being correct. Password expiration need to be handled
by external mechanism, e.g., RADIUS.
Fixes#534
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Removing a user's password hash should be the same an empty password
hash. In the latter case we already allow login with SSH keys, this
change harmonizes the behavior by also allowing login with SSH keys
when the users's password hash is removed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Just like other packages we should version our Linux patches as well,
even though it may be painful and cause some extra overhead, in the
end it allows multi-kernel setups and compatibility with customer's
using Infix as a BR2_EXTERNAL.
Fixes#489
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When syncing interface defaults at boot, some settings are read-only and
some are write-only. Filter these out so sysctl does not log any bogus
Permission Denied messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
cp: cannot stat '/home/lazzer/Documents/addiva/infix/board/common/rootfs/bin/onieprom': No such file or directory
Signed-off-by: Mattias Walström <lazzer@gmail.com>
From https://en.wikipedia.org/wiki/exFAT:
... a file system optimized for flash memory such as USB flash
drives and SD cards.
... has been adopted by the SD Association as the default file
system for SDXC and SDUC cards larger than 32 GB.
The exfatprogs is also a default installed package on most modern
distros, compared to dosfstools (mkfs.vfat) which is not.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For netopeer2 we need to patch away local-users, since if it is enabled
netopeer2 requires all users that should be allowed to use netconf to
also be configured in ietf-netconf-server.
Also add some upstream patches.
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Abstract functions and common functions are located in transport.py
Some quirks has been required due to how rousette works,
these functions has been added to the abstract class
Can be removed when rousette behaves as expected.
This is the only way to delete with restconf so it it must also be
implemented in netconf. This replace the put_diff_dict function.
Also: how the xpath looks is different in restconf/netconf therefore
each protocl has a get_xpath() function as well.
Replaces:
Error: Illegal command
with:
Error: Command not found, or incomplete. Try ? for help or Tab for completion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of potentially blocking sysrepo, which has a 5 second timeout,
we move 'container delete' jobs to be run by the execd queue.
Fixes#479
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change makes sure execd calls KNN style scripts before SNN,
allowing confd to post teardown jobs that are guaranteed to run
before any jobs to create new resources run.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
ietf-system.c: In function ‘change_hostname’:
ietf-system.c:1722:9: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
1722 | system("initctl -nbq touch netbrowse");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ubuntu 22.04 (ubuntu-latest runner on GitHub) has a slightly earlier
version of libxcrypt. The only hard requirement we have is yescrypt
support, so we can relax the configure check slightly to be able to
run coverity scan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We recently dropped Augas from confd and this branch adds support for
$0$cleartext passwords, which require libxcrypt.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All typedefs and identities should be declared in the module that uses
them unless other modules need them. This change also makes it easier
to work with tools like yanglint and pyang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch silences the previously very verbose setup.sh script, and
crucially also fixes a bug in UPDATE_MODULE(). Missing closing '
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with UNKNOWN base mac address, and making it easier for
the user to actually notice the fault condition.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following specifiers are currently supported:
- %h default hostname from /etc/os-release
- %i value of ID from /etc/os-release
- %m last three octets of base MAC, e.g., c0-ff-ee
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With this patch, users not in the NACM admin group and a login shell set
to clish can now log in to the CLI. Prior to this change only members
of the UNIX group 'wheel' could open the klishd socket.
The patch adds another group, 'sys-cli', which acts as a capability for
users. An admin user (member of the admin group) will now be member of
both the UNIX 'wheel' and 'sys-cli' groups. A non-admin user that has
shell set to 'clish' will only be member of the 'sys-cli' group. Other
users will not be mapped to any UNIX group and have only permissions set
in NACM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch simplifies the handling of factory default password for the
admin user by overloading the ietf-system password type. The new type,
$factory$, acts a system hint to use any device specific (or built-in
software/device-tree) default password hash.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugins-sysrepo to fix the annoying issue with
the CLI not supporting, e.g. "show hostname" in system config context.
Details: https://github.com/kernelkit/klish-plugin-sysrepo/issues/3
The problem was two-fold, first we used the wrong ptype for 'show'
(and 'diff') commands, so srp_show() was not even called. Then the
klish-plugin-sysrepo code did not account for show being called for
leaf nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix indentations:
- Corrected indentations in confd.mk to adhere to Buildroot coding
standards
- Relocate YANG Modules List Files:
- Moved the YANG modules list files (.inc) from package/confd to
src/confd
- Add Missing YANG Module:
- Included infix-interfaces@2024-01-15.yang in
yang_modules_confd.inc
- This module was missing in the non-containerized build and is now
correctly added
Unintended leak of Proxy-Authorization header in requests #1
Requests `Session` object does not verify requests after making first request with verify=False #2
- Moved setup.sh and yang_modules files from infix/src/confd/scripts/ to infix/utils/ to streamline the repository structure
- Updated confd.mk to correctly reference the new location of the setup script
- Introduced yang_modules_<type>.inc file to list all YANG modules for improved clarity and maintainability
- Modified the new setup script to dynamically source module lists from yang_modules_<type>.inc
Since a user has access to the shell in developer mode, we might as
well allow booting through the standard boot scripts as well. This
means that a product with a bootloader only accepting images signed by
Company A can now be configured to netboot a regular developer image
without any special user interaction.
We no longer need to set bootdelay on development platforms. You can
now always get to the bootmenu with a Ctrl-C, from there you can get
to the shell if developer mode is enabled. Therefore, override the
default dev-mode detection to statically enable it on the CRB.
If we receive an option 67 (bootfile) matching http://IP/rootfs.itb,
use U-Boot's wget implementation to download the file. The web server
must listen on port 80. tftp:// is also supported.
Without a protocol prefix, assume that the bootfile should be fetched
using TFTP from ${serverip}.
Generate a boot menu, accessible with C-c during a short window, where
a user can interactively select a custom boot source and/or trigger a
factory reset of the device.
With this in place, we should always be able to unbrick a device, as
the image can be fed over the network, and local data can be ignored
by opting in to a factory reset.
Before this change, this invocation...
make O=x-x64 x86_64_defconfig
...would use the output directory...
/path/to/infix/buildroot/x-x64
...which is not the expected behavior. This would happen because
Buildroot will, naturally, expand relative paths based on _its_ top
directory.
Therefore, translate any relative paths to absolute ones based on
_Infix's_ top directory, before handing control over to Buildroot,
such that the expected...
/path/to/infix/x-x64
...output directory is used.
This tries to improve on the existing sniffer in a couple of ways:
- In addition to being usable as a context manager, also allow
explicitly starting and stopping the capture.
- Try to synchronize the start of the capture by snooping stderr and
wait for tcpdump to start up. This should eliminate the need for
sleeps before starting to send packets.
- By default, execute a safety sleep when terminating the capture to
ensure that any straggling packets have had time to arrive at their
destination.
By default, ping(1) will use a random ID in the ICMP packet. Allow
setting it to a fixed value instead.
This makes it easy to identify that particular packet in a packet
capture later on.
Let the ring-bearer^Wuser decide the policy around how VLAN PCP is
mapped to skb->priority on ingress, and back to PCP again on egress.
Either a fixed value is used for all packets, or a 1:1 mapping is done
between the two domains. By default, we follow Linux's defaults of a
fixed 0 value on both ingress and egress.
The interface in question might not exist at init:49 if some other
change requires it to be recreated from scratch, in which case it will
be removed in exit:50. Therefore, run the flush at exit:49, where it
should always still exist.
When timestamping of scripts was added, we unfortunately started to
record the exitstatus of `ts(1)`, rather than the script itself.
Refactor the metadata collection to use `time(1)` instead, which will
propagate the inferior's exitcode. This will also allow us to collect
other parameters in the future.
By default, Linux will map an IP packet's TOS field into skb->priority
when acting as a router. Unfortunately this is only globally
configurable (per network namespace), which leaves us with the
following dilemma:
If we keep reclassification enabled, then a setup like this...
vlan1 vlan2
\ /
br0
/ \
e1 e2
...would likely not work as expected because any priority information
from hardware, that might be mapped to skb->priority via vlan1's
ingress-qos-map, would then be replaced by the standard TOS-mapping on
the routing boundary.
On the other hand, if we disable reclassification, then we won't be
able to source priority information from the TOS field when no other
source is available, as is the case when the source interface is a
regular NIC.
Given that the primary use-case is to run on switchdev ports, we will
most likely always have priority information available from hardware,
which is why we opt to disable the reclassification.
If this ever becomes configurable per interface, then we could open up
the configuration to let users define the policy of which layer's
priority should take precedence.
Opportunistically look for interfaces with multiple transmit queues
and hardware support for the mqprio queuing discipline. For every
matching interface, set up mappings from kernel-internal packet
priorities, via traffic classes, to transmit queues such that as many
high priorities as possible are scheduled on separate queues.
This makes it easier to add more scripts without having to update the
finit config file, and it clarifies which of the scripts in
/libexec/infix only execute at boot.
Sync after `make update-defconfig`:
- avahi selected by mdns-alias package (all)
- iptables and ca-certs selected by other packages (r2s)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Very simple tests work (hostname.py), more complex
tests (static_routing.py) failes due to the lack of
model prefix, for example. infix-ip:ipv4 instead of just
ipv4.
We need to fix this before you send your configuration, run
it through libyang for example and get the full model-name.
This enables access to /restconf on port 443 over HTTP/1.1 and HTTP/2
via rousette when enabled.
Also, slight refactor to allow including /restconf and /netbrowse as
optional locations in the main servier directive.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With increased use of augeas to manage users, groups, and permissions,
we seem to have reached peak complexity. Because when re-running the
same test[1] over and over, somtimes the aug_save() function fails to
actually save the changes to /etc/shadow to disk!
We have already experienced weird behavior with augeas, see comment in
deleted code, and these latest problems became the last straw. We have
decided to replace it with standard C APIs.
As a spin-off, thanks to the requried refactoring, the check_shell()
function, used by the change_nacm() callback, could be replaced with a
call to set_shell() for both "is-admin" and "non-admin" cases. This
means we now also restore Bash privileges (and not just take them away)
when modifying nacm group memberships.
Fixes#468
[1]: test/case/ietf_system/user_admin.py
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Checking if a user is an administratr we cannot rely solely on the
return value of sr_get_items() but also ensure at least one group
matches the search criteria.
Fixes#469
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since containers managed by docker runs as root, files created in bind
mounted volumes will be owned by root:root. This is a problem for
files generated during test execution, as the calling user does not
have permission to remove them.
Therefore, add a wrapper entrypoint that hooks up an exit handler that
will fixup the permissions before exiting the container.
Now that Reggie builds all supported archs there is no point in keeping
two separate (and now very similar) workflows. So we've decided to lay
off Reggie and let Bob, who has seniority, take over Reggie's tasks.
This simplification also means that jobs will no longer be started on
push to branches, only pull requests. For half-baked branches a draft
pull request can be used to auto-start builds, if needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This also adds support in sysrepot to install factory config on boot,
default is only to allow it when installing the module, we can not do
that anymore, since the modules is installed during build and the factory
config (or failure) can only be determed when booted.
This to hopefully speed up boot, do as little as possible
during boot.
* New modules needs to be added to src/confd/scripts/setup.sh
* Permission needs to be changed post-build for YANG files,
see CONFD_PERMISSIONS in confd.mk
Partial revert of 23469bbe3b. When running tests in a GitHub action,
we do not want to run as host root user. Therefore, restore podman as
the default runner, but make sure to prefer docker when attaching to
the host network namespace.
Update docs to match the recent developments in the test system.
Spin off the architecture description to its own document, and focus
testing.md on the day-to-day usage.
When interface naming switched to use 1-based indices instead of
0-based, the topology generation was overlooked thus breaking tests
against a `make run` instance.
Bring everything back in sync.
When testing in the host's namespace, only docker seems to offer the
required capabilities (due to its daemon/client architecture).
Qeneth tests can still be run in podman. Users will have to install
the docker wrappers for podman to make use of this.
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
- Avoid global variable references in set_static_multicast_filter()
In test cases, it is common that we want to verify that a certain type
of traffic reaches a namespace. This has, up to this point, been
solved by the generic sniffer.Sniffer.
Try to improve the two most common use-cases...
1. Test if a flow reaches a namespace
2. Ensure that a flow does not reach a namespace
...by always exiting as soon as the first packet is received.
This saves time on positive tests, and the synchronous API allows it
to compose well with infamy.parallel().
Support the familiar subprocess.run API, and runsh from netns.py.
This should only be used for debugging, or in the rare instances when
we want to test functionality that is not available via NETCONF.
QEMU systems seem work fine with the 5s timeout, whereas some physical
devices can't quite keep up with that.
Let the slower systems indicate that they need a bit more time without
punishing faster ones with a longer default.
This will let other Infamy submodules tune their behavior based on the
particular test system they are running on.
Attributes are defined by creating graph-global attributes with an
"ix_" prefix.
Rather than setting up and tearing down two identical namespaces,
create it once and use it for the duration of the test. (This is
probably a documentation issue with Infamy: there is no requirement
that test.steps are direct descendants of the test, but until this
point there was no example of this in the source base)
In the process of this, it was also discovered that no positive ping
test was done over v6, so that has been added.
Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We already have a pull request template. This is a propsal to add issue
templates as well. These yml templates change the behavior of reporting
issues to more a of a pre-formatted form with guard rails.
It is still possible to report blank issues the old way.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we don't have any VPD defined on this board, supply a default
password hash via the device tree instead.
Also, specify the path to external USB port, so that Infix will pick
it up in ietf-hardware.
Provide a patched device tree that:
- Uses the correct phy-mode for eth2, allowing it to be probed
properly
- Wires up the interrupt signal to the GPIO expander, so that the SFP
cage's I/O lines can be configured as interrupts, rather than having
to poll them
Assume that the caller always want to create a new partition table,
even in scenarios where one already exists. This allows devices to be
reprovisioned with a newer image, for example.
Fixes#394
This is not a production target, so we choose the more developer
friendly option of allowing the boot process to be interrupted.
Also, remove the old update cruft and rely on Marvell's `bubt`
instead.
The BootROM wants the bootloader to be located on LBA1, which is not
ideal when using a GPT to describe the partition table.
Make sure the `bubt` command targets SPI by default.
Buildroot's default ATF version changed from 2.9 to 2.10 when we
upgraded to 24.02.x. This meant that our patches were not applied,
which broke the build.
Take a conservative approach for now, and just pin the ATF version to
the known-good 2.9 series.
During the addition of multi-key support to RAUC and U-Boot, the
bootloader defconfig for CN9130 CRB was overlooked, which meant that
the Infix specific U-Boot hooks never ran, thereby ultimately breaking
the build.
Restore the required options to build in the dev-key by default.
The Buildroot 2024.02.x-kkit branch recently had uboot-tools upgraded
and the patches needed require bison to rebuild.
The recommendation is to also install flex, they always go together.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the salting being applied to Python's `hash()` (see [1]), the
hash of an object is not stable across different Python processes. As
a result, neither are the topology mappings generated by networkx.
The upside of this is randomness that we get better test coverage over
time, especially on physical devices where the underlying hardware
could differ between ports, for example.
On the other hand, it can be very frustrating to track down a bug when
locial nodes are suffled around between phyical nodes on each
invocation of a test case.
Therefore, use a random seed by default, but allow the user to specify
a fixed value if they so choose. We then add a meta test that logs the
seed being used for the current suite - which means we can simply
copy&paste that value to rerun the suite (or single test) with the
same topology mappings.
[1]: https://docs.python.org/3/reference/datamodel.html#object.__hash__
- Present the topologies to networkx as multigraphs, rather than
expaning each port of the record shape as a separate node.
- Create a topology mapping by locating a subgraph monomorphism of the
logical topology in the physical ditto.
This cuts down the time of finding a mapping by several orders of
magnitude. Example:
Before:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 13m1,213s
user 13m0,112s
sys 0m0,732s
After:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 0m0,153s
user 0m0,128s
sys 0m0,024s
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The dagger tool is a helper for scripts generated by confd and should
therefore be installed by confd instead of the rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order to make use of the DCB support in mv88e6xxx we also enable it
in the kernel config.
Fixes: 3a73ce3cfb ("kernel: Import EtherType based priority override support")
As mentioned previously, the NACM default ACLs in `factory-config` were
removed as part of the work on the nacm-basic branch.
Adjust text to not mention any pre-configured user levels, for now. A
future update may change the defaults when we've found resonable levels.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch helps silence kernel errors to console at boot. To fully
silence errors, enable emulated /var in your Qemu runs as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The fact that a USB device currently is not authorized is not an error.
This patch adjusts the log level to slip below 'quiet' to prevent logs
to console at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we do not yet have lldpTxFast, or similar, to enable on LLDP, we
tickle both services to resend their HELLO frames on link down/up event
instead.
+ Reduces turnaround times drastically
+ Restore regression test for mDNS, which we lost recently
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Our local runners do not allow sudo, e.g., when installing libyang and
the other dependencies.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the lifetime of Infix, so far, we've run into at least one customer
issue where we had qualms about our use of the local bit causing issues
with 3rd party software. In the end that was not the root cause of our
problems, but we spent way too much time worrying about it. Hence this
patch, which brings our virtual environments another step closer to the
real hardware that Infix runs on.
The OUI used is one of the "private" ones, taken completly at random.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The base mac address is used by bridges in Infix. This patch adds
support for extracting a base mac from the first interface "- 1",
e.g., if the mac address of e1 is 08:00:20:00:00:01, the base mac
will be 08:00:20:00:00:00.
This works with the Infamy test framework (Qeneth) and also with
the qemu script, included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even when `managed = "in-band-status";` was specified on a port,
mv88e6xxx would insist on forcing the values that were supposed to be
automatically picked up by the MAC via in-band signaling.
In the case of USXGMII links on 6393X, forcing the link bit would
sometimes, for reasons that are not understood, cause the SERDES to
reset its USXGMII link partner base page (register 4.0xf0a2) to 0,
which it would then interpret as 10M/half-duplex. As a result, the
SERDES would erroneously perform rate-matching to 10M on egress
towards the PHY (which is configured for 10G/full-duplex), leading to
nothing but dropped packets and much sadness.
This can most easily be reproduced by the following setup:
.------------.
| .-----. .-------.
| | p9 +---+ 3310P +--.
| 6393X :-----: :-------: | T- or X-Units looped via external cable
| | p10 +---+ 3310P +--'
| '-----' '-------'
'------------'
Make sure that neither p9 nor p10 are managed using in-band-status.
1. ip link set dev p9 up; ip link set dev p10 up
2. ip link set dev p9 down
3. ip link set dev p9 up
After step (3), p10 will experience the failure described above in
about 3/4 of the cases. In the cases where the issue does not arise,
simply repeat steps (2) and (3).
**Thank :heart: you for taking the time to fill out this bug report!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for the bug you encountered.
- type:textarea
attributes:
label:Current Behavior
description:|
A clear and concise description of the issue you're experiencing.
value:|
For code snippets, logs, commands, etc., please use triple backticks:
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-00-00-00 container[3192]: Failed creating container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Expected Behavior
description:|
A clear and concise description of what you expected to happen.
value:|
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-c0-ff-ee container[3192]: Successfully created container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Steps To Reproduce
description:|
Steps to reproduce the issue. For example:
1. Built from source
2. Upgrade to latest release, vYY.MM.P
3. Factory reset
4. Enable feature
5. Check the logs/show command/operational status
validations:
required:false
- type:textarea
attributes:
label:Additional information
description:|
- Relevant parts of `startup-config`
- Output from `show interfaces`, if applicable
- Other observations, screenshots, log files ...
**Tip:** You can attach images or log files by clicking this area to highlight it and then dragging files in.
description:Suggest a new feature, idea or improvement of the OS
labels:
- "feature"
- "triage"
body:
- type:markdown
attributes:
value:|
**Thank :heart: you for taking the time to fill out this feature request!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for your feature. We are also happy to accept contributions from our users. For details see [CONTRIBUTING](https://github.com/kernelkit/infix/blob/master/.github/CONTRIBUTING.md).
- type:textarea
attributes:
label:Description
description:|
A clear and concise description of the problem or missing feature.
**Example:** *I'm always frustrated when [...]*, or *I'd like to see support for [...]*
validations:
required:true
- type:textarea
attributes:
label:Additional Information
description:|
Any other related information, e.g. existing YANG model(s), or possibly screenshots about the feature request here.
validations:
required:false
- type:textarea
attributes:
label:General Information
description:|
Appended to all feature requests for future readers.
value:|
Anyone can help out by [sponsoring][1] development of new features or [contributing][2] pull requests.
Please use this issue for discussions related to the feature.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
