This branch can be used to test push events which is especially
useful when working on the CI infrastructure.
Signed-off-by: Richard Alpe <richard@bit42.se>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually the CNI bridge plugin "takes care" of enabling IPv4 forwarding
on all interfaces, see issue #1125, but when the container tests are run
in a different order from the infix_containers.yaml, Infix may reset the
IPv4 forwarding on this critical interface.
This change is both future proof and also ensures the test works as it
was intended even if tests are run out-of-order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As Infix matures as an operating system it is quickly becoming more and
more useful also for end-device use-cases. The README should reflect
this change in focus.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
From the documentation:
> 'podman image prune' removes all dangling images from local storage.
> With the all option, all unused images are deleted (i.e., images not
> in use by any container).
>
> The image prune command does not prune cache images that only use
> layers that are necessary for other images.
So, when the container script is called in the cleanup phase of the
lifetime of a container, we can use the '--all' option to ensure we also
remove this container's loaded image. In the case this happens before
a reboot of the system, there will be no old version of the image loaded
to /var/lib/containers after boot.
Issue #1098
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There are 2 main reasons for this:
1) It's almost impossible to write complex logical expressions in GH
workflows. I wanted to pass "" as flavor when not building _minimal.
So that the end target string would become TARGET + FLAVOR where
FLAVOR is empty, making it x86_64 for example.
As it turns out "" is false in GH workflow logical expressions, this
in conjunction with the limitations the interpreter has made it hard
to actually write sane expressions in the "with:" variables when
calling downstream jobs via workflow calls.
Here's an example of what I was trying to do and could not:
with:
flavor: ${{ (
github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'ci:main')
) && '' || '_minimal' }}
As '' is false, the first sets of expressions always evaluates to
false making the string "_minimal". I tried bracing this in various
ways and to use "null" or various JSON objects, all in vain.
2) It reduces complexity instead of adding additional.
Signed-off-by: Richard Alpe <richard@bit42.se>
Previously, upgrading Podman containers with the same tag left
behind dangling images, causing overlay storage to grow and fill
disk space.
This change ensures dangling images are cleaned up using
podman image prune. The command is run without -a, so only
unreferenced images are removed. This provides safe cleanup while
preventing unnecessary overlay growth.
Fixes#1098
Signed-off-by: Richard Alpe <richard@bit42.se>
The defconfigs for all architectures other than x86_64 has this
enabled, so align it with the rest.
This has no on-target impact, but it enables us to attach to a live VM
instance and debug it, or do offline debugging like resolving stack
trace lines from oops messages to source locations.
The board/common/uboot/extras.config was updated with CONFIG_MMC_PCI
*after* we last built the SparX5i bootloader, and this was really only
needed for the Qemu build, so let's move the requirement there.
Also, we now (Buildroot 2025.02) need to update the dependencies for the
Fireant bootloader with libbsd (for some reason) and dtc, of course.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit migrates the bootloader build from Raspberry Pi 4 board
package to a dedicated bootloader defconfig. The idea is to set up
dedicated wokflows for building bootloaders, which change rarely,
streamlining the Infix image builds.
A dedicated workflow, or job in an existing workflow, can then do
the composition to minimal SD-card images useful for starting up
Infix on boards where SD-card is the primary boot source.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit yanger looked at the running system using
os.path..., this meant that the static reply / capture data wasn't
used properly. This resulted in strange behavior during unit testing
on GitHub runners where USB ports are missing.
Signed-off-by: Richard Alpe <richard@bit42.se>
The execd runner has not been used since Nov, 2024, ca0e54b. This
weekend it started triggering a warning from Coverity Scan, so let
us drop it for good this time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commits tweaks the material orange theme to use the exact color hue
of Jackys footies. To match this and give a slightly better contrast we
also change Jacksy border and logo text color to a slightly darker tone.
The original logo.svg is retained for reference, the new logo is logo2,
which all the .png variants have now been updated to.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the spirit of my uni English teacher; "simplify, Simplify, SIMPLIFY!"
This commit collapses the About and Introduction into a single document,
doc/index.md.
Also, relocate the System Boot section to doc/boot.md, which we alrady
have and covers the initial bootloader part of it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lot of work still remains, but this new disposition should serve as a
more representative template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Files in doc/cli/*.md are used in and displayed as help text in the CLI
admin-exec level. So we cannot use standard admonitions (yet) since the
terminal markdown converter (lowdown) doesn't support the syntax.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want to discourage people to use sysrepocfg and instead move to use
NETCONF, or even better, RESTCONF. When something's missing we should
add it to these two official, and standardized, interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
And make the ASCII image more generic to ease any branding work we may
need to do for certain customers later on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- custom cover page for pdf
- Center and resize logo
- Place slogan just below logo
- Ensure all text on cover page is in matching grey
Please note, the mkdocs-to-pdf plugin works, but it has a bug in the
enumeration of sections. We may need to fork it to make it work the
way users expect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Way too long. By splitting it in multiple files we can also user
simpler (shorter) headings, which makes navigation easier.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Python tool 'mike'[1] helps manage multiple versions of MkDocs-powered
documentation. Only required when building the kernelkit.org site docs!
For each new tag, that steps year or month, a new version of is created of
the documentation, in a separate sub-directory on the gh-pages branch.
Strategy - Version Grouping with Early Publishing:
- Extract YEAR.MONTH from tag
E.g., v25.06.0-beta1, v25.06.0-rc1, v25.06.0, v25.06.1 → become version 25.06
- From first pre-release onwards:
- v25.06.0-beta1 → creates docs version 25.06
- v25.06.0-rc1 → updates docs version 25.06
- v25.06.0 (GA) → updates docs version 25.06
- v25.06.1 (patch) → updates docs version 25.06
- New major/minor series:
- v25.07.0-beta1 → creates new docs version 25.07
Benefits:
- Users get docs as soon as beta/rc is available
- Patches update existing docs (logical since patches rarely change docs significantly)
- Clean version grouping by YEAR.MONTH
- Mike handles create vs update automatically
[1]: https://github.com/jimporter/mike
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Major overhaul and simplification of both language and structure to
improve accessibility and UX in new documentation framework.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, this change breaks some links on GitHub due to the difference in
how MkDocs and GitHub implement "autolinking" and anchors. Since the
idea is to make MkDocs our primary documentation framework, breaking
links on GitHub in favor of MkDocs is the best compromise.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it a lot easier to find relevant information on how to
perform a system upgrade. Further consolidation may come later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Redesign how GH actions are triggered. This new design uses a
self-trigger to start jobs which are only started via workflow_calls.
The main benefit of this is to be able to start workflows from various
Infix Spins without needing to duplicate the workflow files in them.
Upcoming patches are intended to parameterize to allow Spins to pass
different architectures, brand names and such.
Signed-off-by: Richard Alpe <richard@bit42.se>
We was missing the firmware required for this, and for this to work
cfg80211 needs to be as module since the rootfs is not loaded when it
is loaded if compiled in kernel.
And add iw since it very useful for debugging.
Add test to verify a container on Infix can execute commands on the
host by mounting a script to `/etc/rc.local` with proper permissions.
The test confirms host hostname change using `nsenter` from inside
a privileged container.
Resolves#1024
- Fix by-word movement, detect word barrier using non-alphanum chars
- Fix delete word left/right, make sure to save word in kill buffer
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Buildroot updated to v25.02.3
- Tefactor of nftables container
The nftables container now includes BusyBox, a shell with vi and some
basic filesystem tools, as well as nsenter and unshare, suitable for
testing and other more advanced tasks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
If a extra infix feature require features to be added to an already
loaded module. Instead of have the exact module definition in multiple
places (with date), this will allow a much more flexible sytax:
MODULES=(
"infix-interfaces -e containers"
)
This require that the infix-interfaces is loaded *before* this file
is run.
This since the feature is called 'wifi' in Infix, this makes the naming
consistent over the system.
Also trigger start of a wpa_supplicant, for scanning in the background.
The scanning results is available operational.
Some CLI commands where inadvertently moved from the global CLI
context into the show context.
For example the upgrade command.
As a result, commands like upgrade were unavailable at the top-level
prompt:admin@ix-00-00-00:/> upgrade ?
Error: Command not found, or incomplete.
However, these commands remained accessible under the "show" context
as a temporary workaround:
admin@ix-00-00-00:/> show upgrade ?
URI [(ftp|tftp|http|https|ftp)://(dns.name | ip.address)/path/to/]upgrade-bundle.pkg
This patch restores the affected commands to the global CLI context so
that commands like upgrade function as intended at the root prompt.
Fixes: 9c0a8e39 klish-plugin-infix: fix indentation in infix.xml
Signed-off-by: Richard Alpe <richard@bit42.se>
- relying on config version and files backed up during
configuration is not enough.
- storing a configuration file before upgrading, to be used
when downgrading, is more reliable.
[skip ci]
Apparently the BCM2835 watchdog driver does not hook into /dev/watchdog
but creates its own /dev/watchdog0, and is very picky about interval and
timeout as well it seems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- switch to 6.12 LTS, same as other Infix boards
- trim down kernel config a bit
- sync defconfig with r2s to switch to Finit
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If an invalid mount source path is specified, the container logs a
"file not found" error and subsequently crashes.
Adding a check inside the SR_EV_CHANGE event handler performs an
early validation of the mount source path, allowing to reject
configurations that reference non-existent or unreadable files before
they are committed to the datastore.
This change ensures configuration correctness by enforcing that each
container mount has either a source or content set. Without this, the
system may generate invalid runtime arguments (src=(null)), leading
to container startup failures.
- relying on config version and files backed up during
configuration is not enough.
- storing a configuration file before upgrading, to be used
when downgrading, is more reliable.
[skip ci]
This to get quick turnaround development -> test when
doing PRs main branch builds and release builds are still
build sequentially.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
- Add section on upgrading/downgrading and boot-order to system.md
- Add or update references on upgrading from other pages
- boot.md (update ref)
- cli/upgrade.md (add ref)
- management.md (add ref)
[skip ci]
Libyang is smart, it "fixes" the timezone for you, this was overriden by a
hack in netconf.py and restconf.py, but what you really want is to see
in operational what the current timezone is.
Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
Use new buildroot branching strategy where all our commits are placed
on top of a buildroot release on a branch named BR_RELEASE-kkit.
Signed-off-by: Richard Alpe <richard@bit42.se>
When running a DHCP test `resolvconf -l` looked like this:
admin@client:~$ resolvconf -l
search example.com # e5
admin@client:~$
This resulted in broken result when reading operational data from
system-state (which used resolvonf -l)
Sysrepo, netopeer etc are still responsible to install the modules in
target directory, this will make that we will discover quickly if something
is updated.
Also this enables rm -rf output/target/etc/sysrepo/data/* && make confd-rebuild
This will reinstall all modules again.
This allows a user to run in on any system which has the Infix source
code that contains the modification scripts.
Signed-off-by: Richard Alpe <richard@bit42.se>
The software list from sysrepo is no longer reversed, the reverse now
happens in cli-pretty. This commit reflects that.
Signed-off-by: Richard Alpe <richard@bit42.se>
The reason for this is:
1) We want to use the same fetch tool for all operational data, to
avoid having duplicated xpaths scattered across the repo.
2) We want to call this directly from the CLI, which means it need to
be escape safe. A unprivileged user shall be able to use it but not
escape into a shell or do other malicious stuff.
Signed-off-by: Richard Alpe <richard@bit42.se>
There's several reasons for this. The main reason is that it was
developed as an intermediate way of getting system information when
the operational datastore was almost empty. There's not a lot of data
available in the operational datastore and we shall rely on that data
primarily. This command isn't safe to run from a jailed CLI as i
doesn't validate input and run commands directly in the shell, making
it hard to protect against a CLI jail break.
In upcoming patches we will introduce a new show tool that relies
solely on operational data and which sanitize the user input.
Signed-off-by: Richard Alpe <richard@bit42.se>
- Update usage text for readability, add example
- Reindent getopts case and add -h
- Allow 'git rm -f' to remove already staged patches
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.12.21, same as other tier one boards
- Fix#1006 byt enabling netlink for ethtool (now works!)
- Sync defconfigs:
- LIBXCRYPT now in an rdep of another package
- Disable FORCE check hashes for now
- Drop patches for 6.10 tree (r2s kernel)
- Port RTL8153b patch for R2S LAN LED support
Fixes#1006
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This silences a bogus warning in the log when runparts is called with no
argument. I.e., when there is no product specific init files available.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There is no such loglevel 'critical', only 'crit' is defined.
For some reason this issue has not been spotted until the upgrade to
Buildroot 2025.02, which includes sysklogd v2.7.0, and Finit v4.11.
Introduced in 3e48af6, when the concept of failure-config was added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When stopping a container that is (stuck) in setup state, e.g., fetching
its container image, we need to send SIGTERM to the container wrapper
script rather than forwarding the 'stop' command to podman.
With this fix, and the Finit upgrade, there is no longer a 10 second
timeout before Finit sends SIGKILL to the PID. Instead, the script now
immediately react to the initial SIGTERM.
Related to issue #980
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The code assumes both SRC and DST is passed, here we ensure this
early.
Prior to this patch:
root@host:~$ copy foo
Segmentation fault (core dumped)
Signed-off-by: Richard Alpe <richard@bit42.se>
Prior to this patch the errno value was overwritten by getgrgid()
making the printouts invalid:
Error: setting group owner wheel (10) on /cfg/startup-config.cfg:
Success
Signed-off-by: Richard Alpe <richard@bit42.se>
Avoid a theoretical race between getting the number of groups a user
belongs to and actually processing them. We should not need to check
the return value of getgrouplist() as we know the number of groups fit
inside the buffer.
Signed-off-by: Richard Alpe <richard@bit42.se>
As per earlier decsision, the .cfg suffix is no longer implied when a
user copy to a regular file, so we should allow tab completion in the
copy command to show foo.cfg, otherwise the copy command will fail.
Skip /cfg/startup-config.cfg since it's treated as a special case and
added to the list by the infix_datastore() plugin function.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When copying a file to a directory, the file should be accessible (read
+ write) by all members of the group that are allowed write access.
E.g., an 'admin' level user creating a new file /cfg/foo.cfg should
result in the file being owned by $LOGNAME:wheel with 0660 perms,
because /cfg is root:wheel.
Writing to already existing file, e.g., created by 'root' at first boot,
say /cfg/startup-config.cfg should be possible by all members of the
'wheel' group. In this case thef file already exists as root:wheel and
any user trying to chgrp it will fail, this is fine.
Fixes#977
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For future readers, the user paramenter to the copy() function is
actually the remote user in any curl command.
Also, realign columns in infix_config[].
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
{topdoc} is needed for asciidoctor to find the image during test
report generation.
This is the same functional change as 02d8288863 but with the
generation script actually updated. This was forgotten in the last
commit.
Signed-off-by: Richard Alpe <richard@bit42.se>
Turns out the root cause for the odd log message in #896 was that the
system did not properly call `resolvconf -u` when starting in failure
mode.
This patch simplifies the code by moving all `resolvconf -u` calls to
the same Finit task. Ensuring it is first launched when confd has
successfully consumed any configuration at boot, and then every time
a static DNS server is added. (The udhcpc client script already call
`resolvconf -u` when dynamic DNS servers are learned.)
Fixes#896
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following log message does not stem from an error in setting up the
chroot, but from the internal communication with the chroot. This patch
adds the crucial missing file name in the log message.
avahi-daemon[3590]: chroot.c: open() failed: No such file or directory
So that when the user sees this message, e.g., with "/etc/resolv.conf"
as the arg. to open(), they can be certain; "ah, no a biggie, we have
not created that file yet!"
Issue #896
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Either indent by four spaces or use backticks. Depending on the output
generator they may apply different styling though.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Enabled by user enabling IPv6 forwarding on any interface. This change
also enables net.ipv6.conf.all.accept_ra (=2) to accept any IPv6 route
advertisements even when acting as a router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The phys container test verifies custom mounts, so let's refine and
consolidate this test to focus on docker bridge features.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add new test step that adds a content mount to /var/www/index.html to
verify that changes to a running container are activated.
This test pass was previously part of the container bridge test, but
was moved here to allow that test to focus on bridge specific checks.
Issue #930
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For tasks like upgrade we need, e.g., the image URI. Instead of
guessing where on the container command line the image is, use a
meta-data field in the container shell script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- More logging when deleting a container
- Update 'exec' and 'shell' commands to support running commands
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Containers in Infix are read-only, any persistent data is either stored
in volumes or content mounts. To prevent lingering containers, as have
been seen on some test systems, we move cleanup stage from confd to use
the Finit cleanup:script mechanism.
The resulting code is simpler, shorter, and easier to debug and use.
As an added benefit, confd no longer prunes "unused" volumes by itself
on (any!) reconfiguration event, which with the new container life cycle
in Infix was quite fragile. Instead the CLI command 'container prune'
is extended with 'podman volume prune', which coincidentally the help
text already alluded to.
This patch requires Finit v4.10-rc1, or later.
Fixes#902
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When updating a container configuration we need to rerun the setup stage
of the container. However, a run/task in Finit only runs once for each
runlevel, meaning changes at runtime of a container was broken.
This is a refactor of the container script to allow it to also run as a
pre:script in the Finit setup stage of a sysv/service. Also included is
a fix to the timeout/retry handling in case the container setup fails.
We must call `read -t 60` *before* calling `ip monitor`, otherwise it
will not be called until `ip monitor` returns.
This patch requires Finit v4.9, or later.
Fixes#930
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Rename local variables
- Extract image name, using basename, for podman image exists
Fixes the following syslog error message:
root@foo:~$ podman image exists docker://ghcr.io/kernelkit/curios:edge
Error: unsupported transport "docker" for looking up local images
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add missing tool: timeout
- Add extra flags to sync
- Allow wc to work with large files
- Update defconfig sync -> enable PAM
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Future Infix defconfigs for smaller system may exclude Frr and set all
routes directly in the kernel. So failing to add a user to the frrvty
group should not cause an error, hence the new group_exists().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some netdev drivers, e.g. the FEC found on many i.MX SoCs from NXP,
will detach from their PHYs when configured down.
This means that when confd tries to configure L1 settings for the link
before bringing it up, ethtool fails - since there is no PHY to talk
to.
For interfaces that behave this way, delay the configuration until
after NETDAG_INIT, when the interface is brought up. This is not
optimal, since we are generating needless noise for the link partner,
which is why we only fall back to it as a last resort.
Fix#951
Ideally, all drivers should behave the same. Alas, that is not the
world we live in. For quirks that we can not reliably probe for in any
other way, let products supply a JSON file that declares them.
CID 507415 from coverity was the origin for this change. As it turns
out, the unreachable MAC address generation for VXLANs was hidden by
the generic setup (netdag_gen_link_addr()) saving the day. That is
likely something we want to phase out though, so the VXLAN code should
stand on its own.
Align the GRE code while we're here, because why not? :)
Primarily fixes issue with DHCP server multiple subnets test, which
triggers an ordering issue between reconfiguration of dnsmasq and the
`initctl reload` command.
For the full ChangeLog, please see:
https://github.com/troglobit/finit/releases/tag/4.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Do not allow the topology matcher to setup a LAG where one link is
running at 10G while the other one runs at 1G, since the bond will
never use the 1G port as long as there the 10G link is up.
To run LAG tests on hardware, we have to make sure that the chosen
links are running at the same speed. We do not want to require a
specific link speed from the logical topology, as the real requirement
is merely that the two (or however many) links are of the _same_
speed, not any _particular_ speed.
Rather than having to complicate the topology matcher, let it take
care of the common pattern of matching requirements to provided
features, then let tests pass custom node/edge matchers for the
complicated cases.
Verify connectivity from host to the second DUT via the first, over a
link aggregate. Both aggregate member links are connected to a TPMR
link breaker to hide link down from the DUTs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verify connectivity from host to the second DUT via the first, over a
link aggregate. The lag starts in static mode and then changes to an
LACP aggregate. This verifies not just basic aggregate functionality,
but also changing mode, which is quite tricky to get right.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unclear if the libyang merge operation actually does it's job of merging
all the data properly in the restconf backend.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When first starting up the YANG models are downloaded. Initially all
were printed on the test console, so this was later changed to become
a sort of progress output. However, that broke tap output, causing a
missing leading '#' for the final "YANG models downloaded." message.
Thist patch drops the output entirely from the netconf transport, it
was never added to the restconf transport.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Example use:
@infamy.test_argument("--mode", help="one of 'static' or 'lacp'")
class TestArgs(infamy.ArgumentParser):
pass
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds two SVGs for previewing the virtual test topologies.
quad: fix a lot of copy-paste mistakes, rename nodes and ports to their
correct names. Replace shell comments with C++ style comments,
not all tools, e.g., dotty, support shell comments. The neato
absolute positioning has also been fixed to make it possible to
see all the edges, to facilitate this the used ports have been
swapped around a abit. Colors are used according to the schema
agreed on for tests. Finally, a second link for lag tests have
been added between dut2 and dut3.
dual: coloring similar to quad, update to new edge attribute matcher.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When reading lag status, like LACP actor system prio, port key,
etc., we need CAP_NET_ADMIN. See net/bonding/bond_netlink.c
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some callbacks may run twice, e.g., lag_gen_ports(). Check if the link
already exists, and is the same, then we can exit silently. However, in
case the link exists and does *not* point to the same target, we log an
error with current target for the post mortem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The speed/duplex of a virtio interface is not eenforced in any way. The
driver initializes them to unknown/unkown:
https://github.com/torvalds/linux/blob/dccbe2047a5b0859de24bf463dae9eeea8e01c1e/drivers/net/virtio_net.c#L5375-L5381
It is however possible to set them since there are kernel subsystems
that rely on them, e.g., miimon in the bond driver, which in turn is
required for use with the 802.3ad (lacp) mode.
If we do not initialize speed/duplex the miimon will complain in the log
on virtual test systems every second:
Dec 13 22:34:08 laggy kernel: lag0: (slave e1): failed to get link speed/duplex
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The management of custom-phys-address was made more complicated by the
fact that physical interfaces require restoring the permanent address
when a custom setting is removed.
Simplify this by moving the restoration to the delete path, so we only
have to worry about if there is a custom mac or not during interface
setup.
Also:
- Fix some legacy naming on *_gen() functions
- Fix custom-phys-address on dummy interfaces
Fix#938
Before this change, interface dependencies were only setup when
interfaces were created. This led to problems in flows like this:
1.
configure
set interface br0
set interface br0.10
leave
2.
configure
set interface dummy0
leave
2.
configure
no interface br0
no interface br0.10
leave
Since neither br0 nor br0.10 was created in (2), no dependencies were
setup. Because of that, when the deletion scripts from generation (2)
are generated when entering (3), dagger is free to execute them in any
order. This means that it may choose to remove br0 before br0.10,
which will mean that br0.10 is already gone when we try to remove it.
Therefore, make sure that we generate the full dependency graph on
every iteration.
Also, get rid of the need to keep on-disk state for VETH pairs, and
use the name as a descriminator for which side to create/delete.
With the new iftype enum, we see that configuring an existing dummy or
gre interface types was wrongly classified as an error rather than as
a NOP.
Example, before this change, this was OK:
configure
set interface foo
set interface foo ipv4 address 10.0.0.1 prefix-length 24
leave
However, this was not:
configure
set interface foo
+leave
+configure
set interface foo ipv4 address 10.0.0.1 prefix-length 24
leave
+<KABOOM>
This has multiple advantages:
- Less chances of typos is repeated "infix-if-type:foo" strings
scattered throughout the code
- We can lean on GCC's `-Werror=switch` to make sure that iface
specific logic always handles all types (which was not always the
case - see follow-up commits)
- We can potentially create a `struct afspec_ops` in the future, which
could then be indexed by this enum
The only interfaces that would be in difs, but not in cifs, are
deleted interfaces. But these will be removed from the exit action of
the previous generation, and will never be referenced in the new
generation.
Pointer authentication emulation is expensive. By default, QEMU use the
standard cryptographic algorithm (QARMA5), which is very time consuming.
This commit switches to the fast implementation.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Counters should follow the format from ieee802-ethernet-interface
model, which use:
- in/out for Rx/Tx
- plural from
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of encoding hex data in regular strings, using an 'id:' prefix,
or guessing based on pattern in C code, we have decided for a breaking
change in the DHCP client model.
This commit introduces string and hex values for client-id in the models
for both DHCP client and server. The *breaking* part of the changes are
strictly related to how a user pass binary data as colon-separated hex
digits. The dedicated leaf node `client-id` is now reserved for string
values and the generic `list option` can be used to input user defined
string or hex values. Even non-conformant client-id options can now be
encoded. All described in detail in infix-dhcp-client.yang
The server model has been updated to be able to send generic options in
hex format, and the static host lease matcher for client-id now require
a 'str' or 'hex' modifier.
Note: dnsmasq is RFC compliant and will not match non-conforming option
61 (client-id) even though the client can send such payload.
To increase test coverage, the server_host test has been updated to
check both string and hex client-id. Matching on hostname is already
covered by other test(s).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With support for dns resolver in place, the ietf-system output needs to
be complemented with additional data collected from both the dnsmasq and
openresolv subsystems.
System date taken from 'client3' in the Infix DHCP server-subnets test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- dnsmasq:
- allow listening to all interfaces again to serve DHCP leases
- disable most of the default DHCP options, keep broadcast and
netmask because when dnsmasq can infer these they are better
than breaking networking for clients -- note, they can still
be overridden from global/subnet/host scope -- and for relay
setups they need to be supplied anyway
- confd:
- drop per-interface dnsmasq, although practical for many use-cases,
having a per-subnet focused server means improved integration with
future stand-alone dhcp relay setup
- implement suggested, simplified, yang model
Fixes#703
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The hostname leaf in ietf-system.yang defines it as an fqdn. This patch
adds support for splitting the host and domain parts to set them in
Linux according to hosts(5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A DHCP client should be able to request a DHCP server assigned hostname,
*and* advertise its current hostname (as a client-id). This change lets
the client do either, instead of always assuming the latter.
Alt 1)
option id:hostname => request hostname
Alt 2)
option id:hostname, value:<STRING | auto> => advertise hostname
This also fixes a bug where the hostname sent to the server could be the
old hostname. The fix picks up any new hostname directly from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For consistency with the new dhcp-server model, which has an option
value 'name', options are now referred to as id's or identifiers.
This means bumping the confd syntax version 1.3 -> 1.4 and adding a
migration script for existing dhcp-client configuration files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch introduces a new yang yang model for DHCP server and relay,
using dnsmasq to provide the functionality on a per-interface basis.
Available DHCP options will be queried by confd on startup and can
then be configured in a flexible manner.
The DHCP option 82 feature has been realized by patching dnsmasq
(see patches/dnsmasq/2.90/0000-relay-agent-info.patch).
Signed-off-by: Stefan Schlosser <sgs@grmmbl.org>
Skip the password node in operational data for entries that have locked
or empty password, otherwise the YANG validation (regexp) will fail.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_item() function logs an error: "No data found for ..." in
case the referenced XPatjh does not exist, causing unnecessarily scary
log message about missing genkey elements in /ietf-keystore:keystore/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Similar to the run_multiline() method, sometimes files contain more than
one line and a common read_multiline() quickly becomes useful. This is
currently only used by ietf-system for reading /etc/resolv.conf.head.
Also, fix pylint warning for missing encoding to all open() calls.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Updating SSH information
- Adding Web services information (general, RESTCONF and Web Console)
- Adding Console information
Generic info, and some updates w.r.t specific boards (baudrate, etc)
mDNS and LLDP tests should run independently to avoid interference.
Previously, mDNS tests were blocked due to LLDP's transmit interval
limitations. Moreover, mDNS operates at Layer 3, while LLDP operates
at Layer 2, making IP configuration unnecessary for LLDP tests.
Introduce a parameter in IsolatedMacVlans to set interfaces up by
default. This removes the need to manually bring the interface up
inside the addip function.
By declaring the service as manually configured, we can control it
from dagger (confd) without the indirection via a condition.
This has the benefit of mstpd being in the "stopped", rather than the
somewhat confusing "waiting", state when not running.
Fixes#890
Implemented logic to check if the system supports required services.
Logical edges with 'requires' fields are mapped only if physical edges
provide corresponding services. If not, the test is skipped.
This ensures that tests only run when the required services are available
in the test system configuration.
Fixes#654
This update enhances the LLDP configuration by enabling per-port
administration through the `admin-status` parameter. Users can now
individually enable or disable LLDP operation on specific ports.
Fixes#578
On slow systems, we don't want test steps involving tools like scp or
ssh-keyscan to fail because the server had not come up yet.
Therefore, make sure that the server is ready to accept connections
before moving on to subsequent test steps.
Use CAPTIALIZED names for static data and collect them at the top.
Make a note about for future readers about why a test called
ssh_key_authentication suspiciously does not enable the SSH service :)
Being able to check for a TCP based service is generally useful, not
only for NETCONF. Therefore, break it out to a separate function that
allows any port to be queried.
Due to #902 (which has not been root caused at this time), podman may
indicate the existance of an interface that yanger is not able to
locate in any namespace. Therefore, make sure that we verify that the
interface was actually found before trying to create the operational
data for it.
Break up the --test parameter into either:
--capture: Write system command output to a local directory for later
consumption by...
--replay: Which can replay a previous capture
Rename --wrap-commands => --cmd-prefix
This change introduces the configuration of the tx-interval parameter
for the LLDP service, allowing control over the frequency of LLDP hello
messages. This improvement eliminates the need to toggle the interface
down and up to force the emission of LLDP packets in the test
environment.
This should be a non functional change. The idea is to use the topdoc
dir from 9pm when generating the test report.
Signed-off-by: Richard Alpe <richard@bit42.se>
Useful to only create a new image with only small diff with for example
aarch64_defconfig.
example:
If the only diff is the VENDOR, instead of KernelKit you want 'foobar'.
create a file with the change:
INFIX_VENDOR="foobar"
and call ./utils/generate-defconfig.sh -b aarch64_defconfig -c foobar-diff.conf -o configs/foobar_defconfig
Existing tests relied on manually captured system data from various
points in Infix's history, making them hard to extend as we add new
features.
Move to a new model where we:
To update a unit test:
1. Use Infamy tests to setup a DUT in a known state
2. Use yanger's wrapper mode to capture the system state needed to
produce operational data for a set of YANG models
3. Use cli-pretty to create the expected output for a set of show
commands
When running unit tests, we can then use the captured data to verify
that yanger and cli-pretty works as expected without the need for a
running Infix system - just like before. The difference is that it is
now much easier to capture a new snapshot when the system evolves.
Ensure that all flavors of GRE tunnels can be configured. In addition
to the increased test coverage, it will also be useful as a basis for
collecting representative system state for CLI testing.
Ensure that VLANs can be configured on VLAN filtering bridges. In
addition to the increased test coverage, it will also be useful as a
basis for collecting representative system state for CLI testing.
Allow all host commands to be run with a prefix (e.g. `ssh
user@remotehost sudo`), such that yanger can be tested against the
current state of a remote system.
If a command wrapper _and_ a test directory is specified, the output
of all commands and files are recorded for use by a future test
execution.
Example:
1. Launch a `make run` instance and setup some config for which we
want to test yanger and cli-pretty
2. Capture the output of all commands needed to produce the data for
some YANG model:
`yanger -t /tmp/ifs -w "ixll -A ssh qtap1 sudo" ietf-interfaces`
3. Kill the instance (we do not need it any more)
4. Test cli-pretty using the captured state:
`yanger -t /tmp/ifs ietf-interfaces | cli-pretty show-interfaces
`
The default was set to only accept connections from localhost when
connecting via IPv6. This was not caught in testing since the
test-config accepts connections from all hosts (::).
Accept connections from all hosts in all builtin configs. Inherit
test-config's service definition from factory-config, since we want
testing to be done as close as possible to what are users are running.
The default ping(8) shipped with alpine does not support `ping <addr>
-c1`, but happily executes `ping -c1 <addr>`. Therefore, make sure
that the address is always the last argument.
This is just a first step to add VXLAN tunnels, much more remains.
Implemented right now is as GRE, local, remote and a VNI.
Also refactor gre_basic and gre_bridged to generic tunnel tests,
the same test now tests VXLAN as well.
This is only availible for tests that require paramters. If the test have a
parameter --data the description and test steps can contain {data} which will
be replaced with tha actual data of the parameter data in the test specification.
The suite can also contain meta data for the test specification,
One meta data that is implemented is title, which is used when the
same test code is used twice with parameters.
Also if a test case should not be present in the test specification
for some case. You can add specification: False as meta data.
Usage examples:
Run yanglint on all infix models:
ixyang check
Lint a single model:
ixyang lint infix-interfaces
Dump a tree of ietf-interfaces with all infix augments:
ixyang lint infix-interfaces ietf-interfaces -- -f tree
The yanger source grown significantly, code is disorganized, the
namespace is all over the place, etc.
Take a stab at remedying the situation by splitting out the individual
YANG models in separate Python modules, starting with ietf-system.
Rather than explicitly defining the sources, specify the package names
and let poetry figure out the details. Otherwise, subpackages are not
included, which we want to start using in yanger.
When interactively running, for exampe, yanger interactively from the
source tree, we end up with compiled files in our working tree. Make
sure to ignore these.
These are also provided by other packages (sysrepo, netopeer, etc.)
but having them in here allows us to lint all of our own models
without the need for a build tree.
Using `sys.argv[0]` does not quite achieve the effect we want, namely
that any (test-case, $PYTHONHASHSEED) tuple should always default to
the same transport.
For example, the following two examples should always use the same
transport:
$ make PYTHONHASHSEED=1337 test-sh
infamy0:test$ ./case/ietf_system/hostname/test.py
$ make PYTHONHASHSEED=1337 test-sh
infamy0:test$ cd ./case/ietf_system/hostname
infamy0:hostname$ ./test.py
But, since their argv[0]'s are different, they don't.
Therefore use the _last two components_ of argv[0]'s full path
instead. This should:
- Spread the allocation over an entire suite run, since the
penultimate component is usually the test name.
- Keep the allocation stable when test code is modified (which is
common during debugging of failing tests)
- Avoid instabilities stemming from the local storage location (i.e.,
home directory names etc.)
The somewhat clumsy construct of resolving a logical port name to its
physical counterpart has been with us from Infamy's inception:
_, physical_port = env.ltop.xlate(logical_node, logical_port)
This is needlessly verbose. Since devices already have access to the
mappings which applies to it, make them easy to access:
target = env.attach("target")
# Get physical port names via the subscript operator
target["data0"]
Basic support GRE and GRETAP tunnels both for IPv4 and IPv6.
Limited support right now, only possible to configure local
ip address and remote ip address.
INFIX_OEM_PATH is `""` by default (i.e., not empty in `make`'s
eyes). So we called `git` with `-C ""`, which it interpreted as "from
the current directory" and thus we sourced the autogenerated build id
from _buildroot_ instead of Infix.
Therefore, make sure to strip any quotes from the OEM path before
determining the top directory.
* Use new cleanup in infamy to ensure the boot order gets restored
* Use new boot order in operational and use RPC to set boot order
to remove all SSH commands.
If a test need to clean up itself disregarding test status,
it can add an optional test-cleanup phase.
This is useful if the test in some circomstances leave the device in a
bad state. This can be used to restore the unit to its ordinary state.
Furl answers the question "is this URL serving the content I expect?"
Sometimes, we might be asking a server that in the middle of being
reconfigured, is crashing, is buggy, etc. - in which case it might RST
the connection. In that case the answer to the question is "False" and
not "BURN IT ALL DOWN!!"
The only reliable way of getting logs from the container at all times
is to let conmon be the logging agent.
Unfortunately, the k8s-file format does not handle multiline output
very well, which is something we often see on the stdout/stderr of
containers.
Therefore, add proper syslog support to conmon instead, and make sure
that podman knows enough about it to pass the information along to
conmon.
Instead of running initctl reload, which also prematurely enables
services which are not supposed to be started until we have run
through the netdag and evolved to the next generation.
Handle the original use-case of disabling zeroconf is managed by
asking finit to stop the service immediately in the exit action, and
deferring the cleanup of the service until we call `initctl reload`
after the init action of the new generation.
In ye olde confd, we basically had `50-init.ip` - and that was fine.
Then came containers, VLANs, bridges, etc.; and with it: a whole
forest of setup/teardown scripts - and it was not fine anymore.
For example: if found an init script running at 61, you would have to
grep the source tree and look at _all_ other call sites to get a sense
of what runs before and/or after it.
Therefore: create enums for the init/exit actions where the order is
explicitly stated, and use those for all interface scripts.
Clean up bridge-port config generation to align with the bridge upper
code.
- Remove lots of unnecessary guards that we model guaratees are always
met (existance of containers and leafs). This reduces indentation
depth and increases readability, IMHO.
- Split the generation into smaller pieces, each with a clear purpose.
- Try to include all edge cases around the tricky subject of PVID
migrations, with the actions running in either exit or init, as
appropriate.
TL;DR:
> New code, all bugs removed ;)
Incremental reconfiguration of bridge related settings had lots of
ordering issues.
This change tries to remedy that by:
- Introducing the concept of "snippets": Instead of having to run C
code in the correct order (which is doomed to fail since teardowns
typically need to run in reverse), collect related settings in a
snippet. Later on, we can then concatenate snippets into a larger
file in the proper order.
- Refactoring the bridge setup to take advantage of snippets. Now we
can call out to functions that _both_ generate the VLAN config _and_
sets some bridge global options, for example. This gets us out of
having to pass back settings to the main generation function.
- Ensuring that deleted objects are always removed - in the proper
order - in the exit action of the previous generation. This was
previously not true for VLANs, fix#869.
- Generating `mcd`:s config orthogonally from the bridge setup. Since
we need to keep track of _all_ bridges, figure out when VLAN uppers
exist etc., it becomes _very_ messy to generate the configuration
from the diff of a single interface. There were lots of cases here
where disabling the querier service on one bridge would disable the
whole daemon, thereby disabling the service for other bridges that
still had it enabled.
Fact: ietf-interface.c has become too unwieldy.
Therefore, split it, roughly based on the YANG structure, into
multiple files.
There is much more to do here, like cleaning up the naming (which is
all over the place), moving more system commands into dagger, etc. But
I wanted to keep this change to a strict code reshuffle.
Previously, the generation number was only increased for successful
evolutions. This led to a confusing state in /run/net where multiple
<N>-ABANDONED-<date> directories could exist, with the same value of
N.
Move to a scheme where the generation increments every time we evolve,
even if the evolution fails. If multiple consecutive evolutions fail,
we can now unabiguously determine the order in which they were
executed.
When reconfiguring the system many times (seen during regression
testing), the RAM usage of keeping all generations around starts to
add up.
A tmpfs file, no matter how small, will always consume at least one
full page (4k). So one generation of tiny setup scripts and log files
can end up locking a 1 MB (!) of memory.
Therefore: Once we're done with a generation, archive it in a
compressed tarball, which typically fits inside a single 4k
page. Limit the total number of archives to 10. This should give full
visibility into the history of a system in all normal situations,
while still allowing hammering systems with reconfig cycles in testing
scenarios.
If the callable threw an exception, then the process running inside
the netns would exit before sending back a value on the tx pipe, which
meant that `rx.recv()` would hang in the original process.
Make sure that we catch any exceptions, and send that instead of the
result over the pipe in those scenarios. Then in the original process,
re-raise the exception.
Before this change, setting `GIT_VERSION` in `make`'s environment was
intended to allow the user to specify a custom build id. As it turns
out, `test/test.mk` had duplicated the logic from
`board/common/post-build.sh` to unconditionally override any value set
in it. Because of the way `make` handles variables, where assignments
to variables inherited from the environment are exported back to
it[^1], this would mean that `test.mk` would always clobber any value
set by the user. Furthermore, there is also this file called
`buildroot/package/git/git.mk`, which also (reasonably) has opinions
about what the proper value of `GIT_VERSION` should be. In summary,
this was a bit of a mess.
Therefore: Make sure that there is one single place where we determine
the build id and version, and make sure that those variables are
scoped under the `INFIX_` prefix to avoid clashing with any other
component.
[^1]: https://www.gnu.org/software/make/manual/html_node/Environment.html
Overhaul text and grammar. Simplify, correct, and add information about
the new mDNS settings. Replace 'unit' with 'device', which is the more
common term for hardware.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes the following issue when deleting /infix-services:mdns/interfaces,
which works fine over RESTCONF:
Traceback (most recent call last):
File "/home/jocke/src/infix/test/./case/infix_services/mdns_allow_deny/test.py", line 142, in <module>
dut.delete_xpath("/infix-services:mdns/interfaces")
File "/home/jocke/src/infix/test/infamy/netconf.py", line 418, in delete_xpath
oldd = mod.parse_data_dict(old, no_state=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/.infix/venv/lib/python3.11/site-packages/libyang/schema.py", line 215, in parse_data_dict
return dict_to_dnode(
^^^^^^^^^^^^^^
File "/root/.infix/venv/lib/python3.11/site-packages/libyang/data.py", line 1277, in dict_to_dnode
result.root().validate(
File "/root/.infix/venv/lib/python3.11/site-packages/libyang/data.py", line 430, in validate
self.validate_all(no_state, validate_present)
File "/root/.infix/venv/lib/python3.11/site-packages/libyang/data.py", line 449, in validate_all
raise self.context.error("validation failed")
libyang.util.LibyangError: validation failed:
Invalid leafref value "e3" - no target instance "/if:interfaces/if:interface/if:name" with the same value.
The patch skips validation of the diff in favor of checking the result
of libyang.xpath_del().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Avahi daemon needs to be restarted when changing its configuration
file in /etc/avahi/avahi-daemon.conf, not sufficient to SIGHUP.
Also, minor reformatting for new style.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use container for interface allow/deny and for reflector settings.
Hopefully there will be more settings in the future, e.g., control
reflector interfaces independently.
Fix#678
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduce a new approach to dtb-building:
Old way: `rsync` an overlay containing our dt source to the kernel,
and then build via buildroot's `_INTREE_DTS_NAME`. This does not work
in recent kernels (at least since 6.12), which requires all dtb's to
be explicitly listed in a `Makefile`.
New way: Create a separate package for every board, and build the
device trees via the kernel's standard interface for building external
modules. This has two main advantages:
1. We can easily interpose a patched version of an upstream device
tree. E.g., we can easily set the factory password.
2. It is much easier to get an overview of which boards are enabled,
rather than scrolling back and forth in the `_INTREE_DTS_NAME` list.
Enable all fully supported boards in the defconfigs.
These changes are based on the sysctl recommendations by Frr [1].
Not all recommendations have been incorporated, e.g., ip forwarding is
not enabled per interface, because in Infix this is an opt-in feature.
A readme.txt has been added, documenting the various settings.
New for IPv4:
- Adjust IGMP max memberships: 20 -> 1000
- Use neighbor information on nexthop selection
- Use inbound interface address on ICMP errors
- Ignore routes with link down
- Disable rp_filter
ARP settings have been changed to better fit routers, i.e., systems
with multiple interfaces:
- Always use best local address when sending ARP
- Only reply to ARP if target IP is on the inbound interface
- Generate ARP requests when device is brought up or HW address changes
New for IPv6:
- Keep static global addresses on link down
- Ignore routes with link down
Fixes#829
[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the OSPF(v2) context, there is an "address-family" setting available.
However, since only IPv4 routes are supported in OSPF, currently
this setting is not relevant.
Fixes#813
Make sure that we keep a record of the versions and boot source used
by all devices under test when running the full suite - in case we
ever suspect that there is a mismatch between the intended test image
and the actual one.
Since this test now needs to communicate with the devices, make sure
that we run the wait test first.
Replace the existing remove-module-names-pass in the RESTCONF
transport -- which only worked for top-level containers -- with
libyang's standard `.print_dict()` used by the NETCONF transport
implementation.
As a bouns, the implementation of `.get_iface()` is now transport
agnostic.
When disabling a container in the configuration we should not remove it,
because then any volumes used by it may be lost. Instead, we now simply
disable the service to prevent it from starting, or stopping it, if it
was running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When deleting interfaces we skip a lot of steps in netdag_gen_iface(),
this patch ensures we at least call netdag_gen_ipv4_autoconf() to drop
any running zeroconf agent in the same generation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The mDNS daemon, Avahi, is very verbose in its syslog output. So much
that it often overshadows other subsystems, and on switches and routers
with more than the "normal" amount of ports and interfaces, it quickly
becomes unbearable.
The patches consist of:
- Add -l LEVEL support to avahi-daemon
- Add missing casll to setlogmask() in libdaemon:daemon_set_verbosity()
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The -S switch to less seemed at the time a good idea -- chop off too
long lines and allow horizontal scrolling -- however, the -F option, to
skip pager for content that fit the first screen is overridden by the -S
switch. This makes commands like "show containers", and similar that
normally have waaaaay too few lines for a pager to always page.
So let's drop -S to regain the original behavior. This will cause lines
to be wrapped, but with the new raw mode in the CLI this seems to work
without any weird screen artifacts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to scroll to the end (Shift G, or page down til end),
let's instead start at the end now that we have control over paging in
the CLI ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As it turns out, the setup with a 802.1D bridge in combination with
VLAN uppers stacked on the bridge ports is not possible to support
on mv88e6xxx ports.
Enable VLAN filtering to ensure proper isolation of the locally
terminated VLANs.
This will fail on a system running a vanilla kernel, where the dut's
ports are backed by mv88e6xxx, because:
1. The ports are attached to the same bridge, and are thus in the same
PVT group.
2. Creation of the VLAN uppers causes the DSA layer to add both ports
to the same VTU entry.
As a result, hardware behaves as if both ports had been configured as
tagged members of VLAN 10, instead of just terminating incoming
traffic locally.
Add this test to catch hardware which behaves in this way.
This patch drops a needless restriction of IP addresses on VLAN filtering
bridges from 2024-03-06. The obvious use-case is when the bridge is an
untagged member of a VLAN and only ony management VLAN is required.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the FRR upgrade to 9.1.2, OSPF sometimes reports neighbors
without reporting the routerDesignatedId and routerDesignatedBackupId
attributes. Ensure that these attributes are available before trying
to copy them to the output.
During development of the upcoming ospf_container test, an issue was
discovered where zebra's view of the system drifted from the kernel's
ditto. Specifically: when transitioning from test-config to one with
many virtual interfaces (VLANs VETH pairs etc.), zebra would not
process events for all interfaces, which meant OSPF would not pick
them up.
Our experience matches very well with a bug reported upstream in:
https://github.com/FRRouting/frr/issues/13630
> If we delete kernel interface and create it and set its ip in a
> short time, in rare cases, interface ip will be lost in zebra which
> can be confirmed by vtysh show interface brirf command. This will
> lead to abnormal behavior of other protocol daemons, for example,
> bgpd does not announce the route corresponding to interface ip even
> it was specified by network command.
The issue was marked as fixed by PR 13396, which was merged in the 9.0
cycle:
https://github.com/FRRouting/frr/pull/13396
Therefore, upgrade FRR to the latest patch release from that major.
During debugging of a reconfiguration issue, one hypothesis was that
the tracking of callbacks used to determine when a transaction has
completed (as sysrepo has no hooks for this) was out of sync, causing
us to call `initctl reload` prematurely. This was not the case, but if
it ever occurs in the future, make sure that it is a fatal error that
won't go unnoticed.
- Verify that broadcast packets are also properly moved accross the
bridge, i.e. the broadcast packets sent from vlan interface VLAN10
do not reach VLAN20
Fixes#773
Fix lack of syslog messages from Zebra and add support to easily enable
debug logs for common Zebra subsystems.
Same change made to ospfd for symmetry.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a regression in v24.11.0, introduced in 46dd0c7, where line
drawing characters are not properly displayed in the CLI anymore.
admin@infix:/> show interfaces
INTERFACE PROTOCOL STATE DATA
lo ethernet UP 00:00:00:00:00:00
ipv4 127.0.0.1/8 (static)
ipv6 ::1/128 (static)
br0 bridge
<E2><94><82> ethernet UP 02:00:00:00:00:00
<E2><94><82> ipv4 169.254.1.3/16 (random)
<E2><94><82> ipv6 fe80::ff:fe00:0/64 (link-layer)
<E2><94><9C> swp1 bridge FORWARDING
<E2><94><9C> swp2 bridge FORWARDING
<E2><94><9C> swp3 bridge FORWARDING
<E2><94><9C> swp4 bridge FORWARDING
<E2><94><9C> swp5 bridge FORWARDING
<E2><94><9C> swp6 bridge FORWARDING
<E2><94><9C> swp7 bridge FORWARDING
<E2><94><9C> swp8 bridge FORWARDING
<E2><94><9C> swp9 bridge FORWARDING
<E2><94><94> swp10 bridge FORWARDING
This is because the raw tty from klish disables IUTF8 and the fact that
it does not source any environment, e.g., /etc/profile. (We do not have
any locale settings in the enviornment either, but that's a discussion
for another day.)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit 0ee973b2b2.
Turns out that this workaround simply reduced the size of the window
where this issue can occur.
The previous change now ensures that the DSA tree is always fully
setup by the time nameif runs.
Before this change, we relied on `udevadm settle` to act as a barrier
which we could only cross after all devices had been probed. As it
turns out, when drivers defer probing due to missing dependencies,
`udevadm settle` may exit (as no events are generated for a period of
time) before all devices are set up. This was the root cause behind
issue #685, for which #752 was the initial attempt at a fix.
As we know that systems using mv88e6xxx will always have a device link
referencing the conduit interface, add a script to finit's system
runparts directory, which will block while any device link consumers
are still probing.
As a consequence of this, we can no longer rely on the sysklogd.conf
shipped with finit. Therefore, install an Infix specific one, which
will make sure that the aforementioned script has run before launching
the syslog daemon, which most other things depend on.
Fixes#685
- No more default writable layer
- Don't mention read-only (deprecated, and always on now)
- Use ghfm note highlights
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds latest symlinks to the curiOS containers to make system
upgrades easier. I.e., a user can now reference the bundled image with:
set image oci-archive:/lib/oci/curios-httpd-latest.tar.gz
So that when they upgrade to the latest Infix, which might include an
update of curiOS httpd, they will get a seamless upgrade also of the
container(s) running.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit replaces the 'cfg' alias for 'sysrepocfg -f json' with a
small shell script. Currently only an 'edit' command, similar to the
CLI 'text-editor' command for modifying base64 encoded YANG nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Refactor logging to simplify code and get proper log level
- Clean up lingering directories from any extracted tarball on error
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows running the configure script manually to create and
delete containers. The normal flow via confd has additional handling
to ensure containers are started/stopped on inictl reload.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of using $HOME, which may be a ramdisk, use /var/tmp which
podman also uses by default. Also, make sure to clean up after
ourselves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Disable the default "podman pull" retry value. We use execd to retry
"podman create" on failure. Wihtout this change, a single container
can block start of other containers by 3 * 20 seconds. Now we only
block max 20 seconds before we try starting the next container.
Modern versions of podman (>= 5.0) have this --retry option, but it
does not have CNI, so this is a temporary workaround.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an Infix device is connected to a LAN where the gateway has yet to
connect to the Internet, the container script will fail pulling images
from any remote server.
Nov 16 12:48:13 infix container[3490]: Error: initializing source docker://ghcr.io/kernelkit/curios:edge: pinging container registry ghcr.io: Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io on 127.0.0.1:53: read udp 127.0.0.1:55422->127.0.0.1:53: i/o timeout
Nov 16 12:48:13 infix container[3641]: Error: failed creating container fw, please check the configuration.
Nov 16 12:48:13 infix execd[3490]: /run/containers/queue/S01-fw.sh failed, exit code: 1
Since execd until now only retries on netlink/inotify events, or manual
SIGUSR1, jobs would get stuck even though Internet connectivity had been
established. This patch fixes that with the addition of a retry timer
which runs while there are pending jobs in the queue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Should be inverted to a --verbose or --debug flag instead. After this
change we still see the full 'podman create ...' command, with all the
optionas and arguments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Issue #815 detail issues found running the Clixon Controllar and
Cisco Yangsuite. The errors and warnings listed are very similar
to pyang, which the undersigned has, the following changes fixes
the pyang errors:
- relocate 'feature containers' to submodule
- drop already deviated ospf:database deviations
- drop unused imports
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Anonymous FTP, or URL encoded ftp://user:hostname@addr/oci.tar.gz
- HTTP/HTTPS fetched with curl, optional credentials support
- Verify download against an optional sha256 checksum
Ensure the unpacked directory name does not contain a ':', it is a
restricted character and cannot be part of the file name. If this
syntax is used we retain it as the name and retag it after load.
Fix#801
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Reduce the amount of queues: 3 -> 1
- Simplify post hook
- Refine execd
The resulting simplification of infix_containers_post_hook(), and
touching execd, also ensure container environment variable changes
are propagated.
Fixes#822
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to handle container restarts, incl. restart policy, at
runtime, most of the container data lives in /var/lib/containers,
which on most systems is backed by a persistent store.
As of issue #823 we no longer keep a writable layer for containers,
nor should we cache container state across reboots, all containers
are recreated at boot. This task cleans up any lingering state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Running 'shred' on files stored on eMMC is pointless since the writes
are spread out over other sectors rather than overwriting the content
of the files as it was supposed to on old rotating media.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container support in Infix was released with v24.02, so this change may
unfortunately break a few use-cases out there. Regrettable as this is,
the default behavior, including how containers are started after boot,
break other use-cases that were considered more important.
As of this commit:
- all containers in Infix run in read-only mode, use volumes and
mounts for persistence across reboot/stop/start/upgrade
- all containers are now "recreated" at boot or related config changes,
this ensures an OCI image embedded in the Infix image, /lib/oci/, is
always used as the base for a running container
Fixes#823
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A sane interface name is at least two characters long, and in Linux the
interface name (using ip link) is at most 15 characthers long.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With interactive mode (out="tty") klish puts the tty in raw mode which
fixes all weird issues reported around paged output in the CLI.
Fixes#659
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These are basically the same flags as was passed to klish, but now we
use -R instead of -r to make sure only ANSI coloŕ escapes can affect
the behavior of less.
This change will make it posslbe to shop off too long lines and scroll
vertically on really long lines instead for them breaking output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This update include more backports from Klish 3.1.0, including, but not
limited to:
- Syslog fixes
- Return code fixes
- Changed library and plugin paths (!)
- TTY raw mode fixes
- Use raw mode for interactive commands
- Allow single quotes (') as alternative to regular quotes for commands
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we opportunistically set up mqprio on all interfaces, we pass over
interfaces without offloading support. Catch that error message and log
an informational message about which interfaces are skipped.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if the "usb-ports" key exists in /run/system.json before calling jq,
otherise we get the following error message:
Nov 8 05:11:45 ix bootstrap[3349]: jq: error (at <stdin>:0): Cannot iterate over null (null)
Also, minor whitespace cleanup and bashisms fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 0f410eb a patch was added to RAUC to allow native logging to syslog,
it was however never enabled. This patch enables logging to syslog.
Fix#809
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrapping a system with D-Bus using Finit will create the machine-id
file /var/lib/dbus/machine-id, this can be used as the unique machine-id
for services like RAUC, so let's set that as /etc/machine-id to reduce
the log spam we get otherwise:
Nov 7 06:18:08 test-05-25-f8 rauc[5512]: Failed to get machine-id: Failed to open file <E2>M-^@M-^\/etc/machine-id<E2>M-^@M-^]: No such file or directory
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the initial probe, set up all port leds:
- Disable all LEDs
- Enable netdev trigger for all green LEDs (tp + sfp)
- Enable link statux and rx/tx activity
- Skip all aux LEDs
Also in script, a neat little flash function that can be used both for a
production test, to verify all LEDs work, and at runtime to locate the
device in a rack of devicess.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On Rev. B, the second LED on the copper ports is green instead of yellow.
This patch renames them from yellow -> aux => <device>:aux:tp
Also on Rev. B, the second LED for SFP ports do not work at all. This
patch drops them from the device tree to avoid confusion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some services launched at bootstrap must be possible to override per
product. One such service is iitod, which manages the LEDs in Infix.
This change makes allows a product specific init script to clear the
led condtion, preventing Finit from lauching iitod. Also, rename the
ixinit-done condition to match the nomenclature used already.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch use the new compatible array in /run/system.json, installing
in order, least to most significant product overrides.
We also introduce a new way to run product specific scripts at init, to
override default behavior in Infix, e.g., LED control.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is to workaround #807. To test automatic router id selection
a new test is required, which sets interfaces and activate ospf in
separete NETCONF/RESTCONF query.
Initially done as a workaround for the MACVLAN create/remove race. But
even though the old version of this test now works, this refactor
provides better test step descriptions, making it easier to follow for
anyone looking to manually verify the functionality.
This is a specialized namespace, containing two ports,
which (hopefully) acts as completely transparent "bump-on-the-wire"
bridge.
Useful in scenarios where you want to test what happens when the flow
of packets between two nodes is disrupted. E.g., for testing fail-over
behavior in dynamic routing protocols, L2 redundancy, VRRP etc.
Now that we're using the `passthru` mode of MACVLANs, it seems we can
rely on the parent interface's promiscuity going down to 0 as an
indication that the kernel has completed the removal of the interface,
and will accept the creation of a new one.
When used as a context manager, __exit__ will be called even though
__enter__ might throw an exception half way through. So there is no
guarantee that the instance is on the cleanup list when we get to
stop().
This mode let's us receive all packets from the parent device, which
is automatically set in promiscuous mode, and let's the MACVLAN
transmit packets with any SA, which we need to implement a TPMR (or a
bridge or anything else we might dream up)
This is needed to create namespaces with MACVLANs from different
parent interfaces. The first consumer will be a Two-Port Mac
Relay (TPMR), so that we can control the flow of packets between two
nodes.
Story time:
In the days of yore, we generated PCAPs using tcpdump, which will
flush any buffered packets to its output file on reception of
SIGUSR2. Therefore we sent a USR2 before terminating the capture.
At some point, we switched over to use tshark to capture packets for
us, but the SIGUSR2 sayed in place.
It turns out, tshark will just die on USR2, abandoning the dumpcap
child it has created, which means the enclosing network namespace
can't be properly torn down.
Therefore:
Remove skip sending USR2 and just send TERM directly.
Backport support for saving and restoring system time from a file on
systems with broken RTC that reset to the future.
With this support a system can be sure time only ever moves forward.
Fix#794
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The string variable handling in configuring Finit did not follow the
Buildroot best practises. This patch adds stripping quotes from all
string variables before adding them as configure arguments.
This fixes issue with, e.g., this sneaky bastard:
configure --with-rtc-date=""2024-10-12 12:34:56""
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Creating/Recreating the qcow2 image now logs to stdout, as does the check
using qemu-img, which looks funny in raw mode. So let's delay the start
of raw mode until just before starting qemu.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes an annoying problem with `make run` when set to boot with a
qcow2 disk image. By default the disk image was recreated every time
the qemu.sh script was called.
Also, add image check to enforce regen if broken.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The RTC in the CN913x series does not have any "valid" bit, and this
board (all revs) does not have any backup power connected, so it will
return garbage values after every vold boot.
It was therefore decided to disable the RTC completely and set system
time manually, or using an NTP client. This way any time skips would
only ever be forward, never backwards.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Make show interfaces container aware. This is done by looking though
all podman containers for interfaces and looking up there info from
network namespaces on the main system / hypervisor.
Interfaces controlled by containers are clearly marked in the "show
interfaces" output, with a single gray row. Telling the user that they
belong to one or more named containers. The user can then run "show
interface name NAME" on interfaces owned by containers, which provided
some additional info, such as mac address and stat counters.
The patch also add support for printing veth peers which are owned by
containers.
Lastly, the patch also adds test cases for this functionality.
Signed-off-by: Richard Alpe <richard@bit42.se>
Fixes issue with netopeer2-server failing to load its host certificate.
Follow-up to 8b75022 for the NanoPi R2S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for setting the free form description string as
the interface alias. This can be read from /sys/class/net/*/ifalias, or
using the 'ip link show' command. The ifalias is reported by SNMP and
LLDP by default, and now also in the operational datastore.
Linux supports 250 characters in ifalias, but the IF-MIB is restricted
to 64 characters, so we add a local deviation to limit the type.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new variable INFIX_COMPATIBLE, used for the RAUC compatible string,
is not properly evaluated on defconfigs where it is composed of another
variable, e.g.
INFIX_COMPATIBLE="${INFIX_IMAGE_ID}"
Unfortunately, this is the default value for INFIX_COMPATIBLE, and so it
breaks all tier one defconfigs on the mainline branch since a1771ff.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Introduce the term MAC bridge in the networking documentation
- List the limitation to one MAC bridge on Marvell Linkstree
- Adding lego pictures for the MAC bridge and VLAN bridge examples
[skip ci]
This will facilitate running infix tests from external projects:
- eliminate the need for an external topology.dot.in file
- eliminate the requirement to manually provide external image name
Fixes#763
SVG is a plain text file, better to see why it changed
than binary PNG. Also fix#744 by adding infix/OEM hash
to test specification
Signed-off-by: Mattias Walström <lazzer@gmail.com>
- add default-deny-all rule from 2341e07
- enable iburst for the ntp client (quicker initial sync)
- bump meta version (to skip .cfg migration at boot)
Fix#750 [skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sometimes the interface creation are done, but
the sysfs is not, this gap we sometimes finds
in the nameif script. Wait out the sysfs creation
if running a DSA switch.
Fix#685
Signed-off-by: Mattias Walström <lazzer@gmail.com>
For some documentation changes, e.g., the recent change in the QoS
documentation, see de76b97, it is highly relevant to also mention
this change in the release notes.
In fact, any change that would make it worthwhile for a user to
update their knowledge on a topic should probably be documented
in the release notes.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Full support for base board but not any extension board on the
GPIOs.
### Touch screen
The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
touch functionality. There are multiple touchscreens on the market for
Raspberry Pi, but only the official (first version with 800x480
resolution) is currently supported. Infix supplies all drivers
required to utilize the hardware, but you need to add the actual
graphical application in a container.
There are some important considerations you need to know about when
using Infix for graphical applications. The container needs access to
/dev/dri/ to be able to access the graphics card, and it also needs
access to /run/udev to be able to find the input devices.
Example of running Doom in Infix:
```cli
admin@example:/> configure
admin@example:/config/> edit container doom
admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
admin@example:/config/container/doom/> set privileged
admin@example:/config/container/doom/> edit mount udev
admin@example:/config/container/doom/mount/udev/> set type bind
admin@example:/config/container/doom/mount/udev/> set target /run/udev/
admin@example:/config/container/doom/mount/udev/> set source /run/udev/
admin@example:/config/container/doom/mount/udev/> end
admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
admin@example:/config/container/doom/mount/xorg.conf/> end
admin@example:/config/container/doom/> edit volume var
admin@example:/config/container/doom/volume/var/> set target /var
[out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
for name,ph in data.items():
[out["usb-ports"].extend([{
"name": name,
"path": dev.attrpath("authorized")}, {
"name": name,
"path": dev.attrpath("authorized_default")
}]) for dev in self.devices_from_ph(ph)]
def infix_devices(self, kind):
phs = self.__get_phandle_array(kind)
@@ -101,6 +114,7 @@ class DTSystem:
flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
return [self.into_vpd(device) for device in flat_devices]
class QEMUSystem:
BASE = "/sys/firmware/qemu_fw_cfg"
REV = BASE + "/rev"
@@ -110,7 +124,8 @@ class QEMUSystem:
data = {}
if os.path.exists(QEMUSystem.VPD):
try:
data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG. It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device. All while supporting advanced networking scenarios and running Docker containers."
@@ -44,10 +44,13 @@ C-x i insert C-x g goto-ln C-x o other win C-x C-x swap M-q reform
- tap `c`
- release `Ctrl`
----
> The status field at the bottom asks if you are really sure, and/or if
> you want to add a final Enter/newline to the file. For binary content
> that final newline may be important.
----
## Changing the Editor
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
