With the changes in 9847a8f we can keep the /etc/motd file with a proper
newline at EOF so that also Classic builds make sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by openconfig-system[1], except the infix-system type is binary
to allow encoding an entire file, with optional control characters.
The openconfig-system model also carries login-banner, which is displayed
before login. This could be added later to infix-system to let the user
set an OpenSSH login Banner.
[1]: https://openconfig.net/projects/models/schemadocs/yangdoc/openconfig-system.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 2bcb02d3ef and thus
reeneables classic builds again. Since we build on /mnt on the runner
there should be enough room also for them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling strlen() returns a size that's one byte less than what's needed
to store the string, so when comparing with sizeof(), which returns the
number of available bytes, we must compare >= and not just >.
Found by GCC using 'make check'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When building for cppcheck/coverity we may get a stupid linker that can
wind up not finding, e.g., fexist() in libite (-lite) if it's not added
last in the list of libraries.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Cleanup any docker images to free up space
- Build on /mnt
- Update artifacts: pattern after API changes
- Add .sha256 checksums to each release tarball
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No more artifact/ subdirectory with upload/download-artifact v4,
artifacts are already in the working directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently, running "make test-qeneth" from an output directory that's
not in $HOME does not work in Azure. This patch adds an exception for
the x86_64-netconf target that ensures regression tests run just as if
nothing had changed.
Other platform//variants will be built on /mnt for the time being since
we're running out of space in the runner:
df -h =================================================================
Filesystem Size Used Avail Use% Mounted on
/dev/root 73G 58G 16G 80% /
tmpfs 7.9G 172K 7.9G 1% /dev/shm
tmpfs 3.2G 1.1M 3.2G 1% /run
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sda15 105M 6.1M 99M 6% /boot/efi
/dev/sdb1 74G 4.1G 66G 6% /mnt
tmpfs 1.6G 12K 1.6G 1% /run/user/1001
=======================================================================
This is the output of the new "Manny" investigator, it revealed that we
only have 16 GiB of space, after checkout and cache donwload, to build
and upload *all* platforms/variants. Hence the cheat with /mnt, which
we honestly don't know will remain mounted on these runners.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor test, remove fragile solution with tcpdump started AFTER
the linklocal was activated, this opened for a race condition since
it was listening for a message sent once.
Now wait for the linklocal address instead.
This patch adds out-good-octets and in-good-octets as augment in
the infix-ethernet-interface yang model. These counters represents
OctetsTransmittedOK and OctetsReceivedOK from ethtool.
Signed-off-by: Richard Alpe <richard@bit42.se>
With a self-hosted runner we get the following classic error when
calling `make test-unit`:
make[1]: Entering directory '/home/runner/_work/infix/infix/buildroot'
/home/runner/_work/infix/infix/test/env /home/runner/_work/infix/infix/test/9pm/9pm.py /home/runner/_work/infix/infix/test/case/all-repo.yaml /home/runner/_work/infix/infix/test/case/all-unit.yaml
the input device is not a TTY
make[2]: *** [/home/runner/_work/infix/infix/board/x86_64/board.mk:14: test-unit] Error 1
This patch drops interactive from all non-interactive docker sessions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers do not need, or do not want, to be able to run
containers, so all NETCONF related daemons and applications
need to take this into consideration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When available, show the default value of a leaf node after the
description when issuing 'help leaf-node'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The tagline is read by Finit at boot, from /etc/os-release, and
logged when changing runlevel. The unicode charachter does not
survive the trip via syslog to log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify the code a bit by passing the test file to the runner
function instead of checking it in every caller.
Signed-off-by: Richard Alpe <richard@bit42.se>
As of 4768cae6, we can use conserver/telnet to connect to the docker0
bridge IP:90XX, where XX is DUTXX. This was a great UX improvement
and this patch set aims to further the experience by:
- allow running Infamy (infix-test container) completely rootless¹
- reduce the expsed port range 50->10 (can be improved further)
- use 'podman --publish-all' ports, which allocates ten random
ports for the exposed Qemu telnet ports
- add Quick Start Guide to doc/testing.md
This restores the possiblity of running multiple "make test-sh"
instances, e.g., when multiple users share the same server.
The 'console' script included in this commit uses 'podman inspect' to
find the port number for a given DUT, and optional instance. It takes
either the console/dut number (1-N), or the dut name from the topology.
Also in this commit:
- set hostname for easy identification (for console script)
- set conatainer --name to hostname
- adjust workdir from buildroot to infix/test
- simplify PS1 and add time to prompt (when did the test finish?)
When running 'make test-sh' the prompt now tells you which instance you
are running, e.g., infmay10. Calling 'console 1 infamy10' connects to
console 1 (port 9001) on the infamy10 instance.
For more information, see the Quick Start Guide in doc/testing.md. It
shows how to use the new helper scripts: console and shell.
Fix#227
_______
¹) devs using podman, instead of docker, with slirp4netns installed, can
run the infix-test container completely rootless. We like this, and
as of today podman is our recommendation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New helper class for container testing
- New helper class to urllib, Furl
Due to extremely weak Python-fu in the undersigned, this patch changes
the __init__.py file to add new helper classes for container tests.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix most of what pylint complains about
- Simplify constructs and add missing whitespace
- Simplify output of YANG model downloader
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch handles a corner case we for some reason have not run into
yet. With the new container operational data it was triggered almost
immediately, so let's add some basic guards around it and return None
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a helper that lets you call a Python function (or lambda) in the
context of a network samespace.
Example:
with infamy.IsolatedMacVlan("eth0") as ns:
res = ns.call(lambda: subprocess.run(["ip", "link"],
capture_output=True))
print(res.stdout, f"\n[exitcode:{res.returncode}]")
The call to subprocess.run will be executed in the context of the
network namespace, and thus only list "lo" and the "iface"
macvlan.
The return value of the function passed to ns.call() is passed back
over a multiprocessing.Pipe, which requires that the object be
"picklable". This is true for most objects (even more complex ones
like the CompletedProcess object seen in the example above). Some
notable exceptions are things like file objects, sockets, etc.
The setns(2) syscall is unfortunately not available in current
versions of Python shipped with neither Ubuntu nor Alpine at the time
of this writing. Therefore, shoot from the hip, assume that we're
running on an x86_64 CPU, and just hotwire the syscall directly with
some constants we found in a dumpster.
This is an example of how to create a package that downloads an OCI
archive and installs it to /lib/oci
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds the optional 'user name' argument to the 'copy' command,
enabling using curl scp/sftp protocols for fetching and uploading files.
Changes to cfg_adjust() allow saving and referencing files in the user's
home directory. Useful for both fetching upgrade bundles and container
images.
The 'dir' command now lists files in both $HOME and /cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new klish symbol, shell@infix, which performs proper
droprivs before calling the configured shell.
Fix#298: track user id so shell command gets correct user
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers don't want unprivileged CLI users to be able to exit to
a shell. The shell is currently hard-coded to bash, but should be one
of the ietf-system shells, configurable --with-shell=foo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor is basically only an extra step after
copy source-ds -> dest-ds
to also
copy source-file -> dest-file
Which in the case of factory-config and startup-config is relevant. We
want to update the startup datastore, in case of additional commands,
but also the file /cfg/startup-config.cfg in case of consecutive reboot.
Fix#259 copy factory-config startup-config
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Because sysrepo callbacks are threaded and factory-default RPC is called
from a separate subscription (to prevent blocking), we cannot prevent
ietf-intefaces.c from being called before infix-containers.c, regardless
of the priority we set for our subscriptions.
When assigning a physical network interface this becomes a bit of a pain
during factory-default RPC since the physical interface is hidden from
the host network namespace.
So, when applying factory to running, we check each interface if it was
a container-network previously, if so we call on the container script in
the exit of the current dagger generation to move the interface back to
the host netns.
This affects all other functions that assume interfaces only live in the
host netns. To that end a set of new helper functions have been added
to wrap iproute2 commands in nsenter when the interface lives elsewhere.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The interface name is already a unique qualifier, so we can simplify CNI
network naming to ease the burden when debugging.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
"Sloppy" because, for some reason, we don't get sysrepo update callbacks
for presence containers. I.e., when calling 'set container-network'
compared to 'edit container-network'.
Yes, I've gone over klish-plugins-sysrepo with a fine-toothed comb to
see if it's the culprit, but no, it seems to be sysrepo. Hence the
defaulting of the type also in the change path.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Review found quite a few strings that could be given an obvious pattern
or specialized sub-type, e.g. inet:ip-address, to restrict the input
data validation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the deprecation of CNI i Podman[1], and its upcoming removal in
Podman v5.0, we decided to cut our losses and modify all documentation
and models to become backend neutral. We will continue to use CNI as
long as possible -- it gives us host interfaces, for instance, that is
not part of netawark yet, it seems.
Also, sync mount and volume documentation with YANG model changes.
[1]: https://blog.podman.io/2023/11/cni-deprecation-and-removal-from-podman-5-0/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After discussions in the development team, and an external demo, we
decided to rename file mounts to just mounts and adopt established
nomenclature.
With this change we now allow mounting any type of file or directory
from the host to the container, for regular files/directories a bind
mount is used. We also introduce 'source' and 'type', to support
mounting of host files and directories, the destination path has been
renamed to 'target'. The mount cousin, 'volume', which basically is a
specialized mount, has also been updated to use 'target'.
The 'source' and 'content' are now hidden behind a YANG choice to ensure
users can only use them the intended way (either/or not both).
Initial models had 'destination' (path) as mandatory, with this change
we can reintroduce that to ensure this proper configurations.
The documentation in both YANG model and markdown has been updated,
significantly, to provide lots of examples.
Please note, glob style mounts have not been tested, at all.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When container configurations are not saved to startup-config and the
user reboot the system (or lose power) we will have lingering active
containers cached on persistent storage.
This patch adds a cleanup() function to the post hook, right before
we try to launch any new containers. This callback must be run for
all cases, even if the running-config has no containers configured.
Also, a minor amendment to volume pruning.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. add support for extracting, and finding the directory holding the
index.json metadata file in, OCI images. An archive in Infix is either
a .tar or .tar.gz archive, which we need to unpack for this version of
podman to be able to load them.
2. new RPC '/infix-containers:oci-load' calls 'container load' of an
OCI archive (tarball), optionally gzipped. The resulting image uses
the directory name of the unpacked tarball, so the container script
offers a way to retag the image after loading it.
First class citizens in container transport are docker:// and the OCI
family of URI:s. A docker:// URL, or a local docker-archive:path, is
assumed to be well formed, in which case we leave it up to podman to
handle.
Note: 'podman import' does not fully understand OCI formats. It drops
ENTRYPOINT and COMMAND, while 'podman load' handles things a lot
better. Only letdown is it does not support nameing the image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Rename container/container -> containers/container
- Collapse containers-state into containers
- Complete refactor of network/host-network for improved UX. A new
must expression ensure mutual exclusion between host and networks
- Rename entrypoint -> command, for consistency (overrides ENTRYPOINT)
- Move nodes around a bit for more logical placement in model
- Clean out all traces of a container on removal
- Rename container image_id -> image-id for consistency
The active queue is for tracking currently running containers, ensuring
only relevant changes are applied, and also for container image upgrade,
at the end of which these scripts are re-run to activate the new image
Also, fix misplaced '-f' when pruning unused volumes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Brief overview of configuration support. Need to add admin-exec level
commands, but since operational and actions still are missing, we keep
it out until after the code review.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop debug logs
- no need to restart upgraded containers, they restart automatically
- fix ordering in volume prune (when containers are removed)
- skip directories in container activation (inbox -> execd queue)
- Fix 'container pull IMG creds USER[:PASS]' bug, extra '=' variable
assignment inside infix.xml
- Fix 'container run IMG CMD ARGS' to actually put the CMD in
ENTRYPOINT and append ARGS to image. The podman run and create
commands are *not* behaving the same way
- Rename 'attach' to 'exec', execute command inside an running container
- Add 'container [shell | connect]' to start shell in -- " -- " -- " --
- Add 'container [stat | cleanup | usage stats]' commands
- Add in="tty" to commands thay may end up being interactive
- Split <ACTION> line into multiple lines for readability
- Fix container shift logic:
root@infix-00-00-00:/> show container
/usr/sbin/container: line 361: shift: shift count out of range
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, update container YANG model descriptions and ensure 'path' is
mandatory for each list element and attach a regexp pattern to fix
the mountpoint to an absolute path inside the container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the container configuration context:
edit file ntp.conf
set path /etc/ntp.conf
set content
The last command opens a text editor where you can paste the contents
of the file. This is stored base64 encoded in the datastore as well
as in JSON/XML.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new CLI command 'container upgrade foo', where 'foo'
is the name of the container. If more than one container use the same
image, multiple upgrades must be done because a container runs not on
the 'image:tag' but on the hash of the 'image:tag' it was created from.
Rename "done" queue to "active", since we want to recreate an active
container after fetching an updated base image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for writable container volumes. A volume, when
compared to a mount, is a writable directory created when the container
starts and is automatically rsync'ed with the underlying directory it
is mounted on on first use. A mount otoh does not rsync so it results
only in an empty directory inside the container.
The podman/docker mount feature will be used later to bind mount single
files or sharing directories from the host, e.g., /sys/class/leds/ to
one of more containers.
Note: unused volumes are automatically pruned. Hence, a volume
currently cannot be moved to another container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows containers created with "podman create" to surivce
rebots, and even reconfigurations at runtime, as long as their config
has not changed. Allowing some level of persistence in the writable
layer given to containers.
For even more persistency, support for volumes (they sync with dir in
container on first use) and mounts (creates empty writable dirs in the
container) must be added. A third option, a variant of mounts, is to
allow a leaf-list "file", where binary content can be added and then
mounted into the container, e.g.
/run/containers/files/$name/file.ext -> container://$name/etc/file.ext
None of this is available yet, but seems likely we need to add in the
very near term.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was a tough nut to crack. Turns out the trick to changing the
ENTRYPOINT is to set --entrypoint=command and then call 'podman create
... command args'. Not entirely obvious since the documented approach
is to use a JSON array as the argument: podman create
--entrypoint='["command", "args" ]'.
Admittedly, encoding this in C to transfer it via a POSIX shell script
to the command line, is not the easiest task I've undertaken. So I gave
up and found this workaround.
Worth noting, however, is that one *must* set `--entrypoint`, it is not
enough to just append the command to the 'podman create' command line.
Due to differences in docker and podman, we cannot supply the full args
to an alternate entrypoint command. But for the command to actually run
we need to override the image's ENTRYPOINT and send the command and args
as the last arguments on the command line to podman create.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, ensure the deleted container is actually deleted before recreating
it with a new configuration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds 'manual:yes' to the container's Finit service
configuration and changes from pod: to container: prefix for a
unique namespace to prevent collision with regular services.
The prefix container: is more correct that pod:, which should
be reserved for any future pod support.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd: fix missing variable in container script condition
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- reserved words: map -> xlate
- add missing docstrings
- convert to recommended constructs: proto in (foo, bar)
- drop unused 'f' format strings: f""
- too short exception vars: e -> err, d -> entry
- drop unnecessary () in if expressions
- add whitespace for readability and navigation
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The files inside a release tarball, as well as the tarball name itself,
should not have the leading 'v', that's just for the tag.
Also, add -ver to GNS3 disk.img file as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be replaced with native support for generating container network
interfaces and running under finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This bump adds support for 'set foo' to set foo=true, but also two new
commands from srp_helper@: 'change password', 'text-editor content'.
- ietf-system: 'change password' now starts an interactive session that
results in a random-salted sha512 encrypted hash.
- 'text-editor <node-of-binary-type>', starts 'editor file | base64'
- 'set <node-of-bool-type>', sets node=true
A prototype askpass script has been added as a proof-of-concept. It
follows the design of other askpass style programs, like ssh-askpass,
that pass the resulting password on stdout. With the additional support
for also writing it to an output file, e.g., a pipe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On every system reconf (initctl reload) the .conf files are evaluated
again and log notices about skipping alternative syslogd enties are
logged.
We know that we run the udevd dependend syslogd entry, and everything
else basically in runlevel S depends on it, so not much else would work
if syslogd didn't start. So we can safely set 'nowarn'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When "plopping" back an interface from another network namespace, e.g.,
when removing a container network interface, we cannot just rely on the
'ethernet' node *not* being available for an interface.
Experience shows that sysrepo might send us a curve ball (see comment)
which we interpret to be a true Ethernet interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds information about a vlan filtering bridge to the
operational datastore.
The information included is vlans, pvid and stp-state. These changes
reflects what can be configured though confd.
NOTE: pvid is still missing for bridge interfaces. Discussions on how
to best add this is ongoing. It's currently not configurable due to an
existing self check in the infix-if-bridge yang model.
Signed-off-by: Richard Alpe <richard@bit42.se>
This can now a days be inferred and isn't needed. Also, the interface
type in virtual testing is now etherlike not ethernet.
Signed-off-by: Richard Alpe <richard@bit42.se>
This resolves the regression where configured etherlike interface mac
addresses where not deleted from the system.
Signed-off-by: Richard Alpe <richard@bit42.se>
* Remove bogus ethernet statistics for br0
* Change parentbus for e0 and e1 to make them ethernet devices (not
virtio -> etherlike).
Signed-off-by: Richard Alpe <richard@bit42.se>
Instead of "ethernet". Prior to this patch virtio interfaces where
identified as "ethernet", which resulted in /run/net trying to enable
autoneg on them. Which isn't supported and resulted in an ABANDONED
"default config".
Signed-off-by: Richard Alpe <richard@bit42.se>
Needed for devices that share a lot of properties with an ethernet
device but doesn't support "ethtool" and such. An example is TAP
interfaces.
Signed-off-by: Richard Alpe <richard@bit42.se>
Rely on the interface diff to figure out if any autoneg related config
has changed; if so, generate the resulting configuration based on the
current interface config.
- Remove loopback check, the model only allows ethernet config on
interfaces of type "ethernet".
- Split up the input validation of speed/duplex to give the user an
error message with as much specificity as possible.
- Validate that the configured speed/duplex is supported.
- Move the generated script to execute earlier to avoid unnecessary
link flapping.
- Use negative POSIX error codes, these are (or at least should be)
mapped to sysrepo errors in netdag_gen_iface.
Add the ability to configure interface speed, duplex and autoneg.
Initially this was pared with YANG model deviations that restricted
explicit interface speed and duplex when autoneg was enabled. But due
to conflicting default states in YANG, this code was dropped.
Signed-off-by: Richard Alpe <richard@bit42.se>
The Infix scan token we have is only valid for KernelKit, so for any
downstream forks we must not attempt to run this workflow.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The DHCP client YANG model saw a lot of changes added in the 23.12
sprint, fortunately there was never an official release.
This commit bumps the model version for v24.01.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should be the last outstanding issue to fix#278. Please note,
it is undefined what happens if you have two DHCP clients that request
hostname, and changing hostname from NETCONF at runtime will overwrite
any hostname set by the DHCP client.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For maximum flexibility we allow the user to full control over the DHCP
options the client requests. For this to work we must tell udhcpc to
not set any of its defaults behind the scenes, so we call it with '-o'.
This commit adds support for inferring these udhcpc default options in
NETCONF. So when enabling the DHCP client we now get the same set of
sane options as udhcpc otherwise hides from us.
Fixes#278, at least wrt. the lack of sent options. Allowing the client
script to set the hostname will be added in a later commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No need to guard the hostname option in quotes, it must not contain
whitespace. If user configured more than one word, use first.
Fixes#283
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since the Nanopi R2S does not have a VPD, we use this mechanism to set
the default admin password. Without one, Infix will refuse to generate
the factory- and failure-config files, and thus refuse to start.
On custom boards in production we have VPD in ONIE format that contains
a per-device unique SHA256 hashed admin user password.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Loss of BusyBox "show others", uboot-tools, and e2fsprogs, are likely
due to resolved dependencies from other packages. E.g., Frr requires
bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support for this is based on the upstream Buildroot R2S defconfig and
the myLinux extensions and stripped-down kernel defconfig. For more
information about the Nanopi R2S, see the FriendlyELC wiki at:
https://wiki.friendlyelec.com/wiki/index.php/NanoPi_R2S
Please note, due to the lack of a VPD on the board, and some very poor
devicetree skills by yours truly, Infix currently refuse to boot on this
board. An in-devicetree factory-password-hash node has to be added, and
will be done soon.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All Infix builds should be signed, but for some test equipment, and
during board bringup, this may be too much of a hassle.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Nanopi R2S currently only works with an older U-Boot v2021.10. This
commit only relocates the CN9130 patches to a sub-directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Install the sudo command, and let all members of the "wheel" group run
any command as the superuser.
This ensures that administrators have full access to the system,
primarily for troubleshooting, diagnostics, and remote scripting
purposes.
This let's users script infix devices without needing any special
NETCONF tools installed - ssh is enough. E.g. you can get the running
version with something like:
ssh INFIX-HOST sysrepocfg -X -fjson -d operational \
-x "/system-state/platform/os-release" | jq .
It also means that SCP works as expected, by default.
This adds [PPID] to the syslog lines to the dagger script. After all,
the dagger script is a proxy for confd, so when reading the logs it
seems natural to see the PID of confd rather than a script that will
die soon anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Classic builds don't have udev but rather mdev or mdevd. This patch
imports support from myLinux for conditionally starting sysklogd on
classiic builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Relocate python based probe to netconf builds, and
- Restore basic shell script based probe for classic builds
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
set ospf area 0.0.0.1 area-type nssa-area
set ospf area 0.0.0.1 area-type stub-area
set ospf area 0.0.0.1 summary true
set ospf area 0.0.0.1 default-cost 100
Better than Busybox top, and can attach strace to services. So very
useful for debugging and monitoring a system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since watchdogd may need to run with SCHED_RR, when the supervisor is enabled,
which is not supported by cgroupsv2, we ask Finit to always runs it in the
root cgroup. We must also raise the limit for rtprio to all possible values
for SCHED_RR that a user can set in /etc/watchdogd.conf
Finally, add support for reading extra args from /etc/default/watchdogd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very limited part of the YANG model is implemented so far, basicly it is OSPFv2 with multiple areas and you can change timers
for the interfaces. Limited operational support.
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> leave
In review discussions we have decided, for resonsons of consistency over
correctness, to rename this column to match the YANG model node name
rather than the Linux kernel name.
Also, right align the values. Numbers should always be right-aligned.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch ensures that the DHCP client is not started until the
interface is up and running (link). If the interface goes down,
or loses link, the client is stopped and everything learned from
the server (address, routes, DNS/NTP servers, etc.) is remvoed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an optional service doesn't exist, and the run/task/service stanza
clearly list `nowarn`, we should not log missing/skipping messages. This
patch-set is backported from the upcoming Finit v4.7
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the DHCP options from plain flags to customizable
options with optional values. This works for most key:value options,
but not for the more complex ones, e.g. option 81. For this we have
dedicated handling to use `udhcpc -F fqdn` instad.
Additionally, the inference a default option list has been removed in
favor of a set of generic default options: router, dns, domain, address,
broadcast, ntpsrv, search, staticroutes, msstaticroutes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should be longer, there are devices out there (in the industry)
that may drop the ball on a single ARP, or may be in deep sleep (IoT),
so we should send like 5 ARP with at least 1 sec between them before
timing out.
However, this requires patching BusyBox a bit, so skipping for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add support for option 12, provide current hostname to server for
registering the lease with -- this allows registering in local DNS
for some DHCP servers.
- Add support for option 50, request any previously cached IP address
- Override option 60, vendor class identifier, with Infix vYY.MM
- Adjust timers and retry options to be more persistant
- Include initial metric as environment variable to client
- Disable all default options, set a hard-coded subset, which will be
replaced in a later commit by a generated list.
- Ensure udhcpc creates a pid file, in case we may need to start any
other service/task in sync with the DHCP client
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New log() function replaces stdout logging
- New set_dhcp_routes() and clr_dhcp_routes() functions
- Set all option 121 routes with same metric
- Set all option 3 routers with increasing metric (this is what the
reference udhcpc scripts do, and RFC says the routers should be
listed in order of preference ...)
- Clearing routes must, like IP addresses, be done both by interface
and protocol. This refactor makes sure to delete any DHCP routes
set on the given interface (in case options change)
- Use resolvconf per-interface search+nameserver
- Cache IP lease so we can ask for it back later
- On deconfig|leasefail|nak, make sure to clean up anything that might
be lingering from this interface. E.g., we can get leasefail when a
server denies our request to prolong a lease.
- On renew|bound, refresh routes, and set search+dns + NTP servers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Move from everything in a single /etc/chrony.conf to a split up with
configuration and server snippets. The latter comes in the form of
configured (static) and DHCP client (dynamic) server setup.
To accomodate this new scheme we need to detect when serves are removed
from the configuration, so not only have the whole change_ntp() been
refactored, it has been extended with a new pass.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break out unit tests to separate make target as they don't require all
the built code and infrastructure that the normal tests does.
Run the unit tests early in the Github action stage. They don't
require a full build. This will give early feedback to the users.
Signed-off-by: Richard Alpe <richard@bit42.se>
In this patch we add some arbitrary system output files which contains
interface data. Such as the output from "ip link" and "ethtool". These
files are used by yanger instead of running the actual commands.
Yanger then generates a lot of YANG json data, which are merged using
jq into something that looks like the sysrepo operational data on
a running system. This data is then passed though cli-pretty and its
ouput is compared to the static expected output in the .txt files in
cli-output.
Here's a basic flow overview.
* system-output/foo.json -> yanger ->> data
* system-output/bar.json -> yanger ->> data
* data -> merge -> sysrepo-operational-data
* sysrepo-operational-data -> cli-pretty -> output.txt
* compare output.txt too cli-output/show-foobar.txt
The result of this is that if something changes in yanger OR in
cli-pretty. The corresponding system-output file needs to be updated
for the test to pass. This is indented to catch regression where the
output is unintentionally changed.
Signed-off-by: Richard Alpe <richard@bit42.se>
Normally, no logins are actually possible, but this will have two
desirable effects effects:
- /etc/issue will be printed when hitting return over the console,
allowing the user to see the bootstrapping errors again, without
having to reboot the system.
- On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can
login as root and debug issues.
Collect all bootstrapping issues in all banner-like files during boot,
so that they are presented to the user when logging in. This should
make it harder to miss overlook the fact that a system is running in a
degraded state.
Before this change, the system would move to runlevel 9 as soon as
startup-config failed to load, in which no getty is allowed to run.
Instead, we want to reserve that runlevel for when failure-config
itself also fails to load, since the system will have no valid login
credentials at that point.
This fixes [ERR] from CLI `show routes`, and broken operational status
in setups with DHCP client enabled by default.
Feature (static routing) introduced in release cycle, no need to bring
up in release notes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As it turns out, references to module objects are not safe to keep
across callbacks. In particular: loading a new model into sysrepo at
runtime may cause it to move objects around in memory.
Therefore, fetch a valid reference to "infix-system" on every callback
instead.
* sniffer did not work correctly
* links did not come upp as quick as in qemu
* must_reach in netns was to narrow, increase timeout
* add wait function to handle poll
Currently we only advertise SSH+SFTP services over mDNS-SD, which are
the default services from the avahi package. This patch adds support
for _netconf-ssh._tcp as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical studies shows that the surge protection on the alder board
is not compatible with Energy Efficient Ethernet.
Root cause has not yet been determined.
On the P2's the only reasonable way (in terms of hardware patching
effort) of driving the LEDs is to have the green LEDs at the top and
the yellow ones at the bottom.
Turns out that the gpio-charger doesn't have polled fallback if the
GPIO pin can't function as an interrupt controller.
Fortunately, we have access to the IRQ pin, so we can just use that
for now and leave the driver as-is.
Drop this deviation for v23.11 since it clashes with pyang + NETCONFc client.
We expect to support configuration of speed+duplex in v23.12.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest bump of klish-plugin-sysrepo we no longer need the extra
container name in commands and paths.
Also, update the "show interfaces" example in the top-level README.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for collapsing container-lists where applicable.
E.g., 'edit interfaces interface eth0' -> 'edit interface eth0'.
Great care has been taken to not mess up when container-lists are
critical, like ipv4/ipv6 routes.
Fix#187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting admin's password to "!" is not accepted by the model, which
means we end up in RMA mode, even in cases when a valid startup
exists.
Not supplying a password will cause confd to generate a locked
account, which is what we want.
- Fixes the locking warnings when configuring LEDs on 6393X
- Correctly power up 3310X PHYs strapped to start powered down
- Fix kernel oops when reading from blank NVMEM configured with an
ONIE layout
Silence kernel warning seems to be most secure option. Also, set
MFD_CLOEXEC, because if we ever fork off a child it should never
get a copy of this fd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New command 'show software' to display software versions on each
partition, install date, and which one is currently booted.
admin@infix-00-00-00:/> show software
NAME STATE VERSION DATE
primary booted v23.10.0-132 2023-11-23T22:24:33+00:00
secondary inactive v23.10.0-132 2023-11-23T22:24:33+00:00
admin@infix-00-00-00:/> show software name primary
Name : primary
State : booted
Version : v23.10.0-132-gfd6e8ea
Size : 61992960
SHA-256 : ed6146aec462b77fb8631b14c48d281dd0f4fdb9c062f9482d863ee854081358
Installed : 2023-11-23T22:24:33+00:00
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bootstrap script gets feedback from gen-admin-auth, on error we no
longer bail out but instead log the error and continue booting. This
way a developer build with root login can diagnose the error.
When logging the error we also set /etc/issue, /etc/issue.net for local
and remote login services, as well as the dedicated /etc/banner used by
OpenSSH, to hold the error summary. So when attaching to the console
port, or attempting to log in remotely with SSH, the error is printed
to indicate the device is not healthy.
Finally, since factory-config may be missing we need to bootstrap the
sysrepo db with something else, and fortunately we will always have a
failure-config to fall back on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If pwhash is missing from system.json, lock account. This allows for
more extensive diagnosis on developer builds with a root login.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break fallback hash to a separate function and allow gen_qemu_system_file()
to return the status. We'd like to update the qeneth templates to include
the same VPD data as is used with qemu.sh, but for now this is sufficient.
The Qemu detection has been changed to the, slightly more, secure detection
of qemu_fw_cfg filesystem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds generation of the 20-authentication.json snippet also
for failure-config. The gen-admin-auth script is extended with shell
parameter, since the default shell differs from factory-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit does several things. Its end goal is to fetch the admin
password hash from VPD memory during factory bootstrap.
To accomplish this probe creates a new file /run/system.json with
information read from a fw_cfg QEMU partition. The data from
/run/system.json is then later used during config bootstrap to fill in
the factory administrator password.
The idea is to make QEMU behave the same way hardware does, i.e. a
default/factory password should be fetched and used from
"hardware memory". The hardware portion of this is yet to be done.
Signed-off-by: Richard Alpe <richard@bit42.se>
With the behavior introduced in the referenced commit, port
interfaces (i.e. all ports on many systems) no longer get any SLAAC
address, leaving the user with no way of reaching the system.
Comment says this is by design, but that seems like an awkward
default.
Remove the option, and simplify gen_interfaces to either
- Enable SLAAC, if the port is not going to be part of any bridge, or
- Disabel SLAAC, if the port is going to be part of a bridge
If necessary, we can add an inverse option at a later date.
Fixes: d0f3960 ("confd: add -6 option to gen-interfaces for SLACC on port interfaces")
- Add deviations for non-supported statistics
- Limit config, currently we only have ro support
- Add deviations for non-supported configs and status leafs
[skip ci]
Also, add -S option to less, which causes lines longer than the screen
width to be chopped (truncated) rather than wrapped. With available
terminals supporting xterm a user can scroll right on really long lines.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default srp_show@sysrepo function creates the stripped down version
of running-config that, in the context of showing startup-config or the
factory-config, is very difficult to explain to users why they differ in
format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Having klish as the login shell means losing lots of neat features we've
gotten used to: help text in less pager, initial terminal probing on the
console, and more.
This commit replaces the clish -> klish symlnk with a fuzzy bash wrapper
that fixes all the above annoying little things.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change, the following would happen in /lib/infix/mnt if a
factory-reset was performed:
1. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
2. Check for factory-reset
3. Clear /mnt/cfg/* and /mnt/var/*
4. Mount overlays
This ordering leaves the system with a completely empty /var on the
boot when a factory-reset is executed. Finit will fixup some of this
via its tmpfiles scripts, but we want the ability to ship files under
/var as part of the Squash and have these be available after the bind
mount, just like what happens at every other boot, when we don't
perform a factory-reset.
We solve this by delaying the bind mount (1) until after the reset has
been performed, together with all the overlays (4). While we're here,
make the fallback case, where no persistent /var is available, use a
bind mount as well. This should allow containers to be tested on such
setups, and it's one less flavor to test.
New order:
1. Check for factory-reset
2. Clear /mnt/cfg/* and /mnt/var/*
3. Mount overlays
4. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
Now the only difference between a regular boot and a
"factory-reset-boot" is whether (2) executed or not.
We haven't even called sr_get_items() yet. Must've been a remnant
of an earlier refactor.
Fixes CID 331051
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By default, assume that any LED with the function "tp", "sfp" or
"port" is attached to either an Ethernet PHY or MAC, with support for
offloading the "netdev" trigger.
Use green LEDs to indicate link/activity.
Disable any yellow LEDs for now, later on we can add alarm indications
etc. to these.
When dropping the net package in 5031ff6, a rebuild + test was not made
before pusing to main. As a result Infix suddenly lost one of its most
important packages, iproute2.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate Finit conf to package, like klish and confd. Add condition to
ensure it is not started before mdev/udevd are up and kernel LED modules
have been loaded properly.
Also, add tmpfiles.conf to ensure /run/led is recreated at every boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only config no operational state yet.
routing
routing/control-plane-protocols
control-plane-protocol static name default
static-routes
ipv4 route 192.168.200.0/24 next-hop special-next-hop blackhole
The intention of this is to serve as a help/guidance for both devs and
reviewers of pull requests.
Baseline is taken from Linux v6.5.6, with some (possibly) controversial
additions (at the end of the file):
- Do not enforce max line length
- Alignment of variables, both when assigning and declaring
- Use spaces to adjust when leading tabs are not enough (as Emacs)
I've also added a couple of exceptions for macros like TAILQ_FOREACH()
which are used as control statments (if, while, for), so the opening
brace should be on the same line -- otherwise clang-format thinkts we
are creating a recursive function ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds PID readiness notification to Net-SNMP. This is
required for synchronizing processes like subagents.
PID readiness is similar to systemd READY=1 notification, which
Finit supports, but Net-SNMP only supports that at first startup
not after SIGHUP.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There should be no functional change in this patch.
In this patch we rewrite the data collection in python3. This is the
new script called "yanger". It runs various commands on the system,
such as "ip" and "ethtool". It then mangles the output data from these
commands into valid YANG data.
The yanger script is started from the sysrepo callback in the statd c
code. Its output is parsed using lyd_parse_data_fd().
This means that the daemon part of statd is still written in c and the
new python code is only used when getting a query callback from
sysrepo. The c code still handles the interface netlink messages from
the kernel which controls what interfaces statd should do sysrepo
subscribe/unsubscribe to.
Signed-off-by: Richard Alpe <richard@bit42.se>
Expose fsystemv() in header and remove static. This function can be
useful for others that needs to be in control of any output stream.
Signed-off-by: Richard Alpe <richard@bit42.se>
When Infix Fail Secure Mode ends up in RMA state, runlevel 9, we should
not allow Finit to "time out" and give us a login prompt. Instead we
disable all login services in runlevels 7-9, reserving these extra
levels for future failure modes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Most defconfigs have Bash enabled, those that do not will have the
BusyBox symlink to ash.
This fixes the completion isses we've seen with initctl.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mostly a Bug fix release. Only major change is support for service
`notify:pid` and `readiness none` global option to change how Finit
expects readiness notification.
Fixes:
- Dbus and runparts regression in Finit v4.5. The configure script must
expand `FINIT_RUNPATH_` before defining it in `config.h`
- Service environment variables drop everything but the first argument,
e.g., `VAR="foo bar qux"` drops everything but `foo`
- Internal conditions, e.g., `<int/bootstrap>` turn into flux when
leaving bootstrap, causing depending services to stop
- Global environment variables declared with `set VAR=NAME` do not drop
leading `set `, causing `'set VAR'='NAME'` in env.
- Sanity check environment variables, for services and globally. Ensure
the variable name (key) does not contain spaces, or a leading `set `
https://github.com/troglobit/finit/releases/tag/4.6
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop bridge pvid setting in YANG model, we require bridge ports to
have explicit VLAN assignment (security)
- refactor bridge_vlan_settings(), do not enable vlan_filtering if
there are no VLANs configured on the bridge
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adding missing information
- that PVID should (typically) be set for ports associated untagged
- that the bridge should associated with VLAN to terminate the VLAN
in the bridge
Providing an additional config example (VLAN atop brigde)
Adding picture for this and the existing example (VLAN atop Eth)
Adding info on name conventions (eth.20 vs vlan10)
[skip ci]
Upstream has replaced interactive="true" with:
- in="tty"
- out="tty"
- interrupt="true"
Also, disable Oneliners option since it's too confusing for users
compared to the regular JSON output for startup and factory-config
We can [skip ci] since we do not have any CLI tests yet.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some reasone upstream changed the Pager (less) from -r to -R, to
explictly only allow ANSI color sequences. This caused the 'show
interfaces' command to output <EF><33><13> style replacement chars
instead of UTF8 line drawing characters.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is an attempt at improving the error reporting from klish-plugin-infix,
or more specifically commit@infix. Previously none of the sysrepo errors were
shown, now all the latest errors, as well as a few new ones specific to
interfaces have been added.
Example (eth0 does not exist):
admin@infix-00-00-00:/config/> edit interfaces interface eth0
admin@infix-00-00-00:/config/interfaces/interface/eth0/> leave
Error: Mandatory node "type" instance does not exist. (Data location "/ietf-interfaces:interfaces/interface[name='eth0']".)
Failed committing candidate to running: Validation failed
admin@infix-00-00-00:/config/interfaces/interface/eth0/> set type ethernet
admin@infix-00-00-00:/config/interfaces/interface/eth0/> leave
Error: Cannot create fixed Ethernet interface eth0, wrong type or name.
Please check your changes, try 'diff' and 'do show interfaces'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This affects CLI command such as:
> show interface name p1
Prior to this patch, this took roughly ~1200ms on hardware and with
the path it takes roughly 50ms.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a python3 script "ethtool-to-json" which runs ethtool locally and
converts output which we are interested in into json. The script
simply json encodes the output from ethtool, i.e. it does not print it
in YANG format. This might be a good idea to change in the future if
the C code has to do a lot of ethtool to YANG translations.
The json output of the ethtool-to-json script is then parsed in C
using libjansson, translated to YANG and added to the operational
datastore.
Signed-off-by: Richard Alpe <richard@bit42.se>
The idea was to change regression tests to opt-in, but it does not work
as intended for our core devs, so revert.
If you do *not* want the workflow(s) to run on your fork, you can
disable them with the [...] button on the right-hand side, beside the
"Filter workflow runs" text entry, in the Actions view of your fork.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor factory-reset check slightly to check for a Finit condition
from the bootloader, as well as a custom check for br2-externals.
Note, the chgrp call has been extended to ensure admin users have
permission to create any file or directory in any overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change updates the documentation for the script, hopefully it is
more readable now than the previous wall of text.
Also, a new -6 option to toggle IPv6 SLACC option for port interfaces.
This, in combination with omitting the -b option, allows for enabling
SLACC on interfaces that would otherwise not get an address.
No functional change, tested manually [skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When released the YANG status section claimed IPv4/IPv6 MTU was
not-supported, which was very confusing since the following Changes
section clearly states added support for it.
The YANG Status section was wrong. It has also been cleaned up a bit.
E.g., no need to mention which native model provides an augment or a
deviation, to an end-user the only thing that matters is what is added
to or removed from the standard models.
[skip ci] becuase none of this warrants a rebuild.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No logical change, keeping modification date and revision. We may be
stricted in the future with this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Per spec[1], the PRETTY_NAME "May or may not contain a release code name
or OS version of some kind, as suitable." and seeing as this is not only
a common practice, Finit use this string in the heading when booting.
We've had this already in Infix a while back so it must have been lost
in one of many refactoring rounds.
[1]: https://www.freedesktop.org/software/systemd/man/latest/os-release.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, fix collation of .json snippets to ensure they are sorted by
number, regardless of which directory they originate from.
Second, and with an unexpected twist, use /etc as the target directory
for factory-config.cfg and failure-config.cfg. At first just to avoid
having the resulting .gen and .cfg files in /run/confd/, but it also
unintentionally gives us a way to provide a static /etc/factory-confg
in the image. As the TODO says, not perfect but better than before.
Third, update load script to use the same base path as bootstrap by
sourcing the system /etc/confdrc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A customer specific build required more RAM to boot (bigger image and
more features), but there was no way to modify this as an end user.
This patch opens this up and should give our users a more smooth ride!
We can [skip ci] on this, no functional changes to the OS itself.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adhere to our recommendations and avoid pseudorandom passwords which
are "easy to remember". Also increase password length to 13 chars.
Side notes:
Knowing that a password contains at least one char, one number and so
on, lowers the number of possible passwords to test when brute forcing.
The entropy for the pwgen "easy to remember" passwords isn't good
(naturally).
Signed-off-by: Richard Alpe <richard@bit42.se>
Add counters from Ethtool groups to the operational datastore. The
mapping from Linux / Ethtool to YANG is described in the included
document eth-counters.md.
Signed-off-by: Richard Alpe <richard@bit42.se>
Replaced with full build in GitHub Actions. No other use-cases for it,
and too much of a hassle to maintain, so remove.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A list of interfaces: x10 x9 x8 x7 x6 x5 x4 x1 x2 x3 should be sorted in
order with x10 last. Using the common 'sort -n' would generate: x1 x10
x2 ... so we use version sort. This way we can ensure that the order of
bridge ports is natural and what end users expect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Operational experience shows that the current Infix Fail Secure mode,
introduced in ca9daef, does not work in practice.
The factory datastore in sysrepo is created at boot with the YANG models
and the factory-config file. When the factory-config file is generated
from older versions of these models, the resulting datastore may fail to
pass the validation and system will end up in an unrecoverable state.
Instead, both the factory-config and failure-config must be created at
every boot to match the YANG models in the active Linux image. This
ensures loading the YANG models will always work and the system can
proceed to attempt to load startup-config to the running datastore.
If loading startup-config fails we can fall back to failure-config,
which like factory-config, will then provide a way to log in an dianose
the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If the bootloader knows about a factory-reset or dev-mode button, use
them to allow stopping the boot process, and to signal the
factory-reset condition to infix.
This implements the new model infix-if-vlan.
The new CLI is:
root@infix-00-00-00:/config/interfaces/interface/vlan10/> set vlan id 10 lower-layer-if eth0
with an possible extra option for tag-type, default tag-type is c-vlan.
Without it, the offset generated will always be zero.
But over netconf it will still be correct, most likely
because due to how libyang handles the date-and-time type.
The issues seen in the regression tests looks related to files
missing from minimal defconfig.
Fixes#127.
Signed-off-by: Richard Alpe <richard@bit42.se>
DSA ports such as pX has "link" (parent) set to dsaY. We don't see it
that way from an networking perspective. In this commit we avoid
adding parent to the statd data structure if the linkinfo -> info_kind
is dsa. This means the ports shows up as regular interfaces, which is
what we want.
Signed-off-by: Richard Alpe <richard@bit42.se>
Pretty print all Ethernet frame statistics from the operational
datastore. Only in the detailed interface view.
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds the framework for reading ethtool statistics and
inserting it into the operational datastore.
The ethtool data we rely on is "group data" such as "eth-mac" or
"rmon".
This data can be displayed using:
ethtool --json -S e0 --all-groups
The "group data" is still missing for most common drivers, so testing
this will require a firmware which has support for it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Regenerate if either factory-config.gen or failure-config.gen is missing.
This should not happen, but is better to check for the result rather than
the intermediate result.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to run "resolvconf -u" at boot we need dnsmasq up and running
and startup-config having been loaded successfully. (No point when we
hare in fail secure mode.)
If this bugs out it can be pinpointed by an empty /etc/resolv.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the two /etc/os-release variables:
- IMAGE_ID
- IMAGE_VERSION
The former is configurable, with fallback to name-arch, and the latter
is only set for relase builds. During releae builds the release will
be appended to the image name.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Marvell mv88e6xxx switch driver currently used in active projects do
not support multicast router ports properly yet. Considering that Infix
do not yet have YANG support for configuring IGMP/MLD snooping, we have
decided to disable it in bridge setups by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We should only call 'error' in case loading failure-config fails, not if
loading startup-config fails. Unclear how this passed testing, must have
been a last minute change that got untested.
Found during integration in customer's br2-external.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Overzealous shellcheck application lead to gen-intefaces not creating a
bridge when GEN_IFACE_OPTS was uncommented in /etc/confdrc
Verified in customer br2-external.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Create per-arch unique distribution file names
- Source .gns3a information from /etc/os-release
Instead of attempting to create unique file names by hard-coding an
'infix-' prefix and extracting the "board" or "arch" part from the
defconfig, let's use the branding information from /etc/os-release
along with $BR2_ARCH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it possible for projects using Infix as a br2-external to
override lots of OS-specific strings and contact information that
previously was hard coded.
The generated /etc/os-release now takes most of its data from .config
Worth noting is the changes in VERSION and BUILD_ID fields. The former
will be INFIX_RELEASE, during release builds, and the latter is always
the output from `git descibe ...`, or rather GIT_VERSION. This variable
can be overloaded as well.
See the help text and the new doc/branding.md document for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default arch and disk image filename needs to be generated
to be unique per, at least, each architecture build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to problems with using u-boot as loader¹ we decided to start the
system by calling the kernel image directly. The downside to that is
that, even though RAUC upgrades would work, the kernel would remain
the same.
Improvements to this are of course welcome.
________
¹) Must extract the built-in .dtb and merge with the Qemu .dtb at runtime
to be able to boot primary (or secondry) image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling `load_cfg BR2_EXTERNAL_INFIX_PATH` from post-image.sh caused
warnings due to multiple hits in the .config file:
post-image.sh: 12: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
post-image.sh: 13: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
Let's grep for a "key.*=" instead of "key" to drop those warnings, while
still acting as a catch-all for partial matches.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes to IPv6 address origin (type 'random' rather than 'other')
now reflected in documentation.
Also using 'admin' instead of 'root' user in examples.
As we may need to load firmware to the PHYs, we can't load those
modules until we have access to the rootfs. In order for that to work,
the MDIO driver must not be built-in, as that will cause the kernel to
bind devices with missing (built-in) drivers to bind to the genphy
driver.
Therefore, build everything as modules and let udev load it during
boot.
In order get the ONIE EEPROM support and some mv88e6xxx related fixes,
move to 6.5.6, with the intention of upgrading again, to the next
longterm kernel, as soon as one becomes available.
Also, import patches from kkit-linux-6.5.y.
Everything else is named confd, even syslog messages are logged as
confd, and we've talked about not using sysrepo-plugind one day, so
let's prepare for a world where everthing is like that.
Also, and even more importantly, fix the sysrepo-plugind condition.
We cannot use <pid/syslogd>, because it can be restarted and thus
consequently Finit will stop sysrepo-plugind. This first caused a
bit of head scratching because it cause a lot of very odd errors in
the execution of sysrepo-plugind, transactions being abruptly aborted
for instace.
Whatt we can do, however, is use a static condition, which Finit has
support for since a few releases now. We want to guard the start of
our sysrepo-plugind service behind YANG /usr/libexec/confd/bootstrap.
So we can use <run/bootstrap/success>. In case the bootstrap fails,
we catch that in the row before using if:<run/bootstrap/failure> to
trigger the /usr/libexec/confd/error script (described previously).
The other run/task/services can be guarded behind <pid/confd> and now
everything suddenly makes sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New script 'error' that can be overridden by a br2-external
- Call 'error' if YANG model bootstap or factory-config.gen fails
- Call 'error' if loading startup-config or failure-config fails
The 'error' script calls syslog¹ to log the error messge:
The device has reached an unrecoverable error, please RMA.
____
¹ to get a timestamp log message, and send remote in case a
br2-external has somehow hard-coded network for remote syslog
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This rather huge change is a refactor of the factory-config generataion to add
support for also generating a failure-config.
The confd bootstrap script has been given an rc file. This both eases manual
testing, when modifying the script(s), and also makes it easier to override
from a br2-external. Infix default is router/end-device, but a br2-external
may be a switch firmware and want to default to all ports in a bridge.
The generated failure-config creates a fail-safe "do no harm" config to boot
with in case startup-config for some reason is broken or cannot be applied,
e.g., bug in confd. Meaning, for both the router and switch use-cases the
device will start up with all interfaces isolated¹, with an IPv6 SLAAC (EUI64)
address per interface.
Services enabled in this fail-safe mode are: LLDP, mDNS/SD, SSH, and NETCONF.
All to facilitate diagnostics, troubleshooting and device recovery.
Other noteworthy changes include:
- rename factory/failure directories again -> factory.d/failure.d. Use
same naming as we do on target for directories holding generated files
- The bootstrap script no longer regenerates /cfg/factory.d on each boot
- The bootstrap script copies all static templates to /cfg/factory.d in
case a newer image changes the contents of them. For troubleshooting
- Support for overriding the 20-interfaces.json generation by br2-external
- Support for additional 30-config.json (ovrride/extend) by br2-external
- Expand gen-interfaces to support bridge use-case.
_____
¹ For a switch this means "no switchport", i.e., no switching between ports
otherwise connected to a switchcore (or bridge) in startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd and BusyBox syslogd can not run at the same time. Since they
provide the same service we standardize on them providing <pid/syslogd>.
Also, ensure syslogd does not start until the fifth udevadm has completed.
This creates a barrier preventing other run/task/services from starting
too early. Thus guaranteeing a proper boot order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit fixes a regression introduced in 15572e9e where /bin/bash
was unintentionally set as the defalt /bin/sh in the system. This cause
several warnings and errors when a Bash-based /bin/sh tries to sources
/etc/profile because $SHELL identifies it as /bin/bash.
The ietf-system.yang model, with the infix-system.yang extensions,
declare a per-user SHELL that allow /bin/clish, /bin/bash, /bin/sh
and /bin/false. There should be a clear distinction between them.
This change also helps us keep bashisms away. If a script needs
Bash features, declare: #!/usr/bin/env bash
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit drops sulogin from BusyBox, as well as the Finit replacement,
in the NETCONF builds. The classic builds retain the Finit sulogin.
Furthermore, the Finit rescue mode is disabled (which uses sulogin), so
in case of trouble at boot, e.g. missing fstab or failure to fsck, the
system will no longer go to sulogin but instead log error to console and
reboot.
NOTE: the bootloader still needs to be locked down, otherwise a user
could just as easily change kernel cmdline to 'shell=/bin/sh'
Misc. reshuffle and defaults updated are due to make foo-update-defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- with conditional execution support
- fixes to udevd and udevadm calls in renamed 10-hotplug.conf
- support for overriding internal services, e.g. dbus, keventd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only create a default startup-config from factory-config if one is missing.
Do not load an existing startup-config, that is handled by a later step in
the boot process, which needs to be monitored (and displayed) separately to
fail over to a Fail Secure mode on error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes to the system concerning access rights, like users, should always
be logged, in particular when creating new users or failure to create or
modify their properties.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change addresses a problem accessing Infix over SSH. The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.
The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.
As before this change, the script starts by calling `sshd -t` to verify
they hostkeys. Unlike before we now check for 'invalid format' in the
output of that command. If any file with invalid format is found, we
remove them and regenerate the hostkeys.
In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.
Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We only want Bob to run when PR's have been merged to main, this means
when something is pushed to main. (Took a while to figure this one out
actually.) See the following community discussion for details:
https://github.com/orgs/community/discussions/26724#discussioncomment-3253102
Also, we've seen that moving the 'latest' tag messes up any push/pull/sync
operation between clones and forks, so let's skip it and see how that works.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle IPv6 Router Advertisement (RA) based addresses.
If the last 64 bits of a link-local address is generated using the
local MAC address of the interface, i.e. a EUI-64 based address. Then
the origin is set to "link-layer".
If the addrgenmode is set to "random" instead of "eui64", then the
device will generate the interface identifier portion of the address
(the last 64 bits) randomly rather than deriving it from the MAC
address using the EUI-64 process. This will result in a "random"
origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
Setting the link MTU in Linux changes the sysctl IPV6 MTU, so we have to
set the IPv6 MTU on each run in case the IPv4 MTU changes. Hence, this
also means the IPv6 MTU must be set *after* the IPv4 (link) MTU.
statd has been updated to read the sysctl setting for IPv6 MTU.
Notice how the loopback interface is unsupported for config + status.
Fixes issue #151
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the new fancy result-gh.md file which as github emojis. Also,
split result publishing to its own run command to simplify the YAML
file.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result file with github emojis
> 9pm.py: expose ROOT_PATH to tests via env
> lib_tcl: improve handling of extra ssh args from test
> 9pm: fix evaluation of <base> option in nested suite
> .github: publish test result md in github
> 9pm: resolve <scratch> in suite option
Signed-off-by: Richard Alpe <richard@bit42.se>
Collecting pyyaml==5.4.1 (from -r /root/pip-requirements.txt (line 6))
Downloading PyYAML-5.4.1.tar.gz (175 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 175.1/175.1 kB 16.2 MB/s eta 0:00:00
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'error'
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> [68 lines of output]
/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/config/setupcfg.py:293: _DeprecatedConfig: Deprecated config in `setup.cfg`
!!
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
!!
parsed = self.parsers.get(option_name, lambda x: x)(value)
running egg_info
writing lib3/PyYAML.egg-info/PKG-INFO
writing dependency_links to lib3/PyYAML.egg-info/dependency_links.txt
writing top-level names to lib3/PyYAML.egg-info/top_level.txt
Traceback (most recent call last):
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 335, in main
json_out['return_val'] = hook(**hook_input['kwargs'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 118, in get_requires_for_build_wheel
return hook(config_settings)
^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 355, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=['wheel'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 325, in _get_build_requires
self.run_setup()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 341, in run_setup
exec(code, locals())
File "<string>", line 271, in <module>
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/__init__.py", line 103, in setup
return distutils.core.setup(**attrs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 185, in setup
return run_commands(dist)
^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 201, in run_commands
dist.run_commands()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 969, in run_commands
self.run_command(cmd)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/dist.py", line 989, in run_command
super().run_command(command)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 988, in run_command
cmd_obj.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 318, in run
self.find_sources()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 326, in find_sources
mm.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 548, in run
self.add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 586, in add_defaults
sdist.add_defaults(self)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/sdist.py", line 113, in add_defaults
super().add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 251, in add_defaults
self._add_defaults_ext()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 336, in _add_defaults_ext
self.filelist.extend(build_ext.get_source_files())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.
note: This error originates from a subprocess, and is likely not a problem with pip.
The command '/bin/sh -c ~/init-venv.sh ~/pip-requirements.txt' returned a non-zero code: 1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Improved "show interfaces" information is now
reflected in IP address examples
- source info added
- IPv6 addresses shown
Also added an example with IPv6 privacy for stateless autoconfig
Manually merge PR #137, with minor updates to the YANG deviations, and
complete relocation of the new user-guide. The idea is to keep all the
documentation generic and use the docgen package later to include all
relevant parts into a PDF user guide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Like the Developer's Guide the User's Guide should be a single file on
top-level (at least for now), where it references certain sections in
other files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting deviations of non-supported parts of ietf-ip
Idea is that "pyang -f tree ietf-ip.yang infix-ip.yang" should
show what we really support (and should make tests for).
Only physical interfaces have a permanent link address. So in order to
restore the default MAC generated by the kernel for interfaces such as
bridges, veth pairs, VLAN interfaces, and link aggregates, we recreate
them.
This patch adds support for checking if the phys-address attribute has
been deleted from bridge, vlan, and veth interfaces.
The netdag_must_del() function has been refactorored slightly so each
interface type is responsible for returning true if its condiitions are
satisfied.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The netconf-client Python lib currently does not support the <get-data>
RPC. This commit adds a local extension to the Device class which can
be upstreamed at a later time.
Also some added comments and disabling of pylint warnings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Override read-only flag in YANG model
- Add support for setting custom MAC
- Add support for restoring permanent/original MAC
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable privacy feature, allows true random address instead of EUI64
- Allow global addresses to use router prefix
Fixes#136
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set the IP origin "random" for avahi IPv4LL addresses. The reason we
use random and not link-layer for link-local IPv4 addresses is the
fact that they are not based on link-layer info, such as IPv6 eui64
generated LL addresses.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine copy of the current version of avahi-autoipd.action.
This script will be modified by us in later commits.
Signed-off-by: Richard Alpe <richard@bit42.se>
Modify existing IPv4 code to also add IPv6 address data to the
operational datastore. Also add support for handling link-layer IPv6
address.
IPv6 LL addresses generated with eui64 has "link-layer" origin
and random/secure generated LL addresses has "random" origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
This currently includes cli-pretty tests. It could be executed
separately to clarify test results in github actions. This commit
includes it in the main test execution. The most important thing is
that it's executed.
Signed-off-by: Richard Alpe <richard@bit42.se>
It doesn't look like the regression suites updates the 9pm submodule,
in this commit we attempt to fix this.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: print git sha sum in banner
> 9pm: add graceful check for missing suites and tests
> ssh: Spell out the full name of node properties
> ssh: Remove username from debug messages
> Merge pull request #48 from neg/execute-cleanup
Signed-off-by: Richard Alpe <richard@bit42.se>
There might be more places in confd where this is needed. This works
for the most basic use case.
The proto set here is picked up by statd and converted into a YANG
origin, which is exposed to the user.
Signed-off-by: Richard Alpe <richard@bit42.se>
Flush addresses during shutdown and renewal with new address.
This is kind of a hack and needs further testing.
Signed-off-by: Richard Alpe <richard@bit42.se>
This fixes one bug in Infix, namely that dhcp removes all other
statically configured addresses. However it introduces a new one
where dhcp renewals with new ip addresses are added as "duplicates",
we fix this in a later commit in this patchset.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine version of default.script to our local board override.
The reason for this commit is to track changes we do to it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add protocol from ip route (kernel) as origin in YANG model.
Note, we control the names static and dhcp in the file rt_addrprotos.
Signed-off-by: Richard Alpe <richard@bit42.se>
This file is read by iproute2 and creates valid names for ip proto.
Such as "static" in:
ip addr add dev e0 192.168.1.1/24 proto static
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result markdown file
> Use unique log dir for each 9pm execution
> 9pm: parse 9pm.rc file in harness
> Add new 9pm.py harness examples
> 9pm: add space between timestamp and output
> Move tcl library code to lib_tcl subdirectory
> 9pm: fix TAP skip result when not last in test
> unit_test: allow tap.yaml to be executed from cmdline
> Merge pull request #49 from kernelkit/master
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows us to show empty values easier, while not affecting the
if statements.
This allows for a greater flexibility in which values are shown and
not. For example, we want to show empty columns for data that the
user adds/removes, such as IP addresses.
...
ipv4 addresses :
...
However, we don't want to show empty columns for information that
should never exist for a particular interface type.
Signed-off-by: Richard Alpe <richard@bit42.se>
The old version (bash) where slow and cluttered. This version is much
faster and easier to read / maintain.
Signed-off-by: Richard Alpe <richard@bit42.se>
This test is a "unit" test, which implies that it can be executed
locally without access to a Infix target environment.
Signed-off-by: Richard Alpe <richard@bit42.se>
The port marker is intended to be used as a hint to the
auto-factory-config generator, so that it can create a bridge for all
switch ports by default. Therefore, revert to only include ports that
devlink reports as "flavour physical".
If we want to test this functionality in QEMU, we can use Rocker, the
virtual switch, instead.
The old assumption was that only virtual links would have specific
"linkinfo" data. However, somewhere between 5.19 and 6.1, DSA ports
gained the ability to report its "conduit" interface via the
"linkinfo" attribute. That's great, but unfortunately it broke our
heuristic assumptions.
The new assumption is that only physical ports will report a
"parentbus" attribute. Let's see how long that will last :)
Our custom version has gone from being newer than Buildroot's default
to being older, so there is no reason for us override it anymore.
The kernel has become a bit more picky and will give nasty error
messages if a link's PHY connection is not explicitly defined, but
instead relies on implicit defaults. This was missing from the CPU
port of the CRB, so we supply a small patch to fix that.
When running `make legal-info` Buildroot will collect source and
licenses for all packages, which generates a few warnings for our
local packages. Local packages are skipped.
> The source code for packages that set <PKG>_REDISTRIBUTE = NO will not
> be saved. Patches that were applied are also saved, along with a file
> named series that lists the patches in the order they were applied.
Hence, setting 'foo_REDISTRIBUTE = NO' disables the warning, which seems
like a good idea to reduce the number of unnecessary questions we might
otherwise get.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrap and daemon-specific helper scripts, sometimes known as foot
guns, should not be in $PATH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This unfortunately required some restructuring, and as well as extending
the run time since we have no way of sending Ethernet frames currently
in the test framework (socat would be nice).
- Put enable/disable of services before tcpdump start, LLDP lingers ...
- Extend run time: 3 -> 20 sec to catch periodic LLDP messages
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test use NETCONF to enable/disable SSDP, it then verifies that the
DUT responds to, or does not respond to, SSDP discover messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This first version reliles on netcat (nc), mostly because that's what I
could figure out how to run in a netns. A better way would be to have a
full SsdpClient that can collect query responses properly and log all
devices found.
This, however, will do fine for verifying SSDP on/off functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for enabling LLDP using the std IEEE 802.1ab
LLDP yang model. An infix-lldp model is as well to reduce the set of
available parameters to a bare minimum (enabled), for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
I'm sorry, I'm just so used to this modus from the previous company.
The difference to 'exit', which is available on Cisco IOS, is that it
on the top-level config context does not exit/abort to admin-exec but
instead stops.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The script resides with confd and sets up our system for confd, this
should make it easier to rememeber where it's located.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, for usability, add `name:<SVC>` to each service declaration so they
can be located more easily and/or enabled/disabled using the service they
provide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything (!) potentially shared with other sysrepo plugins/daemons and
helper functions (not yet in libite) that can be used by other daemons
have been relocated to libsrx.
Fix#116
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops auto-enable of services we want to be able to control
via NETCONF/YANG. SSDP and mDNS/SD enable/disable configure support,
using native models, will be included in the same PR and LLDP+SNMP may
come later, using std. IEEE/IETF models, they are not critical atm.
Fix#118
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some system, certain interfaces are not usable by an end-user. The
canonical example of this is the ethernet MAC connected to a switch,
i.e. the DSA port.
Avoid having these be picked up in the generated factory-config, which
would be confusing to a user, by classifying them as "internal" ports
to be ignored by confd and friends.
For some reason, the controller disables the bus power sometime after
it was enabled by the driver. The reference manual says, in Table 645,
about the SD_BUS_POWER bit:
> ... It will be cleared if one of the following occurs: the
> sd_bus_vlt and the voltage support in the Capabilities Register 1 do
> not match or if a card removal state was detected.
Further investigation will be needed to find the (electrical?)
root-cause of this issue.
The kernel's mounting of the rootfs may race against the underlying
device being probed - especially for media like MMC cards and USB
sticks.
Therefore, tell the kernel to wait for the root device to show up.
In the future we want to build disk images from builds where we
haven't locally built Infix, we've just downloaded an existing
release. In those cases we also have to create rauc.status, even
though we're not creating a bundle.
This is the layout expected by the "distro boot" effort in U-Boot.
As far as I understand, the contract is:
- U-Boot built for `fooboard` by `vendor`, will set the `fdtfile`
variable to `vendor/fooboard.dtb` - or more precisely: matching
whatever path the dtb is built at in the kernel tree.
- A distro (e.g. Infix) then just needs to specify the `fdtdir` in its
syslinux config (/boot in our case), and U-Boot will be able to find
the correct dtb.
Make the traditional FITs smaller by:
- Filtering out the kernel image from the rootfs, since the FIT way is
to ship it separately.
- Gzipping the kernel in the FIT, since aarch64 uses the uncompressed
"Image" format, and squashfs won't take care of it for us.
Add source, such as "ethernet" to the show ietf interfaces command.
This is translated from the somewhat obscure ietf type, such as
iana-if-type:ethernetCsmacd => ethernet
Signed-off-by: Richard Alpe <richard@bit42.se>
Replace the old "ip" output with data from the sysrepo operational
datastore. This data is piped through the new json-cfg-pretty script,
which formats the data in a nice human readable way.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add IPv4 address info from "ip addr" json to sysrepo operational
datastore.
This patch adds: MTU and ip with prefix-length.
Signed-off-by: Richard Alpe <richard@bit42.se>
The commit adds a missing description and reorders some yang statements
to meet canonical ordering according to RFC7950, section 14.
It also relocates the /interfaces/interfaces/infix-if:port augment to
its own base model that the bridge (and later lag) models reference.
Solving the bisarre ordering issues we've seen previously.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new infix-interface-type, derived from the IANA base
type, allowing us to limit the list of supported native interface types.
Basing on IANA interface type ensure compatibility with other models,
e.g., standard/ieee/published/802.3/ieee802-ethernet-interface.yang,
which attaches itself to all interfaces of type ianaift:ethernetCsmacd.
Tested with yanglint and in Infix using ieee802-ethernet-interface.yang,
the 'ethernet' container was properly attached to interfaces of type
infixift:ethernet.
Tab completion in the CLI now lists only the supported types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This further locks down confd to fall back to /bin/false as login shell
in case of internal errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch restricts the possible user shells to a subset of the list in
/etc/shells, which is generated by Buildroot. The default is 'false' to
prevent accidental shell access for non-admin role users.
The default shell for the admin user is now /bin/clish, which can be
further locked down before Infix v24.02 LTS.
In case of internal error the default fallback shell is now set to the
customizable LOGIN_SHELL, which currently is /bin/bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following changes have been made to condense and simplify the
leading text in the README. Tested with Grip to verify that the first
paragraph flows nicely to the left to the fine new logo. This allows
us to use the space more efficiently and the reader does not have to
scroll so long before reaching relevant content.
- Right-align logo, and shrink it a bit, to fit text to the left
- Move topic links to a foldout at the top
- Move boring licensing stuff to separate docment
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Go for something simple - Tux trapped in an RJ45 jack.
Also, remove the old versions that we don't use any more. They're in
the log if we ever need them.
This is a cleanup and reorganization of the Infix documentation.
Starting with a simplification of the top-level README, splitting
it up into several pages.
Also, fixes#100 by updating the documentation on Qemu.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also renames all klix_SYM@klinfix to SYM@infix, this is fine since we're
always calling these symbols with @infix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Always respect the requested model to emulate. Before this change, a
device configured to run in TAP mode would ignore a user's requested
model and always emulate a e1000.
This worked on x86_64 where that driver is part of the kernel, but
that is not true for aarch64.
- Always supply a mactab. It was very confusing that the interface
names would change, in Infix, depending on the selected networking
mode.
- Remove old decoy variables that were assigned but never used
anywhere.
- Separately setup the host and target side of a nic (i.e. use a
-netdev/-device pair instead of the -nic shortcut). This lets us
share the host side setup across all modes.
This reverts an earlier change where nano was made the default editor in
a misguided attemt by yours truly to accomodate beginner users.
With the recent improvements of the CLI and the fact that the NETCONF
support has matured greatly, the need for a user-friendly editor have
diminished drastically. Editing system files is now limited to devs
and the core team prefers Mg over nano and vi.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, add a new `quick.md` that pops up when the user types `help`.
Very quick intro to get started. Useful when we add a factory-default
motd: "Welcome to the CLI, type 'help' for a quick overview."
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync sysrepo conf settings, lots of new settings added, one removed
- Check if help topic exists
- password encrypt arguments should be optional, add SWITCH
- show datetime argument should also be optional, add SWITCH
- Trial, output factory- and startup-config colorized
- Switch to srp_prompt v2 for configure context
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The upstream help system has improved greatly. We can now rely more on
it for generating the man-page like help texts for leaf nodes. There
is also a new srp_prompt symbol that overrides the default klish one,
srp_prompt adds a '%x' format specifier for an inline path instead of
the default [edit foo bar] JunOS style two-liner.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lots of changes upstream for parsing help texts, running as different
user, etc. Was getting too difficult to backport to tags/3.0.0, so this
resets the clock on top of (almost) the latest. Experienced issues with
the admin user in configure mode on the latest commits (e4f65d5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is needed for the bleeding edge klish + klish-plugin-sysrepo, which
the next couple of commits will add.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Preparing for a "show system-information" as well, which still needs to
be discussed to determine contents. Some data also still missing, e.g.,
article/serial/product number db.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit switches the klish package to use the kkit branch instead of
keeping a lot of patches from the v3.0.0 release.
Most of the changes made are for dragging tinyrl into the 21st century.
It now supports most of the basic features one have come to expect from
a readline replacement: line navigation, deleting words, erasing entire
line, kill and yank of lines/words and last argument on previous line.
The history has also gotten a bit of a stern talking to. It no longer
deletes lines matching existing old ones from the history, instead it
just checks if the previous command is repeated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the JunOS look of the CLI to something more akin to
a standard shell. To achieve this a %w format specifier to display the
path components is added to both klish and klish-plugin-sysrepo.
Before:
admin@infix-12-34-56:exec> configure
[edit]
admin@infix-12-34-56:configure> ediit interfaces interface eth0
[edit interfaces interface eth0]
admin@infix-12-34-56:configure> leave
admin@infix-12-34-56:exec>
After:
admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interfaces interface eth0
admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
admin@infix-12-34-56:/> leave
However, due to unforseen problems with the naming of VIEWs in klish,
the admin-exec level "path" is hard-coded to "/" for now.
Future imporovement: fold in calling prompt@klish from srp_prompt, and
figure out why the "main" VIEW cannot be changed to "exec" without klish
just bailing out starting up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out one of the reasons some keys did not work as they should in
certain commnands, most notably the Home/End in 'less', was due to the
default TERM variable being set to 'linux'. Changing to 'xterm' fixes
this issue, works with both console and ssh login, and from testing do
not seem to have any adverse effects on existing functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While spending the past couple of weeks actually trying to use the CLI,
I realized that it was very confusing to have a different behavior for
Ctrl-C than I was used to from regular shells (including the old clish
from $OLDJOB).
This change drops the Ctrl-C binding, restoring break/abort behavior,
and lets Ctrl-D be abort/exit. Pressing Ctrl-D in a sub-context in
configure calls exit, when in the top-most configure context we now
do an abort and return to admin-exec.
To apply the changes the user still has to type 'commit' or 'leave',
or tap Ctrl-Z as in the Cisco CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not just for online viewing, these markdown documents are also
made available in the CLI itself from admin-exec as:
help [introduction | keybindings | tutorial]
With this commit we also add lowdown and the real less application to
be the Infix help system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the srp_help_text() symbol. It allows us to
display the full description for a leaf in a YANG model. This has
been added to the 'help [foo]' configure context command.
A separate admin-exec level 'help' command will be added in a later
commit. It will only be an intro to the CLI, keybindings, etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This restores some of the original keybindings for line manipulation
that was part of the original CLISH. They had been disabled upstream
during the UTF8 conversion and never got reimplemented.
From branch kkit on https://github.com/kernelkit/klish, the kkit branch
is based off of the 3.0.0 release. The same patches are also available
on kkit-next, which is based on the latest upstream master.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With completion support. The log command has an optional last arg,
after FILE, tail NUM, which runs tail -n NUM FILE instead of cat.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An excellent example of how to define commands with optional subcommands
and optional parameters:
password encrypt [type <md5 | sha256 | sha512>] [salt STRING] [PASSWORD]
The tricks here are two:
1. mode="switch" in the top-level password command
2. min="0" in the encrypt subcommands
The first turns the COMMAND element into a SWITCH element (with command
matching), and the second makes a COMMAND optional. If an optional
command is input by the user, then the enclosed PARAM is mandatory.
Please note, due to limitations in the mkpasswd¹ utility, spaces are not
supported in PASSWORD, i.e., when read from CLI prompt. However, spaces
are allowed when using the interactive prompt, i.e., when omitting the
PASSWORD from the CLI prompt.
¹) mkpasswd does not look for any leading ' or " in the password arg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The documentation for klish mentions the file ptypes.xml, which defines
the ptype /STRING. So let's use that instead of defining our own types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Helper commands for quickly diagnosnig the networking subsystem after
making config changes. Should over time be replaced with operational
status from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An iana or infix interface type is derived from "ip link" data.
Such as loopback -> iana-if-type:softwareLoopback.
This patch adds support for the following types:
loopback, ethernetCsmacd, veth, l2vlan and bridge.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables a basic sanity check of usernames in BusyBox that by
default is disabled (!). The rules enabled by this are:
- the user or group name should consist only of letters, digits,
underscores, periods, and dashes¹, and not start with a dash (as
defined by IEEE Std 1003.1-2001), or periods²
- for compatibility with Samba machine accounts, $ is supported at the
end of names
- max length of user or group name is 256 chars
Changes in this commit also includes a sync with latest BusyBox 1.36,
which adds: tree, tsort, SHA hw acceleration, and a separate script
for udhcpc6.
_____
¹) The documentation actually mentions "and at-signs" as well, but that
has been explicitly removed from the source code.
²) The documentation does not mention that leading periods are not
allowed, though this is also explicitly mentioned in the source code.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Factor out a new helper function, change_get_user(), to do the bulk of
the work for the change callbacks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugin-sysrepo to get EnableNACM support. For
this to work as expected for the admin user we also need to change the
permission for the model in sysrepo.
Note: the srp_rollback() symbol has been renamed to srp_reset() upstram.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently netopeer2-server expects public keys for users to be in the
canonical place (~/.ssh/authorized_keys). Infix use a custom location
in /var/run, maintained by the ietf-system plugin, which OpenSSH knows
but netopeer2-server doesn't.
It seems to be possible to add some sort of "pattern" to netopeer2 to
indicate where to look for public keys. This is added when building it
but Buildroot does not expose this as a setting. So for now, this seem
to be the least intrusive way of handling it. The owner is root, so a
malicious user cannot change the link or contents without some other
form of privilege escalation first.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point in leaving unused home directories lingering on the system,
also a potential security problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Employ the new 'adduser -d' feature where users can be created with
password login disbled instead of creating them locked by default.
This allows us to create remote users that can only access the device
using public key SSH login, which until this point was not possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The login applet did not know about shadow passwords, and could thus not
determine if a user accont was locked or passwordless. This caused it
to return 'login: bad salt' instead of "Login incorrect", which is the
more secure path for handling brute force attempts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The existing 'adduser -D' command adds a locked user account, similar to
the Debian adduser --disabled-login'. This patch adds support for the
'adduser -d' command, similar to Debian 'adduser --disabled-password',
meaning login is possible but using methods other than password, e.g.,
SSH keys.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This ensures that the operstate is defined for all interface
types. Without supplying this, virtual interfaces (e.g. loopback,
dummies, tunnels) will report an "UNKNOWN" operstate. For ports backed
by physical (or virtualized) hardware, this option has no effect.
- add debug flag to trigger DEBUG() statements
- DEBUG() macro needs 'path' argument
For statd we can add support for an optional '-d' command line option to
trigger, and SIGUSR1 to toggle, debug mode. TBD for confd which still
remains to be refactored into the same standalone daemon as statd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to 1) map debug/error macros to syslog(), which does not
need \n, and 2) when stdout logging is used, let the macro add a \n.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows us to verify common RPC commands from within the
CLI, starting with the poweroff and reboot commands.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use timezone names defined in iana-timezones.yang, replacing
the type 'string' in standard ietf-system.yang
This enables CLI (tab complete) and NETCONF clients (dropdown)
to view available timezone strings, and the yang engine to
validate the input.
Deviation in ietf-system.yang
'replace' username type from general string to a string
with length and pattern restrictions inline with the
BusyBox 'adduser' tool.
Note, chk_sr_user_update is more restrictive, which should
be handled.
Declaring deviations for optional features for clarity regaring
extent of support.
New revision and file of infix-systems created, as earlier version
was included in infix-2023.06 release.
Please see infix-systems@2023-04-11 for history.
Support and deviations has not been checked for the included
'sub-yang-module' infix-systems-software, thus there may be
more updates to come.
two fixes
- first a typo (probably copy/paste issue)
- the sleep and 'vtysh -b' was added to make
vtysh read the /etc/frr/frr.conf file upon start(*)
sleep needed to make this happen after initctl reload
(*) See https://docs.frrouting.org/en/latest/vtysh.html#integrated-configuration-mode
But there ought to be a better way.
This patch does two main things:
1) Breaks "statd" free from "confd".
2) Introduces netlink monitoring of interfaces for sysrepo data.
Prior to this patch, sysrepo operation status was handled by code
named "statd" inside "confd". (Where confd is a sysrepo-plugin and
not a real daemon, which its name implies)
In this patch, we break out the interface part of the operational
sysrepo status, previously "statd", into a new daemon, also called
"statd".
The main reason for doing this is to avoid sysrepo threading, which
allows the new "statd" to have control over sysrepo events in the
same event pool as netlink events from the kernel. This in turn allows
statd to subscribe and unsubscribe dynamically to interfaces that
comes and goes during runtime (such as vlans).
It also makes sense that "statd" is in fact a finit daemon.
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows an application to set a larger socket receive buffer size.
The default size is left unchanged (212992). 1MB is arbitrary chosen.
The main reason for this is to allow netlink kernel sockets to
hold more interface data while user-space is processing it. Typically
useful during main configuration changes where lots of kernel side
changes occur in short period of time, such as VLAN creation.
Signed-off-by: Richard Alpe <richard@bit42.se>
For some reason, the `make license-info` target complained klinfix
needed a hash file, but not the other local repos. Issue #67 tracks
adding license-info to releases, which will need some looking into,
for now this fixes the most glaring packaging oversights.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This script has some seriously sharp edges. Today two devs cut their
fingers on it trying to get new functionality in place. One when, in a
attempt at, adding an innocent status daemon, and another setting up a
client repository with a custom, enabled-by-default, daemon. In both
instances this script happily cleaned out the deamons from enabled/.
A better alternative, as described in issue #74, is to be stricter on
what is enabled by default, and for things we feel provide value in the
Classic build, maintain a separate list of symlinks in its meta board
definitiion instead.
Also, clean out previous attempt at factory-config. Now that we have
the auto-factory support in place we don't need this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In normal use-cases querierd needs a bridge with multicast-snooping
enabled to run. No point in attempting to start querierd by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- allow custom options sourced from optional /etc/default/smcrouted
- don't enable smcrouted by default when enabled in Buildroot .config
because normal use-cases require an /etc/smcroute.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use same if: syntax for release/upload job as for build job. Only thing
the upload job needs to ensure is that it does not try to upload built
artifacts from forks or from non-main builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verifies that RAUC bundles can be installed using NETCONF.
We choose to not add this to the "all" suite for now, as the qeneth
topologies do not run with full disk emulation.
To test locally, configure your "make run" instance to use the UEFI
loader, launch `make run`, and then run:
make INFIX_TESTS=test/case/ietf_system/upgrade.py test-run
We were now at the point where it was completely impossible to see
which files are actually built.
Bring back some order, making future diffs easier to understand.
This let's us report the installed software versions, before any
updates have been made. Since the info should _not_ be erased in a
factory reset (since the installed software versions will not change),
move the status file to aux, which is the proper place for this class
of information.
- When running with full disk emulation (via GRUB on x86, or U-Boot on
aarch64), there's no way for us to influence the commandline passed
to the kernel, so the console is fixed to ttyS0/AMA0. Therefore,
reintroduce an option to choose the console.
- Use a fixed `nr`s for virtconsoles, so that the gdbserver always
listens on `hvc1`. Ideally, we should use udevs `/dev/virtio-ports/*`
symlinks, but for some reason these point to `/dev/vportXpY` and not
to `/dev/hvcY`. TODO: Figure out what the difference is.
- While we're here, remove the duplicated RTC setup which was
introduced with the virtio-console work a while back.
/dev/ram is accepted by the kernel during boot, but there's no actual
file with this name in /dev, so RAUC will get confused about which
slot is actually one we booted from.
Launches an interactive ipython environment, attached to Infix nodes.
This can be used as a playground for developing tests, testing out
NETCONF operations, etc.
As an example, when running meta/play, a call to a device's `_debug()`
method will enable logging of all transmitted and received NETCONF
messages, which is very useful during debugging.
As with config, the call can be described with a regular python
dictionary. As an example, to reboot the device:
target.call_dict("ietf-system", { "system-restart": {} })
To reproduce regression, before fix, in CLI from factory-default:
> configure
> set interfaces interface e0 ipv4 autoconf enable true
> leave
> shell
$ ps; ip -br a
Turns out, for some reason I cannot figure out, that we cannot use the
same pattern as for ipv6 with lydx_get_descendant(). Manually fetching
the node works though.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of relying on startup-config == factory-config we can now set
running-config to factory-config using the factory-default rpc when
we prepare for a new test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use new APIs runbg() and run_status() to call 'reboot' or 'poweroff' in
the background. This allows sysrepo + netopeer to reply to remote RPCs
before networking goes down.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this patch, every new call to lydx_new_path() where "first"
was set to 1 resulted in a memory leak of 72 bytes. Typically at least
once for each sysrepo query.
The memory was allocated deep down in the lyd library, but as the
parent node wasn't set (NULL) it wasn't found by sysrepo when
cleaning up.
In this patch we mitigate this by simply removing the "first" concept,
as it doesn't appear to be needed.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a real example where we create a writable layer for container based
on a simple image.
To be able to properly start/stop and monitor containers using Finit, we
need to add the options `--systemd=false` and `--conmon-pidfile=...`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
echo">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK"| awk '{print $1}')"
cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
{
"name": "$NM",
"category": "router",
"description": "Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
"vendor_name": "KernelKit",
"vendor_url": "https://github.com/kernelkit/",
"product_name": "Infix",
"description": "$INFIX_DESC",
"vendor_name": "$VENDOR_NAME",
"vendor_url": "$VENDOR_HOME",
"product_name": "$NAME",
"registry_version": 6,
"status": "stable",
"maintainer": "KernelKit",
"maintainer_email": "kernelkit@googlegroups.com",
"usage": "Default console login is 'root', no password. For remote login, default user/pass: admin/admin also works.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
"maintainer": "$VENDOR_NAME",
"maintainer_email": "${SUPPORT_URL#mailto:}",
"usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
