Add a new service that, when enabled, will execute run-parts on
`/cfg/user-scripts.d`.
This strikes a balance between two conflicting objectives:
1. There should be no implicit way to schedule arbitrary code
execution on the device, i.e. no default run-parts directory.
2. It is very useful to have a way of scheduling arbitrary code
execution on the device, e.g. being able to install a debug script
on a production image.
With this feature, we still meet (1), since the feature has to be
explicitly enabled in the startup-config; but we also fulfill (2),
since we can easily enable it when needed.
Partial revert of 23469bbe3b. When running tests in a GitHub action,
we do not want to run as host root user. Therefore, restore podman as
the default runner, but make sure to prefer docker when attaching to
the host network namespace.
Update docs to match the recent developments in the test system.
Spin off the architecture description to its own document, and focus
testing.md on the day-to-day usage.
When interface naming switched to use 1-based indices instead of
0-based, the topology generation was overlooked thus breaking tests
against a `make run` instance.
Bring everything back in sync.
When testing in the host's namespace, only docker seems to offer the
required capabilities (due to its daemon/client architecture).
Qeneth tests can still be run in podman. Users will have to install
the docker wrappers for podman to make use of this.
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
Use must{,_not}_receive instead of the general sniffer, so that we can
continue the test as soon as we see the transmission at the receiver,
rather than always waiting the full 5s.
While we're here:
- Show the port mappings in the top block-comment
- Define a few more steps to show the user what is going on
- Avoid global variable references in set_static_multicast_filter()
In test cases, it is common that we want to verify that a certain type
of traffic reaches a namespace. This has, up to this point, been
solved by the generic sniffer.Sniffer.
Try to improve the two most common use-cases...
1. Test if a flow reaches a namespace
2. Ensure that a flow does not reach a namespace
...by always exiting as soon as the first packet is received.
This saves time on positive tests, and the synchronous API allows it
to compose well with infamy.parallel().
Support the familiar subprocess.run API, and runsh from netns.py.
This should only be used for debugging, or in the rare instances when
we want to test functionality that is not available via NETCONF.
QEMU systems seem work fine with the 5s timeout, whereas some physical
devices can't quite keep up with that.
Let the slower systems indicate that they need a bit more time without
punishing faster ones with a longer default.
This will let other Infamy submodules tune their behavior based on the
particular test system they are running on.
Attributes are defined by creating graph-global attributes with an
"ix_" prefix.
Rather than setting up and tearing down two identical namespaces,
create it once and use it for the duration of the test. (This is
probably a documentation issue with Infamy: there is no requirement
that test.steps are direct descendants of the test, but until this
point there was no example of this in the source base)
In the process of this, it was also discovered that no positive ping
test was done over v6, so that has been added.
Avoid having log messages stuck in a pipe when stdout is not a tty,
e.g. when running a suite of tests using 9pm.
Two benefits:
- Nicer experience when interactively running a suite
- Timestamps inserted by 9pm are more useful
It turns out that the semantics of ping's -c option does not match our
expectations. The manual says:
> Stop after sending count ECHO_REQUEST packets. With deadline option,
> ping waits for count ECHO_REPLY packets, until the timeout expires.
But in fact, something like an ICMP_DEST_UNREACH will also count as a
response, meaning that the process will terminate with non-zero
exitcode even though the deadline has not yet been crossed, rather
than keep waiting for an ECHO_REPLY.
To add some extra flavor: this is only the case for iputils' ping,
Busybox's implementation will hold out for a response until the
deadline expires.
Therefore, wrap the ping in an ugly retry loop.
Also, return the full available context from must{,_not}_reach on
failures, instead of just the output. This allows us to show the exit
code in the top-level exception handler.
When a test starts an isolated MACVLAN namespace, it is often useful
to interactively join that namespace to investigate issues. To do
this, we need to find the "sleeper" process backing the namespace, and
`nsenter` into that process's network namespace.
Add a script that automates this process.
To start a shell in the netns of the MACVLAN stacked on top of d1b,
start a shell in the test environment:
infix/test $ ./shell
13:37:00 infamy0:test # ./nsenter d1b
13:37:01 infamy0(netns:d1b):test #
It is not uncommon for subprocesses to fail when developing new tests,
but the default representation of CalledProcessError does not print
the stdout of the program, only that it failed.
Catch this common case when a test is about to fail, and make sure to
log any output it produced.
- Add missing locking around standard counter groups
- Fix reference counting issue with IGMPv3/MLDv2 reports
Found as part of debugging the regression test suite on hardware.
The container host interface text was a bit hard to understand. This
patch splits it up in two parts, basic routed setup and an advanced
with two interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We already have a pull request template. This is a propsal to add issue
templates as well. These yml templates change the behavior of reporting
issues to more a of a pre-formatted form with guard rails.
It is still possible to report blank issues the old way.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This local patch of sysrepo adds support for detecting non-zero return
code from sysrepo callbacks during SR_EV_DONE, which upstream sysrepo
currently, as of v2.2.105, discards.
With this change failure to load startup-config results in the system
detecting the failure applying failure-config instead.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we don't have any VPD defined on this board, supply a default
password hash via the device tree instead.
Also, specify the path to external USB port, so that Infix will pick
it up in ietf-hardware.
Provide a patched device tree that:
- Uses the correct phy-mode for eth2, allowing it to be probed
properly
- Wires up the interrupt signal to the GPIO expander, so that the SFP
cage's I/O lines can be configured as interrupts, rather than having
to poll them
Assume that the caller always want to create a new partition table,
even in scenarios where one already exists. This allows devices to be
reprovisioned with a newer image, for example.
Fixes#394
This is not a production target, so we choose the more developer
friendly option of allowing the boot process to be interrupted.
Also, remove the old update cruft and rely on Marvell's `bubt`
instead.
The BootROM wants the bootloader to be located on LBA1, which is not
ideal when using a GPT to describe the partition table.
Make sure the `bubt` command targets SPI by default.
Buildroot's default ATF version changed from 2.9 to 2.10 when we
upgraded to 24.02.x. This meant that our patches were not applied,
which broke the build.
Take a conservative approach for now, and just pin the ATF version to
the known-good 2.9 series.
During the addition of multi-key support to RAUC and U-Boot, the
bootloader defconfig for CN9130 CRB was overlooked, which meant that
the Infix specific U-Boot hooks never ran, thereby ultimately breaking
the build.
Restore the required options to build in the dev-key by default.
The Buildroot 2024.02.x-kkit branch recently had uboot-tools upgraded
and the patches needed require bison to rebuild.
The recommendation is to also install flex, they always go together.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to the salting being applied to Python's `hash()` (see [1]), the
hash of an object is not stable across different Python processes. As
a result, neither are the topology mappings generated by networkx.
The upside of this is randomness that we get better test coverage over
time, especially on physical devices where the underlying hardware
could differ between ports, for example.
On the other hand, it can be very frustrating to track down a bug when
locial nodes are suffled around between phyical nodes on each
invocation of a test case.
Therefore, use a random seed by default, but allow the user to specify
a fixed value if they so choose. We then add a meta test that logs the
seed being used for the current suite - which means we can simply
copy&paste that value to rerun the suite (or single test) with the
same topology mappings.
[1]: https://docs.python.org/3/reference/datamodel.html#object.__hash__
- Present the topologies to networkx as multigraphs, rather than
expaning each port of the record shape as a separate node.
- Create a topology mapping by locating a subgraph monomorphism of the
logical topology in the physical ditto.
This cuts down the time of finding a mapping by several orders of
magnitude. Example:
Before:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 13m1,213s
user 13m0,112s
sys 0m0,732s
After:
time python3 test/infamy/topology.py \
test/virt/quad/topology.dot.in \
test/infamy/topologies/ring-4-duts.dot >/dev/null
real 0m0,153s
user 0m0,128s
sys 0m0,024s
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The dagger tool is a helper for scripts generated by confd and should
therefore be installed by confd instead of the rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In order to make use of the DCB support in mv88e6xxx we also enable it
in the kernel config.
Fixes: 3a73ce3cfb ("kernel: Import EtherType based priority override support")
As mentioned previously, the NACM default ACLs in `factory-config` were
removed as part of the work on the nacm-basic branch.
Adjust text to not mention any pre-configured user levels, for now. A
future update may change the defaults when we've found resonable levels.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch helps silence kernel errors to console at boot. To fully
silence errors, enable emulated /var in your Qemu runs as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The fact that a USB device currently is not authorized is not an error.
This patch adjusts the log level to slip below 'quiet' to prevent logs
to console at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we do not yet have lldpTxFast, or similar, to enable on LLDP, we
tickle both services to resend their HELLO frames on link down/up event
instead.
+ Reduces turnaround times drastically
+ Restore regression test for mDNS, which we lost recently
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Our local runners do not allow sudo, e.g., when installing libyang and
the other dependencies.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the lifetime of Infix, so far, we've run into at least one customer
issue where we had qualms about our use of the local bit causing issues
with 3rd party software. In the end that was not the root cause of our
problems, but we spent way too much time worrying about it. Hence this
patch, which brings our virtual environments another step closer to the
real hardware that Infix runs on.
The OUI used is one of the "private" ones, taken completly at random.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The base mac address is used by bridges in Infix. This patch adds
support for extracting a base mac from the first interface "- 1",
e.g., if the mac address of e1 is 08:00:20:00:00:01, the base mac
will be 08:00:20:00:00:00.
This works with the Infamy test framework (Qeneth) and also with
the qemu script, included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even when `managed = "in-band-status";` was specified on a port,
mv88e6xxx would insist on forcing the values that were supposed to be
automatically picked up by the MAC via in-band signaling.
In the case of USXGMII links on 6393X, forcing the link bit would
sometimes, for reasons that are not understood, cause the SERDES to
reset its USXGMII link partner base page (register 4.0xf0a2) to 0,
which it would then interpret as 10M/half-duplex. As a result, the
SERDES would erroneously perform rate-matching to 10M on egress
towards the PHY (which is configured for 10G/full-duplex), leading to
nothing but dropped packets and much sadness.
This can most easily be reproduced by the following setup:
.------------.
| .-----. .-------.
| | p9 +---+ 3310P +--.
| 6393X :-----: :-------: | T- or X-Units looped via external cable
| | p10 +---+ 3310P +--'
| '-----' '-------'
'------------'
Make sure that neither p9 nor p10 are managed using in-band-status.
1. ip link set dev p9 up; ip link set dev p10 up
2. ip link set dev p9 down
3. ip link set dev p9 up
After step (3), p10 will experience the failure described above in
about 3/4 of the cases. In the cases where the issue does not arise,
simply repeat steps (2) and (3).
Actually a part of statd, but had to make
a separarate package to get it to work.
Statd helper-scripts are now pre-compiled instead of doing it
in runtime.
Fixes#379
The Finit @console construct detects what your actual serial console is
by looking it up in /sys/class/tty/console/active. This to avoid any
weird problems that might occur when using /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even though dnsmasq only listened to requests from 127.0.0.1, port 53
was visible using nmap. We only use dnsmasq as a local resolver, so
we can safely change the config to bind to loopback instead, and at
the same time get less noise from nmap scans.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds a landing page, generated from the top README.md. It
is a temporary fix before adding a proper web ui.
Run ./gen.sh from the directory to update index.html using the template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor mDNS service record generation for improved control of
announcing services. All to add support for modifying the cname
aliases we announce.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both IETF and POSIX allow longer hostname, 253 and 255, which Linux does
not support. Since Linux 1.0 the maximum has been 64 US-ASCII characters.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These callback are not the primary responisble for the property, but
want to be informed of any changes. E.g., /system/hostname changes
should also update the adminurl in all mDNS records.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate all nginx .conf files to board/common/rootfs/etc/nginx/ and
introduce available/*.conf with symlinks to enabled/*.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Align both qemu targets for 'make run' to use kvm with tcg as fallback
and -cpu max instead of guessing. This allows running Infix on systems
that do not have, or do not allow, kvm acceleration.
This is a temporary fix before we refactor 'make run', see issue #388
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The container tests utilize the bundled curios-httpd, which clashes with
the new web services provided by nginx. So we need to disable it while
testing all the containers.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor setup to automatically redirect http -> https, dropping
the /browse location for now.
Also, log to syslog, which has log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit implements Infix mDNS TXT records, version 1, for available
services. Hard coded for the moment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit includes a small prestudy, done over a period of two weeks,
to gather information about common txt records used by hosts. The most
well-documented is the Apple Printing Spec, which among other things
defines adminurl. A proposed version 1 of the Infix txt record spec is
included in the document. I'm recommending alternative 2:
"vv=1" "vendor=Qemu" "product=VM" "ty=x86-64" "vn=KernelKit" "on=Infix" "ov=v24.03.0"
Including this information would enable quickly scanning a network to
see if the latest version of the software has been deployed. Please
note, I've not included the U-Boot firmware version in this proposal,
but it could be included as "vs=2023.10-kkit3", or similar.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change also requires another restructure for netbrowse itself, hence
the relocation of files in the tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With an increase in requests to confine users to the CLI, access using
SSH/SCP/SFTP to the configuration is becoming more and more important.
The admin role in Infix is mapped to the UNIX group 'wheel', meaning we
want all users in that group to be able to read and write files with
that ownership.
This patch fixes the initial ownership of startup-config, and /cfg, and
ensures the copy command in the CLI retain wheel group permissions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With Classic builds out of the way we can move everything back to common
again to simplify and reduce our collective cognitive overhead a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Classic builds served for a while as an introduction to classic
embedded systems, with a user managed read-writable /etc. Today we
decided to firmly take the plunge into the future with NETCONF and
focus on our core platforms aarch64 and x86_64 (for Qemu).
The reasons are several: reduce overhead, simplify build and release
work, as well as manual testing, since Classic builds do not have any
automated regression testing.
The Classic builds may be resurrected later in a dedicated project.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
External pre-built toolchains are usually distrubuted as binary-only and
currently (Buildroot 2023.02) do not have a license file. Infix use the
Bootlin toolchains, built from Buildroot, which contains a summary.csv
file with all packages, and licenses, used.
This commit adds that csv, under the name toolchain-external-bootlin.csv,
to the legal-info output directory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When building a Linux kernel that does not match the latest kernel known
by Buildroot, the license file is disabled and nothing is extracted.
For an introduction to this see Buildroot gaf33b1c.
To work around this in Infix we wrap the 'legal-info' build target to
set the license file variable and trigger the license extraction anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The plain output mode prevents garbled JSON output due to the built-in
pretty-printer in mctl. Fixed in v2.1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Both L2 and L3 is supported.
With VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge vlans vlan 1 multicast-filter 224.1.3.4 ports e0
Without VLAN-filtering:
admin@infix-00-00-00:/config/interface/br0/> set bridge multicast-filter 224.1.2.3 ports e0
- Rename mdb -> multicast-filters
- Add support for L2 multicast groups
- Change vlan, multicast and mulitcast-filters containers to presence
containers. This will result in that snooping will be disabled when
creating a bridge (or a vlan if vlan-filtered)
- Force the user to choose between VLANs and Multicast on top level bridge configuration
- Force L2 multicast to be state permanent
If an absolute path contains '../' we disallow it because what are you
doing, possible security violation.
Built-ins for running, startup, etc. remain as-is.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On any change to a container network interface we should schedule a
restart of the container to activate the changes. This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.
This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.
Fixes#375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes issues with logger not exiting gracefully on signals (at all)
and busy-looping on stale FIFO.
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Patches in queue for upcoming v4.8 release of Finit fixes:
- initctl touch does not respect -n flag, returning error
- initctl touch does not support template services
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
That factory-config and failure-config can be overridden by customer
specific requirements is documented in the branding document. Focus
on Infix native defaults in general documentation.
Move most of customer specifics to foot note.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 4bfedf7a9 support for disabling IPv6/IPv4 link-local addresses was
added, which in turn caused this regression.
Regression in the v24.03 release cycle, not released -- low severity.
Fixes#353
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Translate LOWER-LAYER-DOWN -> LOWER-DOWN in "show interfaces" overview
and keep LOWER-LAYER-DOWN in detailed "show interfaces name eth0".
Issue #358
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error: error creating container storage: the container name "infamy0" is already in use by "2011c2d7cb1737b788b854a8bd08e519f3cbd6e36dae4975784978cff1f238fc". You have to remove that container to be able to reuse that name.: that name is already in use
make[1]: *** [/home/github-runner/actions-runner/_work/infix/infix/test/test.mk:6: test-unit] Error 125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, log the actual `podman create` arguments to the container log so
we can see what the script actually does when customers report bizarre
happenings with containers.
Fixes#370
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add exception for local images, the "pull" step must be handled by the
operator, i.e., wget of the latest image to the same location as set up
in the image configuration, e.g., for oci-archive:/tmp/foo.tar.gz that
/tmp/foo.tar.gz exists when issuing the upgrade command.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
OCI archives are a bit special. Mention how to load, reference, and
upgrade system using such images.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a host interface setup, i.e., moving an interface from the host to a
container, often using VETH pairs, any route should only be set when an
IP address has been set. This because the CNI ipam plugin, which we
use, require routes be part of ipam, which in turn requires an address.
For details, see <https://www.cni.dev/plugins/current/ipam/static/>
Fixes#366
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All querier functionality for IGMP now handled by mcd, even if there are
no VLAN interfaces on top of the bridge. Also, mcd now handles unique
query interval per interface, or per VLAN, so we no longer need multiple
daemons running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for small incremental changes to bridge ports.
Changes where the libyang diff does not include a bridge reference so
that it will have to be synthesized from the current configuration.
For example, forgetting to set a port's PVID in a VLAN filtering bridge
setup, changing a bridge port's multicast flooding properties, or any
other per-bridge-port setting after the fact.
Fixes#349.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the pivot from having the CLI as default login to Bash (for remote
scripting and production purposes) there is no need for "user friendly"
access to a UNIX shell from the CLI. This provides the possiblity of
limiting users to only the CLI, e.g. a user with only guest or operator
privileges.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop doc/README.md symlink to variant.md
- Make doc/README.md the table of contents
- Clean up variant.md, OSPF and containers now fully supported
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Updating VLAN interface doc inline with current implementation
Mathias has fixed the syntactic sugar when creating eth0.20 interfaces, thus the associated documentation example is updated accordingly.
Only port 2 has an SGMII compatible SERDES. When referencing the
SERDES (comphy), the second argument must contain the port number in
order for the comphy driver to pick the correct configuration.
While __get_phandle_array returns the empty set when the property is
not available, str_array would return None, unless instructed
otherwise. Make sure that it also returns the empty set.
Temporary fix to prevent odd log messages. The fix is to add RAW VLAN
support to mcd so it can run as a proxy querier even if there is no
upper VLAN interface or IP address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds validation of bridge port VLAN memberships and IP
addressing for VLAN filtering bridges:
1. Ports must be a member of this bridge
2. Ports cannot be tagged and untagged member at the same time
3. A VLAN filtering bridge does not support IP addressing
A VLAN filtering bridge can only be a tagged member of a VLAN. Any IP
addressing needs to be done using an upper VLAN interface.
NOTE: while technically possible break up these long must expressions
into multiple must expressions per node (split at 'and'), it will
break libyang in interesting ways that in turn make the confd
inference functionality stop working. E.g., creating VETH pairs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port in a VLAN filtering bridge should be possible to configure
as "tagged only", i.e., to not assign ingressing untagged frames a VLAN
and instead drop them.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Must run in privileged mode
- Fix copy-paste container name: system -> nftables
- Point out the important settings
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch prevents statd from failing and logging errors on interfaces
currently in another network namespace.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch fixes a runtime error triggered by modifying an interface
currently used by a container. The CNI code must always return the
CNI status (reserved for container or not).
How to trigger:
- Create veth pair
- Make one end container-network and add to container
- Leave
- Return to configure and set an IP address on container interface
- Leave - BOOM
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- rtc, already does the best it can, fix occasional duped message
- urandom, check if seed file empty, try using hwrng
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backports of fixes for two issues:
- Finit sometimes locks-up without input on serial console on reboot
- Improved logging of unsupported initctl commands at bootstrap
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify interface generation by collapsing eth_ and ethlike_ifaces to a
single list. Let gen_iface_json() determine interface type by querying
each interface. This allows us to create bridge setups also for qemu
use-cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop all mention of "CNI" and update text to not use, e.g., `cni-bridge`
when this was changed in the model before the merge to main.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a VLAN filtering bridge setup we want to be able to support an
external IGMP/MLD querier running from userspace, because the bridge
multicast code can only generate proxy/NULL querys per VLAN.
This patch is a refactor to allow just that. If a VLAN on the bridge
has an upper interface, matching the bridge name and VID, we generate
a profile for querierd and enable the service.
For all other cases we try to disable any running querierd. It is up
to the daemon to figure out if it has a usable IP address to use as
the query source IP or use 0.0.0.0.
Since the logic for selecting a proper IP address must be handled by
the daemon in the per-VLAN setup, we revert back to also use it for
the stand-alone unfiltered bridge case as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since Infix supports per-VLAN querier parameters, like query interval,
we currently need to run a separate querierd per VLAN interface. The
replacement, mcd, will handle this automatically in its .conf file.
Also, ensure we install the daemon configuration file as an example, and
thus creating the /etc/querierd/ directory for where .conf files for
each interface will be generated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An RFC conforming multicast snooping bridge should forward all unknown
multicast (IP & MAC) on ports where the mcast_flood flag is set. The
upstream kernel does not (yet) support this, but the KernelKit branch
of the kernel and iproute2 now support it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a forward-port of one of my bridge patches to handle RFC4541
style flooding of unknown multicast.
https://lore.kernel.org/netdev/20220411133837.318876-9-troglobit@gmail.com/
Changes since this thread: use inferred mctx (VLAN multicast context)
from br_handle_frame_finish() and br_dev_xmit(), which should fix the
per-VLAN multicast handling issue pointed out by Nikolay.
Todo before next patch series, add new option instead of breaking the
existing functionality for the current mcast_flood flag. E.g., add a
mcast_flood_always, since the current flag stops flooding when there is
a known querier on the LAN.
See the above thread for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A bridge port cannot communicate on layer-3 while acting as a bridge
port. Removing the port from the bridge re-enables the link-local
addresses, if any, from the configuration.
Fix#327
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, no VLAN id, or other VLAN specific information is contained in the
MDB entries, only forwarding information and per-port state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With VLAN filtering on a bridge we cannot use the mcast_query_use_ifaddr
mechanism. This because even if the bridge may have an address it is
likely not on the same subnet as that of the VLAN, and the multicast
code in the kernel does not look at VLAN interfaecs on top of bridge
for a relevant adddress.
For these cases we have to use querierd, or a multicast router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
This reverts commit f5e37bba58 because it
causes a regression in setting up VLAN filtering bridges. The bridge
itself, e.g., br0 currently does not have a bridge-port context at the
same time as it being bridge. The model does not account for that and
thus srx_get_int() for the br0 PVID will always fail.
Reverting this commit allows br0 to be tagged member in all VLANs by
default, for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The srx_*() family of APIs are for some callbacks in confd used to check
if a setting exists or not. The root helper function srx_vaget() always
logged an error if sr_get_items() failed. This has now been fixed and
only the srx_enabled() function still triggers this, because it has no
way of determining an error condition -- otoh it should never fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
**Thank :heart: you for taking the time to fill out this bug report!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for the bug you encountered.
- type:textarea
attributes:
label:Current Behavior
description:|
A clear and concise description of the issue you're experiencing.
value:|
For code snippets, logs, commands, etc., please use triple backticks:
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-00-00-00 container[3192]: Failed creating container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Expected Behavior
description:|
A clear and concise description of what you expected to happen.
value:|
```
admin@infix-c0-ff-ee:/> show log
May 15 07:21:02 infix-c0-ff-ee container[3192]: Successfully created container test from curios-httpd-v24.03.0
- (press h for help or q to quit)
```
validations:
required:true
- type:textarea
attributes:
label:Steps To Reproduce
description:|
Steps to reproduce the issue. For example:
1. Built from source
2. Upgrade to latest release, vYY.MM.P
3. Factory reset
4. Enable feature
5. Check the logs/show command/operational status
validations:
required:false
- type:textarea
attributes:
label:Additional information
description:|
- Relevant parts of `startup-config`
- Output from `show interfaces`, if applicable
- Other observations, screenshots, log files ...
**Tip:** You can attach images or log files by clicking this area to highlight it and then dragging files in.
description:Suggest a new feature, idea or improvement of the OS
labels:
- "feature"
- "triage"
body:
- type:markdown
attributes:
value:|
**Thank :heart: you for taking the time to fill out this feature request!**
We kindly ask that you search to see if an issue [already exists](https://github.com/kernelkit/infix/issues?q=is%3Aissue+sort%3Acreated-desc+) for your feature. We are also happy to accept contributions from our users. For details see [CONTRIBUTING](https://github.com/kernelkit/infix/blob/master/.github/CONTRIBUTING.md).
- type:textarea
attributes:
label:Description
description:|
A clear and concise description of the problem or missing feature.
**Example:** *I'm always frustrated when [...]*, or *I'd like to see support for [...]*
validations:
required:true
- type:textarea
attributes:
label:Additional Information
description:|
Any other related information, e.g. existing YANG model(s), or possibly screenshots about the feature request here.
validations:
required:false
- type:textarea
attributes:
label:General Information
description:|
Appended to all feature requests for future readers.
value:|
Anyone can help out by [sponsoring][1] development of new features or [contributing][2] pull requests.
Please use this issue for discussions related to the feature.
"usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
"usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
