Add a new service that, when enabled, will execute run-parts on
`/cfg/user-scripts.d`.
This strikes a balance between two conflicting objectives:
1. There should be no implicit way to schedule arbitrary code
execution on the device, i.e. no default run-parts directory.
2. It is very useful to have a way of scheduling arbitrary code
execution on the device, e.g. being able to install a debug script
on a production image.
With this feature, we still meet (1), since the feature has to be
explicitly enabled in the startup-config; but we also fulfill (2),
since we can easily enable it when needed.
Partial revert of 23469bbe3b. When running tests in a GitHub action,
we do not want to run as host root user. Therefore, restore podman as
the default runner, but make sure to prefer docker when attaching to
the host network namespace.
Update docs to match the recent developments in the test system.
Spin off the architecture description to its own document, and focus
testing.md on the day-to-day usage.
When interface naming switched to use 1-based indices instead of
0-based, the topology generation was overlooked thus breaking tests
against a `make run` instance.
Bring everything back in sync.
When testing in the host's namespace, only docker seems to offer the
required capabilities (due to its daemon/client architecture).
Qeneth tests can still be run in podman. Users will have to install
the docker wrappers for podman to make use of this.
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
- Avoid global variable references in set_static_multicast_filter()
In test cases, it is common that we want to verify that a certain type
of traffic reaches a namespace. This has, up to this point, been
solved by the generic sniffer.Sniffer.
Try to improve the two most common use-cases...
1. Test if a flow reaches a namespace
2. Ensure that a flow does not reach a namespace
...by always exiting as soon as the first packet is received.
This saves time on positive tests, and the synchronous API allows it
to compose well with infamy.parallel().
Support the familiar subprocess.run API, and runsh from netns.py.
This should only be used for debugging, or in the rare instances when
we want to test functionality that is not available via NETCONF.
QEMU systems seem work fine with the 5s timeout, whereas some physical
devices can't quite keep up with that.
Let the slower systems indicate that they need a bit more time without
punishing faster ones with a longer default.
This will let other Infamy submodules tune their behavior based on the
particular test system they are running on.
Attributes are defined by creating graph-global attributes with an
"ix_" prefix.
Rather than setting up and tearing down two identical namespaces,
create it once and use it for the duration of the test. (This is
probably a documentation issue with Infamy: there is no requirement
that test.steps are direct descendants of the test, but until this
point there was no example of this in the source base)
In the process of this, it was also discovered that no positive ping
test was done over v6, so that has been added.
Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We already have a pull request template. This is a propsal to add issue
templates as well. These yml templates change the behavior of reporting
issues to more a of a pre-formatted form with guard rails.
It is still possible to report blank issues the old way.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we don't have any VPD defined on this board, supply a default
password hash via the device tree instead.
Also, specify the path to external USB port, so that Infix will pick
it up in ietf-hardware.
Provide a patched device tree that:
- Uses the correct phy-mode for eth2, allowing it to be probed
properly
- Wires up the interrupt signal to the GPIO expander, so that the SFP
cage's I/O lines can be configured as interrupts, rather than having
to poll them
Assume that the caller always want to create a new partition table,
even in scenarios where one already exists. This allows devices to be
reprovisioned with a newer image, for example.
Fixes#394
This is not a production target, so we choose the more developer
friendly option of allowing the boot process to be interrupted.
Also, remove the old update cruft and rely on Marvell's `bubt`
instead.
The BootROM wants the bootloader to be located on LBA1, which is not
ideal when using a GPT to describe the partition table.
Make sure the `bubt` command targets SPI by default.
Buildroot's default ATF version changed from 2.9 to 2.10 when we
upgraded to 24.02.x. This meant that our patches were not applied,
which broke the build.
Take a conservative approach for now, and just pin the ATF version to
the known-good 2.9 series.
During the addition of multi-key support to RAUC and U-Boot, the
bootloader defconfig for CN9130 CRB was overlooked, which meant that
the Infix specific U-Boot hooks never ran, thereby ultimately breaking
the build.
Restore the required options to build in the dev-key by default.
The Buildroot 2024.02.x-kkit branch recently had uboot-tools upgraded
and the patches needed require bison to rebuild.
The recommendation is to also install flex, they always go together.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the salting being applied to Python's `hash()` (see [1]), the
hash of an object is not stable across different Python processes. As
a result, neither are the topology mappings generated by networkx.
The upside of this is randomness that we get better test coverage over
time, especially on physical devices where the underlying hardware
could differ between ports, for example.
On the other hand, it can be very frustrating to track down a bug when
locial nodes are suffled around between phyical nodes on each
invocation of a test case.
Therefore, use a random seed by default, but allow the user to specify
a fixed value if they so choose. We then add a meta test that logs the
seed being used for the current suite - which means we can simply
copy&paste that value to rerun the suite (or single test) with the
same topology mappings.
[1]: https://docs.python.org/3/reference/datamodel.html#object.__hash__
- Present the topologies to networkx as multigraphs, rather than
expaning each port of the record shape as a separate node.
- Create a topology mapping by locating a subgraph monomorphism of the
logical topology in the physical ditto.
This cuts down the time of finding a mapping by several orders of
magnitude. Example:
Before:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 13m1,213s
user 13m0,112s
sys 0m0,732s
After:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 0m0,153s
user 0m0,128s
sys 0m0,024s
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The dagger tool is a helper for scripts generated by confd and should
therefore be installed by confd instead of the rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order to make use of the DCB support in mv88e6xxx we also enable it
in the kernel config.
Fixes: 3a73ce3cfb ("kernel: Import EtherType based priority override support")
As mentioned previously, the NACM default ACLs in `factory-config` were
removed as part of the work on the nacm-basic branch.
Adjust text to not mention any pre-configured user levels, for now. A
future update may change the defaults when we've found resonable levels.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch helps silence kernel errors to console at boot. To fully
silence errors, enable emulated /var in your Qemu runs as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The fact that a USB device currently is not authorized is not an error.
This patch adjusts the log level to slip below 'quiet' to prevent logs
to console at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we do not yet have lldpTxFast, or similar, to enable on LLDP, we
tickle both services to resend their HELLO frames on link down/up event
instead.
+ Reduces turnaround times drastically
+ Restore regression test for mDNS, which we lost recently
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Our local runners do not allow sudo, e.g., when installing libyang and
the other dependencies.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the lifetime of Infix, so far, we've run into at least one customer
issue where we had qualms about our use of the local bit causing issues
with 3rd party software. In the end that was not the root cause of our
problems, but we spent way too much time worrying about it. Hence this
patch, which brings our virtual environments another step closer to the
real hardware that Infix runs on.
The OUI used is one of the "private" ones, taken completly at random.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The base mac address is used by bridges in Infix. This patch adds
support for extracting a base mac from the first interface "- 1",
e.g., if the mac address of e1 is 08:00:20:00:00:01, the base mac
will be 08:00:20:00:00:00.
This works with the Infamy test framework (Qeneth) and also with
the qemu script, included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even when `managed = "in-band-status";` was specified on a port,
mv88e6xxx would insist on forcing the values that were supposed to be
automatically picked up by the MAC via in-band signaling.
In the case of USXGMII links on 6393X, forcing the link bit would
sometimes, for reasons that are not understood, cause the SERDES to
reset its USXGMII link partner base page (register 4.0xf0a2) to 0,
which it would then interpret as 10M/half-duplex. As a result, the
SERDES would erroneously perform rate-matching to 10M on egress
towards the PHY (which is configured for 10G/full-duplex), leading to
nothing but dropped packets and much sadness.
This can most easily be reproduced by the following setup:
.------------.
| .-----. .-------.
| | p9 +---+ 3310P +--.
| 6393X :-----: :-------: | T- or X-Units looped via external cable
| | p10 +---+ 3310P +--'
| '-----' '-------'
'------------'
Make sure that neither p9 nor p10 are managed using in-band-status.
1. ip link set dev p9 up; ip link set dev p10 up
2. ip link set dev p9 down
3. ip link set dev p9 up
After step (3), p10 will experience the failure described above in
about 3/4 of the cases. In the cases where the issue does not arise,
simply repeat steps (2) and (3).
Actually a part of statd, but had to make
a separarate package to get it to work.
Statd helper-scripts are now pre-compiled instead of doing it
in runtime.
Fixes#379
The Finit @console construct detects what your actual serial console is
by looking it up in /sys/class/tty/console/active. This to avoid any
weird problems that might occur when using /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even though dnsmasq only listened to requests from 127.0.0.1, port 53
was visible using nmap. We only use dnsmasq as a local resolver, so
we can safely change the config to bind to loopback instead, and at
the same time get less noise from nmap scans.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds a landing page, generated from the top README.md. It
is a temporary fix before adding a proper web ui.
Run ./gen.sh from the directory to update index.html using the template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor mDNS service record generation for improved control of
announcing services. All to add support for modifying the cname
aliases we announce.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both IETF and POSIX allow longer hostname, 253 and 255, which Linux does
not support. Since Linux 1.0 the maximum has been 64 US-ASCII characters.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These callback are not the primary responisble for the property, but
want to be informed of any changes. E.g., /system/hostname changes
should also update the adminurl in all mDNS records.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate all nginx .conf files to board/common/rootfs/etc/nginx/ and
introduce available/*.conf with symlinks to enabled/*.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Align both qemu targets for 'make run' to use kvm with tcg as fallback
and -cpu max instead of guessing. This allows running Infix on systems
that do not have, or do not allow, kvm acceleration.
This is a temporary fix before we refactor 'make run', see issue #388
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The container tests utilize the bundled curios-httpd, which clashes with
the new web services provided by nginx. So we need to disable it while
testing all the containers.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor setup to automatically redirect http -> https, dropping
the /browse location for now.
Also, log to syslog, which has log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit implements Infix mDNS TXT records, version 1, for available
services. Hard coded for the moment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit includes a small prestudy, done over a period of two weeks,
to gather information about common txt records used by hosts. The most
well-documented is the Apple Printing Spec, which among other things
defines adminurl. A proposed version 1 of the Infix txt record spec is
included in the document. I'm recommending alternative 2:
"vv=1" "vendor=Qemu" "product=VM" "ty=x86-64" "vn=KernelKit" "on=Infix" "ov=v24.03.0"
Including this information would enable quickly scanning a network to
see if the latest version of the software has been deployed. Please
note, I've not included the U-Boot firmware version in this proposal,
but it could be included as "vs=2023.10-kkit3", or similar.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change also requires another restructure for netbrowse itself, hence
the relocation of files in the tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With an increase in requests to confine users to the CLI, access using
SSH/SCP/SFTP to the configuration is becoming more and more important.
The admin role in Infix is mapped to the UNIX group 'wheel', meaning we
want all users in that group to be able to read and write files with
that ownership.
This patch fixes the initial ownership of startup-config, and /cfg, and
ensures the copy command in the CLI retain wheel group permissions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With Classic builds out of the way we can move everything back to common
again to simplify and reduce our collective cognitive overhead a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Classic builds served for a while as an introduction to classic
embedded systems, with a user managed read-writable /etc. Today we
decided to firmly take the plunge into the future with NETCONF and
focus on our core platforms aarch64 and x86_64 (for Qemu).
The reasons are several: reduce overhead, simplify build and release
work, as well as manual testing, since Classic builds do not have any
automated regression testing.
The Classic builds may be resurrected later in a dedicated project.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
External pre-built toolchains are usually distrubuted as binary-only and
currently (Buildroot 2023.02) do not have a license file. Infix use the
Bootlin toolchains, built from Buildroot, which contains a summary.csv
file with all packages, and licenses, used.
This commit adds that csv, under the name toolchain-external-bootlin.csv,
to the legal-info output directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When building a Linux kernel that does not match the latest kernel known
by Buildroot, the license file is disabled and nothing is extracted.
For an introduction to this see Buildroot gaf33b1c.
To work around this in Infix we wrap the 'legal-info' build target to
set the license file variable and trigger the license extraction anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The plain output mode prevents garbled JSON output due to the built-in
pretty-printer in mctl. Fixed in v2.1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both L2 and L3 is supported.
With VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge vlans vlan 1 multicast-filter 224.1.3.4 ports e0
Without VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge multicast-filter 224.1.2.3 ports e0
- Rename mdb -> multicast-filters
- Add support for L2 multicast groups
- Change vlan, multicast and mulitcast-filters containers to presence
containers. This will result in that snooping will be disabled when
creating a bridge (or a vlan if vlan-filtered)
- Force the user to choose between VLANs and Multicast on top level bridge configuration
- Force L2 multicast to be state permanent
If an absolute path contains '../' we disallow it because what are you
doing, possible security violation.
Built-ins for running, startup, etc. remain as-is.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On any change to a container network interface we should schedule a
restart of the container to activate the changes. This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.
This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.
Fixes#375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes issues with logger not exiting gracefully on signals (at all)
and busy-looping on stale FIFO.
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Patches in queue for upcoming v4.8 release of Finit fixes:
- initctl touch does not respect -n flag, returning error
- initctl touch does not support template services
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
That factory-config and failure-config can be overridden by customer
specific requirements is documented in the branding document. Focus
on Infix native defaults in general documentation.
Move most of customer specifics to foot note.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 4bfedf7a9 support for disabling IPv6/IPv4 link-local addresses was
added, which in turn caused this regression.
Regression in the v24.03 release cycle, not released -- low severity.
Fixes#353
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Translate LOWER-LAYER-DOWN -> LOWER-DOWN in "show interfaces" overview
and keep LOWER-LAYER-DOWN in detailed "show interfaces name eth0".
Issue #358
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error: error creating container storage: the container name "infamy0" is already in use by "2011c2d7cb1737b788b854a8bd08e519f3cbd6e36dae4975784978cff1f238fc". You have to remove that container to be able to reuse that name.: that name is already in use
make[1]: *** [/home/github-runner/actions-runner/_work/infix/infix/test/test.mk:6: test-unit] Error 125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, log the actual `podman create` arguments to the container log so
we can see what the script actually does when customers report bizarre
happenings with containers.
Fixes#370
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add exception for local images, the "pull" step must be handled by the
operator, i.e., wget of the latest image to the same location as set up
in the image configuration, e.g., for oci-archive:/tmp/foo.tar.gz that
/tmp/foo.tar.gz exists when issuing the upgrade command.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
OCI archives are a bit special. Mention how to load, reference, and
upgrade system using such images.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a host interface setup, i.e., moving an interface from the host to a
container, often using VETH pairs, any route should only be set when an
IP address has been set. This because the CNI ipam plugin, which we
use, require routes be part of ipam, which in turn requires an address.
For details, see <https://www.cni.dev/plugins/current/ipam/static/>
Fixes#366
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All querier functionality for IGMP now handled by mcd, even if there are
no VLAN interfaces on top of the bridge. Also, mcd now handles unique
query interval per interface, or per VLAN, so we no longer need multiple
daemons running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for small incremental changes to bridge ports.
Changes where the libyang diff does not include a bridge reference so
that it will have to be synthesized from the current configuration.
For example, forgetting to set a port's PVID in a VLAN filtering bridge
setup, changing a bridge port's multicast flooding properties, or any
other per-bridge-port setting after the fact.
Fixes#349.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the pivot from having the CLI as default login to Bash (for remote
scripting and production purposes) there is no need for "user friendly"
access to a UNIX shell from the CLI. This provides the possiblity of
limiting users to only the CLI, e.g. a user with only guest or operator
privileges.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop doc/README.md symlink to variant.md
- Make doc/README.md the table of contents
- Clean up variant.md, OSPF and containers now fully supported
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Updating VLAN interface doc inline with current implementation
Mathias has fixed the syntactic sugar when creating eth0.20 interfaces, thus the associated documentation example is updated accordingly.
Only port 2 has an SGMII compatible SERDES. When referencing the
SERDES (comphy), the second argument must contain the port number in
order for the comphy driver to pick the correct configuration.
While __get_phandle_array returns the empty set when the property is
not available, str_array would return None, unless instructed
otherwise. Make sure that it also returns the empty set.
Temporary fix to prevent odd log messages. The fix is to add RAW VLAN
support to mcd so it can run as a proxy querier even if there is no
upper VLAN interface or IP address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds validation of bridge port VLAN memberships and IP
addressing for VLAN filtering bridges:
1. Ports must be a member of this bridge
2. Ports cannot be tagged and untagged member at the same time
3. A VLAN filtering bridge does not support IP addressing
A VLAN filtering bridge can only be a tagged member of a VLAN. Any IP
addressing needs to be done using an upper VLAN interface.
NOTE: while technically possible break up these long must expressions
into multiple must expressions per node (split at 'and'), it will
break libyang in interesting ways that in turn make the confd
inference functionality stop working. E.g., creating VETH pairs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port in a VLAN filtering bridge should be possible to configure
as "tagged only", i.e., to not assign ingressing untagged frames a VLAN
and instead drop them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Must run in privileged mode
- Fix copy-paste container name: system -> nftables
- Point out the important settings
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch prevents statd from failing and logging errors on interfaces
currently in another network namespace.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes a runtime error triggered by modifying an interface
currently used by a container. The CNI code must always return the
CNI status (reserved for container or not).
How to trigger:
- Create veth pair
- Make one end container-network and add to container
- Leave
- Return to configure and set an IP address on container interface
- Leave - BOOM
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- rtc, already does the best it can, fix occasional duped message
- urandom, check if seed file empty, try using hwrng
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backports of fixes for two issues:
- Finit sometimes locks-up without input on serial console on reboot
- Improved logging of unsupported initctl commands at bootstrap
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify interface generation by collapsing eth_ and ethlike_ifaces to a
single list. Let gen_iface_json() determine interface type by querying
each interface. This allows us to create bridge setups also for qemu
use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop all mention of "CNI" and update text to not use, e.g., `cni-bridge`
when this was changed in the model before the merge to main.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a VLAN filtering bridge setup we want to be able to support an
external IGMP/MLD querier running from userspace, because the bridge
multicast code can only generate proxy/NULL querys per VLAN.
This patch is a refactor to allow just that. If a VLAN on the bridge
has an upper interface, matching the bridge name and VID, we generate
a profile for querierd and enable the service.
For all other cases we try to disable any running querierd. It is up
to the daemon to figure out if it has a usable IP address to use as
the query source IP or use 0.0.0.0.
Since the logic for selecting a proper IP address must be handled by
the daemon in the per-VLAN setup, we revert back to also use it for
the stand-alone unfiltered bridge case as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since Infix supports per-VLAN querier parameters, like query interval,
we currently need to run a separate querierd per VLAN interface. The
replacement, mcd, will handle this automatically in its .conf file.
Also, ensure we install the daemon configuration file as an example, and
thus creating the /etc/querierd/ directory for where .conf files for
each interface will be generated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An RFC conforming multicast snooping bridge should forward all unknown
multicast (IP & MAC) on ports where the mcast_flood flag is set. The
upstream kernel does not (yet) support this, but the KernelKit branch
of the kernel and iproute2 now support it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a forward-port of one of my bridge patches to handle RFC4541
style flooding of unknown multicast.
https://lore.kernel.org/netdev/20220411133837.318876-9-troglobit@gmail.com/
Changes since this thread: use inferred mctx (VLAN multicast context)
from br_handle_frame_finish() and br_dev_xmit(), which should fix the
per-VLAN multicast handling issue pointed out by Nikolay.
Todo before next patch series, add new option instead of breaking the
existing functionality for the current mcast_flood flag. E.g., add a
mcast_flood_always, since the current flag stops flooding when there is
a known querier on the LAN.
See the above thread for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port cannot communicate on layer-3 while acting as a bridge
port. Removing the port from the bridge re-enables the link-local
addresses, if any, from the configuration.
Fix#327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, no VLAN id, or other VLAN specific information is contained in the
MDB entries, only forwarding information and per-port state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With VLAN filtering on a bridge we cannot use the mcast_query_use_ifaddr
mechanism. This because even if the bridge may have an address it is
likely not on the same subnet as that of the VLAN, and the multicast
code in the kernel does not look at VLAN interfaecs on top of bridge
for a relevant adddress.
For these cases we have to use querierd, or a multicast router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
This reverts commit f5e37bba58 because it
causes a regression in setting up VLAN filtering bridges. The bridge
itself, e.g., br0 currently does not have a bridge-port context at the
same time as it being bridge. The model does not account for that and
thus srx_get_int() for the br0 PVID will always fail.
Reverting this commit allows br0 to be tagged member in all VLANs by
default, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_*() family of APIs are for some callbacks in confd used to check
if a setting exists or not. The root helper function srx_vaget() always
logged an error if sr_get_items() failed. This has now been fixed and
only the srx_enabled() function still triggers this, because it has no
way of determining an error condition -- otoh it should never fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the changes in 9847a8f we can keep the /etc/motd file with a proper
newline at EOF so that also Classic builds make sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inspired by openconfig-system[1], except the infix-system type is binary
to allow encoding an entire file, with optional control characters.
The openconfig-system model also carries login-banner, which is displayed
before login. This could be added later to infix-system to let the user
set an OpenSSH login Banner.
[1]: https://openconfig.net/projects/models/schemadocs/yangdoc/openconfig-system.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 2bcb02d3ef and thus
reeneables classic builds again. Since we build on /mnt on the runner
there should be enough room also for them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling strlen() returns a size that's one byte less than what's needed
to store the string, so when comparing with sizeof(), which returns the
number of available bytes, we must compare >= and not just >.
Found by GCC using 'make check'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When building for cppcheck/coverity we may get a stupid linker that can
wind up not finding, e.g., fexist() in libite (-lite) if it's not added
last in the list of libraries.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Cleanup any docker images to free up space
- Build on /mnt
- Update artifacts: pattern after API changes
- Add .sha256 checksums to each release tarball
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No more artifact/ subdirectory with upload/download-artifact v4,
artifacts are already in the working directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently, running "make test-qeneth" from an output directory that's
not in $HOME does not work in Azure. This patch adds an exception for
the x86_64-netconf target that ensures regression tests run just as if
nothing had changed.
Other platform//variants will be built on /mnt for the time being since
we're running out of space in the runner:
df -h =================================================================
Filesystem Size Used Avail Use% Mounted on
/dev/root 73G 58G 16G 80% /
tmpfs 7.9G 172K 7.9G 1% /dev/shm
tmpfs 3.2G 1.1M 3.2G 1% /run
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sda15 105M 6.1M 99M 6% /boot/efi
/dev/sdb1 74G 4.1G 66G 6% /mnt
tmpfs 1.6G 12K 1.6G 1% /run/user/1001
=======================================================================
This is the output of the new "Manny" investigator, it revealed that we
only have 16 GiB of space, after checkout and cache donwload, to build
and upload *all* platforms/variants. Hence the cheat with /mnt, which
we honestly don't know will remain mounted on these runners.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor test, remove fragile solution with tcpdump started AFTER
the linklocal was activated, this opened for a race condition since
it was listening for a message sent once.
Now wait for the linklocal address instead.
This patch adds out-good-octets and in-good-octets as augment in
the infix-ethernet-interface yang model. These counters represents
OctetsTransmittedOK and OctetsReceivedOK from ethtool.
Signed-off-by: Richard Alpe <richard@bit42.se>
With a self-hosted runner we get the following classic error when
calling `make test-unit`:
make[1]: Entering directory '/home/runner/_work/infix/infix/buildroot'
/home/runner/_work/infix/infix/test/env /home/runner/_work/infix/infix/test/9pm/9pm.py /home/runner/_work/infix/infix/test/case/all-repo.yaml /home/runner/_work/infix/infix/test/case/all-unit.yaml
the input device is not a TTY
make[2]: *** [/home/runner/_work/infix/infix/board/x86_64/board.mk:14: test-unit] Error 1
This patch drops interactive from all non-interactive docker sessions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers do not need, or do not want, to be able to run
containers, so all NETCONF related daemons and applications
need to take this into consideration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When available, show the default value of a leaf node after the
description when issuing 'help leaf-node'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The tagline is read by Finit at boot, from /etc/os-release, and
logged when changing runlevel. The unicode charachter does not
survive the trip via syslog to log file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify the code a bit by passing the test file to the runner
function instead of checking it in every caller.
Signed-off-by: Richard Alpe <richard@bit42.se>
As of 4768cae6, we can use conserver/telnet to connect to the docker0
bridge IP:90XX, where XX is DUTXX. This was a great UX improvement
and this patch set aims to further the experience by:
- allow running Infamy (infix-test container) completely rootless¹
- reduce the expsed port range 50->10 (can be improved further)
- use 'podman --publish-all' ports, which allocates ten random
ports for the exposed Qemu telnet ports
- add Quick Start Guide to doc/testing.md
This restores the possiblity of running multiple "make test-sh"
instances, e.g., when multiple users share the same server.
The 'console' script included in this commit uses 'podman inspect' to
find the port number for a given DUT, and optional instance. It takes
either the console/dut number (1-N), or the dut name from the topology.
Also in this commit:
- set hostname for easy identification (for console script)
- set conatainer --name to hostname
- adjust workdir from buildroot to infix/test
- simplify PS1 and add time to prompt (when did the test finish?)
When running 'make test-sh' the prompt now tells you which instance you
are running, e.g., infmay10. Calling 'console 1 infamy10' connects to
console 1 (port 9001) on the infamy10 instance.
For more information, see the Quick Start Guide in doc/testing.md. It
shows how to use the new helper scripts: console and shell.
Fix#227
_______
¹) devs using podman, instead of docker, with slirp4netns installed, can
run the infix-test container completely rootless. We like this, and
as of today podman is our recommendation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New helper class for container testing
- New helper class to urllib, Furl
Due to extremely weak Python-fu in the undersigned, this patch changes
the __init__.py file to add new helper classes for container tests.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix most of what pylint complains about
- Simplify constructs and add missing whitespace
- Simplify output of YANG model downloader
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch handles a corner case we for some reason have not run into
yet. With the new container operational data it was triggered almost
immediately, so let's add some basic guards around it and return None
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a helper that lets you call a Python function (or lambda) in the
context of a network samespace.
Example:
with infamy.IsolatedMacVlan("eth0") as ns:
res = ns.call(lambda: subprocess.run(["ip", "link"],
capture_output=True))
print(res.stdout, f"\n[exitcode:{res.returncode}]")
The call to subprocess.run will be executed in the context of the
network namespace, and thus only list "lo" and the "iface"
macvlan.
The return value of the function passed to ns.call() is passed back
over a multiprocessing.Pipe, which requires that the object be
"picklable". This is true for most objects (even more complex ones
like the CompletedProcess object seen in the example above). Some
notable exceptions are things like file objects, sockets, etc.
The setns(2) syscall is unfortunately not available in current
versions of Python shipped with neither Ubuntu nor Alpine at the time
of this writing. Therefore, shoot from the hip, assume that we're
running on an x86_64 CPU, and just hotwire the syscall directly with
some constants we found in a dumpster.
This is an example of how to create a package that downloads an OCI
archive and installs it to /lib/oci
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds the optional 'user name' argument to the 'copy' command,
enabling using curl scp/sftp protocols for fetching and uploading files.
Changes to cfg_adjust() allow saving and referencing files in the user's
home directory. Useful for both fetching upgrade bundles and container
images.
The 'dir' command now lists files in both $HOME and /cfg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new klish symbol, shell@infix, which performs proper
droprivs before calling the configured shell.
Fix#298: track user id so shell command gets correct user
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers don't want unprivileged CLI users to be able to exit to
a shell. The shell is currently hard-coded to bash, but should be one
of the ietf-system shells, configurable --with-shell=foo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This refactor is basically only an extra step after
copy source-ds -> dest-ds
to also
copy source-file -> dest-file
Which in the case of factory-config and startup-config is relevant. We
want to update the startup datastore, in case of additional commands,
but also the file /cfg/startup-config.cfg in case of consecutive reboot.
Fix#259 copy factory-config startup-config
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Because sysrepo callbacks are threaded and factory-default RPC is called
from a separate subscription (to prevent blocking), we cannot prevent
ietf-intefaces.c from being called before infix-containers.c, regardless
of the priority we set for our subscriptions.
When assigning a physical network interface this becomes a bit of a pain
during factory-default RPC since the physical interface is hidden from
the host network namespace.
So, when applying factory to running, we check each interface if it was
a container-network previously, if so we call on the container script in
the exit of the current dagger generation to move the interface back to
the host netns.
This affects all other functions that assume interfaces only live in the
host netns. To that end a set of new helper functions have been added
to wrap iproute2 commands in nsenter when the interface lives elsewhere.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The interface name is already a unique qualifier, so we can simplify CNI
network naming to ease the burden when debugging.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
"Sloppy" because, for some reason, we don't get sysrepo update callbacks
for presence containers. I.e., when calling 'set container-network'
compared to 'edit container-network'.
Yes, I've gone over klish-plugins-sysrepo with a fine-toothed comb to
see if it's the culprit, but no, it seems to be sysrepo. Hence the
defaulting of the type also in the change path.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Review found quite a few strings that could be given an obvious pattern
or specialized sub-type, e.g. inet:ip-address, to restrict the input
data validation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the deprecation of CNI i Podman[1], and its upcoming removal in
Podman v5.0, we decided to cut our losses and modify all documentation
and models to become backend neutral. We will continue to use CNI as
long as possible -- it gives us host interfaces, for instance, that is
not part of netawark yet, it seems.
Also, sync mount and volume documentation with YANG model changes.
[1]: https://blog.podman.io/2023/11/cni-deprecation-and-removal-from-podman-5-0/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After discussions in the development team, and an external demo, we
decided to rename file mounts to just mounts and adopt established
nomenclature.
With this change we now allow mounting any type of file or directory
from the host to the container, for regular files/directories a bind
mount is used. We also introduce 'source' and 'type', to support
mounting of host files and directories, the destination path has been
renamed to 'target'. The mount cousin, 'volume', which basically is a
specialized mount, has also been updated to use 'target'.
The 'source' and 'content' are now hidden behind a YANG choice to ensure
users can only use them the intended way (either/or not both).
Initial models had 'destination' (path) as mandatory, with this change
we can reintroduce that to ensure this proper configurations.
The documentation in both YANG model and markdown has been updated,
significantly, to provide lots of examples.
Please note, glob style mounts have not been tested, at all.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When container configurations are not saved to startup-config and the
user reboot the system (or lose power) we will have lingering active
containers cached on persistent storage.
This patch adds a cleanup() function to the post hook, right before
we try to launch any new containers. This callback must be run for
all cases, even if the running-config has no containers configured.
Also, a minor amendment to volume pruning.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. add support for extracting, and finding the directory holding the
index.json metadata file in, OCI images. An archive in Infix is either
a .tar or .tar.gz archive, which we need to unpack for this version of
podman to be able to load them.
2. new RPC '/infix-containers:oci-load' calls 'container load' of an
OCI archive (tarball), optionally gzipped. The resulting image uses
the directory name of the unpacked tarball, so the container script
offers a way to retag the image after loading it.
First class citizens in container transport are docker:// and the OCI
family of URI:s. A docker:// URL, or a local docker-archive:path, is
assumed to be well formed, in which case we leave it up to podman to
handle.
Note: 'podman import' does not fully understand OCI formats. It drops
ENTRYPOINT and COMMAND, while 'podman load' handles things a lot
better. Only letdown is it does not support nameing the image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Rename container/container -> containers/container
- Collapse containers-state into containers
- Complete refactor of network/host-network for improved UX. A new
must expression ensure mutual exclusion between host and networks
- Rename entrypoint -> command, for consistency (overrides ENTRYPOINT)
- Move nodes around a bit for more logical placement in model
- Clean out all traces of a container on removal
- Rename container image_id -> image-id for consistency
The active queue is for tracking currently running containers, ensuring
only relevant changes are applied, and also for container image upgrade,
at the end of which these scripts are re-run to activate the new image
Also, fix misplaced '-f' when pruning unused volumes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Brief overview of configuration support. Need to add admin-exec level
commands, but since operational and actions still are missing, we keep
it out until after the code review.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop debug logs
- no need to restart upgraded containers, they restart automatically
- fix ordering in volume prune (when containers are removed)
- skip directories in container activation (inbox -> execd queue)
- Fix 'container pull IMG creds USER[:PASS]' bug, extra '=' variable
assignment inside infix.xml
- Fix 'container run IMG CMD ARGS' to actually put the CMD in
ENTRYPOINT and append ARGS to image. The podman run and create
commands are *not* behaving the same way
- Rename 'attach' to 'exec', execute command inside an running container
- Add 'container [shell | connect]' to start shell in -- " -- " -- " --
- Add 'container [stat | cleanup | usage stats]' commands
- Add in="tty" to commands thay may end up being interactive
- Split <ACTION> line into multiple lines for readability
- Fix container shift logic:
root@infix-00-00-00:/> show container
/usr/sbin/container: line 361: shift: shift count out of range
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, update container YANG model descriptions and ensure 'path' is
mandatory for each list element and attach a regexp pattern to fix
the mountpoint to an absolute path inside the container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the container configuration context:
edit file ntp.conf
set path /etc/ntp.conf
set content
The last command opens a text editor where you can paste the contents
of the file. This is stored base64 encoded in the datastore as well
as in JSON/XML.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new CLI command 'container upgrade foo', where 'foo'
is the name of the container. If more than one container use the same
image, multiple upgrades must be done because a container runs not on
the 'image:tag' but on the hash of the 'image:tag' it was created from.
Rename "done" queue to "active", since we want to recreate an active
container after fetching an updated base image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for writable container volumes. A volume, when
compared to a mount, is a writable directory created when the container
starts and is automatically rsync'ed with the underlying directory it
is mounted on on first use. A mount otoh does not rsync so it results
only in an empty directory inside the container.
The podman/docker mount feature will be used later to bind mount single
files or sharing directories from the host, e.g., /sys/class/leds/ to
one of more containers.
Note: unused volumes are automatically pruned. Hence, a volume
currently cannot be moved to another container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows containers created with "podman create" to surivce
rebots, and even reconfigurations at runtime, as long as their config
has not changed. Allowing some level of persistence in the writable
layer given to containers.
For even more persistency, support for volumes (they sync with dir in
container on first use) and mounts (creates empty writable dirs in the
container) must be added. A third option, a variant of mounts, is to
allow a leaf-list "file", where binary content can be added and then
mounted into the container, e.g.
/run/containers/files/$name/file.ext -> container://$name/etc/file.ext
None of this is available yet, but seems likely we need to add in the
very near term.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was a tough nut to crack. Turns out the trick to changing the
ENTRYPOINT is to set --entrypoint=command and then call 'podman create
... command args'. Not entirely obvious since the documented approach
is to use a JSON array as the argument: podman create
--entrypoint='["command", "args" ]'.
Admittedly, encoding this in C to transfer it via a POSIX shell script
to the command line, is not the easiest task I've undertaken. So I gave
up and found this workaround.
Worth noting, however, is that one *must* set `--entrypoint`, it is not
enough to just append the command to the 'podman create' command line.
Due to differences in docker and podman, we cannot supply the full args
to an alternate entrypoint command. But for the command to actually run
we need to override the image's ENTRYPOINT and send the command and args
as the last arguments on the command line to podman create.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, ensure the deleted container is actually deleted before recreating
it with a new configuration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds 'manual:yes' to the container's Finit service
configuration and changes from pod: to container: prefix for a
unique namespace to prevent collision with regular services.
The prefix container: is more correct that pod:, which should
be reserved for any future pod support.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd: fix missing variable in container script condition
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- reserved words: map -> xlate
- add missing docstrings
- convert to recommended constructs: proto in (foo, bar)
- drop unused 'f' format strings: f""
- too short exception vars: e -> err, d -> entry
- drop unnecessary () in if expressions
- add whitespace for readability and navigation
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The files inside a release tarball, as well as the tarball name itself,
should not have the leading 'v', that's just for the tag.
Also, add -ver to GNS3 disk.img file as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be replaced with native support for generating container network
interfaces and running under finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This bump adds support for 'set foo' to set foo=true, but also two new
commands from srp_helper@: 'change password', 'text-editor content'.
- ietf-system: 'change password' now starts an interactive session that
results in a random-salted sha512 encrypted hash.
- 'text-editor <node-of-binary-type>', starts 'editor file | base64'
- 'set <node-of-bool-type>', sets node=true
A prototype askpass script has been added as a proof-of-concept. It
follows the design of other askpass style programs, like ssh-askpass,
that pass the resulting password on stdout. With the additional support
for also writing it to an output file, e.g., a pipe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On every system reconf (initctl reload) the .conf files are evaluated
again and log notices about skipping alternative syslogd enties are
logged.
We know that we run the udevd dependend syslogd entry, and everything
else basically in runlevel S depends on it, so not much else would work
if syslogd didn't start. So we can safely set 'nowarn'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When "plopping" back an interface from another network namespace, e.g.,
when removing a container network interface, we cannot just rely on the
'ethernet' node *not* being available for an interface.
Experience shows that sysrepo might send us a curve ball (see comment)
which we interpret to be a true Ethernet interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds information about a vlan filtering bridge to the
operational datastore.
The information included is vlans, pvid and stp-state. These changes
reflects what can be configured though confd.
NOTE: pvid is still missing for bridge interfaces. Discussions on how
to best add this is ongoing. It's currently not configurable due to an
existing self check in the infix-if-bridge yang model.
Signed-off-by: Richard Alpe <richard@bit42.se>
This can now a days be inferred and isn't needed. Also, the interface
type in virtual testing is now etherlike not ethernet.
Signed-off-by: Richard Alpe <richard@bit42.se>
This resolves the regression where configured etherlike interface mac
addresses where not deleted from the system.
Signed-off-by: Richard Alpe <richard@bit42.se>
* Remove bogus ethernet statistics for br0
* Change parentbus for e0 and e1 to make them ethernet devices (not
virtio -> etherlike).
Signed-off-by: Richard Alpe <richard@bit42.se>
Instead of "ethernet". Prior to this patch virtio interfaces where
identified as "ethernet", which resulted in /run/net trying to enable
autoneg on them. Which isn't supported and resulted in an ABANDONED
"default config".
Signed-off-by: Richard Alpe <richard@bit42.se>
Needed for devices that share a lot of properties with an ethernet
device but doesn't support "ethtool" and such. An example is TAP
interfaces.
Signed-off-by: Richard Alpe <richard@bit42.se>
Rely on the interface diff to figure out if any autoneg related config
has changed; if so, generate the resulting configuration based on the
current interface config.
- Remove loopback check, the model only allows ethernet config on
interfaces of type "ethernet".
- Split up the input validation of speed/duplex to give the user an
error message with as much specificity as possible.
- Validate that the configured speed/duplex is supported.
- Move the generated script to execute earlier to avoid unnecessary
link flapping.
- Use negative POSIX error codes, these are (or at least should be)
mapped to sysrepo errors in netdag_gen_iface.
Add the ability to configure interface speed, duplex and autoneg.
Initially this was pared with YANG model deviations that restricted
explicit interface speed and duplex when autoneg was enabled. But due
to conflicting default states in YANG, this code was dropped.
Signed-off-by: Richard Alpe <richard@bit42.se>
The Infix scan token we have is only valid for KernelKit, so for any
downstream forks we must not attempt to run this workflow.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The DHCP client YANG model saw a lot of changes added in the 23.12
sprint, fortunately there was never an official release.
This commit bumps the model version for v24.01.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should be the last outstanding issue to fix#278. Please note,
it is undefined what happens if you have two DHCP clients that request
hostname, and changing hostname from NETCONF at runtime will overwrite
any hostname set by the DHCP client.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For maximum flexibility we allow the user to full control over the DHCP
options the client requests. For this to work we must tell udhcpc to
not set any of its defaults behind the scenes, so we call it with '-o'.
This commit adds support for inferring these udhcpc default options in
NETCONF. So when enabling the DHCP client we now get the same set of
sane options as udhcpc otherwise hides from us.
Fixes#278, at least wrt. the lack of sent options. Allowing the client
script to set the hostname will be added in a later commit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No need to guard the hostname option in quotes, it must not contain
whitespace. If user configured more than one word, use first.
Fixes#283
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since the Nanopi R2S does not have a VPD, we use this mechanism to set
the default admin password. Without one, Infix will refuse to generate
the factory- and failure-config files, and thus refuse to start.
On custom boards in production we have VPD in ONIE format that contains
a per-device unique SHA256 hashed admin user password.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Loss of BusyBox "show others", uboot-tools, and e2fsprogs, are likely
due to resolved dependencies from other packages. E.g., Frr requires
bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support for this is based on the upstream Buildroot R2S defconfig and
the myLinux extensions and stripped-down kernel defconfig. For more
information about the Nanopi R2S, see the FriendlyELC wiki at:
https://wiki.friendlyelec.com/wiki/index.php/NanoPi_R2S
Please note, due to the lack of a VPD on the board, and some very poor
devicetree skills by yours truly, Infix currently refuse to boot on this
board. An in-devicetree factory-password-hash node has to be added, and
will be done soon.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All Infix builds should be signed, but for some test equipment, and
during board bringup, this may be too much of a hassle.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Nanopi R2S currently only works with an older U-Boot v2021.10. This
commit only relocates the CN9130 patches to a sub-directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Install the sudo command, and let all members of the "wheel" group run
any command as the superuser.
This ensures that administrators have full access to the system,
primarily for troubleshooting, diagnostics, and remote scripting
purposes.
This let's users script infix devices without needing any special
NETCONF tools installed - ssh is enough. E.g. you can get the running
version with something like:
ssh INFIX-HOST sysrepocfg -X -fjson -d operational \
-x "/system-state/platform/os-release" | jq .
It also means that SCP works as expected, by default.
This adds [PPID] to the syslog lines to the dagger script. After all,
the dagger script is a proxy for confd, so when reading the logs it
seems natural to see the PID of confd rather than a script that will
die soon anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Classic builds don't have udev but rather mdev or mdevd. This patch
imports support from myLinux for conditionally starting sysklogd on
classiic builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Relocate python based probe to netconf builds, and
- Restore basic shell script based probe for classic builds
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
set ospf area 0.0.0.1 area-type nssa-area
set ospf area 0.0.0.1 area-type stub-area
set ospf area 0.0.0.1 summary true
set ospf area 0.0.0.1 default-cost 100
Better than Busybox top, and can attach strace to services. So very
useful for debugging and monitoring a system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since watchdogd may need to run with SCHED_RR, when the supervisor is enabled,
which is not supported by cgroupsv2, we ask Finit to always runs it in the
root cgroup. We must also raise the limit for rtprio to all possible values
for SCHED_RR that a user can set in /etc/watchdogd.conf
Finally, add support for reading extra args from /etc/default/watchdogd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very limited part of the YANG model is implemented so far, basicly it is OSPFv2 with multiple areas and you can change timers
for the interfaces. Limited operational support.
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> leave
In review discussions we have decided, for resonsons of consistency over
correctness, to rename this column to match the YANG model node name
rather than the Linux kernel name.
Also, right align the values. Numbers should always be right-aligned.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch ensures that the DHCP client is not started until the
interface is up and running (link). If the interface goes down,
or loses link, the client is stopped and everything learned from
the server (address, routes, DNS/NTP servers, etc.) is remvoed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an optional service doesn't exist, and the run/task/service stanza
clearly list `nowarn`, we should not log missing/skipping messages. This
patch-set is backported from the upcoming Finit v4.7
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the DHCP options from plain flags to customizable
options with optional values. This works for most key:value options,
but not for the more complex ones, e.g. option 81. For this we have
dedicated handling to use `udhcpc -F fqdn` instad.
Additionally, the inference a default option list has been removed in
favor of a set of generic default options: router, dns, domain, address,
broadcast, ntpsrv, search, staticroutes, msstaticroutes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should be longer, there are devices out there (in the industry)
that may drop the ball on a single ARP, or may be in deep sleep (IoT),
so we should send like 5 ARP with at least 1 sec between them before
timing out.
However, this requires patching BusyBox a bit, so skipping for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add support for option 12, provide current hostname to server for
registering the lease with -- this allows registering in local DNS
for some DHCP servers.
- Add support for option 50, request any previously cached IP address
- Override option 60, vendor class identifier, with Infix vYY.MM
- Adjust timers and retry options to be more persistant
- Include initial metric as environment variable to client
- Disable all default options, set a hard-coded subset, which will be
replaced in a later commit by a generated list.
- Ensure udhcpc creates a pid file, in case we may need to start any
other service/task in sync with the DHCP client
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New log() function replaces stdout logging
- New set_dhcp_routes() and clr_dhcp_routes() functions
- Set all option 121 routes with same metric
- Set all option 3 routers with increasing metric (this is what the
reference udhcpc scripts do, and RFC says the routers should be
listed in order of preference ...)
- Clearing routes must, like IP addresses, be done both by interface
and protocol. This refactor makes sure to delete any DHCP routes
set on the given interface (in case options change)
- Use resolvconf per-interface search+nameserver
- Cache IP lease so we can ask for it back later
- On deconfig|leasefail|nak, make sure to clean up anything that might
be lingering from this interface. E.g., we can get leasefail when a
server denies our request to prolong a lease.
- On renew|bound, refresh routes, and set search+dns + NTP servers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Move from everything in a single /etc/chrony.conf to a split up with
configuration and server snippets. The latter comes in the form of
configured (static) and DHCP client (dynamic) server setup.
To accomodate this new scheme we need to detect when serves are removed
from the configuration, so not only have the whole change_ntp() been
refactored, it has been extended with a new pass.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break out unit tests to separate make target as they don't require all
the built code and infrastructure that the normal tests does.
Run the unit tests early in the Github action stage. They don't
require a full build. This will give early feedback to the users.
Signed-off-by: Richard Alpe <richard@bit42.se>
In this patch we add some arbitrary system output files which contains
interface data. Such as the output from "ip link" and "ethtool". These
files are used by yanger instead of running the actual commands.
Yanger then generates a lot of YANG json data, which are merged using
jq into something that looks like the sysrepo operational data on
a running system. This data is then passed though cli-pretty and its
ouput is compared to the static expected output in the .txt files in
cli-output.
Here's a basic flow overview.
* system-output/foo.json -> yanger ->> data
* system-output/bar.json -> yanger ->> data
* data -> merge -> sysrepo-operational-data
* sysrepo-operational-data -> cli-pretty -> output.txt
* compare output.txt too cli-output/show-foobar.txt
The result of this is that if something changes in yanger OR in
cli-pretty. The corresponding system-output file needs to be updated
for the test to pass. This is indented to catch regression where the
output is unintentionally changed.
Signed-off-by: Richard Alpe <richard@bit42.se>
Normally, no logins are actually possible, but this will have two
desirable effects effects:
- /etc/issue will be printed when hitting return over the console,
allowing the user to see the bootstrapping errors again, without
having to reboot the system.
- On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can
login as root and debug issues.
Collect all bootstrapping issues in all banner-like files during boot,
so that they are presented to the user when logging in. This should
make it harder to miss overlook the fact that a system is running in a
degraded state.
Before this change, the system would move to runlevel 9 as soon as
startup-config failed to load, in which no getty is allowed to run.
Instead, we want to reserve that runlevel for when failure-config
itself also fails to load, since the system will have no valid login
credentials at that point.
This fixes [ERR] from CLI `show routes`, and broken operational status
in setups with DHCP client enabled by default.
Feature (static routing) introduced in release cycle, no need to bring
up in release notes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-11-30 11:03:16 +01:00
637 changed files with 42789 additions and 14197 deletions
**Thank :heart: you for taking the time to fill out this bug report!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for the bug you encountered.
- type:textarea
attributes:
label:Current Behavior
description:|
A clear and concise description of the issue you're experiencing.
value:|
For code snippets, logs, commands, etc., please use triple backticks:
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-00-00-00 container[3192]: Failed creating container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Expected Behavior
description:|
A clear and concise description of what you expected to happen.
value:|
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-c0-ff-ee container[3192]: Successfully created container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Steps To Reproduce
description:|
Steps to reproduce the issue. For example:
1. Built from source
2. Upgrade to latest release, vYY.MM.P
3. Factory reset
4. Enable feature
5. Check the logs/show command/operational status
validations:
required:false
- type:textarea
attributes:
label:Additional information
description:|
- Relevant parts of `startup-config`
- Output from `show interfaces`, if applicable
- Other observations, screenshots, log files ...
**Tip:** You can attach images or log files by clicking this area to highlight it and then dragging files in.
description:Suggest a new feature, idea or improvement of the OS
labels:
- "feature"
- "triage"
body:
- type:markdown
attributes:
value:|
**Thank :heart: you for taking the time to fill out this feature request!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for your feature. We are also happy to accept contributions from our users. For details see [CONTRIBUTING](https://github.com/kernelkit/infix/blob/master/.github/CONTRIBUTING.md).
- type:textarea
attributes:
label:Description
description:|
A clear and concise description of the problem or missing feature.
**Example:** *I'm always frustrated when [...]*, or *I'd like to see support for [...]*
validations:
required:true
- type:textarea
attributes:
label:Additional Information
description:|
Any other related information, e.g. existing YANG model(s), or possibly screenshots about the feature request here.
validations:
required:false
- type:textarea
attributes:
label:General Information
description:|
Appended to all feature requests for future readers.
value:|
Anyone can help out by [sponsoring][1] development of new features or [contributing][2] pull requests.
Please use this issue for discussions related to the feature.
"usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
"usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
Reserved facilities for logging in various subsystems:
- local0: rauc
- local1: containers
- local2:
- local3:
- local5:
- local6: reserved
- local7: nginx
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
