Normally, no logins are actually possible, but this will have two
desirable effects effects:
- /etc/issue will be printed when hitting return over the console,
allowing the user to see the bootstrapping errors again, without
having to reboot the system.
- On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can
login as root and debug issues.
Collect all bootstrapping issues in all banner-like files during boot,
so that they are presented to the user when logging in. This should
make it harder to miss overlook the fact that a system is running in a
degraded state.
Before this change, the system would move to runlevel 9 as soon as
startup-config failed to load, in which no getty is allowed to run.
Instead, we want to reserve that runlevel for when failure-config
itself also fails to load, since the system will have no valid login
credentials at that point.
This fixes [ERR] from CLI `show routes`, and broken operational status
in setups with DHCP client enabled by default.
Feature (static routing) introduced in release cycle, no need to bring
up in release notes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As it turns out, references to module objects are not safe to keep
across callbacks. In particular: loading a new model into sysrepo at
runtime may cause it to move objects around in memory.
Therefore, fetch a valid reference to "infix-system" on every callback
instead.
* sniffer did not work correctly
* links did not come upp as quick as in qemu
* must_reach in netns was to narrow, increase timeout
* add wait function to handle poll
Currently we only advertise SSH+SFTP services over mDNS-SD, which are
the default services from the avahi package. This patch adds support
for _netconf-ssh._tcp as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical studies shows that the surge protection on the alder board
is not compatible with Energy Efficient Ethernet.
Root cause has not yet been determined.
On the P2's the only reasonable way (in terms of hardware patching
effort) of driving the LEDs is to have the green LEDs at the top and
the yellow ones at the bottom.
Turns out that the gpio-charger doesn't have polled fallback if the
GPIO pin can't function as an interrupt controller.
Fortunately, we have access to the IRQ pin, so we can just use that
for now and leave the driver as-is.
Drop this deviation for v23.11 since it clashes with pyang + NETCONFc client.
We expect to support configuration of speed+duplex in v23.12.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest bump of klish-plugin-sysrepo we no longer need the extra
container name in commands and paths.
Also, update the "show interfaces" example in the top-level README.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for collapsing container-lists where applicable.
E.g., 'edit interfaces interface eth0' -> 'edit interface eth0'.
Great care has been taken to not mess up when container-lists are
critical, like ipv4/ipv6 routes.
Fix#187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting admin's password to "!" is not accepted by the model, which
means we end up in RMA mode, even in cases when a valid startup
exists.
Not supplying a password will cause confd to generate a locked
account, which is what we want.
- Fixes the locking warnings when configuring LEDs on 6393X
- Correctly power up 3310X PHYs strapped to start powered down
- Fix kernel oops when reading from blank NVMEM configured with an
ONIE layout
Silence kernel warning seems to be most secure option. Also, set
MFD_CLOEXEC, because if we ever fork off a child it should never
get a copy of this fd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New command 'show software' to display software versions on each
partition, install date, and which one is currently booted.
admin@infix-00-00-00:/> show software
NAME STATE VERSION DATE
primary booted v23.10.0-132 2023-11-23T22:24:33+00:00
secondary inactive v23.10.0-132 2023-11-23T22:24:33+00:00
admin@infix-00-00-00:/> show software name primary
Name : primary
State : booted
Version : v23.10.0-132-gfd6e8ea
Size : 61992960
SHA-256 : ed6146aec462b77fb8631b14c48d281dd0f4fdb9c062f9482d863ee854081358
Installed : 2023-11-23T22:24:33+00:00
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bootstrap script gets feedback from gen-admin-auth, on error we no
longer bail out but instead log the error and continue booting. This
way a developer build with root login can diagnose the error.
When logging the error we also set /etc/issue, /etc/issue.net for local
and remote login services, as well as the dedicated /etc/banner used by
OpenSSH, to hold the error summary. So when attaching to the console
port, or attempting to log in remotely with SSH, the error is printed
to indicate the device is not healthy.
Finally, since factory-config may be missing we need to bootstrap the
sysrepo db with something else, and fortunately we will always have a
failure-config to fall back on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If pwhash is missing from system.json, lock account. This allows for
more extensive diagnosis on developer builds with a root login.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break fallback hash to a separate function and allow gen_qemu_system_file()
to return the status. We'd like to update the qeneth templates to include
the same VPD data as is used with qemu.sh, but for now this is sufficient.
The Qemu detection has been changed to the, slightly more, secure detection
of qemu_fw_cfg filesystem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds generation of the 20-authentication.json snippet also
for failure-config. The gen-admin-auth script is extended with shell
parameter, since the default shell differs from factory-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit does several things. Its end goal is to fetch the admin
password hash from VPD memory during factory bootstrap.
To accomplish this probe creates a new file /run/system.json with
information read from a fw_cfg QEMU partition. The data from
/run/system.json is then later used during config bootstrap to fill in
the factory administrator password.
The idea is to make QEMU behave the same way hardware does, i.e. a
default/factory password should be fetched and used from
"hardware memory". The hardware portion of this is yet to be done.
Signed-off-by: Richard Alpe <richard@bit42.se>
With the behavior introduced in the referenced commit, port
interfaces (i.e. all ports on many systems) no longer get any SLAAC
address, leaving the user with no way of reaching the system.
Comment says this is by design, but that seems like an awkward
default.
Remove the option, and simplify gen_interfaces to either
- Enable SLAAC, if the port is not going to be part of any bridge, or
- Disabel SLAAC, if the port is going to be part of a bridge
If necessary, we can add an inverse option at a later date.
Fixes: d0f3960 ("confd: add -6 option to gen-interfaces for SLACC on port interfaces")
- Add deviations for non-supported statistics
- Limit config, currently we only have ro support
- Add deviations for non-supported configs and status leafs
[skip ci]
Also, add -S option to less, which causes lines longer than the screen
width to be chopped (truncated) rather than wrapped. With available
terminals supporting xterm a user can scroll right on really long lines.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default srp_show@sysrepo function creates the stripped down version
of running-config that, in the context of showing startup-config or the
factory-config, is very difficult to explain to users why they differ in
format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Having klish as the login shell means losing lots of neat features we've
gotten used to: help text in less pager, initial terminal probing on the
console, and more.
This commit replaces the clish -> klish symlnk with a fuzzy bash wrapper
that fixes all the above annoying little things.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change, the following would happen in /lib/infix/mnt if a
factory-reset was performed:
1. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
2. Check for factory-reset
3. Clear /mnt/cfg/* and /mnt/var/*
4. Mount overlays
This ordering leaves the system with a completely empty /var on the
boot when a factory-reset is executed. Finit will fixup some of this
via its tmpfiles scripts, but we want the ability to ship files under
/var as part of the Squash and have these be available after the bind
mount, just like what happens at every other boot, when we don't
perform a factory-reset.
We solve this by delaying the bind mount (1) until after the reset has
been performed, together with all the overlays (4). While we're here,
make the fallback case, where no persistent /var is available, use a
bind mount as well. This should allow containers to be tested on such
setups, and it's one less flavor to test.
New order:
1. Check for factory-reset
2. Clear /mnt/cfg/* and /mnt/var/*
3. Mount overlays
4. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
Now the only difference between a regular boot and a
"factory-reset-boot" is whether (2) executed or not.
We haven't even called sr_get_items() yet. Must've been a remnant
of an earlier refactor.
Fixes CID 331051
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By default, assume that any LED with the function "tp", "sfp" or
"port" is attached to either an Ethernet PHY or MAC, with support for
offloading the "netdev" trigger.
Use green LEDs to indicate link/activity.
Disable any yellow LEDs for now, later on we can add alarm indications
etc. to these.
When dropping the net package in 5031ff6, a rebuild + test was not made
before pusing to main. As a result Infix suddenly lost one of its most
important packages, iproute2.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate Finit conf to package, like klish and confd. Add condition to
ensure it is not started before mdev/udevd are up and kernel LED modules
have been loaded properly.
Also, add tmpfiles.conf to ensure /run/led is recreated at every boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only config no operational state yet.
routing
routing/control-plane-protocols
control-plane-protocol static name default
static-routes
ipv4 route 192.168.200.0/24 next-hop special-next-hop blackhole
The intention of this is to serve as a help/guidance for both devs and
reviewers of pull requests.
Baseline is taken from Linux v6.5.6, with some (possibly) controversial
additions (at the end of the file):
- Do not enforce max line length
- Alignment of variables, both when assigning and declaring
- Use spaces to adjust when leading tabs are not enough (as Emacs)
I've also added a couple of exceptions for macros like TAILQ_FOREACH()
which are used as control statments (if, while, for), so the opening
brace should be on the same line -- otherwise clang-format thinkts we
are creating a recursive function ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds PID readiness notification to Net-SNMP. This is
required for synchronizing processes like subagents.
PID readiness is similar to systemd READY=1 notification, which
Finit supports, but Net-SNMP only supports that at first startup
not after SIGHUP.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There should be no functional change in this patch.
In this patch we rewrite the data collection in python3. This is the
new script called "yanger". It runs various commands on the system,
such as "ip" and "ethtool". It then mangles the output data from these
commands into valid YANG data.
The yanger script is started from the sysrepo callback in the statd c
code. Its output is parsed using lyd_parse_data_fd().
This means that the daemon part of statd is still written in c and the
new python code is only used when getting a query callback from
sysrepo. The c code still handles the interface netlink messages from
the kernel which controls what interfaces statd should do sysrepo
subscribe/unsubscribe to.
Signed-off-by: Richard Alpe <richard@bit42.se>
Expose fsystemv() in header and remove static. This function can be
useful for others that needs to be in control of any output stream.
Signed-off-by: Richard Alpe <richard@bit42.se>
When Infix Fail Secure Mode ends up in RMA state, runlevel 9, we should
not allow Finit to "time out" and give us a login prompt. Instead we
disable all login services in runlevels 7-9, reserving these extra
levels for future failure modes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Most defconfigs have Bash enabled, those that do not will have the
BusyBox symlink to ash.
This fixes the completion isses we've seen with initctl.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mostly a Bug fix release. Only major change is support for service
`notify:pid` and `readiness none` global option to change how Finit
expects readiness notification.
Fixes:
- Dbus and runparts regression in Finit v4.5. The configure script must
expand `FINIT_RUNPATH_` before defining it in `config.h`
- Service environment variables drop everything but the first argument,
e.g., `VAR="foo bar qux"` drops everything but `foo`
- Internal conditions, e.g., `<int/bootstrap>` turn into flux when
leaving bootstrap, causing depending services to stop
- Global environment variables declared with `set VAR=NAME` do not drop
leading `set `, causing `'set VAR'='NAME'` in env.
- Sanity check environment variables, for services and globally. Ensure
the variable name (key) does not contain spaces, or a leading `set `
https://github.com/troglobit/finit/releases/tag/4.6
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop bridge pvid setting in YANG model, we require bridge ports to
have explicit VLAN assignment (security)
- refactor bridge_vlan_settings(), do not enable vlan_filtering if
there are no VLANs configured on the bridge
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adding missing information
- that PVID should (typically) be set for ports associated untagged
- that the bridge should associated with VLAN to terminate the VLAN
in the bridge
Providing an additional config example (VLAN atop brigde)
Adding picture for this and the existing example (VLAN atop Eth)
Adding info on name conventions (eth.20 vs vlan10)
[skip ci]
Upstream has replaced interactive="true" with:
- in="tty"
- out="tty"
- interrupt="true"
Also, disable Oneliners option since it's too confusing for users
compared to the regular JSON output for startup and factory-config
We can [skip ci] since we do not have any CLI tests yet.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some reasone upstream changed the Pager (less) from -r to -R, to
explictly only allow ANSI color sequences. This caused the 'show
interfaces' command to output <EF><33><13> style replacement chars
instead of UTF8 line drawing characters.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is an attempt at improving the error reporting from klish-plugin-infix,
or more specifically commit@infix. Previously none of the sysrepo errors were
shown, now all the latest errors, as well as a few new ones specific to
interfaces have been added.
Example (eth0 does not exist):
admin@infix-00-00-00:/config/> edit interfaces interface eth0
admin@infix-00-00-00:/config/interfaces/interface/eth0/> leave
Error: Mandatory node "type" instance does not exist. (Data location "/ietf-interfaces:interfaces/interface[name='eth0']".)
Failed committing candidate to running: Validation failed
admin@infix-00-00-00:/config/interfaces/interface/eth0/> set type ethernet
admin@infix-00-00-00:/config/interfaces/interface/eth0/> leave
Error: Cannot create fixed Ethernet interface eth0, wrong type or name.
Please check your changes, try 'diff' and 'do show interfaces'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This affects CLI command such as:
> show interface name p1
Prior to this patch, this took roughly ~1200ms on hardware and with
the path it takes roughly 50ms.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a python3 script "ethtool-to-json" which runs ethtool locally and
converts output which we are interested in into json. The script
simply json encodes the output from ethtool, i.e. it does not print it
in YANG format. This might be a good idea to change in the future if
the C code has to do a lot of ethtool to YANG translations.
The json output of the ethtool-to-json script is then parsed in C
using libjansson, translated to YANG and added to the operational
datastore.
Signed-off-by: Richard Alpe <richard@bit42.se>
The idea was to change regression tests to opt-in, but it does not work
as intended for our core devs, so revert.
If you do *not* want the workflow(s) to run on your fork, you can
disable them with the [...] button on the right-hand side, beside the
"Filter workflow runs" text entry, in the Actions view of your fork.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor factory-reset check slightly to check for a Finit condition
from the bootloader, as well as a custom check for br2-externals.
Note, the chgrp call has been extended to ensure admin users have
permission to create any file or directory in any overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change updates the documentation for the script, hopefully it is
more readable now than the previous wall of text.
Also, a new -6 option to toggle IPv6 SLACC option for port interfaces.
This, in combination with omitting the -b option, allows for enabling
SLACC on interfaces that would otherwise not get an address.
No functional change, tested manually [skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When released the YANG status section claimed IPv4/IPv6 MTU was
not-supported, which was very confusing since the following Changes
section clearly states added support for it.
The YANG Status section was wrong. It has also been cleaned up a bit.
E.g., no need to mention which native model provides an augment or a
deviation, to an end-user the only thing that matters is what is added
to or removed from the standard models.
[skip ci] becuase none of this warrants a rebuild.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No logical change, keeping modification date and revision. We may be
stricted in the future with this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Per spec[1], the PRETTY_NAME "May or may not contain a release code name
or OS version of some kind, as suitable." and seeing as this is not only
a common practice, Finit use this string in the heading when booting.
We've had this already in Infix a while back so it must have been lost
in one of many refactoring rounds.
[1]: https://www.freedesktop.org/software/systemd/man/latest/os-release.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, fix collation of .json snippets to ensure they are sorted by
number, regardless of which directory they originate from.
Second, and with an unexpected twist, use /etc as the target directory
for factory-config.cfg and failure-config.cfg. At first just to avoid
having the resulting .gen and .cfg files in /run/confd/, but it also
unintentionally gives us a way to provide a static /etc/factory-confg
in the image. As the TODO says, not perfect but better than before.
Third, update load script to use the same base path as bootstrap by
sourcing the system /etc/confdrc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A customer specific build required more RAM to boot (bigger image and
more features), but there was no way to modify this as an end user.
This patch opens this up and should give our users a more smooth ride!
We can [skip ci] on this, no functional changes to the OS itself.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adhere to our recommendations and avoid pseudorandom passwords which
are "easy to remember". Also increase password length to 13 chars.
Side notes:
Knowing that a password contains at least one char, one number and so
on, lowers the number of possible passwords to test when brute forcing.
The entropy for the pwgen "easy to remember" passwords isn't good
(naturally).
Signed-off-by: Richard Alpe <richard@bit42.se>
Add counters from Ethtool groups to the operational datastore. The
mapping from Linux / Ethtool to YANG is described in the included
document eth-counters.md.
Signed-off-by: Richard Alpe <richard@bit42.se>
Replaced with full build in GitHub Actions. No other use-cases for it,
and too much of a hassle to maintain, so remove.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A list of interfaces: x10 x9 x8 x7 x6 x5 x4 x1 x2 x3 should be sorted in
order with x10 last. Using the common 'sort -n' would generate: x1 x10
x2 ... so we use version sort. This way we can ensure that the order of
bridge ports is natural and what end users expect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Operational experience shows that the current Infix Fail Secure mode,
introduced in ca9daef, does not work in practice.
The factory datastore in sysrepo is created at boot with the YANG models
and the factory-config file. When the factory-config file is generated
from older versions of these models, the resulting datastore may fail to
pass the validation and system will end up in an unrecoverable state.
Instead, both the factory-config and failure-config must be created at
every boot to match the YANG models in the active Linux image. This
ensures loading the YANG models will always work and the system can
proceed to attempt to load startup-config to the running datastore.
If loading startup-config fails we can fall back to failure-config,
which like factory-config, will then provide a way to log in an dianose
the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If the bootloader knows about a factory-reset or dev-mode button, use
them to allow stopping the boot process, and to signal the
factory-reset condition to infix.
This implements the new model infix-if-vlan.
The new CLI is:
root@infix-00-00-00:/config/interfaces/interface/vlan10/> set vlan id 10 lower-layer-if eth0
with an possible extra option for tag-type, default tag-type is c-vlan.
Without it, the offset generated will always be zero.
But over netconf it will still be correct, most likely
because due to how libyang handles the date-and-time type.
The issues seen in the regression tests looks related to files
missing from minimal defconfig.
Fixes#127.
Signed-off-by: Richard Alpe <richard@bit42.se>
DSA ports such as pX has "link" (parent) set to dsaY. We don't see it
that way from an networking perspective. In this commit we avoid
adding parent to the statd data structure if the linkinfo -> info_kind
is dsa. This means the ports shows up as regular interfaces, which is
what we want.
Signed-off-by: Richard Alpe <richard@bit42.se>
Pretty print all Ethernet frame statistics from the operational
datastore. Only in the detailed interface view.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds the framework for reading ethtool statistics and
inserting it into the operational datastore.
The ethtool data we rely on is "group data" such as "eth-mac" or
"rmon".
This data can be displayed using:
ethtool --json -S e0 --all-groups
The "group data" is still missing for most common drivers, so testing
this will require a firmware which has support for it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Regenerate if either factory-config.gen or failure-config.gen is missing.
This should not happen, but is better to check for the result rather than
the intermediate result.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to run "resolvconf -u" at boot we need dnsmasq up and running
and startup-config having been loaded successfully. (No point when we
hare in fail secure mode.)
If this bugs out it can be pinpointed by an empty /etc/resolv.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the two /etc/os-release variables:
- IMAGE_ID
- IMAGE_VERSION
The former is configurable, with fallback to name-arch, and the latter
is only set for relase builds. During releae builds the release will
be appended to the image name.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Marvell mv88e6xxx switch driver currently used in active projects do
not support multicast router ports properly yet. Considering that Infix
do not yet have YANG support for configuring IGMP/MLD snooping, we have
decided to disable it in bridge setups by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We should only call 'error' in case loading failure-config fails, not if
loading startup-config fails. Unclear how this passed testing, must have
been a last minute change that got untested.
Found during integration in customer's br2-external.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Overzealous shellcheck application lead to gen-intefaces not creating a
bridge when GEN_IFACE_OPTS was uncommented in /etc/confdrc
Verified in customer br2-external.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Create per-arch unique distribution file names
- Source .gns3a information from /etc/os-release
Instead of attempting to create unique file names by hard-coding an
'infix-' prefix and extracting the "board" or "arch" part from the
defconfig, let's use the branding information from /etc/os-release
along with $BR2_ARCH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it possible for projects using Infix as a br2-external to
override lots of OS-specific strings and contact information that
previously was hard coded.
The generated /etc/os-release now takes most of its data from .config
Worth noting is the changes in VERSION and BUILD_ID fields. The former
will be INFIX_RELEASE, during release builds, and the latter is always
the output from `git descibe ...`, or rather GIT_VERSION. This variable
can be overloaded as well.
See the help text and the new doc/branding.md document for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default arch and disk image filename needs to be generated
to be unique per, at least, each architecture build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to problems with using u-boot as loader¹ we decided to start the
system by calling the kernel image directly. The downside to that is
that, even though RAUC upgrades would work, the kernel would remain
the same.
Improvements to this are of course welcome.
________
¹) Must extract the built-in .dtb and merge with the Qemu .dtb at runtime
to be able to boot primary (or secondry) image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling `load_cfg BR2_EXTERNAL_INFIX_PATH` from post-image.sh caused
warnings due to multiple hits in the .config file:
post-image.sh: 12: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
post-image.sh: 13: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
Let's grep for a "key.*=" instead of "key" to drop those warnings, while
still acting as a catch-all for partial matches.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes to IPv6 address origin (type 'random' rather than 'other')
now reflected in documentation.
Also using 'admin' instead of 'root' user in examples.
As we may need to load firmware to the PHYs, we can't load those
modules until we have access to the rootfs. In order for that to work,
the MDIO driver must not be built-in, as that will cause the kernel to
bind devices with missing (built-in) drivers to bind to the genphy
driver.
Therefore, build everything as modules and let udev load it during
boot.
In order get the ONIE EEPROM support and some mv88e6xxx related fixes,
move to 6.5.6, with the intention of upgrading again, to the next
longterm kernel, as soon as one becomes available.
Also, import patches from kkit-linux-6.5.y.
Everything else is named confd, even syslog messages are logged as
confd, and we've talked about not using sysrepo-plugind one day, so
let's prepare for a world where everthing is like that.
Also, and even more importantly, fix the sysrepo-plugind condition.
We cannot use <pid/syslogd>, because it can be restarted and thus
consequently Finit will stop sysrepo-plugind. This first caused a
bit of head scratching because it cause a lot of very odd errors in
the execution of sysrepo-plugind, transactions being abruptly aborted
for instace.
Whatt we can do, however, is use a static condition, which Finit has
support for since a few releases now. We want to guard the start of
our sysrepo-plugind service behind YANG /usr/libexec/confd/bootstrap.
So we can use <run/bootstrap/success>. In case the bootstrap fails,
we catch that in the row before using if:<run/bootstrap/failure> to
trigger the /usr/libexec/confd/error script (described previously).
The other run/task/services can be guarded behind <pid/confd> and now
everything suddenly makes sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New script 'error' that can be overridden by a br2-external
- Call 'error' if YANG model bootstap or factory-config.gen fails
- Call 'error' if loading startup-config or failure-config fails
The 'error' script calls syslog¹ to log the error messge:
The device has reached an unrecoverable error, please RMA.
____
¹ to get a timestamp log message, and send remote in case a
br2-external has somehow hard-coded network for remote syslog
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This rather huge change is a refactor of the factory-config generataion to add
support for also generating a failure-config.
The confd bootstrap script has been given an rc file. This both eases manual
testing, when modifying the script(s), and also makes it easier to override
from a br2-external. Infix default is router/end-device, but a br2-external
may be a switch firmware and want to default to all ports in a bridge.
The generated failure-config creates a fail-safe "do no harm" config to boot
with in case startup-config for some reason is broken or cannot be applied,
e.g., bug in confd. Meaning, for both the router and switch use-cases the
device will start up with all interfaces isolated¹, with an IPv6 SLAAC (EUI64)
address per interface.
Services enabled in this fail-safe mode are: LLDP, mDNS/SD, SSH, and NETCONF.
All to facilitate diagnostics, troubleshooting and device recovery.
Other noteworthy changes include:
- rename factory/failure directories again -> factory.d/failure.d. Use
same naming as we do on target for directories holding generated files
- The bootstrap script no longer regenerates /cfg/factory.d on each boot
- The bootstrap script copies all static templates to /cfg/factory.d in
case a newer image changes the contents of them. For troubleshooting
- Support for overriding the 20-interfaces.json generation by br2-external
- Support for additional 30-config.json (ovrride/extend) by br2-external
- Expand gen-interfaces to support bridge use-case.
_____
¹ For a switch this means "no switchport", i.e., no switching between ports
otherwise connected to a switchcore (or bridge) in startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd and BusyBox syslogd can not run at the same time. Since they
provide the same service we standardize on them providing <pid/syslogd>.
Also, ensure syslogd does not start until the fifth udevadm has completed.
This creates a barrier preventing other run/task/services from starting
too early. Thus guaranteeing a proper boot order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit fixes a regression introduced in 15572e9e where /bin/bash
was unintentionally set as the defalt /bin/sh in the system. This cause
several warnings and errors when a Bash-based /bin/sh tries to sources
/etc/profile because $SHELL identifies it as /bin/bash.
The ietf-system.yang model, with the infix-system.yang extensions,
declare a per-user SHELL that allow /bin/clish, /bin/bash, /bin/sh
and /bin/false. There should be a clear distinction between them.
This change also helps us keep bashisms away. If a script needs
Bash features, declare: #!/usr/bin/env bash
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit drops sulogin from BusyBox, as well as the Finit replacement,
in the NETCONF builds. The classic builds retain the Finit sulogin.
Furthermore, the Finit rescue mode is disabled (which uses sulogin), so
in case of trouble at boot, e.g. missing fstab or failure to fsck, the
system will no longer go to sulogin but instead log error to console and
reboot.
NOTE: the bootloader still needs to be locked down, otherwise a user
could just as easily change kernel cmdline to 'shell=/bin/sh'
Misc. reshuffle and defaults updated are due to make foo-update-defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- with conditional execution support
- fixes to udevd and udevadm calls in renamed 10-hotplug.conf
- support for overriding internal services, e.g. dbus, keventd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only create a default startup-config from factory-config if one is missing.
Do not load an existing startup-config, that is handled by a later step in
the boot process, which needs to be monitored (and displayed) separately to
fail over to a Fail Secure mode on error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes to the system concerning access rights, like users, should always
be logged, in particular when creating new users or failure to create or
modify their properties.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change addresses a problem accessing Infix over SSH. The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.
The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.
As before this change, the script starts by calling `sshd -t` to verify
they hostkeys. Unlike before we now check for 'invalid format' in the
output of that command. If any file with invalid format is found, we
remove them and regenerate the hostkeys.
In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.
Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We only want Bob to run when PR's have been merged to main, this means
when something is pushed to main. (Took a while to figure this one out
actually.) See the following community discussion for details:
https://github.com/orgs/community/discussions/26724#discussioncomment-3253102
Also, we've seen that moving the 'latest' tag messes up any push/pull/sync
operation between clones and forks, so let's skip it and see how that works.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle IPv6 Router Advertisement (RA) based addresses.
If the last 64 bits of a link-local address is generated using the
local MAC address of the interface, i.e. a EUI-64 based address. Then
the origin is set to "link-layer".
If the addrgenmode is set to "random" instead of "eui64", then the
device will generate the interface identifier portion of the address
(the last 64 bits) randomly rather than deriving it from the MAC
address using the EUI-64 process. This will result in a "random"
origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
Setting the link MTU in Linux changes the sysctl IPV6 MTU, so we have to
set the IPv6 MTU on each run in case the IPv4 MTU changes. Hence, this
also means the IPv6 MTU must be set *after* the IPv4 (link) MTU.
statd has been updated to read the sysctl setting for IPv6 MTU.
Notice how the loopback interface is unsupported for config + status.
Fixes issue #151
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the new fancy result-gh.md file which as github emojis. Also,
split result publishing to its own run command to simplify the YAML
file.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result file with github emojis
> 9pm.py: expose ROOT_PATH to tests via env
> lib_tcl: improve handling of extra ssh args from test
> 9pm: fix evaluation of <base> option in nested suite
> .github: publish test result md in github
> 9pm: resolve <scratch> in suite option
Signed-off-by: Richard Alpe <richard@bit42.se>
Collecting pyyaml==5.4.1 (from -r /root/pip-requirements.txt (line 6))
Downloading PyYAML-5.4.1.tar.gz (175 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 175.1/175.1 kB 16.2 MB/s eta 0:00:00
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'error'
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> [68 lines of output]
/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/config/setupcfg.py:293: _DeprecatedConfig: Deprecated config in `setup.cfg`
!!
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
!!
parsed = self.parsers.get(option_name, lambda x: x)(value)
running egg_info
writing lib3/PyYAML.egg-info/PKG-INFO
writing dependency_links to lib3/PyYAML.egg-info/dependency_links.txt
writing top-level names to lib3/PyYAML.egg-info/top_level.txt
Traceback (most recent call last):
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 335, in main
json_out['return_val'] = hook(**hook_input['kwargs'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 118, in get_requires_for_build_wheel
return hook(config_settings)
^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 355, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=['wheel'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 325, in _get_build_requires
self.run_setup()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 341, in run_setup
exec(code, locals())
File "<string>", line 271, in <module>
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/__init__.py", line 103, in setup
return distutils.core.setup(**attrs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 185, in setup
return run_commands(dist)
^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 201, in run_commands
dist.run_commands()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 969, in run_commands
self.run_command(cmd)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/dist.py", line 989, in run_command
super().run_command(command)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 988, in run_command
cmd_obj.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 318, in run
self.find_sources()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 326, in find_sources
mm.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 548, in run
self.add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 586, in add_defaults
sdist.add_defaults(self)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/sdist.py", line 113, in add_defaults
super().add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 251, in add_defaults
self._add_defaults_ext()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 336, in _add_defaults_ext
self.filelist.extend(build_ext.get_source_files())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.
note: This error originates from a subprocess, and is likely not a problem with pip.
The command '/bin/sh -c ~/init-venv.sh ~/pip-requirements.txt' returned a non-zero code: 1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Improved "show interfaces" information is now
reflected in IP address examples
- source info added
- IPv6 addresses shown
Also added an example with IPv6 privacy for stateless autoconfig
Manually merge PR #137, with minor updates to the YANG deviations, and
complete relocation of the new user-guide. The idea is to keep all the
documentation generic and use the docgen package later to include all
relevant parts into a PDF user guide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Like the Developer's Guide the User's Guide should be a single file on
top-level (at least for now), where it references certain sections in
other files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting deviations of non-supported parts of ietf-ip
Idea is that "pyang -f tree ietf-ip.yang infix-ip.yang" should
show what we really support (and should make tests for).
Only physical interfaces have a permanent link address. So in order to
restore the default MAC generated by the kernel for interfaces such as
bridges, veth pairs, VLAN interfaces, and link aggregates, we recreate
them.
This patch adds support for checking if the phys-address attribute has
been deleted from bridge, vlan, and veth interfaces.
The netdag_must_del() function has been refactorored slightly so each
interface type is responsible for returning true if its condiitions are
satisfied.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The netconf-client Python lib currently does not support the <get-data>
RPC. This commit adds a local extension to the Device class which can
be upstreamed at a later time.
Also some added comments and disabling of pylint warnings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Override read-only flag in YANG model
- Add support for setting custom MAC
- Add support for restoring permanent/original MAC
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable privacy feature, allows true random address instead of EUI64
- Allow global addresses to use router prefix
Fixes#136
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set the IP origin "random" for avahi IPv4LL addresses. The reason we
use random and not link-layer for link-local IPv4 addresses is the
fact that they are not based on link-layer info, such as IPv6 eui64
generated LL addresses.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine copy of the current version of avahi-autoipd.action.
This script will be modified by us in later commits.
Signed-off-by: Richard Alpe <richard@bit42.se>
Modify existing IPv4 code to also add IPv6 address data to the
operational datastore. Also add support for handling link-layer IPv6
address.
IPv6 LL addresses generated with eui64 has "link-layer" origin
and random/secure generated LL addresses has "random" origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
This currently includes cli-pretty tests. It could be executed
separately to clarify test results in github actions. This commit
includes it in the main test execution. The most important thing is
that it's executed.
Signed-off-by: Richard Alpe <richard@bit42.se>
It doesn't look like the regression suites updates the 9pm submodule,
in this commit we attempt to fix this.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: print git sha sum in banner
> 9pm: add graceful check for missing suites and tests
> ssh: Spell out the full name of node properties
> ssh: Remove username from debug messages
> Merge pull request #48 from neg/execute-cleanup
Signed-off-by: Richard Alpe <richard@bit42.se>
There might be more places in confd where this is needed. This works
for the most basic use case.
The proto set here is picked up by statd and converted into a YANG
origin, which is exposed to the user.
Signed-off-by: Richard Alpe <richard@bit42.se>
Flush addresses during shutdown and renewal with new address.
This is kind of a hack and needs further testing.
Signed-off-by: Richard Alpe <richard@bit42.se>
This fixes one bug in Infix, namely that dhcp removes all other
statically configured addresses. However it introduces a new one
where dhcp renewals with new ip addresses are added as "duplicates",
we fix this in a later commit in this patchset.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine version of default.script to our local board override.
The reason for this commit is to track changes we do to it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add protocol from ip route (kernel) as origin in YANG model.
Note, we control the names static and dhcp in the file rt_addrprotos.
Signed-off-by: Richard Alpe <richard@bit42.se>
This file is read by iproute2 and creates valid names for ip proto.
Such as "static" in:
ip addr add dev e0 192.168.1.1/24 proto static
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result markdown file
> Use unique log dir for each 9pm execution
> 9pm: parse 9pm.rc file in harness
> Add new 9pm.py harness examples
> 9pm: add space between timestamp and output
> Move tcl library code to lib_tcl subdirectory
> 9pm: fix TAP skip result when not last in test
> unit_test: allow tap.yaml to be executed from cmdline
> Merge pull request #49 from kernelkit/master
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows us to show empty values easier, while not affecting the
if statements.
This allows for a greater flexibility in which values are shown and
not. For example, we want to show empty columns for data that the
user adds/removes, such as IP addresses.
...
ipv4 addresses :
...
However, we don't want to show empty columns for information that
should never exist for a particular interface type.
Signed-off-by: Richard Alpe <richard@bit42.se>
The old version (bash) where slow and cluttered. This version is much
faster and easier to read / maintain.
Signed-off-by: Richard Alpe <richard@bit42.se>
This test is a "unit" test, which implies that it can be executed
locally without access to a Infix target environment.
Signed-off-by: Richard Alpe <richard@bit42.se>
The port marker is intended to be used as a hint to the
auto-factory-config generator, so that it can create a bridge for all
switch ports by default. Therefore, revert to only include ports that
devlink reports as "flavour physical".
If we want to test this functionality in QEMU, we can use Rocker, the
virtual switch, instead.
The old assumption was that only virtual links would have specific
"linkinfo" data. However, somewhere between 5.19 and 6.1, DSA ports
gained the ability to report its "conduit" interface via the
"linkinfo" attribute. That's great, but unfortunately it broke our
heuristic assumptions.
The new assumption is that only physical ports will report a
"parentbus" attribute. Let's see how long that will last :)
Our custom version has gone from being newer than Buildroot's default
to being older, so there is no reason for us override it anymore.
The kernel has become a bit more picky and will give nasty error
messages if a link's PHY connection is not explicitly defined, but
instead relies on implicit defaults. This was missing from the CPU
port of the CRB, so we supply a small patch to fix that.
When running `make legal-info` Buildroot will collect source and
licenses for all packages, which generates a few warnings for our
local packages. Local packages are skipped.
> The source code for packages that set <PKG>_REDISTRIBUTE = NO will not
> be saved. Patches that were applied are also saved, along with a file
> named series that lists the patches in the order they were applied.
Hence, setting 'foo_REDISTRIBUTE = NO' disables the warning, which seems
like a good idea to reduce the number of unnecessary questions we might
otherwise get.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrap and daemon-specific helper scripts, sometimes known as foot
guns, should not be in $PATH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This unfortunately required some restructuring, and as well as extending
the run time since we have no way of sending Ethernet frames currently
in the test framework (socat would be nice).
- Put enable/disable of services before tcpdump start, LLDP lingers ...
- Extend run time: 3 -> 20 sec to catch periodic LLDP messages
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test use NETCONF to enable/disable SSDP, it then verifies that the
DUT responds to, or does not respond to, SSDP discover messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This first version reliles on netcat (nc), mostly because that's what I
could figure out how to run in a netns. A better way would be to have a
full SsdpClient that can collect query responses properly and log all
devices found.
This, however, will do fine for verifying SSDP on/off functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for enabling LLDP using the std IEEE 802.1ab
LLDP yang model. An infix-lldp model is as well to reduce the set of
available parameters to a bare minimum (enabled), for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
I'm sorry, I'm just so used to this modus from the previous company.
The difference to 'exit', which is available on Cisco IOS, is that it
on the top-level config context does not exit/abort to admin-exec but
instead stops.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The script resides with confd and sets up our system for confd, this
should make it easier to rememeber where it's located.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, for usability, add `name:<SVC>` to each service declaration so they
can be located more easily and/or enabled/disabled using the service they
provide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything (!) potentially shared with other sysrepo plugins/daemons and
helper functions (not yet in libite) that can be used by other daemons
have been relocated to libsrx.
Fix#116
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops auto-enable of services we want to be able to control
via NETCONF/YANG. SSDP and mDNS/SD enable/disable configure support,
using native models, will be included in the same PR and LLDP+SNMP may
come later, using std. IEEE/IETF models, they are not critical atm.
Fix#118
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some system, certain interfaces are not usable by an end-user. The
canonical example of this is the ethernet MAC connected to a switch,
i.e. the DSA port.
Avoid having these be picked up in the generated factory-config, which
would be confusing to a user, by classifying them as "internal" ports
to be ignored by confd and friends.
For some reason, the controller disables the bus power sometime after
it was enabled by the driver. The reference manual says, in Table 645,
about the SD_BUS_POWER bit:
> ... It will be cleared if one of the following occurs: the
> sd_bus_vlt and the voltage support in the Capabilities Register 1 do
> not match or if a card removal state was detected.
Further investigation will be needed to find the (electrical?)
root-cause of this issue.
The kernel's mounting of the rootfs may race against the underlying
device being probed - especially for media like MMC cards and USB
sticks.
Therefore, tell the kernel to wait for the root device to show up.
In the future we want to build disk images from builds where we
haven't locally built Infix, we've just downloaded an existing
release. In those cases we also have to create rauc.status, even
though we're not creating a bundle.
This is the layout expected by the "distro boot" effort in U-Boot.
As far as I understand, the contract is:
- U-Boot built for `fooboard` by `vendor`, will set the `fdtfile`
variable to `vendor/fooboard.dtb` - or more precisely: matching
whatever path the dtb is built at in the kernel tree.
- A distro (e.g. Infix) then just needs to specify the `fdtdir` in its
syslinux config (/boot in our case), and U-Boot will be able to find
the correct dtb.
Make the traditional FITs smaller by:
- Filtering out the kernel image from the rootfs, since the FIT way is
to ship it separately.
- Gzipping the kernel in the FIT, since aarch64 uses the uncompressed
"Image" format, and squashfs won't take care of it for us.
Add source, such as "ethernet" to the show ietf interfaces command.
This is translated from the somewhat obscure ietf type, such as
iana-if-type:ethernetCsmacd => ethernet
Signed-off-by: Richard Alpe <richard@bit42.se>
Replace the old "ip" output with data from the sysrepo operational
datastore. This data is piped through the new json-cfg-pretty script,
which formats the data in a nice human readable way.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add IPv4 address info from "ip addr" json to sysrepo operational
datastore.
This patch adds: MTU and ip with prefix-length.
Signed-off-by: Richard Alpe <richard@bit42.se>
The commit adds a missing description and reorders some yang statements
to meet canonical ordering according to RFC7950, section 14.
It also relocates the /interfaces/interfaces/infix-if:port augment to
its own base model that the bridge (and later lag) models reference.
Solving the bisarre ordering issues we've seen previously.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new infix-interface-type, derived from the IANA base
type, allowing us to limit the list of supported native interface types.
Basing on IANA interface type ensure compatibility with other models,
e.g., standard/ieee/published/802.3/ieee802-ethernet-interface.yang,
which attaches itself to all interfaces of type ianaift:ethernetCsmacd.
Tested with yanglint and in Infix using ieee802-ethernet-interface.yang,
the 'ethernet' container was properly attached to interfaces of type
infixift:ethernet.
Tab completion in the CLI now lists only the supported types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This further locks down confd to fall back to /bin/false as login shell
in case of internal errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch restricts the possible user shells to a subset of the list in
/etc/shells, which is generated by Buildroot. The default is 'false' to
prevent accidental shell access for non-admin role users.
The default shell for the admin user is now /bin/clish, which can be
further locked down before Infix v24.02 LTS.
In case of internal error the default fallback shell is now set to the
customizable LOGIN_SHELL, which currently is /bin/bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following changes have been made to condense and simplify the
leading text in the README. Tested with Grip to verify that the first
paragraph flows nicely to the left to the fine new logo. This allows
us to use the space more efficiently and the reader does not have to
scroll so long before reaching relevant content.
- Right-align logo, and shrink it a bit, to fit text to the left
- Move topic links to a foldout at the top
- Move boring licensing stuff to separate docment
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Go for something simple - Tux trapped in an RJ45 jack.
Also, remove the old versions that we don't use any more. They're in
the log if we ever need them.
This is a cleanup and reorganization of the Infix documentation.
Starting with a simplification of the top-level README, splitting
it up into several pages.
Also, fixes#100 by updating the documentation on Qemu.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also renames all klix_SYM@klinfix to SYM@infix, this is fine since we're
always calling these symbols with @infix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Always respect the requested model to emulate. Before this change, a
device configured to run in TAP mode would ignore a user's requested
model and always emulate a e1000.
This worked on x86_64 where that driver is part of the kernel, but
that is not true for aarch64.
- Always supply a mactab. It was very confusing that the interface
names would change, in Infix, depending on the selected networking
mode.
- Remove old decoy variables that were assigned but never used
anywhere.
- Separately setup the host and target side of a nic (i.e. use a
-netdev/-device pair instead of the -nic shortcut). This lets us
share the host side setup across all modes.
This reverts an earlier change where nano was made the default editor in
a misguided attemt by yours truly to accomodate beginner users.
With the recent improvements of the CLI and the fact that the NETCONF
support has matured greatly, the need for a user-friendly editor have
diminished drastically. Editing system files is now limited to devs
and the core team prefers Mg over nano and vi.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, add a new `quick.md` that pops up when the user types `help`.
Very quick intro to get started. Useful when we add a factory-default
motd: "Welcome to the CLI, type 'help' for a quick overview."
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync sysrepo conf settings, lots of new settings added, one removed
- Check if help topic exists
- password encrypt arguments should be optional, add SWITCH
- show datetime argument should also be optional, add SWITCH
- Trial, output factory- and startup-config colorized
- Switch to srp_prompt v2 for configure context
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The upstream help system has improved greatly. We can now rely more on
it for generating the man-page like help texts for leaf nodes. There
is also a new srp_prompt symbol that overrides the default klish one,
srp_prompt adds a '%x' format specifier for an inline path instead of
the default [edit foo bar] JunOS style two-liner.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lots of changes upstream for parsing help texts, running as different
user, etc. Was getting too difficult to backport to tags/3.0.0, so this
resets the clock on top of (almost) the latest. Experienced issues with
the admin user in configure mode on the latest commits (e4f65d5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is needed for the bleeding edge klish + klish-plugin-sysrepo, which
the next couple of commits will add.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Preparing for a "show system-information" as well, which still needs to
be discussed to determine contents. Some data also still missing, e.g.,
article/serial/product number db.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit switches the klish package to use the kkit branch instead of
keeping a lot of patches from the v3.0.0 release.
Most of the changes made are for dragging tinyrl into the 21st century.
It now supports most of the basic features one have come to expect from
a readline replacement: line navigation, deleting words, erasing entire
line, kill and yank of lines/words and last argument on previous line.
The history has also gotten a bit of a stern talking to. It no longer
deletes lines matching existing old ones from the history, instead it
just checks if the previous command is repeated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the JunOS look of the CLI to something more akin to
a standard shell. To achieve this a %w format specifier to display the
path components is added to both klish and klish-plugin-sysrepo.
Before:
admin@infix-12-34-56:exec> configure
[edit]
admin@infix-12-34-56:configure> ediit interfaces interface eth0
[edit interfaces interface eth0]
admin@infix-12-34-56:configure> leave
admin@infix-12-34-56:exec>
After:
admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interfaces interface eth0
admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
admin@infix-12-34-56:/> leave
However, due to unforseen problems with the naming of VIEWs in klish,
the admin-exec level "path" is hard-coded to "/" for now.
Future imporovement: fold in calling prompt@klish from srp_prompt, and
figure out why the "main" VIEW cannot be changed to "exec" without klish
just bailing out starting up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out one of the reasons some keys did not work as they should in
certain commnands, most notably the Home/End in 'less', was due to the
default TERM variable being set to 'linux'. Changing to 'xterm' fixes
this issue, works with both console and ssh login, and from testing do
not seem to have any adverse effects on existing functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While spending the past couple of weeks actually trying to use the CLI,
I realized that it was very confusing to have a different behavior for
Ctrl-C than I was used to from regular shells (including the old clish
from $OLDJOB).
This change drops the Ctrl-C binding, restoring break/abort behavior,
and lets Ctrl-D be abort/exit. Pressing Ctrl-D in a sub-context in
configure calls exit, when in the top-most configure context we now
do an abort and return to admin-exec.
To apply the changes the user still has to type 'commit' or 'leave',
or tap Ctrl-Z as in the Cisco CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not just for online viewing, these markdown documents are also
made available in the CLI itself from admin-exec as:
help [introduction | keybindings | tutorial]
With this commit we also add lowdown and the real less application to
be the Infix help system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the srp_help_text() symbol. It allows us to
display the full description for a leaf in a YANG model. This has
been added to the 'help [foo]' configure context command.
A separate admin-exec level 'help' command will be added in a later
commit. It will only be an intro to the CLI, keybindings, etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This restores some of the original keybindings for line manipulation
that was part of the original CLISH. They had been disabled upstream
during the UTF8 conversion and never got reimplemented.
From branch kkit on https://github.com/kernelkit/klish, the kkit branch
is based off of the 3.0.0 release. The same patches are also available
on kkit-next, which is based on the latest upstream master.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With completion support. The log command has an optional last arg,
after FILE, tail NUM, which runs tail -n NUM FILE instead of cat.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An excellent example of how to define commands with optional subcommands
and optional parameters:
password encrypt [type <md5 | sha256 | sha512>] [salt STRING] [PASSWORD]
The tricks here are two:
1. mode="switch" in the top-level password command
2. min="0" in the encrypt subcommands
The first turns the COMMAND element into a SWITCH element (with command
matching), and the second makes a COMMAND optional. If an optional
command is input by the user, then the enclosed PARAM is mandatory.
Please note, due to limitations in the mkpasswd¹ utility, spaces are not
supported in PASSWORD, i.e., when read from CLI prompt. However, spaces
are allowed when using the interactive prompt, i.e., when omitting the
PASSWORD from the CLI prompt.
¹) mkpasswd does not look for any leading ' or " in the password arg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The documentation for klish mentions the file ptypes.xml, which defines
the ptype /STRING. So let's use that instead of defining our own types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Helper commands for quickly diagnosnig the networking subsystem after
making config changes. Should over time be replaced with operational
status from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An iana or infix interface type is derived from "ip link" data.
Such as loopback -> iana-if-type:softwareLoopback.
This patch adds support for the following types:
loopback, ethernetCsmacd, veth, l2vlan and bridge.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables a basic sanity check of usernames in BusyBox that by
default is disabled (!). The rules enabled by this are:
- the user or group name should consist only of letters, digits,
underscores, periods, and dashes¹, and not start with a dash (as
defined by IEEE Std 1003.1-2001), or periods²
- for compatibility with Samba machine accounts, $ is supported at the
end of names
- max length of user or group name is 256 chars
Changes in this commit also includes a sync with latest BusyBox 1.36,
which adds: tree, tsort, SHA hw acceleration, and a separate script
for udhcpc6.
_____
¹) The documentation actually mentions "and at-signs" as well, but that
has been explicitly removed from the source code.
²) The documentation does not mention that leading periods are not
allowed, though this is also explicitly mentioned in the source code.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Factor out a new helper function, change_get_user(), to do the bulk of
the work for the change callbacks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugin-sysrepo to get EnableNACM support. For
this to work as expected for the admin user we also need to change the
permission for the model in sysrepo.
Note: the srp_rollback() symbol has been renamed to srp_reset() upstram.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently netopeer2-server expects public keys for users to be in the
canonical place (~/.ssh/authorized_keys). Infix use a custom location
in /var/run, maintained by the ietf-system plugin, which OpenSSH knows
but netopeer2-server doesn't.
It seems to be possible to add some sort of "pattern" to netopeer2 to
indicate where to look for public keys. This is added when building it
but Buildroot does not expose this as a setting. So for now, this seem
to be the least intrusive way of handling it. The owner is root, so a
malicious user cannot change the link or contents without some other
form of privilege escalation first.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point in leaving unused home directories lingering on the system,
also a potential security problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Employ the new 'adduser -d' feature where users can be created with
password login disbled instead of creating them locked by default.
This allows us to create remote users that can only access the device
using public key SSH login, which until this point was not possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The login applet did not know about shadow passwords, and could thus not
determine if a user accont was locked or passwordless. This caused it
to return 'login: bad salt' instead of "Login incorrect", which is the
more secure path for handling brute force attempts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The existing 'adduser -D' command adds a locked user account, similar to
the Debian adduser --disabled-login'. This patch adds support for the
'adduser -d' command, similar to Debian 'adduser --disabled-password',
meaning login is possible but using methods other than password, e.g.,
SSH keys.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This ensures that the operstate is defined for all interface
types. Without supplying this, virtual interfaces (e.g. loopback,
dummies, tunnels) will report an "UNKNOWN" operstate. For ports backed
by physical (or virtualized) hardware, this option has no effect.
- add debug flag to trigger DEBUG() statements
- DEBUG() macro needs 'path' argument
For statd we can add support for an optional '-d' command line option to
trigger, and SIGUSR1 to toggle, debug mode. TBD for confd which still
remains to be refactored into the same standalone daemon as statd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to 1) map debug/error macros to syslog(), which does not
need \n, and 2) when stdout logging is used, let the macro add a \n.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows us to verify common RPC commands from within the
CLI, starting with the poweroff and reboot commands.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use timezone names defined in iana-timezones.yang, replacing
the type 'string' in standard ietf-system.yang
This enables CLI (tab complete) and NETCONF clients (dropdown)
to view available timezone strings, and the yang engine to
validate the input.
Deviation in ietf-system.yang
'replace' username type from general string to a string
with length and pattern restrictions inline with the
BusyBox 'adduser' tool.
Note, chk_sr_user_update is more restrictive, which should
be handled.
Declaring deviations for optional features for clarity regaring
extent of support.
New revision and file of infix-systems created, as earlier version
was included in infix-2023.06 release.
Please see infix-systems@2023-04-11 for history.
Support and deviations has not been checked for the included
'sub-yang-module' infix-systems-software, thus there may be
more updates to come.
two fixes
- first a typo (probably copy/paste issue)
- the sleep and 'vtysh -b' was added to make
vtysh read the /etc/frr/frr.conf file upon start(*)
sleep needed to make this happen after initctl reload
(*) See https://docs.frrouting.org/en/latest/vtysh.html#integrated-configuration-mode
But there ought to be a better way.
This patch does two main things:
1) Breaks "statd" free from "confd".
2) Introduces netlink monitoring of interfaces for sysrepo data.
Prior to this patch, sysrepo operation status was handled by code
named "statd" inside "confd". (Where confd is a sysrepo-plugin and
not a real daemon, which its name implies)
In this patch, we break out the interface part of the operational
sysrepo status, previously "statd", into a new daemon, also called
"statd".
The main reason for doing this is to avoid sysrepo threading, which
allows the new "statd" to have control over sysrepo events in the
same event pool as netlink events from the kernel. This in turn allows
statd to subscribe and unsubscribe dynamically to interfaces that
comes and goes during runtime (such as vlans).
It also makes sense that "statd" is in fact a finit daemon.
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows an application to set a larger socket receive buffer size.
The default size is left unchanged (212992). 1MB is arbitrary chosen.
The main reason for this is to allow netlink kernel sockets to
hold more interface data while user-space is processing it. Typically
useful during main configuration changes where lots of kernel side
changes occur in short period of time, such as VLAN creation.
Signed-off-by: Richard Alpe <richard@bit42.se>
For some reason, the `make license-info` target complained klinfix
needed a hash file, but not the other local repos. Issue #67 tracks
adding license-info to releases, which will need some looking into,
for now this fixes the most glaring packaging oversights.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This script has some seriously sharp edges. Today two devs cut their
fingers on it trying to get new functionality in place. One when, in a
attempt at, adding an innocent status daemon, and another setting up a
client repository with a custom, enabled-by-default, daemon. In both
instances this script happily cleaned out the deamons from enabled/.
A better alternative, as described in issue #74, is to be stricter on
what is enabled by default, and for things we feel provide value in the
Classic build, maintain a separate list of symlinks in its meta board
definitiion instead.
Also, clean out previous attempt at factory-config. Now that we have
the auto-factory support in place we don't need this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In normal use-cases querierd needs a bridge with multicast-snooping
enabled to run. No point in attempting to start querierd by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- allow custom options sourced from optional /etc/default/smcrouted
- don't enable smcrouted by default when enabled in Buildroot .config
because normal use-cases require an /etc/smcroute.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use same if: syntax for release/upload job as for build job. Only thing
the upload job needs to ensure is that it does not try to upload built
artifacts from forks or from non-main builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verifies that RAUC bundles can be installed using NETCONF.
We choose to not add this to the "all" suite for now, as the qeneth
topologies do not run with full disk emulation.
To test locally, configure your "make run" instance to use the UEFI
loader, launch `make run`, and then run:
make INFIX_TESTS=test/case/ietf_system/upgrade.py test-run
We were now at the point where it was completely impossible to see
which files are actually built.
Bring back some order, making future diffs easier to understand.
This let's us report the installed software versions, before any
updates have been made. Since the info should _not_ be erased in a
factory reset (since the installed software versions will not change),
move the status file to aux, which is the proper place for this class
of information.
- When running with full disk emulation (via GRUB on x86, or U-Boot on
aarch64), there's no way for us to influence the commandline passed
to the kernel, so the console is fixed to ttyS0/AMA0. Therefore,
reintroduce an option to choose the console.
- Use a fixed `nr`s for virtconsoles, so that the gdbserver always
listens on `hvc1`. Ideally, we should use udevs `/dev/virtio-ports/*`
symlinks, but for some reason these point to `/dev/vportXpY` and not
to `/dev/hvcY`. TODO: Figure out what the difference is.
- While we're here, remove the duplicated RTC setup which was
introduced with the virtio-console work a while back.
/dev/ram is accepted by the kernel during boot, but there's no actual
file with this name in /dev, so RAUC will get confused about which
slot is actually one we booted from.
Launches an interactive ipython environment, attached to Infix nodes.
This can be used as a playground for developing tests, testing out
NETCONF operations, etc.
As an example, when running meta/play, a call to a device's `_debug()`
method will enable logging of all transmitted and received NETCONF
messages, which is very useful during debugging.
As with config, the call can be described with a regular python
dictionary. As an example, to reboot the device:
target.call_dict("ietf-system", { "system-restart": {} })
To reproduce regression, before fix, in CLI from factory-default:
> configure
> set interfaces interface e0 ipv4 autoconf enable true
> leave
> shell
$ ps; ip -br a
Turns out, for some reason I cannot figure out, that we cannot use the
same pattern as for ipv6 with lydx_get_descendant(). Manually fetching
the node works though.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of relying on startup-config == factory-config we can now set
running-config to factory-config using the factory-default rpc when
we prepare for a new test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use new APIs runbg() and run_status() to call 'reboot' or 'poweroff' in
the background. This allows sysrepo + netopeer to reply to remote RPCs
before networking goes down.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this patch, every new call to lydx_new_path() where "first"
was set to 1 resulted in a memory leak of 72 bytes. Typically at least
once for each sysrepo query.
The memory was allocated deep down in the lyd library, but as the
parent node wasn't set (NULL) it wasn't found by sysrepo when
cleaning up.
In this patch we mitigate this by simply removing the "first" concept,
as it doesn't appear to be needed.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a real example where we create a writable layer for container based
on a simple image.
To be able to properly start/stop and monitor containers using Finit, we
need to add the options `--systemd=false` and `--conmon-pidfile=...`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
echo">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK"| awk '{print $1}')"
cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
{
"name": "$NM",
"category": "router",
"description": "Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
"vendor_name": "KernelKit",
"vendor_url": "https://github.com/kernelkit/",
"product_name": "Infix",
"description": "$INFIX_DESC",
"vendor_name": "$VENDOR_NAME",
"vendor_url": "$VENDOR_HOME",
"product_name": "$NAME",
"registry_version": 6,
"status": "stable",
"maintainer": "KernelKit",
"maintainer_email": "kernelkit@googlegroups.com",
"usage": "Default console login is 'root', no password. For remote login, default user/pass: admin/admin also works.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
"maintainer": "$VENDOR_NAME",
"maintainer_email": "${SUPPORT_URL#mailto:}",
"usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
