mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-26 02:33:02 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Joachim Wiberg
|
6f210174c2 |
@@ -33,4 +33,3 @@ Releases
|
||||
- Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
|
||||
- Ensure the markdown link for the release diff is updated
|
||||
- Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
|
||||
- Sync tags for all repo. sync activities
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
# Security Policy
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
If you discover a security vulnerability in Infix, please use GitHub's built-in
|
||||
[Report a Vulnerability](https://github.com/kernelkit/infix/security/advisories/new)
|
||||
feature for a private and secure disclosure.
|
||||
|
||||
When reporting, include:
|
||||
|
||||
- A clear description of the vulnerability.
|
||||
- Steps to reproduce the issue.
|
||||
- Potential impact of the vulnerability.
|
||||
|
||||
## Supported Versions
|
||||
|
||||
We provide security updates only for the main branch.
|
||||
|
||||
Individual support contracts are provided by _Wires_. See
|
||||
[Support](https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md)
|
||||
for more information.
|
||||
|
||||
## Acknowledgments
|
||||
|
||||
We appreciate the efforts of the security community to help improve the security
|
||||
of Infix. Thank you for your responsible disclosure.
|
||||
+3
-3
@@ -6,7 +6,7 @@ project on GitHub, and Discord, see <https://github.com/kernelkit>:
|
||||
|
||||
Support contracts, development of new features, fast-tracking of reviews
|
||||
and contributions, customer branding of Infix, and even customer specific
|
||||
features for dedicated products is provided by _Wires_.
|
||||
features for dedicated products is provided by Addiva Elektronik.
|
||||
|
||||
:globe_with_meridians: <https://www.wires.se>
|
||||
:e-mail: <mailto:infix@wires.se>
|
||||
:globe_with_meridians: <https://www.addiva.se/electronics/>
|
||||
:e-mail: <mailto:ael@addiva.se>
|
||||
|
||||
@@ -22,8 +22,6 @@ jobs:
|
||||
matrix:
|
||||
target: [aarch64, x86_64]
|
||||
fail-fast: false
|
||||
outputs:
|
||||
build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
|
||||
steps:
|
||||
- name: Cleanup Build Folder
|
||||
run: |
|
||||
@@ -35,22 +33,11 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
clean: true
|
||||
fetch-depth: 0
|
||||
submodules: recursive
|
||||
|
||||
- name: Set Build Variables
|
||||
id: vars
|
||||
run: |
|
||||
if [ -n "${{ github.event.pull_request.head.sha }}" ]; then
|
||||
# Since PRs are built from an internally generated merge
|
||||
# commit, reverse lookups of PRs and/or commits from
|
||||
# image version information are cumbersome. Therefore:
|
||||
# explicitly set a build id that references both the PR
|
||||
# and the commit.
|
||||
printf "INFIX_BUILD_ID=pr%d.%.7s\n" \
|
||||
"${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
|
||||
| tee -a $GITHUB_OUTPUT $GITHUB_ENV
|
||||
fi
|
||||
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
|
||||
if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
|
||||
flavor="_minimal"
|
||||
@@ -125,7 +112,7 @@ jobs:
|
||||
cd output/
|
||||
mv images ${{ steps.vars.outputs.dir }}
|
||||
ln -s ${{ steps.vars.outputs.dir }} images
|
||||
tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
|
||||
tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
|
||||
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
@@ -145,11 +132,6 @@ jobs:
|
||||
- name: Set Build Variables
|
||||
id: vars
|
||||
run: |
|
||||
if [ -n "${{ needs.build.outputs.build_id }}" ]; then
|
||||
echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
|
||||
>>$GITHUB_ENV
|
||||
fi
|
||||
|
||||
if [ "$GITHUB_REF_NAME" != "main" ]; then
|
||||
flavor="_minimal"
|
||||
else
|
||||
@@ -184,22 +166,6 @@ jobs:
|
||||
if: always()
|
||||
run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
- name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
|
||||
# Ensure this runs even if Regression Test fails
|
||||
if: always()
|
||||
run: |
|
||||
asciidoctor-pdf \
|
||||
--theme test/9pm/report/theme.yml \
|
||||
-a pdf-fontsdir=test/9pm/report/fonts \
|
||||
test/.log/last/report.adoc \
|
||||
-o test/.log/last/report.pdf
|
||||
|
||||
- name: Upload Test Report as Artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: test-report
|
||||
path: test/.log/last/report.pdf
|
||||
|
||||
release:
|
||||
if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
|
||||
name: Upload Latest Build
|
||||
|
||||
@@ -55,7 +55,7 @@ jobs:
|
||||
sudo apt-get -y update
|
||||
sudo apt-get -y install pkg-config libjansson-dev libev-dev \
|
||||
libcrypt-dev libglib2.0-dev libpcre2-dev \
|
||||
libuev-dev
|
||||
libuev-dev libite-dev
|
||||
|
||||
- name: Build dependencies
|
||||
run: |
|
||||
@@ -65,8 +65,6 @@ jobs:
|
||||
git clone https://github.com/sysrepo/sysrepo.git
|
||||
mkdir sysrepo/build
|
||||
(cd sysrepo/build && cmake .. && make all && sudo make install)
|
||||
git clone https://github.com/troglobit/libite.git
|
||||
(cd libite && ./autogen.sh && ./configure && make && sudo make install)
|
||||
make dep
|
||||
|
||||
- name: Check applications
|
||||
|
||||
@@ -85,28 +85,22 @@ jobs:
|
||||
cd output/
|
||||
mv images ${{ steps.vars.outputs.dir }}
|
||||
ln -s ${{ steps.vars.outputs.dir }} images
|
||||
tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
|
||||
tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
|
||||
|
||||
mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
|
||||
tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
|
||||
tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
|
||||
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: artifact-${{ matrix.target }}
|
||||
path: output/*.tar.gz
|
||||
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: artifact-disk-image-${{ matrix.target }}
|
||||
path: output/images/*.qcow2
|
||||
|
||||
release:
|
||||
name: Release Infix ${{ github.ref_name }}
|
||||
needs: build
|
||||
runs-on: [ self-hosted, release ]
|
||||
permissions:
|
||||
contents: write
|
||||
discussions: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
@@ -121,14 +115,12 @@ jobs:
|
||||
ver=${GITHUB_REF#refs/tags/}
|
||||
fi
|
||||
echo "ver=${ver}" >> $GITHUB_OUTPUT
|
||||
echo "cat=" >> $GITHUB_OUTPUT
|
||||
if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
|
||||
echo "pre=true" >> $GITHUB_OUTPUT
|
||||
echo "latest=false" >> $GITHUB_OUTPUT
|
||||
elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
|
||||
echo "pre=false" >> $GITHUB_OUTPUT
|
||||
echo "latest=true" >> $GITHUB_OUTPUT
|
||||
echo "cat=Releases" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "pre=false" >> $GITHUB_OUTPUT
|
||||
echo "latest=false" >> $GITHUB_OUTPUT
|
||||
@@ -146,11 +138,6 @@ jobs:
|
||||
for file in *.tar.gz; do
|
||||
sha256sum $file > $file.sha256
|
||||
done
|
||||
if ls *.qcow2 &>/dev/null; then
|
||||
for file in *.qcow2; do
|
||||
sha256sum "$file" > "$file.sha256"
|
||||
done
|
||||
fi
|
||||
|
||||
- name: Extract ChangeLog entry ...
|
||||
run: |
|
||||
@@ -163,9 +150,9 @@ jobs:
|
||||
name: Infix ${{ github.ref_name }}
|
||||
prerelease: ${{ steps.rel.outputs.pre }}
|
||||
makeLatest: ${{ steps.rel.outputs.latest }}
|
||||
discussionCategory: ${{ steps.rel.outputs.cat }}
|
||||
discussionCategory: Releases
|
||||
bodyFile: release.md
|
||||
artifacts: "*.tar.gz*,*.qcow2*"
|
||||
artifacts: "*.tar.gz*"
|
||||
|
||||
- name: Summary
|
||||
run: |
|
||||
|
||||
@@ -8,4 +8,3 @@
|
||||
/test/.venv
|
||||
/test/.log
|
||||
/local.mk
|
||||
/test/spec/Readme.adoc
|
||||
|
||||
@@ -27,13 +27,13 @@ it maintenance-free. Configuration and data, e.g, containers, is stored
|
||||
on separate partitions to ensure complete separation from system files
|
||||
and allow for seamless backup, restore, and provisioning.
|
||||
|
||||
In itself, Infix is perfectly suited for dedicated networking tasks, and
|
||||
with native support for Docker containers, the operating system provides
|
||||
a versatile platform that can easily be adapted to any customer need.
|
||||
Be it legacy applications, network protocols, process monitoring, or
|
||||
edge data analysis, it can run close to end equipment. Either directly
|
||||
connected on dedicated Ethernet ports or indirectly using virtual
|
||||
network cables to exist on the same LAN as other connected equipment.
|
||||
In itself Infix is perfectly suited for dedicated networking tasks and
|
||||
native support for Docker containers provides a versatile platform that
|
||||
can easily be adapted to any customer need. Be it legacy applications,
|
||||
network protocols, process monitoring, or edge data analysis, it can run
|
||||
close to end equipment. Either directly connected on dedicated Ethernet
|
||||
ports or indirectly using virtual network cables to exist on the same
|
||||
LAN as other connected equipment.
|
||||
|
||||
The simple design of Infix provides complete control over both system
|
||||
and data, minimal cognitive burden, and makes it incredibly easy to get
|
||||
@@ -106,16 +106,6 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
|
||||
>
|
||||
> For *customer specific builds* of Infix, see your product repository.
|
||||
|
||||
|
||||
----
|
||||
|
||||
<div align="center">
|
||||
<a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
|
||||
<br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
|
||||
</div>
|
||||
|
||||
----
|
||||
|
||||
[^1]: An immutable operating system is one with read-only file systems,
|
||||
atomic updates, rollbacks, declarative configuration, and workload
|
||||
isolation. All to improve reliability, scalability, and security.
|
||||
|
||||
@@ -128,9 +128,5 @@ SD-card partition.
|
||||
> If possible, serve `infix-aarch64.pkg` over HTTP instead, as
|
||||
> libcurl's TFTP implementation is quite slow.
|
||||
|
||||
## Console Port
|
||||
|
||||
The console port runs at 115200 baud, 8N1.
|
||||
|
||||
[release]: https://github.com/kernelkit/infix/releases
|
||||
[mvebu64boot]: https://github.com/addiva-elektronik/mvebu64boot
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
* Copyright (C) 2020 Marvell International Ltd.
|
||||
*/
|
||||
|
||||
#include "arm64/marvell/cn9130-crb.dtsi"
|
||||
#include "cn9130-crb.dtsi"
|
||||
|
||||
/ {
|
||||
model = "Marvell Armada CN9130-CRB-A";
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
#include <arm64/marvell/cn9130.dtsi>
|
||||
#include "cn9130.dtsi"
|
||||
|
||||
&cp0_syscon0 {
|
||||
cp0_pinctrl: pinctrl {
|
||||
+1
-1
@@ -5,7 +5,7 @@
|
||||
*/
|
||||
|
||||
/dts-v1/;
|
||||
#include <arm64/microchip/sparx5_pcb135_emmc.dts>
|
||||
#include "sparx5_pcb135_emmc.dts"
|
||||
|
||||
&cpu0 {
|
||||
enable-method = "spin-table";
|
||||
+4
-28
@@ -265,38 +265,14 @@
|
||||
};
|
||||
};
|
||||
|
||||
#define SWP_LED \
|
||||
#define SWP_LED(_func) \
|
||||
leds { \
|
||||
#address-cells = <1>; \
|
||||
#size-cells = <0>; \
|
||||
\
|
||||
led@0 { \
|
||||
reg = <0>; \
|
||||
function = "tp"; \
|
||||
color = <LED_COLOR_ID_GREEN>; \
|
||||
default-state = "keep"; \
|
||||
}; \
|
||||
led@1 { \
|
||||
reg = <1>; \
|
||||
function = "aux"; \
|
||||
color = <LED_COLOR_ID_GREEN>; \
|
||||
default-state = "off"; \
|
||||
}; \
|
||||
}
|
||||
|
||||
/* SFP LEDs
|
||||
* Rev A. LEDs do not work at all
|
||||
* Rev B. only outer-most (green) LEDs work
|
||||
*/
|
||||
|
||||
#define SFP_LED \
|
||||
leds { \
|
||||
#address-cells = <1>; \
|
||||
#size-cells = <0>; \
|
||||
\
|
||||
led@0 { \
|
||||
reg = <0>; \
|
||||
function = "sfp"; \
|
||||
function = _func; \
|
||||
color = <LED_COLOR_ID_GREEN>; \
|
||||
default-state = "keep"; \
|
||||
}; \
|
||||
@@ -311,7 +287,7 @@
|
||||
phy-mode = "10gbase-r"; \
|
||||
managed = "in-band-status"; \
|
||||
sfp = <_sfp>; \
|
||||
SFP_LED; \
|
||||
SWP_LED("sfp"); \
|
||||
}
|
||||
|
||||
#define XSWCPU(_n, _eth) \
|
||||
@@ -345,7 +321,7 @@
|
||||
nvmem-cell-names = "mac-address"; \
|
||||
phy-mode = "gmii"; \
|
||||
phy-handle = <_phy>; \
|
||||
SWP_LED; \
|
||||
SWP_LED("tp"); \
|
||||
}
|
||||
|
||||
#define GPHY(_n) \
|
||||
@@ -34,10 +34,6 @@ CONFIG_PROFILING=y
|
||||
CONFIG_ARCH_SPARX5=y
|
||||
CONFIG_ARCH_MVEBU=y
|
||||
CONFIG_ARCH_VEXPRESS=y
|
||||
CONFIG_ARM64_ERRATUM_2441007=y
|
||||
CONFIG_ARM64_ERRATUM_1286807=y
|
||||
CONFIG_ARM64_ERRATUM_1542419=y
|
||||
CONFIG_ARM64_ERRATUM_2441009=y
|
||||
CONFIG_ARM64_VA_BITS_48=y
|
||||
CONFIG_SCHED_MC=y
|
||||
CONFIG_NR_CPUS=64
|
||||
@@ -61,7 +57,6 @@ CONFIG_MODULE_UNLOAD=y
|
||||
CONFIG_KSM=y
|
||||
CONFIG_TRANSPARENT_HUGEPAGE=y
|
||||
CONFIG_CMA=y
|
||||
CONFIG_CMA_AREAS=7
|
||||
CONFIG_NET=y
|
||||
CONFIG_PACKET=y
|
||||
CONFIG_XDP_SOCKETS=y
|
||||
@@ -170,6 +165,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
|
||||
CONFIG_BRIDGE_EBT_SNAT=m
|
||||
CONFIG_BRIDGE_EBT_LOG=m
|
||||
CONFIG_BRIDGE_EBT_NFLOG=m
|
||||
CONFIG_BPFILTER=y
|
||||
CONFIG_BRIDGE=y
|
||||
CONFIG_BRIDGE_VLAN_FILTERING=y
|
||||
CONFIG_BRIDGE_MRP=y
|
||||
@@ -231,7 +227,6 @@ CONFIG_SCSI_SAS_ATA=y
|
||||
CONFIG_SCSI_VIRTIO=y
|
||||
CONFIG_ATA=y
|
||||
CONFIG_SATA_AHCI=y
|
||||
CONFIG_SATA_MOBILE_LPM_POLICY=0
|
||||
CONFIG_SATA_AHCI_PLATFORM=y
|
||||
CONFIG_AHCI_MVEBU=y
|
||||
CONFIG_PATA_OF_PLATFORM=y
|
||||
@@ -287,7 +282,6 @@ CONFIG_NET_DSA_MV88E6XXX_PTP=y
|
||||
CONFIG_MVNETA=m
|
||||
CONFIG_MVPP2=m
|
||||
# CONFIG_NET_VENDOR_MELLANOX is not set
|
||||
# CONFIG_NET_VENDOR_META is not set
|
||||
# CONFIG_NET_VENDOR_MICREL is not set
|
||||
CONFIG_SPARX5_SWITCH=y
|
||||
# CONFIG_NET_VENDOR_MICROSEMI is not set
|
||||
@@ -359,14 +353,13 @@ CONFIG_SERIAL_XILINX_PS_UART=y
|
||||
CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
|
||||
CONFIG_SERIAL_MVEBU_UART=y
|
||||
CONFIG_VIRTIO_CONSOLE=y
|
||||
CONFIG_HW_RANDOM_CN10K=m
|
||||
CONFIG_I2C=y
|
||||
CONFIG_I2C_CHARDEV=y
|
||||
CONFIG_I2C_MUX=y
|
||||
CONFIG_I2C_MUX_GPIO=y
|
||||
CONFIG_I2C_MUX_PCA954x=y
|
||||
CONFIG_I2C_MUX_PINCTRL=y
|
||||
CONFIG_I2C_DESIGNWARE_CORE=y
|
||||
CONFIG_I2C_DESIGNWARE_PLATFORM=y
|
||||
CONFIG_I2C_MV64XXX=y
|
||||
CONFIG_I2C_SLAVE=y
|
||||
CONFIG_SPI=y
|
||||
@@ -502,7 +495,6 @@ CONFIG_EXTCON_USB_GPIO=y
|
||||
CONFIG_IIO=y
|
||||
CONFIG_TI_ADC081C=y
|
||||
CONFIG_PWM=y
|
||||
CONFIG_RESET_GPIO=y
|
||||
CONFIG_PHY_MVEBU_CP110_COMPHY=y
|
||||
CONFIG_PHY_MVEBU_CP110_UTMI=y
|
||||
CONFIG_PHY_SAMSUNG_USB2=y
|
||||
@@ -531,13 +523,13 @@ CONFIG_9P_FS=y
|
||||
CONFIG_NLS_CODEPAGE_437=y
|
||||
CONFIG_NLS_ISO8859_1=y
|
||||
CONFIG_SECURITY=y
|
||||
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
|
||||
CONFIG_CRYPTO_CCM=m
|
||||
CONFIG_CRYPTO_ECHAINIV=y
|
||||
CONFIG_CRYPTO_ANSI_CPRNG=y
|
||||
CONFIG_CRYPTO_GHASH_ARM64_CE=y
|
||||
CONFIG_CRYPTO_SHA1_ARM64_CE=y
|
||||
CONFIG_CRYPTO_SHA2_ARM64_CE=y
|
||||
CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
|
||||
CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
|
||||
CONFIG_DMA_CMA=y
|
||||
CONFIG_CMA_SIZE_MBYTES=0
|
||||
|
||||
@@ -101,13 +101,6 @@ Worth noting, unlike many other boards, the Rockchip family of chipsets
|
||||
runs the UART at 1500000 bps (1.5 Mbps) 8N1.
|
||||
|
||||
|
||||
Console Port
|
||||
------------
|
||||
|
||||
Unlike many other boards, the NanoPi R2S console, and in fact all
|
||||
Rockchip family chipsets, runs at 1500000 bps (1.5 Mbps) 8N1.
|
||||
|
||||
|
||||
Secure Boot
|
||||
-----------
|
||||
|
||||
|
||||
@@ -230,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
|
||||
CONFIG_RFKILL=y
|
||||
CONFIG_NET_9P=y
|
||||
CONFIG_NET_9P_VIRTIO=y
|
||||
# CONFIG_ETHTOOL_NETLINK is not set
|
||||
CONFIG_PCI=y
|
||||
CONFIG_PCIEPORTBUS=y
|
||||
CONFIG_PCI_IOV=y
|
||||
@@ -480,6 +481,7 @@ CONFIG_I2C=y
|
||||
CONFIG_I2C_CHARDEV=y
|
||||
CONFIG_I2C_MUX=y
|
||||
CONFIG_I2C_MUX_PCA954x=y
|
||||
CONFIG_I2C_DESIGNWARE_PLATFORM=y
|
||||
CONFIG_I2C_GPIO=m
|
||||
CONFIG_I2C_RK3X=y
|
||||
CONFIG_I2C_SLAVE=y
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Automatically generated make config: don't edit
|
||||
# Busybox version: 1.36.1
|
||||
# Sun Feb 9 12:25:37 2025
|
||||
# Tue Oct 22 13:12:02 2024
|
||||
#
|
||||
CONFIG_HAVE_DOT_CONFIG=y
|
||||
|
||||
@@ -17,7 +17,7 @@ CONFIG_SHOW_USAGE=y
|
||||
CONFIG_FEATURE_VERBOSE_USAGE=y
|
||||
# CONFIG_FEATURE_COMPRESS_USAGE is not set
|
||||
CONFIG_LFS=y
|
||||
CONFIG_PAM=y
|
||||
# CONFIG_PAM is not set
|
||||
CONFIG_FEATURE_DEVPTS=y
|
||||
CONFIG_FEATURE_UTMP=y
|
||||
CONFIG_FEATURE_WTMP=y
|
||||
@@ -325,7 +325,7 @@ CONFIG_FEATURE_STAT_FILESYSTEM=y
|
||||
CONFIG_STTY=y
|
||||
CONFIG_SUM=y
|
||||
CONFIG_SYNC=y
|
||||
CONFIG_FEATURE_SYNC_FANCY=y
|
||||
# CONFIG_FEATURE_SYNC_FANCY is not set
|
||||
CONFIG_FSYNC=y
|
||||
# CONFIG_TAC is not set
|
||||
CONFIG_TAIL=y
|
||||
@@ -336,7 +336,7 @@ CONFIG_TEST=y
|
||||
CONFIG_TEST1=y
|
||||
CONFIG_TEST2=y
|
||||
CONFIG_FEATURE_TEST_64=y
|
||||
CONFIG_TIMEOUT=y
|
||||
# CONFIG_TIMEOUT is not set
|
||||
CONFIG_TOUCH=y
|
||||
CONFIG_FEATURE_TOUCH_SUSV3=y
|
||||
CONFIG_TR=y
|
||||
@@ -357,7 +357,7 @@ CONFIG_BASE32=y
|
||||
CONFIG_BASE64=y
|
||||
CONFIG_UUENCODE=y
|
||||
CONFIG_WC=y
|
||||
CONFIG_FEATURE_WC_LARGE=y
|
||||
# CONFIG_FEATURE_WC_LARGE is not set
|
||||
CONFIG_WHO=y
|
||||
CONFIG_W=y
|
||||
CONFIG_USERS=y
|
||||
|
||||
@@ -127,7 +127,7 @@ bootdata=
|
||||
diskimg=disk.img
|
||||
bootimg=
|
||||
bootpart=
|
||||
tmpimage=$(mktemp)
|
||||
|
||||
while getopts "a:b:B:n:s:" opt; do
|
||||
case ${opt} in
|
||||
a)
|
||||
@@ -166,7 +166,7 @@ awk \
|
||||
-vimgsize=$imgsize \
|
||||
-vcfgsize=$cfgsize \
|
||||
-vvarsize=$varsize \
|
||||
-vdiskimg=$tmpimage \
|
||||
-vdiskimg=$diskimg \
|
||||
-vbootimg="$bootimg" -vbootpart="$bootpart" \
|
||||
'{
|
||||
sub(/@TOTALSIZE@/, total);
|
||||
@@ -211,7 +211,5 @@ genimage \
|
||||
--rootpath "$root" \
|
||||
--tmppath "$tmp" \
|
||||
--inputpath "$BINARIES_DIR" \
|
||||
--outputpath "$BINARIES_DIR" \
|
||||
--config "$root/genimage.cfg"
|
||||
|
||||
qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
|
||||
rm "$tmpimage"
|
||||
|
||||
@@ -2,6 +2,8 @@
|
||||
|
||||
set -e
|
||||
|
||||
GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
|
||||
|
||||
name=$1
|
||||
compat=$2
|
||||
sign=$3
|
||||
@@ -24,7 +26,7 @@ cp -f "$BINARIES_DIR/rootfs.itbh" "$work/rootfs.itbh"
|
||||
cat >"$work/manifest.raucm" <<EOF
|
||||
[update]
|
||||
compatible=${compat}
|
||||
version=${INFIX_VERSION}
|
||||
version=${GIT_VERSION}
|
||||
|
||||
[bundle]
|
||||
format=verity
|
||||
|
||||
@@ -39,6 +39,22 @@ if [ -n "${ID_LIKE}" ]; then
|
||||
ID="${ID} ${ID_LIKE}"
|
||||
fi
|
||||
|
||||
if [ -z "$GIT_VERSION" ]; then
|
||||
infix_path="$BR2_EXTERNAL_INFIX_PATH"
|
||||
if [ -n "$INFIX_OEM_PATH" ]; then
|
||||
# Use version from br2-external OEM:ing Infix
|
||||
infix_path="$INFIX_OEM_PATH"
|
||||
fi
|
||||
GIT_VERSION=$(git -C "$infix_path" describe --always --dirty --tags)
|
||||
fi
|
||||
|
||||
# Override VERSION in /etc/os-release and filenames for release builds
|
||||
if [ -n "$INFIX_RELEASE" ]; then
|
||||
VERSION="$INFIX_RELEASE"
|
||||
else
|
||||
VERSION=$GIT_VERSION
|
||||
fi
|
||||
|
||||
if [ -n "$INFIX_IMAGE_ID" ]; then
|
||||
NAME="$INFIX_IMAGE_ID"
|
||||
else
|
||||
@@ -55,12 +71,12 @@ rm -f "$TARGET_DIR/etc/os-release"
|
||||
{
|
||||
echo "NAME=\"$INFIX_NAME\""
|
||||
echo "ID=$INFIX_ID"
|
||||
echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
|
||||
echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
|
||||
echo "ID_LIKE=\"${ID}\""
|
||||
echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
|
||||
echo "VERSION=\"${INFIX_VERSION}\""
|
||||
echo "VERSION_ID=${INFIX_VERSION}"
|
||||
echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
|
||||
echo "VERSION=\"${VERSION}\""
|
||||
echo "VERSION_ID=${VERSION}"
|
||||
echo "BUILD_ID=\"${GIT_VERSION}\""
|
||||
if [ -n "$INFIX_IMAGE_ID" ]; then
|
||||
echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
|
||||
fi
|
||||
@@ -86,7 +102,7 @@ rm -f "$TARGET_DIR/etc/os-release"
|
||||
fi
|
||||
} > "$TARGET_DIR/etc/os-release"
|
||||
|
||||
echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
|
||||
echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
|
||||
|
||||
# In case of ambguities, this is what the image was built from
|
||||
cp "$BR2_CONFIG" "$TARGET_DIR/usr/share/infix/config"
|
||||
|
||||
@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
|
||||
else
|
||||
NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
|
||||
fi
|
||||
diskimg=disk.qcow2
|
||||
diskimg=disk.img
|
||||
|
||||
ver()
|
||||
{
|
||||
@@ -48,7 +48,7 @@ fi
|
||||
load_cfg DISK_IMAGE
|
||||
if [ "$DISK_IMAGE" = "y" ]; then
|
||||
ixmsg "Creating Disk Image"
|
||||
diskimg="${NAME}-disk$(ver).qcow2"
|
||||
diskimg="${NAME}-disk$(ver).img"
|
||||
bootcfg=
|
||||
if [ "$DISK_IMAGE_BOOT_DATA" ]; then
|
||||
bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
|
||||
@@ -90,7 +90,7 @@ if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
|
||||
rel=$(ver)
|
||||
ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
|
||||
if [ -n "$rel" ]; then
|
||||
ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
|
||||
ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
@@ -66,7 +66,7 @@ endchoice
|
||||
|
||||
config QEMU_MACHINE
|
||||
string "Select emulated machine"
|
||||
default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max,pauth-impdef=on" if QEMU_aarch64
|
||||
default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
|
||||
default "qemu-system-x86_64 -M pc,accel=kvm:tcg -cpu max" if QEMU_x86_64
|
||||
help
|
||||
You should not have to change this setting, although you may
|
||||
@@ -189,7 +189,7 @@ config QEMU_CLOCK
|
||||
comment "Networking"
|
||||
|
||||
choice
|
||||
prompt "Network Mode"
|
||||
prompt "Mode"
|
||||
default QEMU_NET_USER
|
||||
|
||||
config QEMU_NET_NONE
|
||||
@@ -204,9 +204,6 @@ config QEMU_NET_USER
|
||||
config QEMU_NET_TAP
|
||||
bool "TAP"
|
||||
|
||||
config QEMU_NET_ROCKER
|
||||
bool "Rocker"
|
||||
|
||||
endchoice
|
||||
|
||||
config QEMU_NET_MODEL
|
||||
@@ -232,8 +229,3 @@ config QEMU_NET_TAP_N
|
||||
int "Number of TAPs"
|
||||
depends on QEMU_NET_TAP
|
||||
default 1
|
||||
|
||||
config QEMU_NET_PORTS
|
||||
int "Number of Rocker switch ports"
|
||||
depends on QEMU_NET_ROCKER
|
||||
default 10
|
||||
|
||||
+29
-67
@@ -17,10 +17,9 @@
|
||||
#
|
||||
# ./qemu.sh -h
|
||||
#
|
||||
# shellcheck disable=SC3037
|
||||
|
||||
# Local variables
|
||||
imgdir=$(readlink -f "$(dirname "$0")")
|
||||
imgdir=$(readlink -f $(dirname "$0"))
|
||||
prognm=$(basename "$0")
|
||||
|
||||
usage()
|
||||
@@ -31,7 +30,6 @@ usage()
|
||||
echo "Options:"
|
||||
echo " -c Run menuconfig to change Qemu settings"
|
||||
echo " -h This help text"
|
||||
echo " -k Keep generated qemu.run script (name shown at end)"
|
||||
echo
|
||||
echo "Arguments:"
|
||||
echo " ARGS1 Args before the '--' separator are for kernel space"
|
||||
@@ -56,20 +54,19 @@ die()
|
||||
|
||||
load_qemucfg()
|
||||
{
|
||||
tmp=$(mktemp -p /tmp)
|
||||
local tmp=$(mktemp -p /tmp)
|
||||
|
||||
grep ^CONFIG_QEMU_ "$1" >"$tmp"
|
||||
# shellcheck disable=SC1090
|
||||
. "$tmp"
|
||||
rm "$tmp"
|
||||
grep ^CONFIG_QEMU_ $1 >$tmp
|
||||
. $tmp
|
||||
rm $tmp
|
||||
|
||||
[ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
|
||||
[ "$CONFIG_QEMU_ROOTFS" ] || die "Missing QEMU_ROOTFS"
|
||||
|
||||
[ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
|
||||
[ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
|
||||
&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
|
||||
|
||||
[ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
|
||||
[ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
|
||||
&& die "QEMU_KERNEL or QEMU_BIOS must be set"
|
||||
}
|
||||
|
||||
@@ -96,7 +93,7 @@ append_args()
|
||||
|
||||
if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
|
||||
# Size of initrd, rounded up to nearest kb
|
||||
size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
|
||||
local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
|
||||
echo -n "root=/dev/ram0 ramdisk_size=${size} "
|
||||
elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
|
||||
echo -n "root=PARTLABEL=primary "
|
||||
@@ -120,7 +117,7 @@ rootfs_args()
|
||||
echo -n "-device sd-card,drive=mmc "
|
||||
echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
|
||||
elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
|
||||
echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
|
||||
echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -201,24 +198,13 @@ host_args()
|
||||
|
||||
net_dev_args()
|
||||
{
|
||||
name="e$1"
|
||||
mac=$(printf "02:00:00:00:00:%02x" "$1")
|
||||
local name="e$1"
|
||||
local mac=$(printf "02:00:00:00:00:%02x" $1)
|
||||
|
||||
echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
|
||||
echo "$name $mac" >>"$mactab"
|
||||
}
|
||||
|
||||
rocker_port_args()
|
||||
{
|
||||
sw=$1
|
||||
port=$2
|
||||
name="sw${sw}p${port}"
|
||||
mac=$(printf "02:00:00:00:%02x:%02x" "$sw" "$port")
|
||||
|
||||
echo -n "-netdev tap,id=$name,ifname=$name,script=no,downscript=no "
|
||||
echo "$name $mac" >> "$mactab"
|
||||
}
|
||||
|
||||
net_args()
|
||||
{
|
||||
# Infix will pick up this file via fwcfg and install it to /etc
|
||||
@@ -230,25 +216,14 @@ net_args()
|
||||
echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
|
||||
net_dev_args 1
|
||||
elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
|
||||
for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
|
||||
for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
|
||||
echo -n "-netdev tap,id=e$i,ifname=qtap$i "
|
||||
net_dev_args "$i"
|
||||
done
|
||||
elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
|
||||
sw=sw0 # Only single switch support atm.
|
||||
echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
|
||||
echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
|
||||
echo -n "\"ports\":["
|
||||
for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
|
||||
[ "$i" -gt 1 ] && echo -n ", "
|
||||
echo -n "\"${sw}p${i}\""
|
||||
done
|
||||
echo -n "]}' "
|
||||
for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
|
||||
rocker_port_args 0 "$i"
|
||||
net_dev_args $i
|
||||
done
|
||||
elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
|
||||
local useropts=
|
||||
[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
|
||||
|
||||
echo -n "-netdev user,id=e1${useropts} "
|
||||
net_dev_args 1
|
||||
else
|
||||
@@ -316,17 +291,18 @@ gdb_args()
|
||||
run_qemu()
|
||||
{
|
||||
if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
|
||||
if ! qemu-img check "qemu.qcow2"; then
|
||||
rm -f "qemu.qcow2"
|
||||
if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
|
||||
rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
|
||||
fi
|
||||
if [ ! -f "qemu.qcow2" ]; then
|
||||
if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
|
||||
echo "Creating qcow2 disk image for Qemu ..."
|
||||
qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
|
||||
-F qcow2 "qemu.qcow2" > /dev/null
|
||||
-F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
|
||||
fi
|
||||
fi
|
||||
|
||||
read -r qemu <<EOF
|
||||
local qemu
|
||||
read qemu <<EOF
|
||||
$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
|
||||
$(loader_args) \
|
||||
$(rootfs_args) \
|
||||
@@ -341,28 +317,18 @@ run_qemu()
|
||||
$(gdb_args) \
|
||||
$CONFIG_QEMU_EXTRA
|
||||
EOF
|
||||
# Save resulting command to a script, because I cannot for the life
|
||||
# of me figure out how to embed the JSON snippet for Rocker and run
|
||||
# it here without issues, spent way too much time on it -- Joachim
|
||||
run=$(mktemp -t run.qemu.XXX)
|
||||
echo "#!/bin/sh" > "$run"
|
||||
if [ "$CONFIG_QEMU_KERNEL" ]; then
|
||||
echo "$qemu -append \"$(append_args)\" $*" >> "$run"
|
||||
else
|
||||
echo "$qemu $*" >> "$run"
|
||||
fi
|
||||
chmod +x "$run"
|
||||
|
||||
echo "Starting Qemu :: Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
|
||||
line=$(stty -g)
|
||||
stty raw
|
||||
$run
|
||||
stty "$line"
|
||||
if [ -n "$keep" ]; then
|
||||
echo "Keeping generated qemu.run script: $run"
|
||||
|
||||
if [ "$CONFIG_QEMU_KERNEL" ]; then
|
||||
$qemu -append "$(append_args)" "$@"
|
||||
else
|
||||
rm "$run"
|
||||
$qemu "$@"
|
||||
fi
|
||||
|
||||
stty "$line"
|
||||
}
|
||||
|
||||
dtb_args()
|
||||
@@ -398,7 +364,7 @@ generate_dot()
|
||||
hostports="<qtap1> qtap1"
|
||||
targetports="<e1> e1"
|
||||
edges="host:qtap1 -- target:e1 [kind=mgmt];"
|
||||
for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
|
||||
for tap in $(seq 2 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
|
||||
hostports="$hostports | <qtap$tap> qtap$tap "
|
||||
targetports="$targetports | <e$tap> e$tap "
|
||||
edges="$edges host:qtap$tap -- target:e$tap;"
|
||||
@@ -438,8 +404,7 @@ menuconfig()
|
||||
exec kconfig-mconf Config.in
|
||||
}
|
||||
|
||||
scriptdir=$(dirname "$(readlink -f "$0")")
|
||||
cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
|
||||
cd $(dirname $(readlink -f "$0"))
|
||||
|
||||
while [ "$1" != "" ]; do
|
||||
case $1 in
|
||||
@@ -449,9 +414,6 @@ while [ "$1" != "" ]; do
|
||||
-h)
|
||||
usage
|
||||
;;
|
||||
-k)
|
||||
keep=true
|
||||
;;
|
||||
*)
|
||||
break
|
||||
esac
|
||||
|
||||
@@ -9,20 +9,46 @@
|
||||
# $3 IP adddress
|
||||
|
||||
PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
|
||||
NAME="/etc/frr/static.d/$2-zeroconf.conf"
|
||||
NEXT="${NAME}+"
|
||||
|
||||
log()
|
||||
{
|
||||
logger -I $$ -t zeroconf -p user.notice "$*"
|
||||
}
|
||||
|
||||
# Reduce changes needed by comparing with previous route(s)
|
||||
act()
|
||||
{
|
||||
case $1 in
|
||||
add)
|
||||
echo "! Generated by avahi-autoipd" > "$NEXT"
|
||||
echo "ip route 0.0.0.0/0 $2 254" >> "$NEXT"
|
||||
cmp -s "$NAME" "$NEXT" && return
|
||||
mv "$NEXT" "$NAME"
|
||||
;;
|
||||
del)
|
||||
[ -f "$NAME" ] || return
|
||||
rm "$NAME"
|
||||
;;
|
||||
*)
|
||||
return
|
||||
;;
|
||||
esac
|
||||
|
||||
initctl -nbq restart staticd
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
BIND)
|
||||
ip addr flush dev "$2" proto random
|
||||
ip addr add "$3"/16 brd 169.254.255.255 scope link dev "$2" proto random
|
||||
act add "$2"
|
||||
log "set ipv4ll $3 on iface $2"
|
||||
;;
|
||||
|
||||
CONFLICT|UNBIND|STOP)
|
||||
act del "$2"
|
||||
ip addr flush dev "$2" proto random
|
||||
log "clr ipv4ll on iface $2"
|
||||
;;
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
# --log-level debug
|
||||
OSPFD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf --log syslog"
|
||||
@@ -1 +0,0 @@
|
||||
RAUC_ARGS="-s"
|
||||
@@ -1,2 +0,0 @@
|
||||
# --log-level debug
|
||||
ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "
|
||||
@@ -3,19 +3,16 @@
|
||||
# and similar events feed servers and configuration to dnsmasq.
|
||||
domain-needed
|
||||
|
||||
# Allow configuration and cache clear over D-Bus
|
||||
enable-dbus
|
||||
# Only listen to loopback (local system)
|
||||
interface=lo
|
||||
bind-dynamic
|
||||
#listen-address=127.0.0.1,::1
|
||||
|
||||
# Disable the following dnsmasq default DHCP options
|
||||
#dhcp-option=option:netmask
|
||||
#dhcp-option=28 # option:broadcast
|
||||
#dhcp-option=option:domain-name
|
||||
dhcp-option=option:router
|
||||
dhcp-option=option:dns-server
|
||||
dhcp-option=12 # option:hostname
|
||||
enable-dbus
|
||||
|
||||
# Generated by openresolv
|
||||
resolv-file=/var/lib/misc/resolv.conf
|
||||
|
||||
# Include all files in a directory which end in .conf
|
||||
conf-dir=/etc/dnsmasq.d/,*.conf
|
||||
|
||||
|
||||
@@ -1,7 +1,4 @@
|
||||
# Start a container instance (%i) and redirect logs to /log/container
|
||||
# Give podman enough time to properly shut down the container. Every
|
||||
# time we start a container we run the setup stage, disable the Finit
|
||||
# timeout to allow the setup stage to run to completion.
|
||||
sysv log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
|
||||
pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container \
|
||||
[2345] <!> :%i container -n %i -- container %i
|
||||
service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
|
||||
[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
|
||||
sysv :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> log kill:10 \
|
||||
[2345] container -n %i -- container %i
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
# A single mstpd instance can manage multiple bridges, which are
|
||||
# dynamically added/removed by the kernel via the /sbin/bridge-stp
|
||||
# usermode helper. We use a manual service so that confd can
|
||||
# enable/disable it without an initctl barrier, since it needs to
|
||||
# already be running when a bridge interface with spanning tree
|
||||
# enabled is created.
|
||||
|
||||
service env:-/etc/default/mstpd manual:yes \
|
||||
[S0123456789] mstpd $MSTPD_ARGS -- Spanning Tree daemon
|
||||
@@ -1,4 +0,0 @@
|
||||
# Use <pid/syslogd> as barrier for other system tasks and service that
|
||||
# rely on modules, firmware, and device nodes to be ready.
|
||||
service if:udevd nowarn env:-/etc/default/sysklogd <run/udevadm:post/success> \
|
||||
[S0123456789] syslogd -F $SYSLOGD_ARGS -- System log daemon
|
||||
@@ -1 +1 @@
|
||||
service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)
|
||||
service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
../available/mstpd.conf
|
||||
@@ -1 +0,0 @@
|
||||
/var/lib/dbus/machine-id
|
||||
@@ -1 +1,2 @@
|
||||
alias cli='clish'
|
||||
alias cfg='sysrepocfg -f json'
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
HostKey /var/lib/ssh/ssh_host_rsa_key
|
||||
HostKey /var/lib/ssh/ssh_host_ecdsa_key
|
||||
HostKey /var/lib/ssh/ssh_host_ed25519_key
|
||||
@@ -0,0 +1,3 @@
|
||||
net.ipv4.ip_forward=1
|
||||
net.ipv4.ip_forward_update_priority=0
|
||||
net.ipv6.conf.all.forwarding=1
|
||||
@@ -1,32 +1 @@
|
||||
# Router defaults
|
||||
net.ipv4.conf.default.rp_filter=0
|
||||
net.ipv4.conf.all.rp_filter=0
|
||||
|
||||
net.ipv4.conf.lo.rp_filter=0
|
||||
|
||||
net.ipv4.icmp_errors_use_inbound_ifaddr=1
|
||||
net.ipv4.conf.all.ignore_routes_with_linkdown=1
|
||||
|
||||
# Use neigh information on selection of nexthop for multipath hops
|
||||
net.ipv4.fib_multipath_use_neigh=1
|
||||
|
||||
# Sane ARP defaults for a switch/router
|
||||
net.ipv4.conf.default.arp_announce=2
|
||||
net.ipv4.conf.all.arp_announce=2
|
||||
|
||||
net.ipv4.conf.default.arp_notify=1
|
||||
net.ipv4.conf.all.arp_notify=1
|
||||
|
||||
net.ipv4.conf.default.arp_ignore=1
|
||||
net.ipv4.conf.all.arp_ignore=1
|
||||
|
||||
# IP Routing
|
||||
net.ipv4.ip_forward=1
|
||||
net.ipv4.ip_forward_update_priority=0
|
||||
|
||||
net.ipv4.conf.all.forwarding=0
|
||||
net.ipv4.conf.default.forwarding=0
|
||||
|
||||
# Multicast group subscriptions
|
||||
net.ipv4.igmp_max_memberships=1000
|
||||
net.ipv4.neigh.default.mcast_solicit=10
|
||||
|
||||
@@ -1,23 +1,5 @@
|
||||
# Router defaults
|
||||
net.ipv6.route.max_size=131072
|
||||
net.ipv6.conf.all.ignore_routes_with_linkdown=1
|
||||
|
||||
# IP Routing is disabled by default, enabled globally, and per
|
||||
# interface, for each interface in confd. See also accept_ra.
|
||||
net.ipv6.conf.all.forwarding=0
|
||||
net.ipv6.conf.all.forwarding=1
|
||||
net.ipv6.conf.default.forwarding=0
|
||||
|
||||
# Accept router advertisements even when forwarding is enabled
|
||||
net.ipv6.conf.all.accept_ra=2
|
||||
net.ipv6.conf.default.accept_ra=2
|
||||
|
||||
# IPv6 SLAAC
|
||||
net.ipv6.conf.all.autoconf=0
|
||||
net.ipv6.conf.default.autoconf=0
|
||||
|
||||
# Keep permanent addresses on an admin down
|
||||
net.ipv6.conf.all.keep_addr_on_down=1
|
||||
net.ipv6.conf.default.keep_addr_on_down=1
|
||||
|
||||
# Multicast group subscriptions
|
||||
net.ipv6.mld_max_msf=512
|
||||
|
||||
@@ -1,145 +0,0 @@
|
||||
Many of the defaults here are are taken from the Frr recommendations [1].
|
||||
Below are relevant excerpts from the kernel documentation.
|
||||
|
||||
|
||||
accept_ra, accept Router Advertisements; autoconfigure using them, also
|
||||
determines whether or not to transmit Router Solicitations.
|
||||
If and only if the functional setting is to accept Router
|
||||
Advertisements, Router Solicitations will be transmitted.
|
||||
|
||||
0 - Do not accept Router Advertisements.
|
||||
|
||||
1 - Accept Router Advertisements if forwarding is disabled.
|
||||
|
||||
2 - Overrule forwarding behaviour. Accept Router Advertisements even
|
||||
if forwarding is enabled.
|
||||
|
||||
Default:
|
||||
- enabled if local forwarding is disabled
|
||||
- disabled if local forwarding is enabled
|
||||
|
||||
|
||||
accept_ra_pinfo, learn Prefix Information in Router Advertisement.
|
||||
|
||||
Default:
|
||||
- enabled if accept_ra is enabled
|
||||
- disabled if accept_ra is disabled
|
||||
|
||||
|
||||
autoconf, autoconfigure IPv6 addresses using Prefix Information in
|
||||
Router Advertisements.
|
||||
|
||||
Default:
|
||||
- enabled if accept_ra_pinfo is enabled
|
||||
- disabled if accept_ra_pinfo is disabled
|
||||
|
||||
|
||||
arp_announce, define restriction level for announcing the local source
|
||||
address from IP packets in ARP requests sent on interface:
|
||||
|
||||
0 - (default) Use any local address, configured on any interface
|
||||
|
||||
1 - Try to avoid local addresses that are not in the target’s subnet
|
||||
for this interface. Useful when target hosts reachable via this
|
||||
interface require the source IP address in ARP requests to be part
|
||||
of their logical network configured on the receiving interface.
|
||||
When we generate the request we will check all our subnets that
|
||||
include the target IP and will preserve the source address if it
|
||||
is from such subnet. If there is no such subnet we select source
|
||||
address according to the rules for level 2.
|
||||
|
||||
2 - Always use the best local address for this target. In this mode we
|
||||
ignore the source address in the IP packet and try to select local
|
||||
address that we prefer for talks with the target host. Such local
|
||||
address is selected by looking for primary IP addresses on all our
|
||||
subnets on the outgoing interface that include the target address.
|
||||
If no suitable local address is found we select the first local
|
||||
address we have on the outgoing interface or on all other
|
||||
interfaces, with the hope we will receive reply for our request
|
||||
and even sometimes no matter the source IP address we announce.
|
||||
|
||||
|
||||
arp_notify, define mode for notification of address and device changes.
|
||||
|
||||
0 - (default): do nothing
|
||||
1 - generate gratuitous arp requests when device is brought up or
|
||||
hardware address changes.
|
||||
|
||||
|
||||
arp_ignore, define different modes for sending replies in response to
|
||||
received ARP requests that resolve local target addresses:
|
||||
|
||||
0 - (default): reply for any local target IP address, configured on
|
||||
any interface
|
||||
|
||||
1 - reply only if the target IP address is a local address configured
|
||||
on the incoming interface
|
||||
|
||||
2 - reply only if the target IP address is local address configured on
|
||||
the incoming interface and both with the sender’s IP address are part
|
||||
from same subnet on this interface
|
||||
|
||||
3 - do not reply for local addresses configured with scope host, only
|
||||
resolutions for global and link addresses are replied
|
||||
|
||||
4-7 - reserved
|
||||
|
||||
8 - do not reply for all local addresses
|
||||
|
||||
|
||||
arp_accept, define behavior for accepting gratuitous ARP (garp) frames
|
||||
from devices that are not already present in the ARP table:
|
||||
|
||||
0 - don’t create new entries in the ARP table
|
||||
|
||||
1 - create new entries in the ARP table
|
||||
|
||||
2 - create new entries only if the source IP address is in the same
|
||||
subnet as an address configured on the interface that received
|
||||
the garp message.
|
||||
|
||||
Both replies and requests type gratuitous arp will trigger the ARP
|
||||
table to be updated, if this setting is on. If the ARP table already
|
||||
contains the IP address of the gratuitous arp frame, the arp table
|
||||
will be updated regardless if this setting is on or off.
|
||||
|
||||
|
||||
icmp_errors_use_inbound_ifaddr
|
||||
|
||||
0 - (default): icmp error messages are sent with the primary address
|
||||
of the exiting interface.
|
||||
|
||||
1 - the message will be sent with the primary address of the interface
|
||||
that received the packet that caused the icmp error. This is the
|
||||
behaviour many network administrators will expect from a router.
|
||||
And it can make debugging complicated network layouts much easier.
|
||||
|
||||
Note, if no primary address exists for the interface selected, then
|
||||
the primary address of the first non-loopback interface that has one
|
||||
will be used regardless of this setting.
|
||||
|
||||
|
||||
rp_filter, reverse path source filtering:
|
||||
|
||||
0 - (default): no source validation.
|
||||
|
||||
1 - Strict mode as defined in RFC3704, 'Strict Reverse Path'. Each
|
||||
incoming packet is tested against the FIB and if the interface is
|
||||
not the best reverse path the packet check will fail. By default
|
||||
failed packets are discarded.
|
||||
|
||||
2 - Loose mode as defined in RFC3704, 'Loose Reverse Path'. Each
|
||||
incoming packet’s source address is also tested against the FIB
|
||||
and if the source address is not reachable via any interface the
|
||||
packet check will fail.
|
||||
|
||||
Current recommended practice in RFC3704 is to enable strict mode to
|
||||
prevent IP spoofing from DDos attacks. If using asymmetric routing or
|
||||
other complicated routing, then loose mode is recommended.
|
||||
|
||||
The max value from conf/{all,interface}/rp_filter is used when doing
|
||||
source validation on the {interface}.
|
||||
|
||||
|
||||
|
||||
[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/bin/sh
|
||||
# User-friendly wrapper for sysrepocfg
|
||||
# TODO: add import/export, copy, ...
|
||||
|
||||
# Edit YANG binary types using sysrepo, base64, and duct tape.
|
||||
edit()
|
||||
{
|
||||
xpath=$1
|
||||
if [ -z "$xpath" ]; then
|
||||
echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if tmp=$(sysrepocfg -G "$xpath"); then
|
||||
file=$(mktemp)
|
||||
|
||||
echo "$tmp" | base64 -d > "$file"
|
||||
if /usr/bin/editor "$file"; then
|
||||
tmp=$(base64 -w0 < "$file")
|
||||
sysrepocfg -S "$xpath" -u "$tmp"
|
||||
fi
|
||||
|
||||
rm -f "$file"
|
||||
else
|
||||
echo "Failed to retrieve value for $xpath"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage:"
|
||||
echo " cfg CMD [ARG]"
|
||||
echo
|
||||
echo "Command:"
|
||||
echo " edit XPATH Edit YANG binary type"
|
||||
echo " help This help text"
|
||||
echo
|
||||
echo "As a backwards compatible fallback, this script forwards"
|
||||
echo "all other commands as options to sysrepocfg."
|
||||
echo
|
||||
|
||||
exit 0
|
||||
}
|
||||
|
||||
cmd=$1; shift
|
||||
case $cmd in
|
||||
edit)
|
||||
edit "$1"
|
||||
;;
|
||||
help)
|
||||
usage
|
||||
;;
|
||||
*)
|
||||
set -- "$cmd" "$@"
|
||||
exec sysrepocfg -f json "$@"
|
||||
;;
|
||||
esac
|
||||
@@ -21,11 +21,7 @@ dir()
|
||||
if [ -d "$1" ]; then
|
||||
dir "$1"
|
||||
else
|
||||
if [ "$USER" = "root" ]; then
|
||||
dir "$HOME"
|
||||
else
|
||||
dir "/home/$USER"
|
||||
fi
|
||||
dir "$HOME"
|
||||
dir "/cfg"
|
||||
dir "/log"
|
||||
fi
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# -d ;; suppress error message "the terminal is dumb"
|
||||
# -F :: exit if the entire file can be displayed on the first screen
|
||||
# -I :: Ignore case, even for patterns
|
||||
# -K :: exit immediately when an interrupt character (usually ^C) is typed
|
||||
# -R :: Almost raw control charachters, only ANSI color escape sequences and
|
||||
# OSC 8 hyperlink sequences are output. Allows veritcal scrolling
|
||||
# -X :: No termcap initialization and deinitialization set to the terminal.
|
||||
# This is what leaves the contents of the output on screen.
|
||||
|
||||
export LESS="-P %f (press h for help or q to quit)"
|
||||
export LANG=en_US.UTF-8
|
||||
|
||||
less -RIKd -FX "$@"
|
||||
+1
@@ -0,0 +1 @@
|
||||
less
|
||||
Regular → Executable
-49
@@ -70,14 +70,12 @@ options:
|
||||
-p Show plain output, no bells or whistles
|
||||
|
||||
commands:
|
||||
dhcp Show DHCP server
|
||||
port PORT Show port configuration and link information
|
||||
ports Show ports available for bridging
|
||||
vlans Show port groups in bridge
|
||||
ifaces Show interfaces and their addresses
|
||||
fdb Show forwarding database (unicast)
|
||||
mdb Show multicast forwarding database
|
||||
stp Show spanning tree status
|
||||
ip addr Show IPv4 addresses
|
||||
route Show routing table
|
||||
ipv6 addr Show IPv6 addresses
|
||||
@@ -89,41 +87,6 @@ commands:
|
||||
EOF
|
||||
}
|
||||
|
||||
is_dhcp_running()
|
||||
{
|
||||
sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
|
||||
."infix-dhcp-server:dhcp-server".enabled as $global |
|
||||
if ."infix-dhcp-server:dhcp-server".subnet? then
|
||||
(."infix-dhcp-server:dhcp-server".subnet[] |
|
||||
select(.enabled != false)) |
|
||||
if $global != false and . then "true" else "false" end
|
||||
else "false" end
|
||||
' 2>/dev/null | grep -q true
|
||||
}
|
||||
|
||||
dhcp()
|
||||
{
|
||||
if ! is_dhcp_running; then
|
||||
echo "DHCP server not enabled."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
case $1 in
|
||||
detail)
|
||||
sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
|
||||
jq -C .
|
||||
;;
|
||||
stat*)
|
||||
sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
|
||||
/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
|
||||
;;
|
||||
*)
|
||||
sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
|
||||
/usr/libexec/statd/cli-pretty "show-dhcp-server"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Usage 1: show port eth0
|
||||
# Usage 2: show port
|
||||
# Usage 3: show ports
|
||||
@@ -225,12 +188,6 @@ rstp()
|
||||
mstpctl showport br0
|
||||
}
|
||||
|
||||
stp()
|
||||
{
|
||||
sysrepocfg -f json -X -d operational -m ietf-interfaces | \
|
||||
/usr/libexec/statd/cli-pretty "show-bridge-stp"
|
||||
}
|
||||
|
||||
fdb()
|
||||
{
|
||||
bridge $bopt fdb show
|
||||
@@ -331,9 +288,6 @@ case $cmd in
|
||||
help)
|
||||
usage
|
||||
;;
|
||||
dhcp | dhcp-server)
|
||||
dhcp $*
|
||||
;;
|
||||
port*)
|
||||
ports $*
|
||||
;;
|
||||
@@ -399,9 +353,6 @@ case $cmd in
|
||||
span*)
|
||||
rstp
|
||||
;;
|
||||
stp*)
|
||||
stp
|
||||
;;
|
||||
sys*)
|
||||
system
|
||||
;;
|
||||
@@ -1,9 +0,0 @@
|
||||
# Extend finit's default udevadm settle synchronization for situations
|
||||
# where device are very slow to probe (see #685)
|
||||
run nowarn if:udevd cgroup.init <service/udevd/ready> log \
|
||||
[S] /usr/libexec/infix/hw-wait -- Probing hardware
|
||||
|
||||
# Now that everything should be probed, do a final pass over the
|
||||
# uevent queue before starting syslogd and everything else
|
||||
run nowarn if:udevd cgroup.init :post <service/udevd/ready> log \
|
||||
[S] udevadm settle -t 30 --
|
||||
@@ -1,6 +0,0 @@
|
||||
d /run/containers/args 0700 - -
|
||||
d /run/containers/files 0700 - -
|
||||
d /var/lib/containers 0700 - -
|
||||
d /var/lib/containers/oci 0700 - -
|
||||
d /run/cni 0755 - -
|
||||
L+ /var/lib/cni - - - - /run/cni
|
||||
@@ -1,2 +1 @@
|
||||
d /var/run/frr 0755 frr frr -
|
||||
R /var/tmp/frr - - - -
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
if [ $# -lt 2 ]; then
|
||||
echo "usage: $0 <quirk-name> <ifname>"
|
||||
exit 1
|
||||
fi
|
||||
quirk=$1
|
||||
ifname=$2
|
||||
if [ -f "/etc/product/interface-quirks.json" ]; then
|
||||
echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
|
||||
else
|
||||
echo "false"
|
||||
fi
|
||||
@@ -1,41 +0,0 @@
|
||||
#!/bin/sh
|
||||
# (Ab)use the kernel's device link subsystem to detect consumer side
|
||||
# devices that may be very slow to probe (looking at you, mv88e6xxx!).
|
||||
|
||||
ident=$(basename "$0")
|
||||
|
||||
report()
|
||||
{
|
||||
if [ -r "/tmp/$ident" ]; then
|
||||
logger -k -p "user.$1" -t "$ident" "Waited for slow devices:"
|
||||
sort "/tmp/$ident" | uniq -c | logger -k -p "user.$1" -t "$ident"
|
||||
fi
|
||||
|
||||
rm -f "/tmp/$ident"
|
||||
}
|
||||
|
||||
for _ in $(seq 50); do
|
||||
again=
|
||||
|
||||
for dl in /sys/class/devlink/*; do
|
||||
[ -r "$dl/status" ] || continue
|
||||
|
||||
status=$(cat "$dl/status")
|
||||
if [ "$status" = "consumer probing" ]; then
|
||||
basename "$(readlink "$dl/consumer")" >>"/tmp/$ident"
|
||||
again=yes
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
if [ -z "$again" ]; then
|
||||
report notice
|
||||
exit 0
|
||||
fi
|
||||
|
||||
sleep .2
|
||||
done
|
||||
|
||||
logger -k -p user.error -t "$ident" "Timeout waiting for devices to come online"
|
||||
report error
|
||||
exit 1
|
||||
@@ -8,11 +8,10 @@ import struct
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
|
||||
SYSTEM_JSON = "/run/system.json"
|
||||
onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
|
||||
SYSTEM_JSON = "/run/system.json"
|
||||
KKIT_IANA_PEM = 61046
|
||||
|
||||
|
||||
class DTSystem:
|
||||
BASE = "/sys/firmware/devicetree/base"
|
||||
INFIX = BASE + "/chosen/infix"
|
||||
@@ -29,9 +28,7 @@ class DTSystem:
|
||||
if not os.path.exists(phandle):
|
||||
continue
|
||||
|
||||
with open(phandle, "rb") as f:
|
||||
data = f.read()
|
||||
ph, = struct.unpack(">L", data)
|
||||
ph, = struct.unpack(">L", open(phandle, "rb").read())
|
||||
dt[ph] = root
|
||||
|
||||
sys = {}
|
||||
@@ -43,18 +40,14 @@ class DTSystem:
|
||||
if not os.path.exists(phandle):
|
||||
continue
|
||||
|
||||
with open(phandle, "rb") as f:
|
||||
data = f.read()
|
||||
ph, = struct.unpack(">L", data)
|
||||
ph, = struct.unpack(">L", open(phandle, "rb").read())
|
||||
if ph not in sys:
|
||||
sys[ph] = []
|
||||
sys[ph].append(root)
|
||||
|
||||
phs = set(list(dt.keys()) + list(sys.keys()))
|
||||
|
||||
self.devs = {ph: [Device(ph, dt.get(ph), s if s is not None else "")
|
||||
for s in (sys.get(ph) or []) if ph is not None]
|
||||
for ph in phs}
|
||||
self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None] for ph in phs }
|
||||
self.base = Device(0, None, DTSystem.BASE)
|
||||
self.infix = Device(0, None, DTSystem.INFIX)
|
||||
|
||||
@@ -63,8 +56,7 @@ class DTSystem:
|
||||
if not os.path.exists(path):
|
||||
return ()
|
||||
|
||||
with open(path, "rb") as f:
|
||||
data = f.read()
|
||||
data = open(path, "rb").read()
|
||||
elems = len(data) // struct.calcsize(">L")
|
||||
return struct.unpack(">" + elems * "L", data)
|
||||
|
||||
@@ -77,8 +69,7 @@ class DTSystem:
|
||||
return {}
|
||||
|
||||
try:
|
||||
with open(dev.attrpath("nvmem"), "rb", 0) as f:
|
||||
data = onieprom.from_tlv(f)
|
||||
data = onieprom.from_tlv(open(dev.attrpath("nvmem"), "rb", 0))
|
||||
except:
|
||||
data = {}
|
||||
|
||||
@@ -93,18 +84,14 @@ class DTSystem:
|
||||
}
|
||||
|
||||
def infix_usb_devices(self, out):
|
||||
names = self.infix.str_array("usb-port-names", ())
|
||||
phs = self.__get_phandle_array("usb-ports")
|
||||
data = dict(zip(names, phs))
|
||||
names=self.infix.str_array("usb-port-names", ())
|
||||
phs=self.__get_phandle_array("usb-ports")
|
||||
data=dict(zip(names,phs))
|
||||
if data != {}:
|
||||
out["usb-ports"] = []
|
||||
for name, ph in data.items():
|
||||
[out["usb-ports"].extend([{
|
||||
"name": name,
|
||||
"path": dev.attrpath("authorized")}, {
|
||||
"name": name,
|
||||
"path": dev.attrpath("authorized_default")
|
||||
}]) for dev in self.devices_from_ph(ph)]
|
||||
for name,ph in data.items():
|
||||
[out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
|
||||
|
||||
|
||||
def infix_devices(self, kind):
|
||||
phs = self.__get_phandle_array(kind)
|
||||
@@ -114,7 +101,6 @@ class DTSystem:
|
||||
flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
|
||||
return [self.into_vpd(device) for device in flat_devices]
|
||||
|
||||
|
||||
class QEMUSystem:
|
||||
BASE = "/sys/firmware/qemu_fw_cfg"
|
||||
REV = BASE + "/rev"
|
||||
@@ -124,8 +110,7 @@ class QEMUSystem:
|
||||
data = {}
|
||||
if os.path.exists(QEMUSystem.VPD):
|
||||
try:
|
||||
with open(QEMUSystem.VPD, "rb", 0) as f:
|
||||
data = onieprom.from_tlv(f)
|
||||
data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
|
||||
except:
|
||||
pass
|
||||
|
||||
@@ -142,27 +127,31 @@ class QEMUSystem:
|
||||
def usb_ports(self):
|
||||
ports = [
|
||||
{
|
||||
"name": "USB",
|
||||
"path": "/sys/bus/usb/devices/usb1/authorized"
|
||||
}, {
|
||||
"name": "USB",
|
||||
"path": "/sys/bus/usb/devices/usb1/authorized_default"
|
||||
}, {
|
||||
"name": "USB2",
|
||||
"path": "/sys/bus/usb/devices/usb2/authorized"
|
||||
}, {
|
||||
"name": "USB2",
|
||||
"path": "/sys/bus/usb/devices/usb2/authorized_default"
|
||||
}]
|
||||
"name": "USB",
|
||||
"path": "/sys/bus/usb/devices/usb1/authorized"
|
||||
|
||||
},
|
||||
{
|
||||
"name": "USB",
|
||||
"path": "/sys/bus/usb/devices/usb1/authorized_default"
|
||||
|
||||
},
|
||||
{
|
||||
"name": "USB2",
|
||||
"path": "/sys/bus/usb/devices/usb2/authorized"
|
||||
},
|
||||
{
|
||||
"name": "USB2",
|
||||
"path": "/sys/bus/usb/devices/usb2/authorized_default"
|
||||
|
||||
}]
|
||||
return ports
|
||||
|
||||
|
||||
class Device:
|
||||
def __init__(self, ph, dtpath, syspath):
|
||||
self.ph, self.dtpath, self.syspath = ph, dtpath, syspath
|
||||
|
||||
def available(self):
|
||||
return self.syspath is not None
|
||||
return self.syspath != None
|
||||
|
||||
def __getitem__(self, attr):
|
||||
return self.attr(attr).decode("utf-8").strip("\0")
|
||||
@@ -170,6 +159,7 @@ class Device:
|
||||
def __setitem__(self, attr, value):
|
||||
return self.attr(attr, val=value.encode("utf-8"))
|
||||
|
||||
|
||||
def attrpath(self, attr):
|
||||
return os.path.join(self.syspath, attr)
|
||||
|
||||
@@ -178,16 +168,13 @@ class Device:
|
||||
|
||||
def attr(self, attr, default=None, val=None):
|
||||
if not self.hasattr(attr):
|
||||
return default if val is None else False
|
||||
return default if val == None else False
|
||||
|
||||
if val:
|
||||
with open(self.attrpath(attr), "wb") as f:
|
||||
f.write(val)
|
||||
open(self.attrpath(attr), "wb").write(value)
|
||||
return True
|
||||
|
||||
with open(self.attrpath(attr), "rb") as f:
|
||||
data = f.read()
|
||||
return data
|
||||
return open(self.attrpath(attr), "rb").read()
|
||||
|
||||
def str(self, attr, default=None):
|
||||
val = self.attr(attr)
|
||||
@@ -207,9 +194,7 @@ class Device:
|
||||
if not self.hasdtattr(attr):
|
||||
return default
|
||||
|
||||
with open(self.dtattrpath(attr), "rb") as f:
|
||||
data = f.read()
|
||||
return data
|
||||
return open(self.dtattrpath(attr), "rb").read()
|
||||
|
||||
def dtstr(self, attr, default=None):
|
||||
val = self.dtattr(attr)
|
||||
@@ -227,7 +212,6 @@ def vpd_get_json_ve(vpd, pem):
|
||||
|
||||
return out
|
||||
|
||||
|
||||
def vpd_get_pwhash(vpd):
|
||||
if not vpd.get("trusted"):
|
||||
return None
|
||||
@@ -235,9 +219,8 @@ def vpd_get_pwhash(vpd):
|
||||
kkit = vpd_get_json_ve(vpd, KKIT_IANA_PEM)
|
||||
return kkit.get("pwhash")
|
||||
|
||||
|
||||
def vpd_inject(out, vpds):
|
||||
out["vpd"] = {vpd["board"]: vpd for vpd in vpds}
|
||||
out["vpd"] = { vpd["board"]: vpd for vpd in vpds }
|
||||
|
||||
product = out["vpd"].get("product", {}).get("data", {})
|
||||
hoistattrs = ("vendor", "product-name", "part-number", "serial-number", "mac-address")
|
||||
@@ -251,7 +234,6 @@ def vpd_inject(out, vpds):
|
||||
out["factory-password-hash"] = pwhash
|
||||
break
|
||||
|
||||
|
||||
def qemu_base_mac():
|
||||
"""Find MAC address of first non-loopback interface, subtract with 1"""
|
||||
base_path = '/sys/class/net'
|
||||
@@ -262,8 +244,7 @@ def qemu_base_mac():
|
||||
continue
|
||||
try:
|
||||
# pylint: disable=invalid-name
|
||||
fn = os.path.join(base_path, iface, 'address')
|
||||
with open(fn, 'r', encoding='ascii') as f:
|
||||
with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
|
||||
mac = f.read().strip()
|
||||
interfaces.append((mac, iface))
|
||||
except FileNotFoundError:
|
||||
@@ -280,7 +261,6 @@ def qemu_base_mac():
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def probe_qemusystem(out):
|
||||
"""Probe Qemu based test systems and 'make run'"""
|
||||
admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
|
||||
@@ -308,7 +288,6 @@ def probe_qemusystem(out):
|
||||
subprocess.run("initctl -nbq cond set qemu".split(), check=False)
|
||||
return 0
|
||||
|
||||
|
||||
def probe_dtsystem(out):
|
||||
"""Probe DTS based system, expects a VPD in ONIE PROM format."""
|
||||
dtsys = DTSystem()
|
||||
@@ -318,8 +297,6 @@ def probe_dtsystem(out):
|
||||
if model:
|
||||
out["product-name"] = model
|
||||
|
||||
out["compatible"] = dtsys.base.str_array("compatible")
|
||||
|
||||
staticpw = dtsys.infix.str("factory-password-hash")
|
||||
if not out["factory-password-hash"]:
|
||||
out["factory-password-hash"] = staticpw
|
||||
@@ -327,7 +304,6 @@ def probe_dtsystem(out):
|
||||
vpd_inject(out, vpds)
|
||||
return 0
|
||||
|
||||
|
||||
def main():
|
||||
out = {
|
||||
"vendor": None,
|
||||
@@ -362,6 +338,5 @@ def main():
|
||||
shutil.chown(SYSTEM_JSON, user="root", group="wheel")
|
||||
return err
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
|
||||
@@ -1,50 +1,22 @@
|
||||
#!/bin/sh
|
||||
# Find, install, and run product specific files and script in /etc
|
||||
# before resuming bootstrap.
|
||||
#
|
||||
# Use /etc/product/init.d/S01-myscript for scripts, may be a symlink, it
|
||||
# will be called with `start` as its only argument.
|
||||
#
|
||||
# The compatible array is listed in the same order as the device tree,
|
||||
# most significant to least. Hence the reverse.[], to ensure overrides
|
||||
# are applied in order of significance.
|
||||
# Find and install any product specific files in /etc before bootstrap
|
||||
ident=$(basename "$0")
|
||||
|
||||
PRODUCT_INIT=/etc/product/init.d
|
||||
PREFIXD=/usr/share/product
|
||||
COMPATIBLES=$(jq -r '.compatible | reverse.[] | ascii_downcase' /run/system.json)
|
||||
PRODUCT=$(jq -r '."product-name" | ascii_downcase' /run/system.json)
|
||||
|
||||
note()
|
||||
{
|
||||
logger -I $$ -k -p user.notice -t "$ident" "$1"
|
||||
}
|
||||
|
||||
found=false
|
||||
for PRODUCT in $COMPATIBLES; do
|
||||
DIR="$PREFIXD/$PRODUCT"
|
||||
if [ -d "$DIR" ]; then
|
||||
note "Using vendor/product-specific defaults for $PRODUCT."
|
||||
for dir in "$DIR"/*; do
|
||||
[ -d "$dir" ] && cp -a "$dir" /
|
||||
done
|
||||
found=true
|
||||
fi
|
||||
DIR="$PREFIXD/$PRODUCT"
|
||||
if [ -z "$PRODUCT" ] || [ ! -d "$DIR" ]; then
|
||||
note "No vendor/product specific directory found, using built-in defaults."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
note "Using vendor/product specific defaults."
|
||||
for dir in "$DIR"/*; do
|
||||
[ -d "$dir" ] && cp -a "$dir" /
|
||||
done
|
||||
|
||||
if [ "$found" = false ]; then
|
||||
note "No vendor/product-specific directory found, using built-in defaults."
|
||||
fi
|
||||
|
||||
# Conditions for bootstrap services, this enables product specific
|
||||
# init scripts to prevent select services from starting.
|
||||
initctl -nbq cond set led
|
||||
|
||||
if [ -d "$PRODUCT_INIT" ]; then
|
||||
note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
|
||||
/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
|
||||
fi
|
||||
|
||||
# Product specific init done.
|
||||
initctl -nbq cond set product
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -14,6 +14,24 @@ for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
|
||||
fi
|
||||
done
|
||||
|
||||
# Sometimes the sysfs is not populated when the switch driver is loaded, with the result
|
||||
# that the DSA interface was not found (no /dsa/tagging entry in sysfs. See issue #685.
|
||||
#
|
||||
# This mitigates that problem by waiting for sysfs to come up if a DSA switch is found
|
||||
if [ -n "$(devlink -j dev info | jq -r '.info.[].driver' | grep -q mv88e6085)" ]; then
|
||||
timeout=50
|
||||
while [ -z "$(ls /sys/class/net/*/dsa/tagging)" ]; do
|
||||
timeout=$((timeout-1))
|
||||
if [ $timeout -eq 0 ]; then
|
||||
logger -k -p user.emerg -t "$ident" "Failed to find DSA interface"
|
||||
exit 1
|
||||
fi
|
||||
sleep 0.1
|
||||
done
|
||||
|
||||
logger -k -p user.notice -t "$ident" "Found DSA interface in $timeout seconds"
|
||||
fi
|
||||
|
||||
# Find CPU interfaces used for connecting to a switch managed by DSA
|
||||
for netif in /sys/class/net/*; do
|
||||
iface=$(basename "$netif")
|
||||
|
||||
@@ -43,15 +43,10 @@ while [ "$1" ]; do
|
||||
txqs="$2"
|
||||
shift 2
|
||||
|
||||
[ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
|
||||
[ $txqs -lt 2 ] && continue
|
||||
[ $txqs -gt 8 ] && txqs=8
|
||||
|
||||
output=$(tc qdisc add dev $iface root mqprio hw 1 \
|
||||
num_tc $txqs $(map $txqs) $(queues $txqs) 2>&1) || true
|
||||
if echo "$output" | grep -q "does not support hardware offload"; then
|
||||
echo "Skipping $iface, hardware offload not supported."
|
||||
elif [ -n "$output" ]; then
|
||||
echo "$output"
|
||||
fi
|
||||
tc qdisc add dev $iface root mqprio hw 1 \
|
||||
num_tc $txqs $(map $txqs) $(queues $txqs) || true
|
||||
done
|
||||
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Initialize speed/duplex of virtio interfaces
|
||||
# For virtual test systems (lacp tests)
|
||||
|
||||
ifaces=$(ip -d -json link show | jq -r '.[] | select(.parentbus == "virtio") | .ifname')
|
||||
for iface in $ifaces; do
|
||||
ethtool -s "$iface" speed 1000 duplex full
|
||||
done
|
||||
@@ -4,14 +4,10 @@
|
||||
# the migrate tool inserts old version in name before .cfg extension.
|
||||
CONFIG_FILE="/cfg/startup-config.cfg"
|
||||
BACKUP_FILE="/cfg/backup/startup-config.cfg"
|
||||
BACKUP_DIR="$(dirname "$BACKUP_FILE")"
|
||||
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
chown root:wheel "$BACKUP_DIR"
|
||||
chmod 0770 "$BACKUP_DIR"
|
||||
mkdir -p "$(dirname "$BACKUP_FILE")"
|
||||
|
||||
if [ ! -f "$CONFIG_FILE" ]; then
|
||||
logger -I $$ -k -p user.notice -t $(basename "$0") "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
|
||||
note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
|
||||
exit 0
|
||||
elif migrate -cq "$CONFIG_FILE"; then
|
||||
exit 0
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
#!/bin/sh
|
||||
exec initctl -bq cond set ixinit
|
||||
exec initctl -bq cond set ixinit-done
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Store and convert RSA PUBLIC/PRIVATE KEYs to be able to use them in
|
||||
# OpenSSHd.
|
||||
set -e
|
||||
|
||||
NAME="$1"
|
||||
DIR="$2"
|
||||
PUBLIC="$3"
|
||||
PRIVATE="$4"
|
||||
TMP="$(mktemp)"
|
||||
|
||||
echo -e '-----BEGIN RSA PRIVATE KEY-----' > "$DIR/$NAME"
|
||||
echo "$PRIVATE" >> "$DIR/$NAME"
|
||||
echo -e '-----END RSA PRIVATE KEY-----' >> "$DIR/$NAME"
|
||||
|
||||
echo -e "-----BEGIN RSA PUBLIC KEY-----" > "$TMP"
|
||||
echo -e "$PUBLIC" >> "$TMP"
|
||||
echo -e "-----END RSA PUBLIC KEY-----" >> "$TMP"
|
||||
|
||||
ssh-keygen -i -m PKCS8 -f "$TMP" > "$DIR/$NAME.pub"
|
||||
chmod 0600 "$DIR/$NAME.pub"
|
||||
chmod 0600 "$DIR/$NAME"
|
||||
chown sshd:sshd "$DIR/$NAME.pub"
|
||||
chown sshd:sshd "$DIR/$NAME"
|
||||
@@ -45,6 +45,11 @@ factory_reset()
|
||||
find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
|
||||
logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
|
||||
|
||||
# Shred all files to prevent restoring contents
|
||||
find /mnt/cfg -type f -exec shred -zu {} \;
|
||||
find /mnt/var -type f -exec shred -zu {} \;
|
||||
|
||||
# Remove any lingering directories and symlinks as well
|
||||
rm -rf /mnt/cfg/* /mnt/var/*
|
||||
|
||||
logger $opt -p user.crit -t "$nm" "Factory reset complete."
|
||||
|
||||
@@ -1,19 +1,5 @@
|
||||
#!/bin/bash
|
||||
# This script can be used to start, stop, create, and delete containers.
|
||||
# It is what confd use, with the Finit container@.conf template, to set
|
||||
# up, run, and delete containers.
|
||||
#
|
||||
# NOTE: when creating/deleting containers, remember 'initctl reload' to
|
||||
# activate the changes! In confd this is already handled.
|
||||
#
|
||||
DOWNLOADS=/var/lib/containers/oci
|
||||
BUILTIN=/lib/oci
|
||||
TMPDIR=/var/tmp
|
||||
container=$0
|
||||
checksum=""
|
||||
extracted=
|
||||
timeout=30
|
||||
dir=""
|
||||
#!/bin/sh
|
||||
|
||||
all=""
|
||||
env=""
|
||||
port=""
|
||||
@@ -24,192 +10,80 @@ log()
|
||||
logger -I $PPID -t container -p local1.notice -- "$*"
|
||||
}
|
||||
|
||||
err()
|
||||
{
|
||||
rc=$1; shift
|
||||
logger -I $PPID -t container -p local1.err -- "Error: $*"
|
||||
|
||||
if [ -n "$extracted" ]; then
|
||||
if [ -d "$TMPDIR/$dir" ]; then
|
||||
log "Cleaning up extracted $dir"
|
||||
rm -rf "$dir"
|
||||
fi
|
||||
fi
|
||||
|
||||
[ "$rc" -eq 0 ] || exit "$rc"
|
||||
}
|
||||
|
||||
pidfn()
|
||||
{
|
||||
echo "/run/containers/${1}.pid"
|
||||
}
|
||||
|
||||
check()
|
||||
{
|
||||
file=$1
|
||||
|
||||
if [ -z "$checksum" ]; then
|
||||
log "no checksum to verify $file against, continuing."
|
||||
return 0
|
||||
fi
|
||||
|
||||
if echo "${checksum} ${file}" | "$cmdsum" -c -s; then
|
||||
log "$file checksum verified OK."
|
||||
return 0
|
||||
fi
|
||||
|
||||
got=$("$cmdsum" "${file}" | awk '{print $1}')
|
||||
log "$file checksum mismatch, got $got, expected $checksum, removing file."
|
||||
rm -f "$file"
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
# Fetch an OCI image over ftp/http/https. Use wget for FTP, which curl
|
||||
# empirically does not work well with. Log progress+ & error to syslog.
|
||||
fetch()
|
||||
{
|
||||
url=$1
|
||||
file=$(basename "$url")
|
||||
dst="$DOWNLOADS/$file"
|
||||
|
||||
cd "$DOWNLOADS" || return
|
||||
if [ -e "$file" ]; then
|
||||
log "$file already available."
|
||||
if check "$file"; then
|
||||
echo "$dst"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
log "Fetching $url"
|
||||
|
||||
if echo "$url" | grep -qE "^ftp://"; then
|
||||
cmd="wget -q $url"
|
||||
elif echo "$url" | grep -qE "^https?://"; then
|
||||
cmd="curl $creds -sSL --fail -o \"$file\" $url"
|
||||
else
|
||||
log "Unsupported URL scheme: $url"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if out=$(eval "$cmd" 2>&1); then
|
||||
log "$file downloaded successfully."
|
||||
if check "$file"; then
|
||||
echo "$dst"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# log error message from backend
|
||||
while IFS= read -r line; do
|
||||
log "$line"
|
||||
done <<EOF
|
||||
$out
|
||||
EOF
|
||||
return 1
|
||||
}
|
||||
|
||||
# Unpacks a given oci-archive.tar[.gz] in the current directory. Sanity
|
||||
# checks, at least one index.json in the top-level dir of the archive.
|
||||
# If there are more index files, this function does not handle them.
|
||||
unpack_archive()
|
||||
{
|
||||
uri=$1
|
||||
tag=$2
|
||||
img=$(basename "$uri")
|
||||
image=$1
|
||||
name=$2
|
||||
|
||||
# Supported transports for load and create
|
||||
case "$uri" in
|
||||
case "$image" in
|
||||
oci:*) # Unpacked OCI image
|
||||
file=${uri#oci:}
|
||||
file=${image#oci:}
|
||||
;;
|
||||
oci-archive:*) # Packed OCI image, .tar or .tar.gz format
|
||||
file=${uri#oci-archive:}
|
||||
file=${image#oci-archive:}
|
||||
;;
|
||||
ftp://* | http://* | https://*)
|
||||
if ! file=$(fetch "$uri"); then
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
*) # docker://*, docker-archive:*, or URL
|
||||
if podman image exists "$img"; then
|
||||
echo "$img"
|
||||
return 0
|
||||
fi
|
||||
# XXX: use --retry=0 with Podman 5.0 or later.
|
||||
if ! id=$(podman pull --quiet "$uri"); then
|
||||
log "Failed pulling $uri"
|
||||
return 1
|
||||
fi
|
||||
# Echo image tag to caller
|
||||
podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
|
||||
echo "$image"
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ ! -e "$file" ]; then
|
||||
if [ -e "$DOWNLOADS/$file" ]; then
|
||||
file="$DOWNLOADS/$file"
|
||||
elif [ -e "$BUILTIN/$file" ]; then
|
||||
file="$BUILTIN/$file"
|
||||
if [ -e "/var/lib/containers/oci/$file" ]; then
|
||||
file="/var/lib/containers/oci/$file"
|
||||
elif [ -e "/lib/oci/$file" ]; then
|
||||
file="/lib/oci/$file"
|
||||
else
|
||||
err 1 "cannot find OCI archive $file in URI $uri"
|
||||
log "Error: cannot find OCI archive $file in search path."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -d "$file" ]; then
|
||||
index=$(find "$file" -name index.json)
|
||||
if [ -z "$index" ]; then
|
||||
err 1 "cannot find index.json in OCI image $file"
|
||||
log "Error: cannot find index.json in OCI image $file"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
cd "$TMPDIR" || err 0 "failed cd $TMPDIR, wiill use $(pwd) for OCI archive extraction."
|
||||
|
||||
index=$(tar tf "$file" |grep index.json)
|
||||
if [ -z "$index" ]; then
|
||||
err 1 "invalid OCI archive, cannot find index.json in $file"
|
||||
log "Error: invalid OCI archive, cannot find index.json in $file"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
|
||||
tar xf "$file" || err 1 "failed unpacking $file in $(pwd)"
|
||||
extracted=true
|
||||
tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
|
||||
remove=true
|
||||
fi
|
||||
|
||||
dir=$(dirname "$index")
|
||||
if echo "$dir" | grep -q ":"; then
|
||||
if [ -z "$tag" ]; then
|
||||
tag="$dir"
|
||||
fi
|
||||
sanitized_dir=$(echo "$dir" | cut -d':' -f1)
|
||||
mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
|
||||
dir="$sanitized_dir"
|
||||
fi
|
||||
|
||||
[ -n "$quiet" ] || log "Loading OCI image $dir ..."
|
||||
podman load -qi "$dir" >/dev/null
|
||||
|
||||
# Clean up after ourselves
|
||||
if [ -n "$extracted" ]; then
|
||||
log "Cleaning up extracted $dir"
|
||||
rm -rf "$dir"
|
||||
fi
|
||||
|
||||
# Retag image from podman default $dir:latest
|
||||
if [ -n "$tag" ]; then
|
||||
podman tag "$dir" "$tag" >/dev/null
|
||||
podman rmi "$dir" >/dev/null
|
||||
# Rename image from podman default $dir:latest
|
||||
if [ -n "$name" ]; then
|
||||
podman tag "$dir" "$name" >/dev/null
|
||||
podman rmi "$dir" >/dev/null
|
||||
else
|
||||
tag=$dir
|
||||
name=$dir
|
||||
fi
|
||||
|
||||
echo "$tag"
|
||||
if [ "$remove" = "true" ]; then
|
||||
rm -rf "$file"
|
||||
fi
|
||||
|
||||
echo "$name"
|
||||
}
|
||||
|
||||
running()
|
||||
{
|
||||
status=$(podman inspect -f '{{.State.Status}}' "$1" 2>/dev/null)
|
||||
[ "$status" = "running" ] && return 0
|
||||
run=$(podman inspect "$1" 2>/dev/null |jq .[].State.Running)
|
||||
[ "$run" = "true" ] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
@@ -228,19 +102,16 @@ create()
|
||||
|
||||
# Unpack and load docker-archive/oci/oci-archive, returning image
|
||||
# name, or return docker:// URL for download.
|
||||
if ! image=$(unpack_archive "$image"); then
|
||||
exit 1
|
||||
fi
|
||||
image=$(unpack_archive "$image")
|
||||
|
||||
if [ -z "$logging" ]; then
|
||||
logging="--log-driver syslog"
|
||||
logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
|
||||
fi
|
||||
|
||||
# When we get here we've already fetched, or pulled, the image
|
||||
args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
|
||||
args="$args --replace --quiet --cgroup-parent=containers $caps"
|
||||
args="$args --restart=$restart --systemd=false --tz=local $privileged"
|
||||
args="$args $vol $mount $hostname $entrypoint $env $port $logging"
|
||||
pidfile=/run/container:${name}.pid
|
||||
args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
|
||||
pidfn=/run/container:${name}.pid
|
||||
|
||||
[ -n "$quiet" ] || log "---------------------------------------"
|
||||
[ -n "$quiet" ] || log "Got name: $name image: $image"
|
||||
@@ -263,22 +134,22 @@ create()
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2048
|
||||
log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
|
||||
if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
|
||||
[ -n "$quiet" ] || log "Successfully created container $name from $image"
|
||||
log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
|
||||
if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
|
||||
[ -n "$quiet" ] || log "Successfully created container $name from $image"
|
||||
rm -f "/run/containers/env/${name}.env"
|
||||
[ -n "$manual" ] || start "$name"
|
||||
|
||||
# Should already be enabled by confd (this is for manual use)
|
||||
initctl -bnq enable "container@${name}.conf"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
err 1 "failed creating container $name, please check the configuration."
|
||||
log "Error: failed creating container $name, please check the configuration."
|
||||
exit 1
|
||||
}
|
||||
|
||||
delete()
|
||||
{
|
||||
name=$1
|
||||
image=$2
|
||||
|
||||
if [ -z "$name" ]; then
|
||||
echo "Usage:"
|
||||
@@ -286,30 +157,18 @@ delete()
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Should already be stopped, but if not ...
|
||||
log "$name: should already be stopped, double checking ..."
|
||||
container stop "$name" >/dev/null
|
||||
|
||||
while running "$name"; do
|
||||
log "$name: still running, waiting for it to stop ..."
|
||||
_=$((timeout -= 1))
|
||||
if [ $timeout -le 0 ]; then
|
||||
err 1 "timed out waiting for container $1 to stop before deleting it."
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
log "$name: calling podman rm -vif ..."
|
||||
podman rm -vif "$name" >/dev/null 2>&1
|
||||
[ -n "$quiet" ] || log "Container $name has been removed."
|
||||
}
|
||||
|
||||
waitfor()
|
||||
{
|
||||
timeout=$2
|
||||
while [ ! -f "$1" ]; do
|
||||
_=$((timeout -= 1))
|
||||
if [ $timeout -le 0 ]; then
|
||||
err 1 "timed out waiting for $1, aborting!"
|
||||
log "Timeout waiting for $1, aborting!"
|
||||
exit 1
|
||||
fi
|
||||
sleep 1;
|
||||
done
|
||||
@@ -324,7 +183,7 @@ start()
|
||||
return
|
||||
fi
|
||||
|
||||
initctl start container:$name
|
||||
initctl -bq cond set "container:$name"
|
||||
# Real work is done by wrap() courtesy of finit sysv emulation
|
||||
}
|
||||
|
||||
@@ -337,7 +196,7 @@ stop()
|
||||
return
|
||||
fi
|
||||
|
||||
initctl stop container:$name
|
||||
initctl -bq cond clr "container:$name"
|
||||
# Real work is done by wrap() courtesy of finit sysv emulation
|
||||
}
|
||||
|
||||
@@ -345,27 +204,8 @@ wrap()
|
||||
{
|
||||
name=$1
|
||||
cmd=$2
|
||||
pidfile=$(pidfn "$name")
|
||||
|
||||
# Containers have three phases: setup, running, and teardown.
|
||||
|
||||
# The setup phase may run forever in the background trying to fetch
|
||||
# the image. It saves its PID in /run/containers/${name}.pid
|
||||
if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
|
||||
pid=$(cat "$pidfile")
|
||||
|
||||
# Check if setup is still running ...
|
||||
if kill -0 "$pid" 2>/dev/null; then
|
||||
kill "$pid"
|
||||
wait "$pid" 2>/dev/null
|
||||
fi
|
||||
|
||||
rm -f "$pidfile"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Skip "echo $name" from podman start in log
|
||||
podman "$cmd" "$name" >/dev/null
|
||||
podman "$cmd" "$name"
|
||||
}
|
||||
|
||||
# Removes network $1 from all containers
|
||||
@@ -396,19 +236,6 @@ netrestart()
|
||||
done
|
||||
}
|
||||
|
||||
cleanup()
|
||||
{
|
||||
pidfile=$(pidfn "$name")
|
||||
|
||||
log "Received signal, exiting."
|
||||
if [ -n "$name" ] && [ -f "$pidfile" ]; then
|
||||
log "$name: in setup phase, removing $pidfile ..."
|
||||
rm -f "$pidfile"
|
||||
fi
|
||||
|
||||
exit 1
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
cat <<EOF
|
||||
@@ -421,7 +248,6 @@ options:
|
||||
--dns-search LIST Set host lookup search list when creating container
|
||||
--cap-add CAP Add capability to unprivileged container
|
||||
--cap-drop CAP Drop capability, for privileged containter
|
||||
--checksum TYPE:SUM Use md5/sha256/sha512 to verify ftp/http/https archives
|
||||
-c, --creds USR[:PWD] Credentials to pass to curl -u for remote ops
|
||||
-d, --detach Detach a container started with 'run IMG [CMD]'
|
||||
-e, --env FILE Environment variables when creating container
|
||||
@@ -441,15 +267,14 @@ options:
|
||||
Syntax: [[ip:][hostPort]:]containerPort[/protocol]
|
||||
-q, --quiet Quiet operation, called from confd
|
||||
-r, --restart POLICY One of "no", "always", or "on-failure:NUM"
|
||||
--read-only Do not create a writable layer
|
||||
-s, --simple Show output in simplified format
|
||||
-t, --timeout SEC Set timeout for delete/restart commands, default: 20
|
||||
-v, --volume NAME:PATH Create named volume mounted inside container on PATH
|
||||
|
||||
commands:
|
||||
create NAME IMAGE NET Create container NAME using IMAGE with networks NET
|
||||
delete [network] NAME Remove container NAME or network NAME from all containers
|
||||
exec NAME CMD Run a command inside a container
|
||||
flush Clean up lingering containers and associated anonymous volumes
|
||||
find [ifname PID] Find PID of container where '--net IFNAME' currently lives
|
||||
or, find the name of our IFNAME inside the container @PID
|
||||
help Show this help text
|
||||
@@ -460,13 +285,11 @@ commands:
|
||||
restart [network] NAME Restart a (crashed) container or container(s) using network
|
||||
run NAME [CMD] Run a container interactively, with an optional command
|
||||
save IMAGE FILE Save a container image to an OCI tarball FILE[.tar.gz]
|
||||
setup NAME Create and set up container as a Finit task
|
||||
shell [CMD] Start a shell, or run CMD, inside a container
|
||||
shell Start a shell inside a container
|
||||
show [image | volume] Show containers, images, or volumes
|
||||
stat Show continuous stats about containers (Ctrl-C aborts)
|
||||
start [NAME] Start a container, see -n
|
||||
stop [NAME] Stop a container, see -n
|
||||
upgrade NAME Upgrade a running container (stop, pull, restart)
|
||||
volume [prune] Prune unused volumes
|
||||
EOF
|
||||
}
|
||||
@@ -484,25 +307,6 @@ while [ "$1" != "" ]; do
|
||||
shift
|
||||
caps="$caps --cap-drop=$1"
|
||||
;;
|
||||
--checksum)
|
||||
shift
|
||||
type="${1%%:*}"
|
||||
checksum="${1#*:}"
|
||||
case "$type" in
|
||||
md5)
|
||||
cmdsum=md5sum
|
||||
;;
|
||||
sha256)
|
||||
cmdsum=sha256sum
|
||||
;;
|
||||
sha512)
|
||||
cmdsum=sha512sum
|
||||
;;
|
||||
*)
|
||||
err 1 "Unsupported checksum type: $type"
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
-c | --creds)
|
||||
shift
|
||||
creds="-u $1"
|
||||
@@ -547,6 +351,7 @@ while [ "$1" != "" ]; do
|
||||
--log-path)
|
||||
shift
|
||||
logging="$logging --log-opt path=$1"
|
||||
log_path="$1"
|
||||
;;
|
||||
-m | --mount)
|
||||
shift
|
||||
@@ -581,13 +386,12 @@ while [ "$1" != "" ]; do
|
||||
shift
|
||||
restart=$1
|
||||
;;
|
||||
--read-only)
|
||||
ro="--read-only=true"
|
||||
;;
|
||||
-s | --simple)
|
||||
simple=true
|
||||
;;
|
||||
-t | --timeout)
|
||||
shift
|
||||
timeout=$1
|
||||
;;
|
||||
-v | --volume)
|
||||
shift
|
||||
vol="$vol -v $1"
|
||||
@@ -604,8 +408,6 @@ if [ -n "$cmd" ]; then
|
||||
shift
|
||||
fi
|
||||
|
||||
trap cleanup INT HUP TERM
|
||||
|
||||
case $cmd in
|
||||
# Does not work atm., cannot attach to TTY because
|
||||
# we monitor 'podman start -ai foo' with Finit.
|
||||
@@ -618,24 +420,15 @@ case $cmd in
|
||||
;;
|
||||
delete)
|
||||
cmd=$1
|
||||
[ -n "$name" ] || name=$2
|
||||
name=$2
|
||||
if [ "$cmd" = "network" ] && [ -n "$name" ]; then
|
||||
netwrm "$name"
|
||||
else
|
||||
[ -n "$name" ] || name=$1
|
||||
delete "$name"
|
||||
delete "$@"
|
||||
fi
|
||||
;;
|
||||
exec)
|
||||
if [ -z "$name" ]; then
|
||||
name="$1"
|
||||
shift
|
||||
fi
|
||||
podman exec -i "$name" "$@"
|
||||
;;
|
||||
flush)
|
||||
echo "Cleaning up any lingering containers";
|
||||
podman rm -av $force
|
||||
podman exec -it "$@"
|
||||
;;
|
||||
find)
|
||||
cmd=$1
|
||||
@@ -662,12 +455,25 @@ case $cmd in
|
||||
usage
|
||||
;;
|
||||
load)
|
||||
url=$1
|
||||
name=$2
|
||||
# shellcheck disable=SC2086
|
||||
name=$(unpack_archive "$1" $2)
|
||||
[ -n "$name" ] || exit 1
|
||||
if echo "$url" | grep -q "://"; then
|
||||
file=$(basename "$url")
|
||||
curl -k $creds -Lo "$file" "$url"
|
||||
else
|
||||
file="$url"
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2086
|
||||
name=$(unpack_archive "$file" $name)
|
||||
|
||||
# Show resulting image(s) matching $name
|
||||
podman images -n "$name"
|
||||
if [ -n "$name" ]; then
|
||||
podman images -n "$name"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
locate) # Find where the host's ifname lives
|
||||
if [ -z "$network" ]; then
|
||||
@@ -694,7 +500,7 @@ case $cmd in
|
||||
podman images $all --format "{{.Repository}}:{{.Tag}}"
|
||||
;;
|
||||
oci)
|
||||
find $BUILTIN $DOWNLOADS -type f 2>/dev/null
|
||||
find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
|
||||
;;
|
||||
*)
|
||||
podman ps $all --format "{{.Names}}"
|
||||
@@ -736,38 +542,8 @@ case $cmd in
|
||||
gzip "$file"
|
||||
fi
|
||||
;;
|
||||
setup)
|
||||
[ -n "$name" ] || err 1 "setup: missing container name."
|
||||
script=/run/containers/${name}.sh
|
||||
[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
|
||||
|
||||
# Save our PID in case we get stuck here and someone wants to
|
||||
# stop us, e.g., due to reconfiguration or reboot.
|
||||
pidfile=$(pidfn "${name}")
|
||||
echo $$ > "$pidfile"
|
||||
|
||||
while ! "$script"; do
|
||||
log "${name}: setup failed, waiting for network changes ..."
|
||||
read -t 60 _ < <(ip monitor address route)
|
||||
|
||||
# On IP address/route changes, wait a few seconds more to ensure
|
||||
# the system has ample time to react and set things up for us.
|
||||
log "${name}: retrying ..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
rm -f "$pidfile"
|
||||
;;
|
||||
shell)
|
||||
if [ -z "$name" ]; then
|
||||
name="$1"
|
||||
shift
|
||||
fi
|
||||
if [ $# -gt 0 ]; then
|
||||
podman exec -i "$name" sh -c "$*"
|
||||
else
|
||||
podman exec -it "$name" sh -l
|
||||
fi
|
||||
podman exec -it "$1" sh -l
|
||||
;;
|
||||
show)
|
||||
cmd=$1
|
||||
@@ -820,10 +596,12 @@ case $cmd in
|
||||
else
|
||||
name=$1
|
||||
stop "$name"
|
||||
timeout=20
|
||||
while running "$name"; do
|
||||
_=$((timeout -= 1))
|
||||
if [ $timeout -le 0 ]; then
|
||||
err 1 "timed out waiting for container $1 to stop before restarting it."
|
||||
log "Timeout waiting for container $1 to stop before restarting it."
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
@@ -849,7 +627,7 @@ case $cmd in
|
||||
;;
|
||||
upgrade)
|
||||
# Start script used to initially create container
|
||||
script=/run/containers/${1}.sh
|
||||
script=/var/lib/containers/active/S01-${1}.sh
|
||||
|
||||
# Find container image
|
||||
img=$(podman inspect "$1" | jq -r .[].ImageName)
|
||||
@@ -860,15 +638,15 @@ case $cmd in
|
||||
|
||||
# Likely an OCI archive, or local directory, assume user has updated image.
|
||||
if echo "$img" | grep -Eq '^localhost/'; then
|
||||
file=$(awk '/^# meta-image:/ {print $3}' "$script")
|
||||
echo ">> Upgrading container $1 using $file ..."
|
||||
file=$(awk '{s=$NF} END{print s}' "$script")
|
||||
echo "Upgrading container ${1} with local archive: $file ..."
|
||||
else
|
||||
printf ">> Stopping ... "
|
||||
podman stop "$1"
|
||||
printf ">> "
|
||||
podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
|
||||
echo ">> Starting $1 ..."
|
||||
fi
|
||||
echo ">> Starting $1 ..."
|
||||
if ! "$script"; then
|
||||
echo ">> Failed recreating container $1"
|
||||
exit 1
|
||||
@@ -880,7 +658,7 @@ case $cmd in
|
||||
[ -n "$cmd" ] && shift
|
||||
case $cmd in
|
||||
prune)
|
||||
podman volume prune $force
|
||||
podman volume $force prune
|
||||
;;
|
||||
*)
|
||||
false
|
||||
@@ -888,22 +666,6 @@ case $cmd in
|
||||
esac
|
||||
;;
|
||||
*)
|
||||
if [ -n "$SERVICE_SCRIPT_TYPE" ] && [ -n "$SERVICE_ID" ]; then
|
||||
case "$SERVICE_SCRIPT_TYPE" in
|
||||
pre)
|
||||
# Called as pre-script from Finit service
|
||||
exec $container -q -n "$SERVICE_ID" setup
|
||||
;;
|
||||
cleanup)
|
||||
# Called as cleanup-script from Finit service
|
||||
log "Calling $container -n $SERVICE_ID delete"
|
||||
exec $container -q -n "$SERVICE_ID" delete
|
||||
;;
|
||||
*)
|
||||
false
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
usage
|
||||
exit 1
|
||||
;;
|
||||
|
||||
@@ -50,7 +50,7 @@ set_dhcp_routes()
|
||||
# format: dest1/mask gw1 ... destn/mask gwn
|
||||
set -- $staticroutes
|
||||
while [ -n "$1" -a -n "$2" ]; do
|
||||
log "adding route $1 via $2 metric $metric tag 100"
|
||||
log "adding route $1 via $2 dev $interface proto dhcp"
|
||||
echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
|
||||
shift 2
|
||||
done
|
||||
@@ -115,7 +115,7 @@ case "$ACTION" in
|
||||
/usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
|
||||
fi
|
||||
|
||||
if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto dhcp; then
|
||||
if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
|
||||
echo "$ip" > "$IP_CACHE"
|
||||
fi
|
||||
if [ -n "$ipv6" ] ; then
|
||||
|
||||
@@ -33,7 +33,6 @@ CONFIG_KALLSYMS_ALL=y
|
||||
CONFIG_PROFILING=y
|
||||
CONFIG_SMP=y
|
||||
CONFIG_EFI=y
|
||||
CONFIG_KPROBES=y
|
||||
# CONFIG_GCC_PLUGINS is not set
|
||||
CONFIG_MODULES=y
|
||||
CONFIG_MODULE_UNLOAD=y
|
||||
@@ -145,6 +144,7 @@ CONFIG_BRIDGE_EBT_REDIRECT=m
|
||||
CONFIG_BRIDGE_EBT_SNAT=m
|
||||
CONFIG_BRIDGE_EBT_LOG=m
|
||||
CONFIG_BRIDGE_EBT_NFLOG=m
|
||||
CONFIG_BPFILTER=y
|
||||
CONFIG_BRIDGE=y
|
||||
CONFIG_BRIDGE_VLAN_FILTERING=y
|
||||
CONFIG_BRIDGE_MRP=y
|
||||
@@ -161,14 +161,12 @@ CONFIG_MPLS=y
|
||||
CONFIG_NET_MPLS_GSO=y
|
||||
CONFIG_MPLS_ROUTING=m
|
||||
CONFIG_MPLS_IPTUNNEL=m
|
||||
CONFIG_NET_SWITCHDEV=y
|
||||
CONFIG_NET_PKTGEN=y
|
||||
# CONFIG_WIRELESS is not set
|
||||
CONFIG_NET_9P=y
|
||||
CONFIG_NET_9P_VIRTIO=y
|
||||
CONFIG_LWTUNNEL=y
|
||||
CONFIG_PCI=y
|
||||
CONFIG_PCI_MSI=y
|
||||
CONFIG_UEVENT_HELPER=y
|
||||
CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
|
||||
CONFIG_DEVTMPFS=y
|
||||
@@ -210,7 +208,6 @@ CONFIG_NET_VRF=y
|
||||
CONFIG_E1000=y
|
||||
CONFIG_NE2K_PCI=y
|
||||
CONFIG_8139CP=y
|
||||
CONFIG_ROCKER=y
|
||||
# CONFIG_WLAN is not set
|
||||
CONFIG_INPUT_EVDEV=y
|
||||
CONFIG_SERIAL_8250=y
|
||||
@@ -267,5 +264,5 @@ CONFIG_PANIC_ON_OOPS=y
|
||||
CONFIG_PANIC_TIMEOUT=20
|
||||
CONFIG_DETECT_HUNG_TASK=y
|
||||
CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
|
||||
CONFIG_FUNCTION_TRACER=y
|
||||
# CONFIG_FTRACE is not set
|
||||
CONFIG_UNWINDER_FRAME_POINTER=y
|
||||
|
||||
+1
-1
Submodule buildroot updated: 74fc86b099...475ea17ffe
+11
-16
@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
|
||||
BR2_INIT_FINIT=y
|
||||
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
|
||||
BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
BR2_SYSTEM_BIN_SH_BASH=y
|
||||
BR2_TARGET_GENERIC_GETTY_PORT="@console"
|
||||
BR2_TARGET_GENERIC_GETTY_TERM="xterm"
|
||||
@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
|
||||
BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
|
||||
BR2_LINUX_KERNEL=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
|
||||
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
|
||||
BR2_LINUX_KERNEL_DTS_SUPPORT=y
|
||||
BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
|
||||
BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
|
||||
BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
|
||||
BR2_LINUX_KERNEL_INSTALL_TARGET=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_DBUS_CXX=y
|
||||
@@ -56,8 +59,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
|
||||
BR2_PACKAGE_LIBSSH_OPENSSL=y
|
||||
BR2_PACKAGE_LIBSSH2=y
|
||||
BR2_PACKAGE_LIBSSH2_OPENSSL=y
|
||||
BR2_PACKAGE_LIBXCRYPT=y
|
||||
BR2_PACKAGE_LIBOPENSSL_BIN=y
|
||||
BR2_PACKAGE_LIBINPUT=y
|
||||
BR2_PACKAGE_LIBCURL_CURL=y
|
||||
BR2_PACKAGE_NETOPEER2_CLI=y
|
||||
BR2_PACKAGE_NSS_MDNS=y
|
||||
@@ -77,7 +80,6 @@ BR2_PACKAGE_IPROUTE2=y
|
||||
BR2_PACKAGE_IPTABLES_NFTABLES=y
|
||||
BR2_PACKAGE_IPUTILS=y
|
||||
BR2_PACKAGE_LLDPD=y
|
||||
BR2_PACKAGE_MSTPD=y
|
||||
BR2_PACKAGE_NETCALC=y
|
||||
BR2_PACKAGE_NETCAT_OPENBSD=y
|
||||
BR2_PACKAGE_NETSNMP=y
|
||||
@@ -107,7 +109,6 @@ BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -120,7 +121,6 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
|
||||
BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
|
||||
BR2_PACKAGE_HOST_GENEXT2FS=y
|
||||
BR2_PACKAGE_HOST_GENIMAGE=y
|
||||
BR2_PACKAGE_HOST_GO_BIN=y
|
||||
BR2_PACKAGE_HOST_RAUC=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
|
||||
@@ -130,17 +130,13 @@ INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set u
|
||||
INFIX_HOME="https://github.com/kernelkit/infix/"
|
||||
INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
|
||||
INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
|
||||
BR2_PACKAGE_ALDER_ALDER=y
|
||||
BR2_PACKAGE_MARVELL_CN9130_CRB=y
|
||||
BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
|
||||
BR2_PACKAGE_STYX_DCP_SC_28P=y
|
||||
BR2_PACKAGE_CONFD=y
|
||||
BR2_PACKAGE_CONFD_TEST_MODE=y
|
||||
BR2_PACKAGE_CURIOS_HTTPD=y
|
||||
BR2_PACKAGE_CURIOS_NFTABLES=y
|
||||
BR2_PACKAGE_EXECD=y
|
||||
BR2_PACKAGE_GENCERT=y
|
||||
BR2_PACKAGE_STATD=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_FACTORY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
|
||||
@@ -151,6 +147,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
|
||||
BR2_PACKAGE_FINIT_PLUGIN_TTY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
|
||||
BR2_PACKAGE_IITO=y
|
||||
BR2_PACKAGE_K8S_LOGGER=y
|
||||
BR2_PACKAGE_KEYACK=y
|
||||
BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
|
||||
BR2_PACKAGE_LANDING=y
|
||||
@@ -164,12 +161,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
|
||||
BR2_PACKAGE_PODMAN_DRIVER_VFS=y
|
||||
BR2_PACKAGE_TETRIS=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
BR2_PACKAGE_LIBINPUT=y
|
||||
BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
DISK_IMAGE_BOOT_BIN=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
DISK_IMAGE_BOOT_BIN=y
|
||||
GNS3_APPLIANCE_RAM=512
|
||||
GNS3_APPLIANCE_IFNUM=10
|
||||
|
||||
@@ -27,14 +27,17 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
|
||||
BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
|
||||
BR2_LINUX_KERNEL=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
|
||||
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
|
||||
BR2_LINUX_KERNEL_DTS_SUPPORT=y
|
||||
BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/dcp-sc-28p-a styx/dcp-sc-28p-b marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
|
||||
BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
|
||||
BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
|
||||
BR2_LINUX_KERNEL_INSTALL_TARGET=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_DBUS_CXX=y
|
||||
@@ -72,7 +75,6 @@ BR2_PACKAGE_FRR=y
|
||||
BR2_PACKAGE_IPROUTE2=y
|
||||
BR2_PACKAGE_IPUTILS=y
|
||||
BR2_PACKAGE_LLDPD=y
|
||||
BR2_PACKAGE_MSTPD=y
|
||||
BR2_PACKAGE_NETCALC=y
|
||||
BR2_PACKAGE_NGINX=y
|
||||
BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
|
||||
@@ -90,7 +92,6 @@ BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -112,15 +113,10 @@ INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set u
|
||||
INFIX_HOME="https://github.com/kernelkit/infix/"
|
||||
INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
|
||||
INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
|
||||
BR2_PACKAGE_ALDER_ALDER=y
|
||||
BR2_PACKAGE_MARVELL_CN9130_CRB=y
|
||||
BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
|
||||
BR2_PACKAGE_STYX_DCP_SC_28P=y
|
||||
BR2_PACKAGE_CONFD=y
|
||||
BR2_PACKAGE_CONFD_TEST_MODE=y
|
||||
BR2_PACKAGE_GENCERT=y
|
||||
BR2_PACKAGE_STATD=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_FACTORY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
|
||||
@@ -138,9 +134,6 @@ BR2_PACKAGE_MCD=y
|
||||
BR2_PACKAGE_MDNS_ALIAS=y
|
||||
BR2_PACKAGE_LIBINPUT=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
DISK_IMAGE_BOOT_BIN=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
|
||||
@@ -8,6 +8,7 @@ BR2_CCACHE=y
|
||||
BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
|
||||
BR2_ENABLE_DEBUG=y
|
||||
BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_TARGET_GENERIC_HOSTNAME="infix"
|
||||
BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
|
||||
BR2_INIT_FINIT=y
|
||||
@@ -29,7 +30,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
|
||||
BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
|
||||
BR2_LINUX_KERNEL=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
|
||||
BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
|
||||
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
|
||||
@@ -41,7 +42,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_LINUX_FIRMWARE=y
|
||||
@@ -74,6 +74,7 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
|
||||
BR2_PACKAGE_LIBSSH_OPENSSL=y
|
||||
BR2_PACKAGE_LIBSSH2=y
|
||||
BR2_PACKAGE_LIBSSH2_OPENSSL=y
|
||||
BR2_PACKAGE_LIBXCRYPT=y
|
||||
BR2_PACKAGE_LIBOPENSSL_BIN=y
|
||||
BR2_PACKAGE_LIBINPUT=y
|
||||
BR2_PACKAGE_LIBCURL_CURL=y
|
||||
@@ -127,7 +128,6 @@ BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -175,9 +175,9 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
|
||||
INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
|
||||
INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
|
||||
BR2_PACKAGE_CONFD=y
|
||||
BR2_PACKAGE_EXECD=y
|
||||
BR2_PACKAGE_GENCERT=y
|
||||
BR2_PACKAGE_STATD=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_FACTORY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
|
||||
@@ -188,6 +188,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
|
||||
BR2_PACKAGE_FINIT_PLUGIN_TTY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
|
||||
BR2_PACKAGE_IITO=y
|
||||
BR2_PACKAGE_K8S_LOGGER=y
|
||||
BR2_PACKAGE_KEYACK=y
|
||||
BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
|
||||
BR2_PACKAGE_LANDING=y
|
||||
@@ -201,10 +202,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
|
||||
BR2_PACKAGE_PODMAN_DRIVER_VFS=y
|
||||
BR2_PACKAGE_TETRIS=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
# GNS3_APPLIANCE is not set
|
||||
|
||||
@@ -39,7 +39,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_LINUX_FIRMWARE=y
|
||||
@@ -89,7 +88,6 @@ BR2_PACKAGE_IPROUTE2=y
|
||||
BR2_PACKAGE_IPTABLES_NFTABLES=y
|
||||
BR2_PACKAGE_IPUTILS=y
|
||||
BR2_PACKAGE_LLDPD=y
|
||||
BR2_PACKAGE_MSTPD=y
|
||||
BR2_PACKAGE_NETCALC=y
|
||||
BR2_PACKAGE_NETCAT_OPENBSD=y
|
||||
BR2_PACKAGE_NETSNMP=y
|
||||
@@ -119,7 +117,6 @@ BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -168,9 +165,9 @@ INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
|
||||
INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
|
||||
BR2_PACKAGE_CONFD=y
|
||||
# BR2_PACKAGE_CONFD_TEST_MODE is not set
|
||||
BR2_PACKAGE_EXECD=y
|
||||
BR2_PACKAGE_GENCERT=y
|
||||
BR2_PACKAGE_STATD=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_FACTORY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
|
||||
@@ -181,6 +178,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
|
||||
BR2_PACKAGE_FINIT_PLUGIN_TTY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
|
||||
BR2_PACKAGE_IITO=y
|
||||
BR2_PACKAGE_K8S_LOGGER=y
|
||||
BR2_PACKAGE_KEYACK=y
|
||||
BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
|
||||
BR2_PACKAGE_LANDING=y
|
||||
@@ -195,9 +193,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
|
||||
BR2_PACKAGE_TETRIS=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
# GNS3_APPLIANCE is not set
|
||||
|
||||
@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
|
||||
BR2_INIT_FINIT=y
|
||||
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
|
||||
BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
BR2_SYSTEM_BIN_SH_BASH=y
|
||||
BR2_TARGET_GENERIC_GETTY_PORT="@console"
|
||||
BR2_TARGET_GENERIC_GETTY_TERM="xterm"
|
||||
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
|
||||
BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
|
||||
BR2_LINUX_KERNEL=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
|
||||
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
|
||||
BR2_LINUX_KERNEL_INSTALL_TARGET=y
|
||||
@@ -34,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_DBUS_CXX=y
|
||||
@@ -55,8 +54,10 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
|
||||
BR2_PACKAGE_LIBSSH_OPENSSL=y
|
||||
BR2_PACKAGE_LIBSSH2=y
|
||||
BR2_PACKAGE_LIBSSH2_OPENSSL=y
|
||||
BR2_PACKAGE_LIBXCRYPT=y
|
||||
BR2_PACKAGE_LIBOPENSSL_BIN=y
|
||||
BR2_PACKAGE_LIBCURL_CURL=y
|
||||
BR2_PACKAGE_LIBMNL=y
|
||||
BR2_PACKAGE_NETOPEER2_CLI=y
|
||||
BR2_PACKAGE_NSS_MDNS=y
|
||||
BR2_PACKAGE_LINUX_PAM=y
|
||||
@@ -75,7 +76,6 @@ BR2_PACKAGE_IPROUTE2=y
|
||||
BR2_PACKAGE_IPTABLES_NFTABLES=y
|
||||
BR2_PACKAGE_IPUTILS=y
|
||||
BR2_PACKAGE_LLDPD=y
|
||||
BR2_PACKAGE_MSTPD=y
|
||||
BR2_PACKAGE_NETCALC=y
|
||||
BR2_PACKAGE_NETCAT_OPENBSD=y
|
||||
BR2_PACKAGE_NETSNMP=y
|
||||
@@ -105,7 +105,6 @@ BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -125,7 +124,6 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
|
||||
BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
|
||||
BR2_PACKAGE_HOST_GENEXT2FS=y
|
||||
BR2_PACKAGE_HOST_GENIMAGE=y
|
||||
BR2_PACKAGE_HOST_GO_BIN=y
|
||||
BR2_PACKAGE_HOST_MTOOLS=y
|
||||
BR2_PACKAGE_HOST_RAUC=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
|
||||
@@ -140,9 +138,9 @@ BR2_PACKAGE_CONFD=y
|
||||
BR2_PACKAGE_CONFD_TEST_MODE=y
|
||||
BR2_PACKAGE_CURIOS_HTTPD=y
|
||||
BR2_PACKAGE_CURIOS_NFTABLES=y
|
||||
BR2_PACKAGE_EXECD=y
|
||||
BR2_PACKAGE_GENCERT=y
|
||||
BR2_PACKAGE_STATD=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_FACTORY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
|
||||
@@ -153,6 +151,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
|
||||
BR2_PACKAGE_FINIT_PLUGIN_TTY=y
|
||||
BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
|
||||
BR2_PACKAGE_IITO=y
|
||||
BR2_PACKAGE_K8S_LOGGER=y
|
||||
BR2_PACKAGE_KEYACK=y
|
||||
BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
|
||||
BR2_PACKAGE_LANDING=y
|
||||
@@ -166,10 +165,7 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
|
||||
BR2_PACKAGE_PODMAN_DRIVER_VFS=y
|
||||
BR2_PACKAGE_TETRIS=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
GNS3_APPLIANCE_RAM=512
|
||||
|
||||
@@ -7,14 +7,13 @@ BR2_CCACHE=y
|
||||
BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
|
||||
BR2_ENABLE_DEBUG=y
|
||||
BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
|
||||
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
|
||||
BR2_TARGET_GENERIC_HOSTNAME="ix"
|
||||
BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
|
||||
BR2_INIT_FINIT=y
|
||||
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
|
||||
BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
|
||||
BR2_ROOTFS_MERGED_USR=y
|
||||
BR2_SYSTEM_BIN_SH_BASH=y
|
||||
BR2_TARGET_GENERIC_GETTY_PORT="@console"
|
||||
BR2_TARGET_GENERIC_GETTY_TERM="xterm"
|
||||
@@ -27,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
|
||||
BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
|
||||
BR2_LINUX_KERNEL=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.25"
|
||||
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
|
||||
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
|
||||
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
|
||||
BR2_LINUX_KERNEL_INSTALL_TARGET=y
|
||||
@@ -35,7 +34,6 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
|
||||
BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
|
||||
BR2_PACKAGE_STRACE=y
|
||||
BR2_PACKAGE_STRESS_NG=y
|
||||
BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
|
||||
BR2_PACKAGE_JQ=y
|
||||
BR2_PACKAGE_E2FSPROGS=y
|
||||
BR2_PACKAGE_DBUS_CXX=y
|
||||
@@ -52,7 +50,10 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
|
||||
BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
|
||||
BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
|
||||
BR2_PACKAGE_PYTHON3=y
|
||||
BR2_PACKAGE_LIBSSH_OPENSSL=y
|
||||
BR2_PACKAGE_LIBSSH2=y
|
||||
BR2_PACKAGE_LIBSSH2_OPENSSL=y
|
||||
BR2_PACKAGE_LIBXCRYPT=y
|
||||
BR2_PACKAGE_LIBOPENSSL_BIN=y
|
||||
BR2_PACKAGE_LIBCURL_CURL=y
|
||||
BR2_PACKAGE_LIBMNL=y
|
||||
@@ -70,7 +71,6 @@ BR2_PACKAGE_FRR=y
|
||||
BR2_PACKAGE_IPROUTE2=y
|
||||
BR2_PACKAGE_IPUTILS=y
|
||||
BR2_PACKAGE_LLDPD=y
|
||||
BR2_PACKAGE_MSTPD=y
|
||||
BR2_PACKAGE_NETCALC=y
|
||||
BR2_PACKAGE_NGINX=y
|
||||
BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
|
||||
@@ -82,14 +82,12 @@ BR2_PACKAGE_TCPDUMP=y
|
||||
BR2_PACKAGE_WHOIS=y
|
||||
BR2_PACKAGE_BASH_COMPLETION=y
|
||||
BR2_PACKAGE_SUDO=y
|
||||
BR2_PACKAGE_GETENT=y
|
||||
BR2_PACKAGE_KMOD_TOOLS=y
|
||||
BR2_PACKAGE_PWGEN=y
|
||||
BR2_PACKAGE_RAUC=y
|
||||
BR2_PACKAGE_RAUC_DBUS=y
|
||||
BR2_PACKAGE_RAUC_GPT=y
|
||||
BR2_PACKAGE_RAUC_NETWORK=y
|
||||
BR2_PACKAGE_RAUC_JSON=y
|
||||
BR2_PACKAGE_SYSKLOGD=y
|
||||
BR2_PACKAGE_SYSKLOGD_LOGGER=y
|
||||
BR2_PACKAGE_WATCHDOGD=y
|
||||
@@ -138,9 +136,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
|
||||
BR2_PACKAGE_LOWDOWN=y
|
||||
BR2_PACKAGE_MCD=y
|
||||
BR2_PACKAGE_MDNS_ALIAS=y
|
||||
BR2_PACKAGE_SHOW=y
|
||||
BR2_PACKAGE_ROUSETTE=y
|
||||
BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
|
||||
TRUSTED_KEYS=y
|
||||
TRUSTED_KEYS_DEVELOPMENT=y
|
||||
GNS3_APPLIANCE_RAM=512
|
||||
|
||||
+4
-282
@@ -4,241 +4,7 @@ Change Log
|
||||
All notable changes to the project are documented in this file.
|
||||
|
||||
|
||||
[v25.04.0][] - 2025-04-30
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
- Upgrade Linux kernel to 6.12.25 (LTS)
|
||||
- Upgrade Buildroot to 2025.02.1 (LTS)
|
||||
- Format for disk image (for QEMU) has changed to `qcow2`
|
||||
|
||||
### Fixes
|
||||
- Fix #1002: Broken symlink in release package
|
||||
- Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
|
||||
- Bump R2S kernel, now same as tier one boards
|
||||
- Fix #1015: Not possible to save custom SSH settings in startup-config
|
||||
- Fix group owner and permissions of `/cfg/backup` directory
|
||||
- Fix extraction of old version for `/cfg/backup/` files
|
||||
- Fix configuration migration issues when upgrading
|
||||
|
||||
[v25.03.0][] - 2025-03-31
|
||||
-------------------------
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This release is the first with the new Buildroot 2025.02 (LTS)
|
||||
|
||||
### Changes
|
||||
- Upgrade Linux kernel to 6.12.21 (LTS)
|
||||
- Upgrade Buildroot to 2025.02.0 (LTS)
|
||||
|
||||
### Fixes
|
||||
- Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
|
||||
- Fix #980: the system fails to reboot when a container is (stuck), for
|
||||
whatever reason, in its 'setup' state
|
||||
- Fix #990: web console, ttyd service, stopped working after upgrade to
|
||||
Buildroot 2025.02, caused by new (missing) option `--writable`
|
||||
- Fix TCAM memory corruption in `mvpp2` Ethernet controller
|
||||
- Fix annoying (but harmless) usage message from the logger tool when
|
||||
`startup-config` fails to load and the system reverts to failure mode
|
||||
- Fix harmless log warning for product specific init when no product
|
||||
specific init scripts are found
|
||||
- Backport fixes for sysklogd, affecting hostname filtering and periods
|
||||
in TAG names, pending official backport in Buildroot
|
||||
|
||||
|
||||
[v25.02.0][] - 2025-03-04
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
- Upgrade Linux kernel to 6.12.18 (LTS)
|
||||
- Upgrade Buildroot to 2024.02.11 (LTS)
|
||||
- Add support for link aggregation (lag), static (balance-xor) and LACP
|
||||
- Add support for the [i.MX 8M Plus EVK][EVK]
|
||||
- YANG type change for SSH private/public keys, from ietf-crypto-types
|
||||
to infix-crypto-types
|
||||
- Disable global IPv6 forwarding by default, enable by per-interface
|
||||
setting. Note, route advertisements are always accepted. Issue #785
|
||||
- Drop automatic default route (interface route) for IPv4 autoconf, not
|
||||
necessary and causes more confusion than good. Issue #923
|
||||
- Update scripting with new RESTCONF examples
|
||||
|
||||
### Fixes
|
||||
- Fix #896: `/etc/resolv.conf` not properly generated when system runs
|
||||
in fail secure mode (failing to load `startup-config`)
|
||||
- Fix #902: containers "linger" in the system (state 'exited') after
|
||||
having removed them from the configuration
|
||||
- Fix #930: container configuration changes does not apply at runtime
|
||||
only when saved to `startup-config` and system is rebooted
|
||||
- Fix #936: DHCP server reconfiguration does not always take effect.
|
||||
- Fix #956: CLI `copy` command complains it cannot change owner when
|
||||
copying `factory-config` to `running-config`. Bogus error, the
|
||||
latter is not really a file
|
||||
- Fix #977: "Operation not permitted" when saving `running-config` to
|
||||
`startup-config` (harmless warning but annoying and concerning)
|
||||
|
||||
[EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
|
||||
|
||||
|
||||
[v25.01.0][] - 2025-01-31
|
||||
-------------------------
|
||||
|
||||
> [!NOTE]
|
||||
> This release contains breaking changes in the configuration file
|
||||
> syntax for DHCP clients. Specifically DHCP options *with value*,
|
||||
> i.e., the syntax for sending a hexadecimal value now require `hex`
|
||||
> prefix before a string of colon-separated pairs of hex values.
|
||||
|
||||
### Changes
|
||||
|
||||
- Upgrade Linux kernel to 6.12.11 (LTS)
|
||||
- Upgrade Buildroot to 2024.02.10 (LTS)
|
||||
- Upgrade FRR from 9.1.2 to 9.1.3
|
||||
- Add support for configuring SSH server, issue #441. As a result,
|
||||
both SSH and NETCONF now use the same host key in `factory-config`
|
||||
- Add operational support for reading DNS resolver info, issue #510
|
||||
- Add operational support for NTP client, issue #510
|
||||
- Add support for more mDNS settings: allow/deny interfaces, acting
|
||||
as "reflector" and filtering of reflected services. Issue #678
|
||||
- Add DHCPv4 server support, multiple subnets with static hosts and
|
||||
DHCP options on global, subnet, or host level, issue #703.
|
||||
Contributed by [MINEx Networks](https://minexn.com/)
|
||||
- DHCP client options aligned with DHCP server, `startup-config`
|
||||
files with old syntax are automatically migrated
|
||||
- Breaking change in DHCP client options *with value*. Hexadecimal
|
||||
values must now be formatted as `{ "hex": "c0:ff:ee" }` (JSON)
|
||||
- Add documentation on management via SSH, Web (RESTCONF, Web
|
||||
Console), and Console Port, issue #787
|
||||
- Add documentation of DNS client use and configuration, issue #798
|
||||
- Add support for changing boot order for the system with an RPC,
|
||||
including support for reading boot order from operational datastore
|
||||
- Add support for GRE/GRETAP tunnels
|
||||
- Add support for STP/RSTP on bridges
|
||||
- Add support for VXLAN tunnels
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #777: Authorized SSH key not applied to `startup-config`
|
||||
- Fix #829: Avahi (mDNS responder) not starting properly on switches
|
||||
with *many* ports (>10). This led to a review of `sysctl`:
|
||||
- New for IPv4:
|
||||
- Adjust IGMP max memberships: 20 -> 1000
|
||||
- Use neighbor information on nexthop selection
|
||||
- Use inbound interface address on ICMP errors
|
||||
- Ignore routes with link down
|
||||
- Disable `rp_filter`
|
||||
- ARP settings have been changed to better fit routers, i.e.,
|
||||
systems with multiple interfaces:
|
||||
- Always use best local address when sending ARP
|
||||
- Only reply to ARP if target IP is on the inbound interface
|
||||
- Generate ARP requests when device is brought up or HW address changes
|
||||
- New for IPv6:
|
||||
- Keep static global addresses on link down
|
||||
- Ignore routes with link down
|
||||
- Fix #861: Fix error when running 251+ reconfigurations in test-mode
|
||||
- Fix #869: Setup of bridges is now more robust
|
||||
- Fix #899: DHCP client with client-id does not work
|
||||
- Minor cleanup of Networking Guide
|
||||
- Fix memory leaks in `confd`
|
||||
|
||||
|
||||
[v24.11.1][] - 2024-11-29
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
|
||||
- Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink
|
||||
messages and drifted out of sync with the kernel's view of addresses
|
||||
and interfaces available in the system
|
||||
- Allow setting IP address directly on VLAN filtering bridges. This
|
||||
only works when the bridge is an untagged member of a (single) VLAN.
|
||||
- cli: usability -- showing log files now automatically jump to the end
|
||||
of the file, where the latest events are
|
||||
- cli: usability -- showing container status, or other status that
|
||||
overflows the terminal horizontally, now wrap the lines and exit the
|
||||
pager immediately if the contents fit on the first screen
|
||||
- The default log level of the mDNS responder, `avahi-daemon`, has been
|
||||
adjusted to make it less verbose. Now only `LOG_NOTICE` and higher
|
||||
severity is logged -- making it very quiet
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #685: DSA conduit interface not always detected. Previous
|
||||
attempt at a fix (v24.10.2) mitigated the issue, but did not
|
||||
completely solve it.
|
||||
- Fix #835: redesign how the system creates/deletes containers from the
|
||||
`running-config`. Prior to this change, all removal and creation was
|
||||
handled by a separate queue that ran asynchronously from the `confd`
|
||||
process. This could lead to situations where new configurations are
|
||||
applied before the queue had been fully processed. After this change
|
||||
containers are deleted synchronously and new containers are created
|
||||
in the same flow as during normal runtime operation (start/upgrade)
|
||||
- Fix start of containers with `manual=True` option should now work
|
||||
again, regression in v24.11.0
|
||||
- Fix loss of writable volumes when temporarily disabling a container
|
||||
in the configuration, now the container remains dormant with all its
|
||||
volumes still available
|
||||
- Fix presentation bug in CLI `show interfaces` where all line-drawing
|
||||
characters showed up as hexadecimal values. Regression in v24.11.0
|
||||
- Fix missing log messages from Frr Zebra daemon
|
||||
- Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an
|
||||
interface, e.g., `br0`
|
||||
- Creating more than one container trigger restarts of previously set
|
||||
up containers. Which in some cases may cause these earlier ones to
|
||||
end up in an inconsistent state
|
||||
- Prevent traffic assigned to locally terminated VLANs from being
|
||||
forwarded, when the underlying ports are simultaneously attached to
|
||||
a VLAN filtering bridge.
|
||||
|
||||
|
||||
[v24.11.0][] - 2024-11-20
|
||||
-------------------------
|
||||
|
||||
> [!CAUTION]
|
||||
> This release contains breaking changes for container users! As of
|
||||
> v24.11.0, all persistent[^1] containers always run in `read-only` mode
|
||||
> and the setting itself is deprecated (kept only for compatibility
|
||||
> reasons). The main reason for this change is to better serve users
|
||||
> with embedded container images in their builds of Infix. I.e., they
|
||||
> can now upgrade the OCI image in their build and rely on the container
|
||||
> being automatically upgraded when Infix is upgraded, issue #823. For
|
||||
> other users, the benefit is that *all* container configuration changes
|
||||
> take when activated, issue #822, without having to perform any tricks.
|
||||
|
||||
### Changes
|
||||
|
||||
- Add validation of interface name lengths, (1..15), Linux limit
|
||||
- Add support for ftp/http/https URI:s in container image, with a new
|
||||
`checksum` setting for MD5/SHA256/SHA512 verification, issue #801
|
||||
- Add a retry timer to the background container create service. This
|
||||
will ensure failing `docker pull` operations from remote images are
|
||||
retrying after 60 seconds, or quicker
|
||||
- CLI base component, `klish`, has been updated with better support for
|
||||
raw terminal mode and alternate quotes (' in addition to ")
|
||||
- Log silenced from container activation messages, only the very bare
|
||||
necessities are now logged, e.g., `podman create` command + status
|
||||
- Factory reset no longer calls `shred` to "securely erase" any files
|
||||
from writable data partitions. This will speed up the next boot
|
||||
considerably
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #659: paged output in CLI accessed via console port sometimes
|
||||
causes lost lines, e.g. missing interfaces. With updated `klish`
|
||||
and the terminal in raw mode, the pager (less) can now control both
|
||||
the horizontal and vertical
|
||||
- Fix #822: adding, or changing, an environment variable to a running
|
||||
container does not take without the `container upgrade NAME` trick
|
||||
- Fix #823: with an OCI image embedded in the Infix image, an existing
|
||||
container in the configuration is not upgraded to the new OCI image
|
||||
with the Infix upgrade.
|
||||
- Frr leaves log files in `/var/tmp/frr` on unclean shutdowns. This
|
||||
has now been fixed with a "tmpfiles" cleanup of that path at boot
|
||||
|
||||
[^1]: I.e., set up in the configuration, as opposed to temporary ones
|
||||
started with `container run` from the CLI admin-exec context.
|
||||
|
||||
|
||||
[v24.10.2][] - 2024-11-08
|
||||
[v24.10.2][UNRELEASED]
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
@@ -256,44 +22,23 @@ All notable changes to the project are documented in this file.
|
||||
- Support for saving and restoring system clock from a disk file. This
|
||||
allows restoring the system clock to a sane date in case the RTC is
|
||||
disabled or does not have a valid time, issue #794
|
||||
- Update device discovery chapter with information on `infix.local` mDNS
|
||||
alias, `netbrowse` support to discover *all* local units, and command
|
||||
examples for disabling LLDP and mDNS services, issue #786
|
||||
- Updated OSPF documentation to include information on *global OSPF
|
||||
settings* (`redistribution`, `explicit-router-id`, etc.), issue #812
|
||||
- Added information on *forwarding of IEEE reserved group addresses*
|
||||
to bridge section of networking documentation, issue #788
|
||||
- Add support for bootstrap conditions and early init product overrides
|
||||
- Styx: enable second Ethernet port LED in device tree, again, rename
|
||||
it: yellow -> aux, and make sure it is turned off at boot
|
||||
- Styx: disable second port LED for the 4xSFP slots, does not work
|
||||
- Styx: override iitod (LED daemon) with a product specific LED script
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #685: DSA conduit interface not always detected, randomly causing
|
||||
major issues configuring systems with multiple switch cores
|
||||
- Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S.
|
||||
This fixes a regression in v24.10.0 causing loss of NETCONF support
|
||||
- Fix #809: enable syslog logging for RAUC
|
||||
- Fix harmless bootstrap log error message on systems without USB ports:
|
||||
`jq: error (at <stdin>:0): Cannot iterate over null (null)`
|
||||
- Change confusing `tc` log error message: `Error: does not support
|
||||
hardware offload` to `Skipping $iface, hardware offload not supported.`
|
||||
|
||||
This fixes a regression in v24.10.0 causing loss of NETCONF supprt
|
||||
|
||||
|
||||
[v24.10.1][] - 2024-10-18
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
|
||||
- Add support for interface description, sometimes referred to as
|
||||
"ifAlias". Saved as an Linux interface alias (not `altname`), e.g.,
|
||||
`/sys/class/interfaces/veth0a/ifalias`, includes operational support
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #735: `copy` and `erase` commands missing from CLI, regression
|
||||
in Infix v24.10.0 defconfigs, now added as dep. in klish package
|
||||
|
||||
@@ -308,9 +53,7 @@ Also, heads-up to all downstream users of Infix. YANG models have been
|
||||
renamed to ease maintenance, more info below.
|
||||
|
||||
### Changes
|
||||
|
||||
- Software control of port LEDs on the Styx platform has been disabled.
|
||||
|
||||
Default driver behavior, green link and green traffic blink, is kept
|
||||
as-is, which should mitigate issues reported in #670
|
||||
- Correcting documentation on QoS. For packets containing both a VLAN
|
||||
@@ -346,7 +89,6 @@ renamed to ease maintenance, more info below.
|
||||
see <https://kernelkit.org/posts/firewall-container/>
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #499: add an NACM rule to factory-config, which by default deny
|
||||
everyone to read user password hash(es)
|
||||
- Fix #663: internal Ethernet interfaces shown in CLI tab completion
|
||||
@@ -358,7 +100,7 @@ renamed to ease maintenance, more info below.
|
||||
with `custom-phys-address` to allow for constructing more free-form
|
||||
MAC addresses based on the chassis MAC (a.k.a., base MAC) address.
|
||||
For more information, see the YANG model, a few examples are listed in
|
||||
the updated documentation.
|
||||
the updated documentation.
|
||||
The syntax will be automatically updated in the `startup-config` and
|
||||
`factory-config` -- make sure to verify the changes and update any
|
||||
static `factory-config` used for your products
|
||||
@@ -395,7 +137,6 @@ also been added to facilitate site specific adaptations. Please see the
|
||||
documentation for details.
|
||||
|
||||
### Known Issues
|
||||
|
||||
- The CLI command `show interfaces` may for some terminal resolutions
|
||||
not display all interfaces (on systems with >20 interfaces). This
|
||||
problem is limited to the console port and only occurs for smaller
|
||||
@@ -404,7 +145,6 @@ documentation for details.
|
||||
using the CLI from an SSH session, is not affected. Issue #659
|
||||
|
||||
### Changes
|
||||
|
||||
- Upgrade Buildroot to 2024.02.6 (LTS)
|
||||
- Upgrade Linux kernel to 6.6.52 (LTS)
|
||||
- Upgrade libyang to 3.4.2
|
||||
@@ -424,7 +164,6 @@ documentation for details.
|
||||
by `mctl` reporting no multicast filtering enabled on bridge
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be
|
||||
randomized. Problem caused by kernel setting a random MAC before any
|
||||
bridge port is added. Fixed by using the device's base MAC address on
|
||||
@@ -487,7 +226,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
- StarFive VisionFive2 (RISC-V)
|
||||
|
||||
### Changes
|
||||
|
||||
- Upgrade Buildroot to 2024.02.5 (LTS)
|
||||
- Upgrade Linux kernel to 6.6.46 (LTS)
|
||||
- Issue #158: enhance security of factory reset. All file content
|
||||
@@ -539,7 +277,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
log messages. See `/var/log/debug` for *all* log messages
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #274: add missing link/traffic LEDs on NanoPi R2S LAN port
|
||||
- Fix #489: ensure all patches are versioned, including Linux kernel
|
||||
- Fix #531: creating a new VLAN interface named `vlanN` should not set
|
||||
@@ -569,7 +306,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
> upgrade, but before reboot, a factory reset is required!
|
||||
|
||||
### Changes
|
||||
|
||||
- Upgrade Buildroot to 2024.02.3 (LTS)
|
||||
- Upgrade Linux kernel to 6.6.34 (LTS)
|
||||
- Upgrade bundled curiOS httpd container to v24.05.0
|
||||
@@ -636,7 +372,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
[yescrypt]: https://en.wikipedia.org/wiki/Yescrypt
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix #424: regression, root user can log in without password
|
||||
- Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
|
||||
to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
|
||||
@@ -668,13 +403,11 @@ Finally, the following consumer boards are now fully supported:
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
|
||||
- Add small delay in U-Boot to allow stopping boot on reference boards
|
||||
- Document how to provision the bootloader and Infix on a blank board
|
||||
- Use initial hostname from `/etc/os-release` as configuration fallback
|
||||
|
||||
### Fixes
|
||||
|
||||
- Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
|
||||
to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
|
||||
- Fix provisioning script after changes to make GRUB loading more robust
|
||||
@@ -689,7 +422,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
-------------------------
|
||||
|
||||
### Changes
|
||||
|
||||
- Default web landing page refactored into a Buildroot package to make
|
||||
it possible to overload from customer repos.
|
||||
- Enable DCB support in aarch64 kernel (for EtherType prio override)
|
||||
@@ -700,7 +432,6 @@ Finally, the following consumer boards are now fully supported:
|
||||
- Issue #374: add timestamps to dagger .log files
|
||||
|
||||
### Fixes
|
||||
|
||||
- Add missing LICENSE hash for factory reset tool
|
||||
- Fix #424: regression, root user can log in without password
|
||||
|
||||
@@ -722,7 +453,6 @@ idea is to generate supported features from the models and include in
|
||||
future releases.
|
||||
|
||||
### Changes
|
||||
|
||||
- Bump the base Buildroot version to v2024.02 LTS
|
||||
- Bump the base Linux kernel version to 6.6 LTS
|
||||
- Drop Classic variant to reduce overhead, simplify build & release
|
||||
@@ -803,7 +533,6 @@ future releases.
|
||||
named 'default'
|
||||
|
||||
### Fixes
|
||||
|
||||
- confd: Fix memory leak when operating on candidate configuration
|
||||
- probe: Fix crash on systems without USB
|
||||
- Reduced syslog errors for accesses no non-existing xpaths
|
||||
@@ -1546,14 +1275,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
|
||||
- N/A
|
||||
|
||||
[buildroot]: https://buildroot.org/
|
||||
[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.04.0...HEAD
|
||||
[v25.04.0]: https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
|
||||
[v25.03.0]: https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
|
||||
[v25.02.0]: https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
|
||||
[v25.01.0]: https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
|
||||
[v24.11.1]: https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
|
||||
[v24.11.0]: https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
|
||||
[v24.10.2]: https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2
|
||||
[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.10.1...HEAD
|
||||
[v24.10.1]: https://github.com/kernelkit/infix/compare/v24.10.0...v24.10.1
|
||||
[v24.10.0]: https://github.com/kernelkit/infix/compare/v24.09.0...v24.10.0
|
||||
[v24.09.0]: https://github.com/kernelkit/infix/compare/v24.08.0...v24.09.0
|
||||
|
||||
+5
-9
@@ -1,16 +1,13 @@
|
||||
<img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
|
||||
|
||||
Welcome to Infix, your friendly Network Operating System! On these
|
||||
pages you can find both user and developer documentation.
|
||||
|
||||
Most topics on configuring the system include CLI examples, but every
|
||||
setting, as well as status read-back from the operational datastore, is
|
||||
also possible to perform using NETCONF or RESTCONF. In fact, the Infix
|
||||
regression test system solely relies on NETCONF and RESTCONF.
|
||||
> Topics on configuring the system include CLI examples, every setting
|
||||
> is also possible to perform using NETCONF. In fact, the Infix test
|
||||
> system solely relies on NETCONF for configuring network topologies.
|
||||
|
||||
> [!TIP]
|
||||
> The CLI documentation is also available from inside the CLI itself
|
||||
> using the `help` command in admin-exec mode.
|
||||
The CLI documentation is also available from inside the CLI itself using
|
||||
the `help` command.
|
||||
|
||||
- **CLI Topics**
|
||||
- [Introduction to the CLI](cli/introduction.md)
|
||||
@@ -21,7 +18,6 @@ regression test system solely relies on NETCONF and RESTCONF.
|
||||
- [Introduction](introduction.md)
|
||||
- [System Configuration](system.md)
|
||||
- [Network Configuration](networking.md)
|
||||
- [DHCP Server](dhcp.md)
|
||||
- [Syslog Support](syslog.md)
|
||||
- **Infix In-Depth**
|
||||
- [Boot Procedure](boot.md)
|
||||
|
||||
+18
-46
@@ -60,14 +60,14 @@ rootfs overlay -- with a [VPD](vpd.md) you can even support several!
|
||||
### Variables & Format Specifiers
|
||||
|
||||
Parts of the configuration you likely always want to generated, like the
|
||||
SSH hostkey used by SSH server and NETCONF, a unique hostname, or the `admin` user's
|
||||
SSH hostkey used by NETCONF, a unique hostname, or the `admin` user's
|
||||
unique (per-device with a VPD) password hash. This section lists the
|
||||
available keywords, see the next section for examples of how to use
|
||||
them:
|
||||
|
||||
- **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)
|
||||
XPath: `/ietf-system:system/authentication/user/password`
|
||||
- **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
|
||||
- **Default NETCONF hostkey:** `genkey` (regenerated at factory reset)
|
||||
XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
|
||||
- **Hostname format specifiers:**
|
||||
XPath: `/ietf-system:system/hostname`
|
||||
@@ -221,8 +221,8 @@ $ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3Rl
|
||||
|
||||
**IETF Keystore**
|
||||
|
||||
Notice how both the public and private keys are left empty here, this
|
||||
cause them to be always automatically regenerated after each factory reset.
|
||||
Notice how both the public and private keys are left empty here. The
|
||||
`genkey` is always automatically regenerated after each factory reset.
|
||||
Keeping the `factory-config` snippet like this means we can use the same
|
||||
file on multiple devices, without risking them sharing the same host
|
||||
keys. Sometimes you may want the same host keys, but that is the easy
|
||||
@@ -245,6 +245,8 @@ use-case and not documented here.
|
||||
},
|
||||
```
|
||||
|
||||
The `genkey` is currently only used by the NETCONF SSH backend.
|
||||
|
||||
**IETF NETCONF Server**
|
||||
|
||||
```json
|
||||
@@ -278,28 +280,6 @@ use-case and not documented here.
|
||||
},
|
||||
```
|
||||
|
||||
**Infix Services**
|
||||
```json
|
||||
"infix-services:ssh": {
|
||||
"enabled": true,
|
||||
"hostkey": [
|
||||
"genkey"
|
||||
],
|
||||
"listen": [
|
||||
{
|
||||
"name": "ipv4",
|
||||
"address": "0.0.0.0",
|
||||
"port": 22
|
||||
},
|
||||
{
|
||||
"name": "ipv6",
|
||||
"address": "::1",
|
||||
"port": 22
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
Integration
|
||||
@@ -390,30 +370,22 @@ But you can of course use only two numbers, *major.minor*, as well.
|
||||
> with your own versioning scheme.
|
||||
|
||||
|
||||
### Specifying Versioning Information
|
||||
### `INFIX_RELEASE`
|
||||
|
||||
Two optional environment variables control the version information
|
||||
recorded in images. Both of these **must be** a lower-case string (no
|
||||
spaces or other characters outside of 0–9, a–z, '.', '_' and '-')
|
||||
identifying the operating system version, excluding any OS name
|
||||
information or release code name, and suitable for processing by
|
||||
scripts or usage in generated filenames.
|
||||
|
||||
#### `INFIX_BUILD_ID`
|
||||
|
||||
Used for `BUILD_ID` in `/etc/os-release`.
|
||||
|
||||
**Default:** `$(git describe --always --dirty --tags)`, from the _top
|
||||
directory_. By default, the top directory refers to the root of the
|
||||
Infix source tree, but this can be changed by setting the branding
|
||||
variable `INFIX_OEM_PATH`, e.g. in a `defconfig` file or via `make
|
||||
menuconfig`, to the path of an enclosing br2-external.
|
||||
|
||||
#### `INFIX_RELEASE`
|
||||
This global variable **must be** a lower-case string (no spaces or
|
||||
other characters outside of 0–9, a–z, '.', '_' and '-') identifying
|
||||
the operating system version, excluding any OS name information or
|
||||
release code name, and suitable for processing by scripts or usage
|
||||
in generated filenames.
|
||||
|
||||
Used for `VERSION` and `VERSION_ID` in `/etc/os-release` and
|
||||
generated file names like disk images, etc.
|
||||
|
||||
**Default:** `${INFIX_BUILD_ID}`
|
||||
**Default:** generated using `git describe --always --dirty --tags`,
|
||||
with an additional `-C $infix_path`. This variable defaults to the
|
||||
Infix tree and can be changed by setting the menuconfig branding
|
||||
variable `INFIX_OEM_PATH` to that of the br2-external. It is also
|
||||
possible to set the `GIT_VERSION` variable in your `post-build.sh`
|
||||
script to change how the VCS version is extracted.
|
||||
|
||||
[NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg
|
||||
|
||||
+99
-257
@@ -20,9 +20,6 @@ Containers in Infix
|
||||
* [Application Container: ntpd](#application-container-ntpd)
|
||||
* [Advanced](#advanced)
|
||||
* [Running Host Commands From Container](#running-host-commands-from-container)
|
||||
* [Container Requirements](#container-requirements)
|
||||
* [Advanced Users](#advanced-users)
|
||||
|
||||
|
||||
Introduction
|
||||
------------
|
||||
@@ -31,19 +28,18 @@ Infix comes with native support for Docker containers using [podman][].
|
||||
The [YANG model][1] describes the current level of support, complete
|
||||
enough to run both system and application containers.
|
||||
|
||||
Key design features of Infix, like using Linux switchdev, allow users to
|
||||
assign switch ports directly to containers, not just bridged VETH pairs.
|
||||
This is a rare and in many cases *unique* feature of Infix.
|
||||
Key design features, like using Linux switchdev, allow users to assign
|
||||
switch ports directly to containers, not just bridged VETH pairs, this
|
||||
is a rare and in many cases *unique* feature of Infix.
|
||||
|
||||
All network specific settings are done using the IETF interfaces YANG
|
||||
model, with augments for containers to ensure smooth integration with
|
||||
container networking in podman.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Even though the `podman` command can be used directly from a shell
|
||||
> prompt, we strongly recommend using the CLI commands instead. They
|
||||
> employ the services of a wrapper `container` script which handles the
|
||||
> integration of Docker containers in the system.
|
||||
> **Note:** even though the `podman` command can be used directly from a
|
||||
> shell prompt, we strongly recommend using the CLI commands instead.
|
||||
> They employ the services of a wrapper `container` script which handles
|
||||
> the integration of containers in the system.
|
||||
|
||||
|
||||
Caution
|
||||
@@ -83,32 +79,30 @@ In the CLI, containers can be run in one of two ways:
|
||||
1. `container run IMAGE [COMMAND]`, or
|
||||
2. enter `configure` context, then `edit container NAME`
|
||||
|
||||
The first is useful mostly for testing, or running single commands in
|
||||
an image. It is a wrapper for `podman run -it --rm ...`.
|
||||
The former is useful mostly for testing, or running single commands in
|
||||
an image. It is a wrapper for `podman run -it --rm ...`, while the
|
||||
latter is a wrapper and adaptation of `podman create ...`.
|
||||
|
||||
The second creates a read-only container that by default automatically
|
||||
start at every boot. It basically wraps `podman create ...`.
|
||||
The second create a container with a semi-persistent writable layer that
|
||||
survives container restarts and host system restarts. However, if you
|
||||
change the container configuration or upgrade the image (see below), the
|
||||
container will be recreated and the writable layer is lost. This is why
|
||||
it is recommended to set up a named volume for directories, or use file
|
||||
[Content Mounts](#content-mounts), in your container if you want truly
|
||||
persistent content.
|
||||
|
||||
When non-volatile storage is needed two complementary options exist:
|
||||
In fact, in many cases the best way is to create a `read-only` container
|
||||
and use file mounts and volumes only for the critical parts. Podman
|
||||
ensures (using tmpfs) `read-only` containers still have writable
|
||||
directories for certain critical file system paths: `/dev`, `/dev/shm`,
|
||||
`/run`, `/tmp`, and `/var/tmp`. Meaning, what you most often need is
|
||||
writable volumes for `/var/lib` and `/etc`, or only file mounts for a
|
||||
few files in `/etc`. The actual needs depend on the container image and
|
||||
application to run.
|
||||
|
||||
- **Volumes:** data stored in a volume is persisted until explicitly
|
||||
removed from the configuration, i.e., across host reboots and
|
||||
container upgrades
|
||||
- **[Content Mounts](#content-mounts):** where the content of a file
|
||||
mounted into the container is kept along with the container
|
||||
configuration in the device's `startup-config`
|
||||
|
||||
Podman ensures (using tmpfs) all containers have writable directories
|
||||
for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
|
||||
`/tmp`, and `/var/tmp`. Meaning, what you most often need is writable
|
||||
volumes for `/var/lib` and `/etc`, or only file mounts for a few files
|
||||
in `/etc`. The [actual requirements](#container-requirements) depend on
|
||||
your container image and application to run.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running containers from public registries, double-check that they
|
||||
> support the CPU architecture of your host system. Remember, unlike
|
||||
> virtualization, containers reuse the host's CPU and kernel.
|
||||
> **Note:** when running containers from public registries, double-check
|
||||
> that they support the CPU architecture of your host system. Remember,
|
||||
> unlike virtualization, containers reuse the host's CPU and kernel.
|
||||
|
||||
|
||||
<img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
|
||||
@@ -129,30 +123,24 @@ Classic Hello World:
|
||||
Hello from Docker!
|
||||
This message shows that your installation appears to be working correctly.
|
||||
|
||||
A web server with [nginx][], using standard docker bridge. Podman will
|
||||
automatically create a VETH pair for us, connecting the container to the
|
||||
`docker0` bridge:
|
||||
Persistent web server using nginx, sharing the host's network:
|
||||
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit interface docker0
|
||||
admin@example:/config/interface/docker0/> set container-network
|
||||
admin@example:/config/interface/docker0/> end
|
||||
admin@example:/config/> edit container web
|
||||
admin@example:/config/container/web/> set image docker://nginx:alpine
|
||||
admin@example:/config/container/web/> set network publish 8080:80
|
||||
admin@example:/config/container/web/> set network interface docker0
|
||||
admin@example:/config/container/web/> set volume cache target /var/cache
|
||||
admin@example:/config/container/web/> leave
|
||||
admin@example:/config> edit container web
|
||||
admin@example:/config/container/web> set image docker://nginx:alpine
|
||||
admin@example:/config/container/web> set publish 80:80
|
||||
admin@example:/config/container/web> set network host
|
||||
admin@example:/config/container/web> leave
|
||||
admin@example:/> show container
|
||||
|
||||
Exit to the shell and verify the service with curl, or try to attach
|
||||
to your device's IP address using your browser:
|
||||
|
||||
admin@example:~$ curl http://localhost:8080
|
||||
admin@example:~$ curl http://localhost
|
||||
|
||||
or connect to port 8080 of your running Infix system with a browser.
|
||||
See the following sections for how to add more interfaces and manage
|
||||
your container at runtime.
|
||||
or connect to port 80 of your running Infix system with a browser. See
|
||||
the following sections for how to add more interfaces and manage your
|
||||
container at runtime.
|
||||
|
||||
|
||||
Container Images
|
||||
@@ -180,20 +168,13 @@ The CLI help shows:
|
||||
oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
|
||||
May be in .tar or .tar.gz format
|
||||
|
||||
Additionally, the following URIs are also supported for setups
|
||||
that do not use a HUB or similar. Recommend using 'checksum'!
|
||||
|
||||
ftp://addr/path/to/archive -- Downloaded using wget
|
||||
http://addr/path/to/archive -- Downloaded using curl
|
||||
https://addr/path/to/archive -- Downloaded using curl
|
||||
|
||||
Note: if a remote repository cannot be reached, the creation of the
|
||||
container will be put on a queue that retries pull every time
|
||||
there is a route change in the host's system.
|
||||
|
||||
> [!TIP]
|
||||
> The built-in help system in the CLI is generated from the YANG model,
|
||||
> so the same information is also available for remote NETCONF users.
|
||||
> **Note::** the built-in help system in the CLI is generated from the
|
||||
> YANG model, so the same information is also available for remote
|
||||
> NETCONF users.
|
||||
|
||||
The two most common variants are `docker://` and `oci-archive:/`.
|
||||
|
||||
@@ -236,46 +217,21 @@ mind.
|
||||
-rw-r--r-- 1 root root 7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
|
||||
drwx------ 6 frr frr 4096 Mar 27 11:57 frr/
|
||||
|
||||
Importing the image into Podman can be done either from the CLI
|
||||
Importing the image into podman can be done either from the CLI
|
||||
admin-exec context ...
|
||||
|
||||
admin@example:/var/tmp$ cli
|
||||
admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge
|
||||
|
||||
> [!TIP]
|
||||
> The `name curios:edge` is the tag you give the imported (raw) archive
|
||||
> which you can then reference in your container image configuration:
|
||||
> `set image curios:edge`.
|
||||
> The `name curios:edge` is the tag you give the imported
|
||||
> (raw) archive which you can then reference in your container image
|
||||
> configuration: `set image curios:edge`.
|
||||
|
||||
... or by giving the container configuration the full path to the OCI
|
||||
archive, which helps greatly with container upgrades (see below):
|
||||
|
||||
admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz
|
||||
|
||||
**Checksum Example:**
|
||||
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit container sys
|
||||
admin@example:/config/container/sys/> set hostname sys
|
||||
admin@example:/config/container/sys/> set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
|
||||
admin@example:/config/container/sys/> set checksum
|
||||
md5 sha256 sha512
|
||||
admin@example:/config/container/sys/> set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629
|
||||
admin@example:/config/container/sys/> leave
|
||||
admin@example:/> copy running-config startup-config
|
||||
admin@example:/> show container
|
||||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||
b02e945c43c9 localhost/curios-oci-amd64-v24.05.0:latest 5 seconds ago Up 5 seconds sys
|
||||
|
||||
admin@example:/> show log
|
||||
...
|
||||
Nov 20 07:24:56 infix container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
|
||||
Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
|
||||
Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
|
||||
Nov 20 07:24:57 infix container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
|
||||
Nov 20 07:24:57 infix container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
|
||||
Nov 20 07:24:57 infix container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
|
||||
|
||||
|
||||
Upgrading a Container Image
|
||||
---------------------------
|
||||
@@ -284,24 +240,21 @@ Upgrading a Container Image
|
||||
The applications in your container are an active part of the system as a
|
||||
whole, so make it a routine to keep your container images up-to-date!
|
||||
|
||||
Containers are created at first setup and at every boot. If the image
|
||||
exists in the file system it is reused -- i.e., an image pulled from a
|
||||
remote registry is not fetched again.
|
||||
> **Note:** the default writable layer is lost when upgrading the image.
|
||||
> Use named volumes for content that you want to persist across upgrades.
|
||||
|
||||
To upgrade a versioned image:
|
||||
- update your `running-config` to use the new `image:tag`
|
||||
- `leave` to activate the change, if you are in the CLI
|
||||
- Podman pulls the new image in the background
|
||||
- Your container is recreated with the new image
|
||||
- The container is started
|
||||
|
||||
For "unversioned" images, e.g., images using a `:latest` or `:edge` tag,
|
||||
use the following CLI command (`NAME` is the name of your container):
|
||||
All container configurations are locked to the image hash at the time of
|
||||
first download, not just ones that use an `:edge` or `:latest` tag. An
|
||||
upgrade of containers using versioned images is more obvious -- update
|
||||
the configuration to use the new `image:tag` -- the latter is a bit
|
||||
trickier. Either remove the configuration and recreate it (leave/apply
|
||||
the changes between), or use the admin-exec level command:
|
||||
|
||||
admin@example:/> container upgrade NAME
|
||||
|
||||
This stops the container, does `container pull IMAGE`, and recreates it
|
||||
with the new image. Upgraded containers are automatically restarted.
|
||||
Where `NAME` is the name of your container. This command stops the
|
||||
container, does `container pull IMAGE`, and then recreates it with the
|
||||
new image. Upgraded containers are automatically restarted.
|
||||
|
||||
**Example using registry:**
|
||||
|
||||
@@ -326,30 +279,12 @@ the upgrade command as
|
||||
Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
|
||||
7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52
|
||||
|
||||
OCI archives can also be fetched from ftp/http/https URL, in that case
|
||||
the upgrade can be done the same way as a registry image (above).
|
||||
|
||||
> [!TIP]
|
||||
> Containers running from OCI images embedded in the operating system,
|
||||
> e.g., `/lib/oci/mycontainer.tar.gz`, always run from the version in
|
||||
> the operating system. To upgrade, install the new container image at
|
||||
> build time, after system upgrade the container is also upgraded. The
|
||||
> system unpacks and loads the OCI images into Podman every boot, which
|
||||
> ensures the running container always has known starting state.
|
||||
>
|
||||
> **Example:** default builds of Infix include a couple of OCI images
|
||||
> for reference, one is `/lib/oci/curios-nftables-v24.11.0.tar.gz`, but
|
||||
> there is also a symlink called `curios-nftables-latest.tar.gz` in the
|
||||
> same directory, which is what the Infix regression tests use in the
|
||||
> image configuration of the container. This is what enables easy
|
||||
> upgrades of the container along with the system itself.
|
||||
|
||||
|
||||
Capabilities
|
||||
-------------
|
||||
|
||||
An unprivileged container works for almost all use-cases, but there are
|
||||
occasions where they are too restricted and users start looking for the
|
||||
occasions where they are too restricted and users being looking for the
|
||||
`privileged` flag. Capabilities offers a middle ground.
|
||||
|
||||
For example, a system container from which `ping` does not work:
|
||||
@@ -365,9 +300,9 @@ For example, a system container from which `ping` does not work:
|
||||
...
|
||||
|
||||
Infix supports a subset of all [capabilities][6] that are relevant for
|
||||
containers. Please note, that this is an advanced topic that require
|
||||
time and analysis of your container application to figure out which
|
||||
capabilities you need.
|
||||
containers. Please note, that this is and advanced topic and will
|
||||
require time and analysis of your container application to figure out
|
||||
which capabilities you need.
|
||||
|
||||
|
||||
Networking and Containers
|
||||
@@ -377,16 +312,9 @@ By default, unlike other systems, persistent[^1] containers have no
|
||||
networking enabled. All network access has to be set up explicitly.
|
||||
Currently two types of of container networks are supported:
|
||||
|
||||
- `host`: an managed host interface, e.g., one end of a VETH pair,
|
||||
or even a physical interface
|
||||
- `host`: one end of a VETH pair, or a physical Ethernet port
|
||||
- `bridge`: an IP masquerading bridge
|
||||
|
||||
In the former the interface is delegated to (moved into) the container,
|
||||
while in the latter a VETH pair is automatically created by Podman and
|
||||
one end delegated to the container, while the other end is assigned to
|
||||
the bridge (see the next section).
|
||||
|
||||
> [!TIP]
|
||||
> For more information on VETH pairs, see the [Networking Guide][0].
|
||||
|
||||
|
||||
@@ -419,12 +347,10 @@ have to set manually:
|
||||
admin@example:/config/interface/docker0/> set type bridge
|
||||
admin@example:/config/interface/docker0/> set container-network type bridge
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When configuring the system via an API such as NETCONF or RESTCONF, no
|
||||
> settings are inferred. Instead it is up to the caller to fully define
|
||||
> the desired setup. This makes the CLI very useful for first setup and
|
||||
> then extracting the resulting XML from the shell using the `cfg -X`
|
||||
> command.
|
||||
> **Note:** when doing the same operation over NETCONF there is no
|
||||
> inference, so all the "magic" settings need to be defined. This
|
||||
> makes the CLI very useful for first setup and then extracting the
|
||||
> resulting XML from the shell using the `cfg -X` command.
|
||||
|
||||
We have to declare the interface as a container network, ensuring the
|
||||
interface cannot be used by the system for any other purpose. E.g., a
|
||||
@@ -464,11 +390,11 @@ in a `bridge`. Below an example of a system container calls `set
|
||||
network interface docker0`, here we show how to set options for that
|
||||
network:
|
||||
|
||||
admin@example:/config/container/ntpd/> edit network interface docker0
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/>
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/> set option
|
||||
admin@example:/config/container/ntpd/> edit network docker0
|
||||
admin@example:/config/container/ntpd/network/docker0/>
|
||||
admin@example:/config/container/ntpd/network/docker0/> set option
|
||||
<string> Options for masquerading container bridges.
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/> help option
|
||||
admin@example:/config/container/ntpd/network/docker0/> help option
|
||||
NAME
|
||||
option <string>
|
||||
|
||||
@@ -479,9 +405,9 @@ network:
|
||||
mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
|
||||
interface_name=foo0 -- set interface name inside container
|
||||
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/> set option ip=172.17.0.2
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/> set option interface_name=wan
|
||||
admin@example:/config/container/ntpd/network/interface/docker0/> leave
|
||||
admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
|
||||
admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
|
||||
admin@example:/config/container/ntpd/network/docker0/> leave
|
||||
|
||||
|
||||
### Container Host Interface
|
||||
@@ -493,12 +419,8 @@ example.
|
||||
|
||||
The network `option` setting is available also for this case, but only
|
||||
the `interface_name=foo0` option works. Which is still very useful. To
|
||||
set:
|
||||
|
||||
- IP address, use IPv4/IPv6 settings in the interface settings
|
||||
- MAC address, to use the `custom-phys-address` in the interface settings
|
||||
|
||||
For an example of both, see the next section.
|
||||
change the MAC address, you need to use the `custom-phys-address` in the
|
||||
general network settings.
|
||||
|
||||
[^3]: Something which the container bridge network type does behind the
|
||||
scenes with one end of an automatically created VETH pair.
|
||||
@@ -525,7 +447,6 @@ line where we declare the `ntpd` end as a container network interface:
|
||||
admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
|
||||
admin@example:/config/interface/ntpd/> set container-network
|
||||
|
||||
> [!TIP]
|
||||
> Notice how you can also set a custom MAC address at the same time.
|
||||
|
||||
Adding the interface to the container is the same as before, but since
|
||||
@@ -535,7 +456,6 @@ can take a bit of a shortcut.
|
||||
admin@example:/config/container/ntpd/> set network interface ntpd
|
||||
admin@example:/config/container/ntpd/> leave
|
||||
|
||||
> [!TIP]
|
||||
> Use the `set network interface ntpd option interface_name=foo0` to set
|
||||
> the name of the interface inside the container to `foo0`.
|
||||
|
||||
@@ -558,7 +478,6 @@ We start by adding the second VETH pair:
|
||||
admin@example:/config/interface/veth1a/> set veth peer veth1
|
||||
admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24
|
||||
|
||||
> [!NOTE]
|
||||
> The LAN bridge (br1) in this example has IP address 192.168.1.1.
|
||||
|
||||
When a container has multiple host interfaces it can often be useful to
|
||||
@@ -610,40 +529,29 @@ file system:
|
||||
admin@example:/config/container/system/mount/leds> end
|
||||
admin@example:/config/container/system/>
|
||||
|
||||
Any type of file can be *bind mounted* into the container, just watch
|
||||
out for permissions though. In the example above, `/sys/class/leds` is
|
||||
not writable from a container unless it runs in *privileged* mode. For
|
||||
plain configuration files you get more freedom, and your container can
|
||||
rely on, e.g., *inotify* events to trigger reloading its services when
|
||||
you change the file on the host.
|
||||
|
||||
So it depends on the container, and indeed your overall setup, what to
|
||||
use. An intriguing option is *Content Mounts*, which when changed also
|
||||
trigger a container restart.
|
||||
|
||||
Other times *volumes* are a better fit. A volume is an automatically
|
||||
Sometimes *volumes* are a better fit. A volume is an automatically
|
||||
created read-writable entity that follows the life of your container.
|
||||
|
||||
admin@example:/config/container/ntpd/> set volume varlib target /var/lib
|
||||
|
||||
Volumes are persistent across both reboots and upgrades of the base
|
||||
image. They are created by Podman when the container first starts up,
|
||||
unlike a regular bind mount it synchronizes with the contents of the
|
||||
underlying container image's path at first use. I.e., "bind-mount, if
|
||||
empty: then rsync".
|
||||
Volumes survive reboots and upgrading of the base image, unlike the
|
||||
persistent writable layer you get by default, which does not survive
|
||||
upgrades. The volume is created by podman when the container first
|
||||
starts up, unlike a regular bind mount it synchronizes with the contents
|
||||
of the underlying container image's path on the first start. I.e.,
|
||||
"bind-mount, if empty: then rsync".
|
||||
|
||||
> [!NOTE]
|
||||
> Infix support named volumes (only), and it is not possible to share a
|
||||
> volume between containers. All the tricks possible with volumes may
|
||||
> be added in a later release.
|
||||
|
||||
### Content Mounts
|
||||
|
||||
Content mounts are a special type of file mount where the file contents
|
||||
is stored with the container configuration. This can be very useful
|
||||
when deploying similar systems at multiple sites. When the host loads
|
||||
its `startup-config` (or even `factory-config`) a temporary file is
|
||||
created using the decoded base64 data from the `content` node.
|
||||
Content mount is a special type of where the file contents for the
|
||||
container is stored alongside the container configuration. This can be
|
||||
very useful when deploying similar systems at multiple sites. When the
|
||||
host loads its `startup-config` (or even `factory-config`) a temporary
|
||||
file is created using the decoded base64 data from the `content` node.
|
||||
|
||||
admin@example:/config/container/ntpd/> edit mount ntpd.conf
|
||||
admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
|
||||
@@ -656,10 +564,9 @@ The editor is a small [Emacs clone called Mg][2], see the built-in help
|
||||
text, or press Ctrl-x Ctrl-c to exit and save. When the editor exits
|
||||
the contents are base64 encoded and stored in the candidate datastore.
|
||||
|
||||
> [!NOTE]
|
||||
> Since these files are always recreated when the host is restarted,
|
||||
> changes made by the container are not preserved, or saved back to the
|
||||
> host's startup-config.
|
||||
> **Note:** since these files are always recreated when the host is
|
||||
> restarted, changes made by the container are not preserved, or saved
|
||||
> back to the host's startup-config even if the read-only option is off.
|
||||
|
||||
Infix has three different text editors available. For more information,
|
||||
see [CLI Text Editor](cli/text-editor.md).
|
||||
@@ -681,11 +588,10 @@ we created previously:
|
||||
admin@example:/config/container/system/> set publish 222:22
|
||||
admin@example:/config/container/system/> leave
|
||||
|
||||
> [!NOTE]
|
||||
> Ensure you have a network connection to the registry. If the image
|
||||
> cannot be pulled, creation of the container will be put in a queue and
|
||||
> be retried every time there is a change in the routing table, e.g.,
|
||||
> default route is added, and every 60 seconds.
|
||||
> **Note:** ensure you have a network connection to the registry.
|
||||
> If the image cannot be pulled, creation of the container will be
|
||||
> put in a queue and be retried every time there is a change in the
|
||||
> routing table, e.g., default route is added.
|
||||
|
||||
Provided the image is downloaded successfully, a new `system` container
|
||||
now runs behind the docker0 interface, forwarding container port 22 to
|
||||
@@ -801,13 +707,12 @@ Another *insecure* approach is to access the host system directly,
|
||||
bypassing the namespaces that make up the boundary between host and
|
||||
container.
|
||||
|
||||
> [!CAUTION]
|
||||
> Please note, this completely demolishes the isolation barrier between
|
||||
> container and host operating system. It is only suitable in
|
||||
> situations where the container serves more as a unit of distribution
|
||||
> rather than as a separate component of the system. *Strongly
|
||||
> recommended* to use this only in trusted setups! Consider also
|
||||
> limiting the time frame in which this is active!
|
||||
> **Security:** Please note, this completely demolishes the isolation
|
||||
> barrier between container and host operating system. It is only
|
||||
> suitable in situations where the container serves more as a unit of
|
||||
> distribution rather than as a separate component of the system.
|
||||
> *Strongly recommended* to use this only in trusted setups! Consider
|
||||
> also limiting the time frame in which this is active!
|
||||
|
||||
First, enable *Privileged* mode, this unlocks the door and allows the
|
||||
container to manage resources on the host system. An example is the
|
||||
@@ -842,58 +747,6 @@ control an Infix system this way, see [Scripting Infix](scripting.md).
|
||||
it may not be enabled by default in BusyBox.
|
||||
|
||||
|
||||
Container Requirements
|
||||
----------------------
|
||||
|
||||
In addition to general [*best practices*][7] for container images, there
|
||||
are a few more things to consider when targeting embedded systems:
|
||||
|
||||
- Ensure the image targets the CPU architecture of the target system,
|
||||
learn more about [Multi-platform Builds][8]
|
||||
- Follow [best practices for naming and tagging][10], e.g., `:latest` vs `:1.0`
|
||||
- Follow [OCI recommendations and layout][9],
|
||||
learn more about [OCI and Docker Exporters][6]
|
||||
|
||||
If the [Docker documentation][11] is not enough, there are plenty of
|
||||
[guides online][12] with examples on how to create your own container
|
||||
image. For the more advanced, please see the next section.
|
||||
|
||||
|
||||
### Advanced Users
|
||||
|
||||
Most people prefer their system containers small, often based on Alpine
|
||||
Linux, or similar, with only a few small applications, including their
|
||||
own, and an SSH server perhaps. For some developers, even this is too
|
||||
big, so they roll their own from source. This section is for you.
|
||||
|
||||
Depending on your needs, here is a checklist:
|
||||
|
||||
- you need something that can forward signals, e.g.,
|
||||
- [tini][]
|
||||
- [Bash only][13], or
|
||||
- BusyBox init, a classic most embedded developers know, but read on ...
|
||||
- a system container only need the bare necessities of a system bringup
|
||||
- E.g., BusyBox's init, [but not everything][15]
|
||||
- Some of the networking is set up by Podman and CNI for you, but
|
||||
you may want to run a DHCP client?
|
||||
- Do *not* rename interfaces inside the container, use the dedicated
|
||||
`interface_name` option in the configuration instead
|
||||
- Remember, Podman provides a `tmpfs` for all critical system paths:
|
||||
`/dev`, `/dev/shm`, `/run`, `/tmp`, and `/var/tmp`, so you don't
|
||||
need to clean or set up any of these mount points
|
||||
|
||||
Examples using `tini` and BusyBox init are available from the KernelKit
|
||||
[curiOS project][14]. It is a small Buildroot based container image
|
||||
builder that generates OCI compatible image tarballs without any tools
|
||||
from Docker or Podman -- ready-made images exist for testing on both
|
||||
AMD64 and ARM64 targets, as well as `docker pull` images and and OCI
|
||||
tarballs with SHA256 checksums for integrity checking.
|
||||
|
||||
Finally, if you build your own version of Infix, and embed OCI tarballs
|
||||
in the system image, then see the tip at the end of [Upgrading a
|
||||
Container Image](#upgrading-a-container-image) (above).
|
||||
|
||||
|
||||
[0]: networking.md
|
||||
[1]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers.yang
|
||||
[2]: https://github.com/troglobit/mg
|
||||
@@ -901,15 +754,4 @@ Container Image](#upgrading-a-container-image) (above).
|
||||
[4]: system.md#ssh-authorized-key
|
||||
[5]: https://docs.docker.com/build/exporters/oci-docker/
|
||||
[6]: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
||||
[7]: https://docs.docker.com/build/building/best-practices/
|
||||
[8]: https://docs.docker.com/build/building/multi-platform/
|
||||
[9]: https://github.com/opencontainers/image-spec/blob/main/image-layout.md
|
||||
[10]: https://docs.docker.com/get-started/docker-concepts/building-images/build-tag-and-publish-an-image/#tagging-images
|
||||
[11]: https://www.docker.com/blog/multi-arch-images/
|
||||
[12]: https://lemariva.com/blog/2018/05/tutorial-docker-on-embedded-systems-raspberry-pi-beagleboard
|
||||
[13]: https://sirikon.me/posts/0009-pid-1-bash-script-docker-container.html
|
||||
[14]: https://github.com/kernelkit/curiOS/
|
||||
[15]: https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
|
||||
[tini]: https://github.com/krallin/tini
|
||||
[nginx]: https://hub.docker.com/_/nginx
|
||||
[podman]: https://podman.io
|
||||
|
||||
+1
-64
@@ -131,8 +131,6 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
|
||||
on Buildroot to finalize the target filesystem and generate the images.
|
||||
The final `run` argument is explained below.
|
||||
|
||||
|
||||
|
||||
### `confd`
|
||||
|
||||
The Infix `src/confd/` is the engine of the system. Currently it is a
|
||||
@@ -166,78 +164,17 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
|
||||
make confd-rebuild all run
|
||||
|
||||
|
||||
### `statd`
|
||||
|
||||
The Infix status daemon, `src/statd`, is responsible for populating the
|
||||
sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
|
||||
but unlike `confd`, it relies entirely on `yanger`, a Python script that
|
||||
gathers data from local linux services and feeds it into sysrepo.
|
||||
|
||||
To apply changes, rebuild the image:
|
||||
|
||||
make python-statd-rebuild statd-rebuild all
|
||||
|
||||
Rebuilding the image and testing on target for every change during
|
||||
development process can be tedious. Instead, `yanger` allows remote
|
||||
execution, running the script directly on the host system (test
|
||||
container):
|
||||
|
||||
infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
|
||||
|
||||
`ixll` is a utility script that lets you run network commands using an
|
||||
**interface name** instead of a hostname. It makes operations like
|
||||
`ssh`, `scp`, and network discovery easier.
|
||||
|
||||
Normally, `yanger` runs commands **locally** to retrieve data
|
||||
(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
|
||||
executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
|
||||
commands to a remote system connected to the local `d3a` interface via
|
||||
SSH. This setup is used for running `yanger` in an
|
||||
[interactive test environment](testing.md#interactive-usage). The yanger
|
||||
script runs on the `host` system, but key commands are executed on the
|
||||
`target` system.
|
||||
|
||||
For debugging or testing, you can capture system command output and
|
||||
replay it later without needing a live system.
|
||||
|
||||
To capture:
|
||||
|
||||
infamy0:test # ../src/statd/python/yanger/yanger -c /tmp/capture ieee802-dot1ab-lldp
|
||||
|
||||
To replay:
|
||||
|
||||
infamy0:test # ../src/statd/python/yanger/yanger -r /tmp/capture ieee802-dot1ab-lldp
|
||||
|
||||
This is especially useful when working in isolated environments or debugging
|
||||
issues without direct access to the DUT.
|
||||
|
||||
### Agree on YANG Model
|
||||
|
||||
When making changes to the `confd` and `statd` services, you will often need to update
|
||||
the YANG models. If you are adding a new YANG module, it's best to follow the
|
||||
structure of an existing one. However, before making any changes, **always discuss
|
||||
them with the Infix core team**. This helps avoid issues later in development and
|
||||
makes pull request reviews smoother.
|
||||
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
||||
Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
|
||||
see also [Infix in Virtual Environments](virtual.md), or on a physical
|
||||
device by upgrading to the latest build or "[netbooting](netboot.md)"
|
||||
and running the image from RAM. The latter is how most board porting
|
||||
work is done -- **much quicker** change-load-test cycles.
|
||||
see also [Infix in Virtual Environments](virtual.md).
|
||||
|
||||
The Infix automated test suite is built around Qemu and [Qeneth][2], see:
|
||||
|
||||
* [Testing](testing.md)
|
||||
* [Docker Image](../test/docker/README.md)
|
||||
|
||||
With any new feature added to Infix, it is essential to include relevant
|
||||
test case(s). See the [Test Development](testing.md#test-development)
|
||||
section for guidance on adding test cases.
|
||||
|
||||
|
||||
Reviewing
|
||||
---------
|
||||
|
||||
-171
@@ -1,171 +0,0 @@
|
||||
DHCP Server
|
||||
===========
|
||||
|
||||
The DHCPv4 server provides automatic IP address assignment and network
|
||||
configuration for clients. It supports address pools, static host
|
||||
assignments, and customizable DHCP options. It also serves as a DNS
|
||||
proxy for local subnets and can even forward queries to upstream DNS
|
||||
servers[^1].
|
||||
|
||||
> [!NOTE]
|
||||
> When using the CLI, the system automatically enables essential options
|
||||
> like DNS servers and default gateway based on the system's network
|
||||
> configuration. These options can be disabled, changed or overridden,
|
||||
> at any level: global, subnet, or per-host.
|
||||
|
||||
|
||||
## Basic Configuration
|
||||
|
||||
The following example configures a DHCP server for subnet 192.168.2.0/24
|
||||
with an address pool:
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit dhcp-server
|
||||
admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
|
||||
```
|
||||
|
||||
When setting up the server from the CLI, the system automatically adds a
|
||||
few default DHCP options that will be sent to clients: both DNS server
|
||||
and default gateway will use the system address on the matching
|
||||
interface.
|
||||
|
||||
```
|
||||
admin@example:/> show running-config
|
||||
"infix-dhcp-server:dhcp-server": {
|
||||
"subnet": [
|
||||
{
|
||||
"subnet": "192.168.2.0/24",
|
||||
"option": [
|
||||
{
|
||||
"id": "dns-server",
|
||||
"address": "auto"
|
||||
},
|
||||
{
|
||||
"id": "router",
|
||||
"address": "auto"
|
||||
}
|
||||
],
|
||||
"pool": {
|
||||
"start-address": "192.168.2.100",
|
||||
"end-address": "192.168.2.200"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Remember to set up an interface in this subnet, avoid using addresses
|
||||
> in the DHCP pool, or reserved for static hosts. In Class C networks
|
||||
> the router usually has address `.1`. Depending on the use-case, you
|
||||
> may also want to set up routing.
|
||||
|
||||
|
||||
## Static Host Assignment
|
||||
|
||||
To reserve specific IP addresses for clients based on their MAC address,
|
||||
hostname, or client ID:
|
||||
|
||||
```
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit host 192.168.2.10
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set match mac-address 00:11:22:33:44:55
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> set hostname printer
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/host/192.168.2.10/> leave
|
||||
```
|
||||
|
||||
Match hosts using a client identifier instead of MAC address:
|
||||
|
||||
```
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit host 192.168.1.50
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> edit match
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> set client-id hex c0:ff:ee
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/match/> leave
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> set lease-time infinite
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/host/192.168.1.50/> leave
|
||||
```
|
||||
|
||||
The `hex` prefix here ensures matching of client ID is done using the
|
||||
hexadecimal octets `c0:ff:ee`, three bytes. Without the prefix the
|
||||
ASCII string "c0:ff:ee", eight bytes, is used.
|
||||
|
||||
> [!NOTE]
|
||||
> The DHCP server is fully RFC conformant, in the case of option 61 this
|
||||
> means that using the `hex` prefix will require the client to set the
|
||||
> `htype` field of the option to `00`. See RFC 2132 for details.
|
||||
|
||||
|
||||
## Custom DHCP Options
|
||||
|
||||
Configure additional DHCP options globally, per subnet, or per host:
|
||||
|
||||
```
|
||||
admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option dns-server
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> set address 8.8.8.8
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/dns-server/> leave
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> edit option ntp-server
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> set address 192.168.2.1
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/option/ntp-server/> leave
|
||||
```
|
||||
|
||||
When configuring, e.g., `dns-server`, or `router` options with the value
|
||||
`auto`, the system uses the IP address from the interface matching the
|
||||
subnet. For example:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces brief
|
||||
Interface Status Address
|
||||
eth0 UP 192.168.1.1/24
|
||||
eth1 UP 192.168.2.1/24
|
||||
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> edit option dns-server
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> set address auto
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/option/dns-server/> leave
|
||||
```
|
||||
|
||||
In this case, clients in subnet 192.168.1.0/24 will receive 192.168.1.1
|
||||
as their DNS server address.
|
||||
|
||||
|
||||
## Multiple Subnets
|
||||
|
||||
Configure DHCP for multiple networks:
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit dhcp-server
|
||||
admin@example:/config/dhcp-server/> edit subnet 192.168.1.0/24
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> set pool start-address 192.168.1.100 end-address 192.168.1.200
|
||||
admin@example:/config/dhcp-server/subnet/192.168.1.0/24/> leave
|
||||
admin@example:/config/dhcp-server/> edit subnet 192.168.2.0/24
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> set pool start-address 192.168.2.100 end-address 192.168.2.200
|
||||
admin@example:/config/dhcp-server/subnet/192.168.2.0/24/> leave
|
||||
```
|
||||
|
||||
|
||||
## Monitoring
|
||||
|
||||
View active leases and server statistics:
|
||||
|
||||
```
|
||||
admin@example:/> show dhcp-server
|
||||
IP ADDRESS MAC HOSTNAME CLIENT ID EXPIRES
|
||||
192.168.2.22 00:a0:85:00:02:05 00:c0:ff:ee 3591s
|
||||
192.168.1.11 00:a0:85:00:04:06 foo 01:00:a0:85:00:04:06 3591s
|
||||
|
||||
admin@example:/> show dhcp-server statistics
|
||||
DHCP offers sent : 6
|
||||
DHCP ACK messages sent : 5
|
||||
DHCP NAK messages sent : 0
|
||||
DHCP decline messages received : 0
|
||||
DHCP discover messages received : 6
|
||||
DHCP request messages received : 5
|
||||
DHCP release messages received : 6
|
||||
DHCP inform messages received : 6
|
||||
```
|
||||
|
||||
|
||||
[^1]: This requires the system DNS resolver to be configured.
|
||||
+65
-213
@@ -1,29 +1,29 @@
|
||||
# Discover Devices
|
||||
|
||||
Infix advertises itself via the [mDNS-SD](#mdns-sd) and [LLDP](#lldp)
|
||||
discovery protocols. mDNS-SD has good client support in Windows, macOS
|
||||
and on Linux systems. More on these protocols later.
|
||||
|
||||
An even simpler method is available when directly attached to an Infix
|
||||
device:
|
||||
Discover Infix Units
|
||||
====================
|
||||
|
||||
```
|
||||
.----. Ethernet .-------.
|
||||
| PC +---------------------+ Infix |
|
||||
'----' if1 e1 '-------'
|
||||
.----. Ethernet .-------.
|
||||
| PC +---------------------+ Infix |
|
||||
'----' if1 eth0 '-------'
|
||||
```
|
||||
Figure 1: PC directly connected over Ethernet to Infix unit (here eth0).
|
||||
|
||||
With IPv6 you can *ping the all-hosts* address (ff02::1), the device's
|
||||
link-local IPv6 address is then seen in the response. In the following
|
||||
example, the PC here uses *tap0* as *if1*, Infix responds with address
|
||||
*fe80::ff:fec0:ffed*.
|
||||
|
||||
When you wish to discover the IP address of an Infix switch, the simplest
|
||||
way is probably to *ping the IPv6 all-hosts* address (ff02::1) over a
|
||||
directly connected Ethernet cable. The unit's link-local IPv6 address is
|
||||
seen in the response.
|
||||
|
||||
In the example below, the PC is connected to Infix via interface *tap0*
|
||||
(*tap0* is *if1* in Figure 1) and Infix responds with address
|
||||
*fe80::ff:fe00:0*.
|
||||
|
||||
```
|
||||
linux-pc:# ping -6 -L -c 3 ff02::1%tap0
|
||||
PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
|
||||
64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=1 ttl=64 time=0.558 ms
|
||||
64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=2 ttl=64 time=0.419 ms
|
||||
64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=3 ttl=64 time=0.389 ms
|
||||
64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=1 ttl=64 time=0.558 ms
|
||||
64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=2 ttl=64 time=0.419 ms
|
||||
64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=3 ttl=64 time=0.389 ms
|
||||
|
||||
--- ff02::1%tap0 ping statistics ---
|
||||
3 packets transmitted, 3 received, 0% packet loss, time 2043ms
|
||||
@@ -31,42 +31,42 @@ rtt min/avg/max/mdev = 0.389/0.455/0.558/0.073 ms
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> The `-L` option ignores local responses from the PC.
|
||||
|
||||
This address can then be used to connect to the device, e.g., using SSH.
|
||||
Notice the syntax `username@address%interface`:
|
||||
The PC could connect then connect to Infix, e.g., using SSH.
|
||||
|
||||
```
|
||||
linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
|
||||
admin@fe80::ff:fec0:ffed%tap0's password: admin
|
||||
admin@infix-c0-ff-ee:~$
|
||||
linux-pc:# ssh admin@fe80::ff:fe00:0%tap0
|
||||
admin@fe80::ff:fe00:0%tap0's password: admin
|
||||
admin@infix-00-00-00:~$
|
||||
```
|
||||
|
||||
## Discovery mechanisms available in Infix
|
||||
|
||||
## LLDP
|
||||
Infix advertises its presence via the [mDNS](#mdns) and [LLDP](#lldp)
|
||||
discovery protocols.
|
||||
|
||||
Infix supports LLDP (IEEE 802.1AB). For a device with factory default
|
||||
settings, the link-local IPv6 address can be read from the Management
|
||||
Address TLV using *tcpdump* or other sniffing tools[^1]:
|
||||
|
||||
### LLDP
|
||||
|
||||
Infix supports LLDP (IEEE 802.1AB). For a unit with factory default
|
||||
settings, the PC can readout the link-local IPv6 address from the
|
||||
Management Address TLV using *tcpdump* or other sniffing tools[^1].
|
||||
```
|
||||
linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
|
||||
tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
|
||||
15:51:52.061071 LLDP, length 193
|
||||
Chassis ID TLV (1), length 7
|
||||
Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
|
||||
Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
|
||||
Port ID TLV (2), length 7
|
||||
Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
|
||||
Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
|
||||
Time to Live TLV (3), length 2: TTL 120s
|
||||
System Name TLV (5), length 14: infix-c0-ff-ee
|
||||
System Name TLV (5), length 14: infix-00-00-00
|
||||
System Description TLV (6), length 91
|
||||
Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
|
||||
System Capabilities TLV (7), length 4
|
||||
System Capabilities [Bridge, WLAN AP, Router, Station Only] (0x009c)
|
||||
Enabled Capabilities [Station Only] (0x0080)
|
||||
Management Address TLV (8), length 24
|
||||
Management Address length 17, AFI IPv6 (2): fe80::ff:fec0:ffed
|
||||
Management Address length 17, AFI IPv6 (2): fe80::ff:fe00:0
|
||||
Interface Index Interface Numbering (2): 2
|
||||
Port Description TLV (4), length 4: eth0
|
||||
Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
|
||||
@@ -83,12 +83,11 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
If the device has an IPv4 address assigned, it is shown in an additional
|
||||
If the unit has an IPv4 address assigned, it is shown in an additional
|
||||
Management Address TLV.
|
||||
|
||||
> [!NOTE]
|
||||
> The Management Addresses shown by LLDP are not necessarily associated
|
||||
> with the port transmitting the LLDP message.
|
||||
> **Note** The Management Addresses shown by LLDP are not
|
||||
> necessarily associated with the port transmitting the LLDP message.
|
||||
|
||||
In the example below, the IPv4 address (10.0.1.1) happens to be
|
||||
assigned to *eth0*, while the IPv6 address (2001:db8::1) is not.
|
||||
@@ -98,11 +97,11 @@ linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
|
||||
tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
|
||||
15:46:07.908665 LLDP, length 207
|
||||
Chassis ID TLV (1), length 7
|
||||
Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
|
||||
Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
|
||||
Port ID TLV (2), length 7
|
||||
Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
|
||||
Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
|
||||
Time to Live TLV (3), length 2: TTL 120s
|
||||
System Name TLV (5), length 14: infix-c0-ff-ee
|
||||
System Name TLV (5), length 14: infix-00-00-00
|
||||
System Description TLV (6), length 91
|
||||
Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
|
||||
System Capabilities TLV (7), length 4
|
||||
@@ -131,194 +130,47 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
The LLDP service can be disabled using the following commands.
|
||||
[^1]: [lldpd: implementation of IEEE 802.1ab
|
||||
(LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
|
||||
is handy to sniff and display LLDP packets.
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/> configure
|
||||
admin@infix-c0-ff-ee:/config/> no lldp
|
||||
admin@infix-c0-ff-ee:/config/> leave
|
||||
admin@infix-c0-ff-ee:/>
|
||||
```
|
||||
### mDNS
|
||||
|
||||
|
||||
## mDNS-SD
|
||||
|
||||
DNS-SD/mDNS-SD can be used to discover Infix devices and services. By
|
||||
default, Infix use the `.local` domain for advertising services. Some
|
||||
networks use `.lan` instead, so this configurable:
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/> configure
|
||||
admin@infix-c0-ff-ee:/config/> edit mdns
|
||||
admin@infix-c0-ff-ee:/config/mdns/> set domain lan
|
||||
```
|
||||
|
||||
Other available settings include limiting the interfaces mDNS responder
|
||||
acts on:
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/config/> set interfaces allow e1
|
||||
```
|
||||
|
||||
or
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/config/> set interfaces deny wan
|
||||
```
|
||||
|
||||
The `allow` and `deny` settings are complementary, `deny` always wins.
|
||||
|
||||
----
|
||||
|
||||
In Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can be used to
|
||||
search for devices advertising their services via mDNS.
|
||||
DNS-SD/mDNS can be used to discover Infix units and services. Infix
|
||||
units present their IP addresses, services and hostname within the
|
||||
.local domain. This method has good client support in Apple and Linux
|
||||
systems. On Linux, tools such as *avahi-browse* or *mdns-scan*[^2] can
|
||||
be used to search for devices advertising their services via mDNS.
|
||||
|
||||
```
|
||||
linux-pc:# avahi-browse -ar
|
||||
+ tap0 IPv6 infix-c0-ff-ee SFTP File Transfer local
|
||||
+ tap0 IPv4 infix-c0-ff-ee SFTP File Transfer local
|
||||
+ tap0 IPv6 infix-c0-ff-ee SSH Remote Terminal local
|
||||
+ tap0 IPv4 infix-c0-ff-ee SSH Remote Terminal local
|
||||
= tap0 IPv4 infix-c0-ff-ee SFTP File Transfer local
|
||||
hostname = [infix-c0-ff-ee.local]
|
||||
+ tap0 IPv6 infix-00-00-00 SFTP File Transfer local
|
||||
+ tap0 IPv4 infix-00-00-00 SFTP File Transfer local
|
||||
+ tap0 IPv6 infix-00-00-00 SSH Remote Terminal local
|
||||
+ tap0 IPv4 infix-00-00-00 SSH Remote Terminal local
|
||||
= tap0 IPv4 infix-00-00-00 SFTP File Transfer local
|
||||
hostname = [infix-00-00-00.local]
|
||||
address = [10.0.1.1]
|
||||
port = [22]
|
||||
txt = []
|
||||
= tap0 IPv4 infix-c0-ff-ee SSH Remote Terminal local
|
||||
hostname = [infix-c0-ff-ee.local]
|
||||
= tap0 IPv4 infix-00-00-00 SSH Remote Terminal local
|
||||
hostname = [infix-00-00-00.local]
|
||||
address = [10.0.1.1]
|
||||
port = [22]
|
||||
txt = []
|
||||
= tap0 IPv6 infix-c0-ff-ee SFTP File Transfer local
|
||||
hostname = [infix-c0-ff-ee.local]
|
||||
address = [fe80::ff:fec0:ffed]
|
||||
= tap0 IPv6 infix-00-00-00 SFTP File Transfer local
|
||||
hostname = [infix-00-00-00.local]
|
||||
address = [fe80::ff:fe00:0]
|
||||
port = [22]
|
||||
txt = []
|
||||
= tap0 IPv6 infix-c0-ff-ee SSH Remote Terminal local
|
||||
hostname = [infix-c0-ff-ee.local]
|
||||
address = [fe80::ff:fec0:ffed]
|
||||
= tap0 IPv6 infix-00-00-00 SSH Remote Terminal local
|
||||
hostname = [infix-00-00-00.local]
|
||||
address = [fe80::ff:fe00:0]
|
||||
port = [22]
|
||||
txt = []
|
||||
^C
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> The `-t` option is also very useful, it stops browsing automatically
|
||||
> when a "more or less complete list" has been printed. However, some
|
||||
> devices on the LAN may be in deep sleep so run the command again if
|
||||
> you cannot find the device you are looking for.
|
||||
|
||||
Additionally, *avahi-resolve-host-name* can be used to verify domain
|
||||
name mappings for IP addresses. By default, it translates from IPv4
|
||||
addresses. This function allows users to confirm that addresses are
|
||||
mapped correctly.
|
||||
|
||||
```
|
||||
linux-pc:# avahi-resolve-host-name infix-c0-ff-ee.local
|
||||
infix-c0-ff-ee.local 10.0.1.1
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
Thanks to mDNS we can use the advertised name instead of the IP
|
||||
address for operations like `ping` and `ssh` as shown below:
|
||||
|
||||
```
|
||||
linux-pc:# ping infix-c0-ff-ee.local -c 3
|
||||
PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
|
||||
64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.852 ms
|
||||
64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=1.12 ms
|
||||
64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.35 ms
|
||||
|
||||
--- infix-c0-ff-ee.local ping statistics ---
|
||||
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
|
||||
rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
|
||||
|
||||
linux-pc:# ssh admin@infix-c0-ff-ee.local
|
||||
(admin@infix-c0-ff-ee.local) Password:
|
||||
.-------.
|
||||
| . . | Infix -- a Network Operating System
|
||||
|-. v .-| https://kernelkit.org
|
||||
'-'---'-
|
||||
|
||||
Run the command 'cli' for interactive OAM
|
||||
|
||||
linux-pc:#
|
||||
```
|
||||
|
||||
To disable mDNS/mDNS-SD, type the commands:
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/> configure
|
||||
admin@infix-c0-ff-ee:/config/> no mdns
|
||||
admin@infix-c0-ff-ee:/config/> leave
|
||||
```
|
||||
|
||||
### Human-Friendly Hostname Alias
|
||||
|
||||
Each Infix deviuce advertise itself as *infix.local*, in addition to its
|
||||
full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*). This alias
|
||||
works seamlessly on a network with a single Infix device, and makes it
|
||||
easy to connect when the exact hostname is not known in advance. The
|
||||
examples below show how the alias can be used for actions such as
|
||||
pinging or establishing an SSH connection:
|
||||
|
||||
```
|
||||
linux-pc:# ping infix.local -c 3
|
||||
PING infix.local (10.0.1.1) 56(84) bytes of data.
|
||||
64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.751 ms
|
||||
64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=2.28 ms
|
||||
64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.42 ms
|
||||
|
||||
--- infix.local ping statistics ---
|
||||
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
|
||||
rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
|
||||
|
||||
linux-pc:# ssh admin@infix.local
|
||||
(admin@infix.local) Password:
|
||||
.-------.
|
||||
| . . | Infix -- a Network Operating System
|
||||
|-. v .-| https://kernelkit.org
|
||||
'-'---'-
|
||||
|
||||
Run the command 'cli' for interactive OAM
|
||||
|
||||
admin@infix-c0-ff-ee:~$
|
||||
```
|
||||
|
||||
When multiple Infix devices are present on the LAN the alias will not
|
||||
uniquely identify a device; *infix.local* will refer to any of the
|
||||
Infix devices, likely the one that first appeared.
|
||||
|
||||
> [!NOTE]
|
||||
> When multiple Infix devices are present on the LAN, use the full name,
|
||||
> e.g., *infix-c0-ff-ee.local* or *foo.local* rather than the alias
|
||||
> *infix.local* to deterministically connect to the device.
|
||||
|
||||
|
||||
### Browse Network Using *network.local*
|
||||
|
||||
Another mDNS alias that all Infix devices advertise is *network.local*.
|
||||
This is a web service which basically runs `avahi-browse` and displays a
|
||||
table of other Infix devices and their services.
|
||||
|
||||
|
||||
|
||||
With multiple Infix devices on the LAN, one will take the role of your
|
||||
portal to access all others, if it goes down another takes its place.
|
||||
|
||||
To disable the netbrowse service, and the *network.local* alias, the
|
||||
following commands can be used:
|
||||
|
||||
```
|
||||
admin@infix-c0-ff-ee:/> configure
|
||||
admin@infix-c0-ff-ee:/config/> edit web
|
||||
admin@infix-c0-ff-ee:/config/web/> no netbrowse
|
||||
admin@infix-c0-ff-ee:/config/web/> leave
|
||||
```
|
||||
|
||||
|
||||
[^1]: E.g., [lldpd](https://github.com/lldp/lldpd) which includes the
|
||||
*lldpcli* too, handy to sniff and display LLDP packets.
|
||||
[^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
|
||||
tool for scanning for mDNS/DNS-SD services on the local network.
|
||||
tool for scanning for mDNS/DNS-SD published services on the local
|
||||
network
|
||||
|
||||
+8
-17
@@ -6,7 +6,13 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
|
||||
┌─────────────────────────────────┬──────────────────────────────────┐
|
||||
│ YANG │ Linux / Ethtool │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-total-octets │ FramesReceivedOK, │
|
||||
│ out-frames │ FramesTransmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ out-multicast-frames │ MulticastFramesXmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ out-broadcast-frames │ BroadcastFramesXmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-total-frames │ FramesReceivedOK, │
|
||||
│ │ FrameCheckSequenceErrors │
|
||||
│ │ FramesLostDueToIntMACRcvError │
|
||||
│ │ AlignmentErrors │
|
||||
@@ -19,23 +25,8 @@ This column contains the mapping between YANG and Linux / Ethtool counters.
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-broadcast-frames │ BroadcastFramesReceivedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-error-fcs-frames │ FrameCheckSequenceErrors │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-error-undersize-frames │ undersize_pkts │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
| in-error-oversize-frames | etherStatsJabbers, |
|
||||
| | etherStatsOversizePkts |
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ in-error-mac-internal-frames │ FramesLostDueToIntMACRcvError │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ out-frames │ FramesTransmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ out-multicast-frames │ MulticastFramesXmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ out-broadcast-frames │ BroadcastFramesXmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ infix-eth:out-good-octets │ OctetsTransmittedOK │
|
||||
├─────────────────────────────────┼──────────────────────────────────┤
|
||||
│ infix-eth:in-good-octets │ OctetsReceivedOK │
|
||||
│ in-error-fcs-frames │ FrameCheckSequenceErrors │
|
||||
└─────────────────────────────────┴──────────────────────────────────┘
|
||||
```
|
||||
|
||||
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 368 KiB After Width: | Height: | Size: 358 KiB |
+1
-1
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 280 KiB After Width: | Height: | Size: 281 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 258 KiB |
@@ -1,195 +0,0 @@
|
||||
# Management
|
||||
|
||||
The system utilizes YANG models for keeping configuration and operational
|
||||
data. These databases can be managed through different interfaces such
|
||||
as NETCONF, RESTCONF, and CLI via SSH or Console.
|
||||
|
||||
## SSH Management
|
||||
|
||||
An SSH server (SSHv2) is provided for remote management. It can be
|
||||
enabled/disabled as shown below.
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit ssh
|
||||
admin@example:/config/ssh/> set enabled
|
||||
admin@example:/config/ssh/>
|
||||
```
|
||||
|
||||
By default the SSH server accepts connections to port 22 on all its IP
|
||||
addresses, but this can be adjusted using the `listen` command. To
|
||||
make the server (only) listen for incoming connections to IP address
|
||||
_192.168.1.1_ and port _12345_ the following commands can be used.
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit ssh
|
||||
admin@example:/config/ssh/> show
|
||||
enabled true;
|
||||
hostkey genkey;
|
||||
listen ipv4 {
|
||||
address 0.0.0.0;
|
||||
port 22;
|
||||
}
|
||||
listen ipv6 {
|
||||
address ::;
|
||||
port 22;
|
||||
}
|
||||
admin@example:/config/ssh/> no listen ipv6
|
||||
admin@example:/config/ssh/> edit listen ipv4
|
||||
admin@example:/config/ssh/listen/ipv4/> set address 192.168.1.1
|
||||
admin@example:/config/ssh/listen/ipv4/> set port 12345
|
||||
admin@example:/config/ssh/listen/ipv4/>
|
||||
```
|
||||
|
||||
The default SSH hostkey is generated on first boot and is used in both
|
||||
SSH and NETCONF (SSH transport). Custom keys can be added to the
|
||||
configuration in `ietf-keystore`. The only supported hostkey type is
|
||||
RSA for now, thus the private key must be
|
||||
`ietf-crypto-types:rsa-private-key-format` and the public key
|
||||
`ietf-crypto-types:ssh-public-key-format`
|
||||
|
||||
### Use your own SSH hostkeys
|
||||
|
||||
Hostkeys can be generated with OpenSSL:
|
||||
```bash
|
||||
openssl genpkey -quiet -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -outform PEM > mykey
|
||||
openssl rsa -RSAPublicKey_out < mykey > mykey.pub
|
||||
```
|
||||
Store the keys in `ietf-keystore` _without_ the header and footer information
|
||||
created by OpenSSL.
|
||||
|
||||
After the key has been stored in the keystore and given the name
|
||||
_mykey_ it can be added to SSH configuration:
|
||||
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit ssh
|
||||
admin@example:/config/ssh/> set hostkey mykey
|
||||
|
||||
## Console Port
|
||||
|
||||
For units with a console port, it is possible for users to login to
|
||||
shell/CLI with functionality similar to what is provided via SSH.
|
||||
|
||||
The type and setup for your console port is product specific. For
|
||||
instance, it can be a USB-C port connected to the CPU serial port
|
||||
using a USB-to-serial converter. To connect you would need a USB-C cable
|
||||
connected to the console port of the device. The serial port is
|
||||
typically setup to run at 115200 baud, 8N1.
|
||||
|
||||
|
||||
```
|
||||
Infix -- a Network Operating System v24.11.1 (ttyS0)
|
||||
example login: admin
|
||||
Password:
|
||||
.-------.
|
||||
| . . | Infix -- a Network Operating System
|
||||
|-. v .-| https://kernelkit.org
|
||||
'-'---'-'
|
||||
|
||||
Run the command 'cli' for interactive OAM
|
||||
|
||||
admin@example:~$
|
||||
```
|
||||
|
||||
The `resize` command can be used to update terminal settings to the
|
||||
size of your terminal window.
|
||||
|
||||
```
|
||||
admin@example:~$ resize
|
||||
COLUMNS=115;LINES=59;export COLUMNS LINES;
|
||||
admin@example:~$
|
||||
```
|
||||
|
||||
CLI can be entered from shell in the same way as for SSH.
|
||||
|
||||
```
|
||||
admin@example:~$ cli
|
||||
|
||||
See the 'help' command for an introduction to the system
|
||||
|
||||
admin@example:/> show interfaces
|
||||
INTERFACE PROTOCOL STATE DATA
|
||||
lo ethernet UP 00:00:00:00:00:00
|
||||
ipv4 127.0.0.1/8 (static)
|
||||
ipv6 ::1/128 (static)
|
||||
e1 ethernet LOWER-DOWN 00:53:00:06:03:01
|
||||
e2 ethernet LOWER-DOWN 00:53:00:06:03:02
|
||||
...
|
||||
admin@example:/>
|
||||
```
|
||||
|
||||
## Web, Web-console and RESTCONF
|
||||
|
||||
The system provides a set of Web services:
|
||||
|
||||
- a rudimentary Web server, currently limited to an information page
|
||||
- a RESTCONF server with equivalent management capabilities as NETCONF
|
||||
- a Web console service, where the shell/CLI can be accessed via
|
||||
HTTPS, similar to connecting via a console port or SSH
|
||||
|
||||
There is also a *Netbrowse* Web service presenting information about
|
||||
the unit's neighbors, collected via mDNS (see
|
||||
[Discovery](discovery.md) for more details).
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit web
|
||||
admin@example:/config/web/> help
|
||||
enabled Enable or disable on all web services.
|
||||
console Web console interface.
|
||||
netbrowse mDNS Network Browser.
|
||||
restconf IETF RESTCONF Server.
|
||||
admin@example:/config/web/>
|
||||
```
|
||||
|
||||
### Enable/disable Web Service and Server
|
||||
|
||||
The Web service can be enabled as shown below.
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit web
|
||||
admin@example:/config/web/> set enabled
|
||||
admin@example:/config/web/>
|
||||
```
|
||||
|
||||
Enabling the Web service implies that a Web server is
|
||||
enabled. Currently this Web server provides generic Infix information,
|
||||
as well as a link to a Web console. The Web server uses HTTPS; any
|
||||
HTTP request is redirected to HTTPS.
|
||||
|
||||
The _enabled_ setting for the Web service acts as a global
|
||||
enable/disable setting for the other Web services (Web console,
|
||||
RESTCONF and Netbrowse).
|
||||
|
||||
### Enable/disable Web Console
|
||||
|
||||
The Web console service provides a terminal service similar to Console
|
||||
or SSH. The Web console is secured via HTTPS on port 7861.
|
||||
|
||||
The Web console has its own enable/disable setting, but will only be
|
||||
activated if the Web service is enabled. The example below shows how
|
||||
to disable the Web console.
|
||||
|
||||
```
|
||||
admin@example:/config/web/> edit console
|
||||
admin@example:/config/web/console/> no enabled
|
||||
admin@example:/config/web/console/>
|
||||
```
|
||||
|
||||
### Enable/disable RESTCONF Service
|
||||
|
||||
Alternatively, the system can be managed remotely using
|
||||
RESTCONF. Meaning you can `curl` it instead of using a dedicated
|
||||
NETCONF client.
|
||||
|
||||
The RESTCONF service has its own enable/disable setting, but will
|
||||
only be activated if the Web service is enabled. The example below
|
||||
shows how to disable the RESTCONF service.
|
||||
|
||||
```
|
||||
admin@example:/config/web/> edit restconf
|
||||
admin@example:/config/web/restconf/> no enabled
|
||||
admin@example:/config/web/restconf/>
|
||||
```
|
||||
-130
@@ -1,130 +0,0 @@
|
||||
Netboot HowTo
|
||||
=============
|
||||
|
||||
This document describes how to set up network booting U-Boot devices on
|
||||
a LAN, e.g., when working with an evaluation board or other embedded
|
||||
system. The most secure way to do this is with a local LAN between a PC
|
||||
and the device.
|
||||
|
||||
Instead of setting up everything in U-Boot to download the Linux Image,
|
||||
device tree, and initramfs, we will let U-Boot download a script with
|
||||
instructions to run. When you have multiple systems (boards) this
|
||||
quickly becomes a lot easier to manage.
|
||||
|
||||
> [!NOTE]
|
||||
> Instructions in this HowTo assume a Debian based development system,
|
||||
> e.g., Ubuntu or Linux Mint.
|
||||
|
||||
|
||||
## Network Interface Setup
|
||||
|
||||
For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
|
||||
create an old-style interfaces config[^1] with the following content:
|
||||
|
||||
```
|
||||
# /etc/network/interfaces.d/gimli
|
||||
auto eth2
|
||||
iface eth2 inet static
|
||||
address 192.168.0.1
|
||||
netmask 255.255.255.0
|
||||
|
||||
auto eth3
|
||||
iface eth3 inet manual
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> Use configuration file names in `.d/` directories that make sense and
|
||||
> can easily be remembered. Here we use the hostname of the PC.
|
||||
|
||||
|
||||
## DHCP/TFTP Server Setup
|
||||
|
||||
The examples given here use `dnsmasq`, which provides both DHCP and TFTP
|
||||
server support. The same can be achieved with other implementations.
|
||||
|
||||
Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
|
||||
we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
|
||||
Add a file called `/etc/dnsmasq.d/gimli`.
|
||||
|
||||
Initial content:
|
||||
|
||||
```
|
||||
# Remember IP address handed out to BOOTP clients
|
||||
bootp-dynamic
|
||||
# Disable check-if-ip-address-is-already-used
|
||||
no-ping
|
||||
|
||||
# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
|
||||
# when using the same images for system upgrade as for netbooting.
|
||||
enable-tftp
|
||||
tftp-root=/srv/ftp
|
||||
```
|
||||
|
||||
> [!CAUTION]
|
||||
> First of all, make sure you DO NOT accidentally set up dnsmasq so that
|
||||
> it starts acting as a DHCP server also on your office LAN! Follow the
|
||||
> instructions below for more details.
|
||||
|
||||
If you have many interfaces used for lab equipment and only one office
|
||||
LAN interface, then use something like this:
|
||||
|
||||
```
|
||||
# Disable DHCP server on loopback and office LAN (eth0)
|
||||
except-interface=lo
|
||||
except-interface=eth0
|
||||
```
|
||||
|
||||
To further lock this down, we only run the DHCP server on each of the
|
||||
interfaces used for lab equipment, with a dedicated IP range as well:
|
||||
|
||||
```
|
||||
# Currently I have an imx8mp-evk on eth2, so on my system I have a
|
||||
# symlink bootfile-eth2 -> netboot.scr
|
||||
interface=eth2
|
||||
dhcp-range=192.168.0.100,192.168.0.199,1h
|
||||
dhcp-boot=tag:eth2,bootfile-eth2
|
||||
```
|
||||
|
||||
## Bootfile netboot.scr
|
||||
|
||||
The bootfile U-Boot retrieves from the TFTP server is a script that
|
||||
looks like this, `netboot.sh`:
|
||||
|
||||
```sh
|
||||
setenv ramdisk_addr_r 0x58000000
|
||||
setenv fdt_addr_r 0x50400000
|
||||
|
||||
setenv autoboot off
|
||||
tftp ${fdt_addr_r} imx8mp-evk/imx8mp-evk.dtb
|
||||
tftp ${kernel_addr_r} imx8mp-evk/Image
|
||||
tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
|
||||
|
||||
setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
|
||||
booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
|
||||
```
|
||||
|
||||
U-Boot cannot read script files directly, so we need to wrap it with a
|
||||
FIT format header, this is done by first converting it on the PC:
|
||||
|
||||
```
|
||||
$ mkimage -T script -d netboot.sh netboot.scr
|
||||
```
|
||||
|
||||
The output is `netboot.scr` which we symlink to above in the dnsmasq
|
||||
setup step.
|
||||
|
||||
|
||||
## U-Boot Commands
|
||||
|
||||
U-Boot is a maze of environment variables, some with values, some wrap
|
||||
commands, and most are undocumented. We will use a prefix for our
|
||||
variables to ensure we do not overwrite anything you may want to use
|
||||
later.
|
||||
|
||||
```sh
|
||||
==> setenv ixboot 'dhcp && source \${fileaddr}'
|
||||
==> saveenv
|
||||
```
|
||||
|
||||
|
||||
[^1]: To prevent NetworkManager from automatically managing the interfaces.
|
||||
+128
-480
@@ -7,10 +7,9 @@ model forms the base, extended with [ietf-ip.yang][2] and other layer-3
|
||||
IETF models. The layer-2 bridge and aggregate models are defined by
|
||||
Infix to exploit the unique features not available in IEEE models.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When issuing `leave` to activate your changes, remember to also save
|
||||
> your settings, `copy running-config startup-config`. See the [CLI
|
||||
> Introduction](cli/introduction.md) for a background.
|
||||
> **Note:** when issuing `leave` to activate your changes, remember to
|
||||
> also save your settings, `copy running-config startup-config`. See
|
||||
> the [CLI Introduction](cli/introduction.md) for a background.
|
||||
|
||||
|
||||
## Interface LEGO®
|
||||
@@ -43,18 +42,18 @@ it. In this example, traffic assigned to the VLAN in question would be
|
||||
diverted to the VLAN interface before entering the bridge, while all
|
||||
other traffic would be bridged as usual.
|
||||
|
||||
| **Type** | **Yang Model** | **Description** |
|
||||
|----------|----------------------------|--------------------------------------------------------------|
|
||||
| bridge | infix-if-bridge | SW implementation of an IEEE 802.1Q bridge |
|
||||
| ip | ietf-ip, infix-ip | IP address to the subordinate interface |
|
||||
| vlan | infix-if-vlan | Capture all traffic belonging to a specific 802.1Q VID |
|
||||
| lag | infix-if-lag | Link aggregation, static and IEEE 802.3ad (LACP) |
|
||||
| lo | ietf-interfaces | Software loopback interface |
|
||||
| eth | ieee802-ethernet-interface | Physical Ethernet device/port. |
|
||||
| | infix-ethernet-interface | |
|
||||
| veth | infix-if-veth | Virtual Ethernet pair, typically one end is in a container |
|
||||
| *common* | ietf-interfaces, | Properties common to all interface types |
|
||||
| | infix-interfaces | |
|
||||
| **Type** | **Yang Model** | **Description** |
|
||||
|----------|----------------------------|---------------------------------------------------------------|
|
||||
| bridge | infix-if-bridge | SW implementation of an IEEE 802.1Q bridge |
|
||||
| ip | ietf-ip, infix-ip | IP address to the subordinate interface |
|
||||
| vlan | infix-if-vlan | Capture all traffic belonging to a specific 802.1Q VID |
|
||||
| lag[^1] | infix-if-lag | Bonds multiple interfaces into one, creating a link aggregate |
|
||||
| lo | ietf-interfaces | Software loopback interface |
|
||||
| eth | ieee802-ethernet-interface | Physical Ethernet device/port. |
|
||||
| | infix-ethernet-interface | |
|
||||
| veth | infix-if-veth | Virtual Ethernet pair, typically one end is in a container |
|
||||
| *common* | ietf-interfaces, | Properties common to all interface types |
|
||||
| | infix-interfaces | |
|
||||
|
||||
|
||||
## Data Plane
|
||||
@@ -104,11 +103,10 @@ The `description` is saved as Linux `ifalias` on an interface. It is a
|
||||
free-form string, useful for describing purpose or just adding comments
|
||||
for remote debugging, e.g., using the operational datastore.
|
||||
|
||||
> [!CAUTION]
|
||||
> There is no validation or safety checks performed by the system when
|
||||
> using `custom-phys-address`. In particular the `offset` variant can
|
||||
> be dangerous to use -- pay attention to the meaning of bits in the
|
||||
> upper-most octet: local bit, multicast/group, etc.
|
||||
> **Note:** there is no validation or safety checks performed by the
|
||||
> system when using `custom-phys-address`. In particular the `offset`
|
||||
> variant can be dangerous to use -- pay attention to the meaning of
|
||||
> bits in the upper-most octet: local bit, multicast/group, etc.
|
||||
|
||||
#### Fixed custom MAC
|
||||
|
||||
@@ -154,9 +152,9 @@ fabric!
|
||||
#### MAC Bridge
|
||||
|
||||
In Infix ports are by default not switch ports, unless the customer
|
||||
specific factory config sets it up this way. To enable switching, with
|
||||
offloading if you have a switch chipset, between ports you create a
|
||||
bridge and then add ports to that bridge. Like this:
|
||||
specific factory config sets it up this way. To enable switching
|
||||
between ports you create a bridge and then add ports to that
|
||||
bridge. That's it.
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
@@ -169,16 +167,11 @@ admin@example:/config/> leave
|
||||
|
||||
Here we add two ports to bridge `br0`: `eth0` and `eth1`.
|
||||
|
||||
> [!TIP]
|
||||
> The CLI has several built-in helpers governed by convention. E.g.,
|
||||
> naming bridges `brN`, where `N` is a number, the type is *inferred*
|
||||
> automatically and unlocks all bridge features. Other conventions are
|
||||
> `vethNA`, where `N` is a number and `A` is a letter ('a' for access
|
||||
> port and 'b' for bridge side is common), and `ethN.M` for VLAN M on
|
||||
> top of `ethN`, or `dockerN` for a IP masquerading container bridge.
|
||||
>
|
||||
> Note, this inference only works with the CLI, configuring networking
|
||||
> over NETCONF or RESTCONF requires setting the type explicitly.
|
||||
> **Note:** Infix has many built-in helpers controlled by convention.
|
||||
> E.g., if you name your bridge `brN`, where `N` is a number, Infix sets
|
||||
> the interface type automatically and unlocks all bridge features.
|
||||
> Other "magic" names are `ethN.M` for VLAN M on top of `ethN`, or
|
||||
> `dockerN` to create an IP masquerading container bridge.
|
||||
|
||||
|
||||
|
||||
@@ -189,11 +182,11 @@ bridge should be used instead.
|
||||
|
||||
#### VLAN Filtering Bridge
|
||||
|
||||
By default bridges in Linux do not filter based on VLAN tags. This can
|
||||
be enabled when creating a bridge by adding a port to a VLAN as a tagged
|
||||
or untagged member. Use the port default VID (PVID) setting to control
|
||||
VLAN association for traffic ingressing a port untagged (default PVID:
|
||||
1).
|
||||
By default bridges in Linux do not filter based on VLAN tags. It can be
|
||||
enabled in Infix when creating a bridge by adding a port to a VLAN as a
|
||||
tagged or untagged member. Use the port default VID (PVID) setting to
|
||||
control VLAN association for traffic ingressing a port untagged (default
|
||||
PVID: 1).
|
||||
|
||||
```
|
||||
admin@example:/config/> edit interface br0
|
||||
@@ -221,15 +214,9 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 10 tagged br0
|
||||
admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
|
||||
```
|
||||
|
||||
To route or to manage via a VLAN, a VLAN interface needs to be created
|
||||
on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
|
||||
below for more on this topic.
|
||||
|
||||
> [!NOTE]
|
||||
> In some use-cases only a single management VLAN on the bridge is used.
|
||||
> For the example above, if the bridge itself is an untagged member only
|
||||
> in VLAN 10, IP addresses can be set directly on the bridge without the
|
||||
> need for dedicated VLAN interfaces on top of the bridge.
|
||||
> To route or to manage via a VLAN, a VLAN interface needs to be created
|
||||
> on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
|
||||
> below for more on this topic.
|
||||
|
||||
|
||||
#### Multicast Filtering and Snooping
|
||||
@@ -240,11 +227,10 @@ also supports "snooping", i.e., IGMP and MLD, to automatically reduce
|
||||
the broadcast effects of multicast. See the next section for a summary
|
||||
of the [terminology used](#terminology--abbreviations).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Currently there is no way to just enable multicast filtering without
|
||||
> also enabling snooping. This may change in the future, in which case
|
||||
> a `filtering` enabled setting will be made available along with the
|
||||
> existing `snooping` setting.
|
||||
> **Note:** currently there is no way to just enable multicast filtering
|
||||
> without also enabling snooping. This may change in the future, in
|
||||
> which case a `filtering` enabled setting will be made available along
|
||||
> with the existing `snooping` setting.
|
||||
|
||||
When creating your bridge you must decide if you need a VLAN filtering
|
||||
bridge or a plain bridge (see previous section). Multicast filtering is
|
||||
@@ -285,15 +271,15 @@ br0 224.1.1.1 e3, e2
|
||||
br0 ff02::6a br0
|
||||
```
|
||||
|
||||
This is a rather small LAN, so our bridge has already become the elected
|
||||
IGMP querier. We see it is ours because the timeout is `None`, and we
|
||||
recognize the IP address the system has detected, as ours. We can also
|
||||
see two ports that have joined the same IPv4 multicast group, 224.1.1.1,
|
||||
and one join from the system itself for the IPv6 group ff02::6a.
|
||||
It is a small LAN, so our bridge has already become the elected IGMP
|
||||
querier. We see it is ours because the timeout is `None`, and we
|
||||
recognize our IP address. We can also see two ports that have joined
|
||||
the same IPv4 multicast group, 224.1.1.1, and one join from Infix itself
|
||||
for the IPv6 group ff02::6a.
|
||||
|
||||
Now, let us see what happens when we add another bridge, this time with
|
||||
VLAN filtering enabled. We skip the boring parts about how to move
|
||||
ports e4-e7 to `br1` and assign them to VLANs, and again, focus on the
|
||||
Now, let's see what happens when we add another bridge, with VLAN
|
||||
filtering enabled. We skip the boring parts about how to move ports
|
||||
e4-e7 to `br1` and assign them to VLANs, and again, focus on the
|
||||
multicast bits only:
|
||||
|
||||
```
|
||||
@@ -305,7 +291,7 @@ admin@example:/config/interface/br1/> leave
|
||||
admin@example:/> copy running-config startup-config
|
||||
```
|
||||
|
||||
Let us see what we get:
|
||||
Let's see what we get:
|
||||
|
||||
```
|
||||
admin@example:/> show ip multicast
|
||||
@@ -384,314 +370,22 @@ an IGMP/MLD fast-leave port.
|
||||
tables shown above, a *None* timeout is declared when the current
|
||||
device is the active querier
|
||||
|
||||
> [!TIP]
|
||||
> The reason why multicast flooding is enabled by default is to ensure
|
||||
> safe co-existence with MAC multicast, which is common in industrial
|
||||
> networks. It also allows end devices that do not know of IGMP/MLD to
|
||||
> communicate over multicast as long as the group they have chosen is
|
||||
> not used by other IGMP/MLD aware devices on the LAN.
|
||||
> **Note:** the reason why multicast flooding is enabled by default is
|
||||
> to ensure safe co-existence with MAC multicast, which is very common
|
||||
> in industrial networks. It also allows end devices that do not know
|
||||
> of IGMP/MLD to communicate over multicast as long as the group they
|
||||
> have chosen is not used by other IGMP/MLD aware devices on the LAN.
|
||||
>
|
||||
> As soon as an IGMP/MLD membership report to "join" a group is received
|
||||
> the group is added to the kernel MDB and forwarding to other ports
|
||||
> stop. The only exception to this rule is multicast router ports.
|
||||
>
|
||||
> If your MAC multicast forwarding is not working properly, it may be
|
||||
> because an IP multicast group maps to the same MAC address. Please
|
||||
> see [RFC 1112][RFC1112] for details. Use static multicast router
|
||||
> ports, or static multicast MAC filters, to mitigate.
|
||||
> the group is added to the MDB and forwarding to other ports stop. The
|
||||
> only exception to this rule is multicast router ports.
|
||||
|
||||
[RFC1112]: https://www.rfc-editor.org/rfc/rfc1112.html
|
||||
[RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
|
||||
[RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html
|
||||
|
||||
#### Forwarding of IEEE Reserved Group Addresses
|
||||
|
||||
Addresses in the range `01:80:C2:00:00:0X` are used by various bridge
|
||||
signaling protocols, and are not forwarded by default. Still, it is
|
||||
sometimes useful to let the bridge forward such packets, this can be
|
||||
done by specifying protocol names or the last address *nibble* as
|
||||
decimal value `0..15`:
|
||||
|
||||
```
|
||||
admin@example:/config/> edit interface br0 bridge
|
||||
admin@example:/config/interface/br0/bridge/> set ieee-group-forward # Tap the ? ley for alternatives
|
||||
[0..15] List of IEEE link-local protocols to forward, e.g., STP, LLDP
|
||||
dot1x 802.1X Port-Based Network Access Control.
|
||||
lacp 802.3 Slow Protocols, e.g., LACP.
|
||||
lldp 802.1AB Link Layer Discovery Protocol (LLDP).
|
||||
stp Spanning Tree (STP/RSPT/MSTP).
|
||||
admin@example:/config/interface/br0/bridge/> set ieee-group-forward
|
||||
```
|
||||
|
||||
The following example configures bridge *br0* to forward LLDP packets.
|
||||
|
||||
```
|
||||
admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
|
||||
admin@example:/config/interface/br0/bridge/>
|
||||
```
|
||||
|
||||
|
||||
### Link Aggregation
|
||||
|
||||
A link aggregate, or *lag*, allows multiple physical interfaces to be
|
||||
combined into a single logical interface, providing increased bandwidth
|
||||
(in some cases) and redundancy (primarily). Two modes of qualifying lag
|
||||
member ports are available:
|
||||
|
||||
1. **static**: Active members selected based on link status (carrier)
|
||||
2. **lacp:** IEEE 802.3ad Link Aggregation Control Protocol
|
||||
|
||||
In LACP mode, LACPDUs are exchanged by the link partners to qualify each
|
||||
lag member, while in static mode only carrier is used. This additional
|
||||
exchange in LACP ensures traffic can be forwarded in both directions.
|
||||
|
||||
Traffic distribution, for both modes, across the active lag member ports
|
||||
is determined by the hash policy[^1]. It uses an XOR of the source,
|
||||
destination MAC addresses and the EtherType field. This, IEEE
|
||||
802.3ad-compliant, algorithm will place all traffic to a particular
|
||||
network peer on the same link. Meaning there is no increased bandwidth
|
||||
for communication between two specific devices.
|
||||
|
||||
> [!TIP]
|
||||
> Similar to other interface types, naming your interface `lagN`, where
|
||||
> `N` is a number, allows the CLI to automatically infer the interface
|
||||
> type as LAG.
|
||||
|
||||
|
||||
#### Basic Configuration
|
||||
|
||||
Creating a link aggregate interface and adding member ports:
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit interface lag0
|
||||
admin@example:/config/interface/lag0/> set lag mode static
|
||||
admin@example:/config/interface/lag0/> end
|
||||
admin@example:/config/> set interface eth7 lag-port lag lag0
|
||||
admin@example:/config/> set interface eth8 lag-port lag lag0
|
||||
admin@example:/config/> leave
|
||||
```
|
||||
|
||||
A static lag responds only to link (carrier) changes of member ports.
|
||||
E.g., in this example egressing traffic is continuously distributed over
|
||||
the two links until link down on one link is detected, triggering all
|
||||
traffic to be steered to the sole remaining link.
|
||||
|
||||
|
||||
#### LACP Configuration
|
||||
|
||||
LACP mode provides dynamic negotiation of the link aggregate. Key
|
||||
settings include:
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit interface lag0
|
||||
admin@example:/config/interface/lag0/> set lag mode lacp
|
||||
admin@example:/config/interface/lag0/> set lag lacp mode passive
|
||||
admin@example:/config/interface/lag0/> set lag lacp rate fast
|
||||
admin@example:/config/interface/lag0/> set lag lacp system-priority 100
|
||||
```
|
||||
|
||||
LACP mode supports two operational modes:
|
||||
|
||||
- **active:** Initiates negotiation by sending LACPDUs (default)
|
||||
- **passive:** Waits for peer to initiate negotiation
|
||||
|
||||
> [!NOTE]
|
||||
> At least one end of the link must be in active mode for negotiation to occur.
|
||||
|
||||
The LACP rate setting controls protocol timing:
|
||||
|
||||
- **slow:** LACPDUs sent every 30 seconds, with 90 second timeout (default)
|
||||
- **fast:** LACPDUs sent every second, with 3 second timeout
|
||||
|
||||
|
||||
#### Link Flapping
|
||||
|
||||
To protect against link flapping, debounce timers can be configured to
|
||||
delay link qualification. Usually only the `up` delay is needed:
|
||||
|
||||
```
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
|
||||
```
|
||||
|
||||
#### Operational Status, Overview
|
||||
|
||||
Like other interfaces, link aggregates are also available in the general
|
||||
interfaces overview in the CLI admin-exec context. Here is the above
|
||||
static mode aggregate:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces
|
||||
INTERFACE PROTOCOL STATE DATA
|
||||
lo ethernet UP 00:00:00:00:00:00
|
||||
ipv4 127.0.0.1/8 (static)
|
||||
ipv6 ::1/128 (static)
|
||||
.
|
||||
.
|
||||
.
|
||||
lag0 lag UP static: balance-xor, hash: layer2
|
||||
│ ethernet UP 00:a0:85:00:02:00
|
||||
├ eth7 lag ACTIVE
|
||||
└ eth8 lag ACTIVE
|
||||
```
|
||||
|
||||
Same aggregate, but in LACP mode:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces
|
||||
INTERFACE PROTOCOL STATE DATA
|
||||
lo ethernet UP 00:00:00:00:00:00
|
||||
ipv4 127.0.0.1/8 (static)
|
||||
ipv6 ::1/128 (static)
|
||||
.
|
||||
.
|
||||
.
|
||||
lag0 lag UP lacp: active, rate: fast (1s), hash: layer2
|
||||
│ ethernet UP 00:a0:85:00:02:00
|
||||
├ eth7 lag ACTIVE active, short_timeout, aggregating, in_sync, collecting, distributing
|
||||
└ eth8 lag ACTIVE active, short_timeout, aggregating, in_sync, collecting, distributing
|
||||
```
|
||||
|
||||
|
||||
#### Operational Status, Detail
|
||||
|
||||
In addition to basic status shown in the interface overview, detailed
|
||||
LAG status can be inspected:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces name lag0
|
||||
name : lag0
|
||||
index : 25
|
||||
mtu : 1500
|
||||
operational status : up
|
||||
physical address : 00:a0:85:00:02:00
|
||||
lag mode : static
|
||||
lag type : balance-xor
|
||||
lag hash : layer2
|
||||
link debounce up : 0 msec
|
||||
link debounce down : 0 msec
|
||||
ipv4 addresses :
|
||||
ipv6 addresses :
|
||||
in-octets : 0
|
||||
out-octets : 2142
|
||||
```
|
||||
|
||||
Same aggregate, but in LACP mode:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces name lag0
|
||||
name : lag0
|
||||
index : 24
|
||||
mtu : 1500
|
||||
operational status : up
|
||||
physical address : 00:a0:85:00:02:00
|
||||
lag mode : lacp
|
||||
lag hash : layer2
|
||||
lacp mode : active
|
||||
lacp rate : fast (1s)
|
||||
lacp aggregate id : 1
|
||||
lacp system priority: 65535
|
||||
lacp actor key : 9
|
||||
lacp partner key : 9
|
||||
lacp partner mac : 00:a0:85:00:03:00
|
||||
link debounce up : 0 msec
|
||||
link debounce down : 0 msec
|
||||
ipv4 addresses :
|
||||
ipv6 addresses :
|
||||
in-octets : 100892
|
||||
out-octets : 111776
|
||||
```
|
||||
|
||||
Member ports provide additional status information:
|
||||
|
||||
- Link failure counter: number of detected link failures
|
||||
- LACP state flags: various states of LACP negotiation:
|
||||
- `active`: port is actively sending LACPDUs
|
||||
- `short_timeout`: using fast rate (1s) vs. slow rate (30s)
|
||||
- `aggregating`: port is allowed to aggregate in this LAG
|
||||
- `in_sync`: port is synchronized with partner
|
||||
- `collecting`: port is allowed to receive traffic
|
||||
- `distributing`: port is allowed to send traffic
|
||||
- `defaulted`: using default partner info (partner not responding)
|
||||
- `expired`: partner info has expired (no LACPDUs received)
|
||||
- Aggregator ID: unique identifier for this LAG group
|
||||
- Actor state: LACP state flags for this port (local)
|
||||
- Partner state: LACP state flags from the remote port
|
||||
|
||||
Example member port status:
|
||||
|
||||
```
|
||||
admin@example:/> show interfaces name eth7
|
||||
name : eth7
|
||||
index : 8
|
||||
mtu : 1500
|
||||
operational status : up
|
||||
physical address : 00:a0:85:00:02:00
|
||||
lag member : lag0
|
||||
lag member state : active
|
||||
lacp aggregate id : 1
|
||||
lacp actor state : active, short_timeout, aggregating, in_sync, collecting, distributing
|
||||
lacp partner state : active, short_timeout, aggregating, in_sync, collecting, distributing
|
||||
link failure count : 0
|
||||
ipv4 addresses :
|
||||
ipv6 addresses :
|
||||
in-octets : 473244
|
||||
out-octets : 499037
|
||||
```
|
||||
|
||||
|
||||
#### Example: Switch Uplink with LACP
|
||||
|
||||
LACP mode provides the most robust operation, automatically negotiating
|
||||
the link aggregate and detecting configuration mismatches.
|
||||
|
||||
A common use case is connecting a switch to an upstream device:
|
||||
|
||||
```
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit interface lag0
|
||||
admin@example:/config/interface/lag0/> set lag mode lacp
|
||||
```
|
||||
|
||||
Enable fast LACP for quicker fail-over:
|
||||
|
||||
```
|
||||
admin@example:/config/interface/lag0/> set lag lacp rate fast
|
||||
```
|
||||
|
||||
Add uplink ports
|
||||
|
||||
```
|
||||
admin@example:/config/interface/lag0/> end
|
||||
admin@example:/config/> set interface eth7 lag-port lag lag0
|
||||
admin@example:/config/> set interface eth8 lag-port lag lag0
|
||||
```
|
||||
|
||||
Enable protection against "link flapping".
|
||||
|
||||
```
|
||||
admin@example:/config/interface/lag0/> edit lag link-monitor
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/> edit debounce
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set up 500
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> set down 200
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> top
|
||||
```
|
||||
|
||||
Add to bridge for switching
|
||||
|
||||
```
|
||||
admin@example:/config/interface/lag0/lag/link-monitor/debounce/> end
|
||||
admin@example:/config/> set interface lag0 bridge-port bridge br0
|
||||
admin@example:/config/> leave
|
||||
```
|
||||
|
||||
|
||||
### VLAN Interfaces
|
||||
|
||||
Creating a VLAN can be done in many ways. This section assumes VLAN
|
||||
Creating a VLAN can be done in many ways. This section assumes VLAN
|
||||
interfaces created atop another Linux interface. E.g., the VLAN
|
||||
interfaces created on top of the Ethernet interface or bridge in the
|
||||
picture below.
|
||||
@@ -731,9 +425,7 @@ As conventions, a VLAN interface for VID 20 on top of an Ethernet
|
||||
interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
|
||||
top of a bridge interface *br0* is named *vlan10*.
|
||||
|
||||
> [!NOTE]
|
||||
> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
|
||||
> number, the CLI infers the interface type automatically.
|
||||
> **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.
|
||||
|
||||
|
||||
### Physical Ethernet Interfaces
|
||||
@@ -792,10 +484,9 @@ Auto-negotiation of speed/duplex mode is desired in almost all
|
||||
use-cases, but it is possible to disable auto-negotiation and specify
|
||||
a fixed speed and duplex mode.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When setting a fixed speed and duplex mode, ensure both sides of the
|
||||
> link have matching configuration. If speed does not match, the link
|
||||
> will not come up. If duplex mode does not match, the result is
|
||||
> If setting a fixed speed and duplex mode, ensure both sides of the
|
||||
> link have matching configuration. If speed does not match, the link
|
||||
> will not come up. If duplex mode does not match, the result is
|
||||
> reported collisions and/or bad throughput.
|
||||
|
||||
The example below configures port eth3 to fixed speed 100 Mbit/s
|
||||
@@ -888,10 +579,9 @@ interfaces {
|
||||
admin@example:/config/>
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> This is another example of the automatic inference of the interface
|
||||
> type from the name. Any name can be used, but then you have to set
|
||||
> the interface type to `veth` manually.
|
||||
> **Note:** this is another example of the automatic inference of the
|
||||
> interface type from the name. Any name can be used, but then you have
|
||||
> to set the interface type to `veth` manually.
|
||||
|
||||
|
||||
## Management Plane
|
||||
@@ -899,8 +589,7 @@ admin@example:/config/>
|
||||
This section details IP Addresses And Other Per-Interface IP settings.
|
||||
|
||||
Infix support several network interface types, each can be assigned one
|
||||
or more IP addresses, both IPv4 and IPv6 are supported. (There is no
|
||||
concept of a "primary" address.)
|
||||
or more IP addresses, both IPv4 and IPv6 are supported.
|
||||
|
||||
|
||||
|
||||
@@ -914,8 +603,7 @@ Multiple address assignment methods are available:
|
||||
| link-local | infix-ip | Auto-assignment of IPv4 address in 169.254.x.x/16 range |
|
||||
| dhcp | infix-dhcp-client | Assignment of IPv4 address by DHCP server, e.g., *10.0.1.1/24* |
|
||||
|
||||
> [!NOTE]
|
||||
> The DHCP address method is only available for *LAN* interfaces
|
||||
> **Note:** DHCP address method is only available for *LAN* interfaces
|
||||
> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
|
||||
|
||||
Supported DHCP (request) options, configurability (Cfg) and defaults,
|
||||
@@ -923,36 +611,35 @@ are listed below. Configurable options can be disabled on a per client
|
||||
interface basis, some options, like `clientid` and option 81, are
|
||||
possible to set the value of as well.
|
||||
|
||||
| **Opt** | **Name** | **Cfg** | **Description** |
|
||||
|---------|-----------------------------|---------|-----------------------------------------------------|
|
||||
| 1 | `netmask` | No | Request IP address and netmask |
|
||||
| 3 | `router` | Yes | Default route(s), see also option 121 and 249 |
|
||||
| 6 | `dns-server` | Yes | DNS server(s), static ones take precedence |
|
||||
| 12 | `hostname` | Yes | DHCP cannot set hostname, only for informing server |
|
||||
| 15 | `domain` | Yes | Default domain name, for name resolution |
|
||||
| 28 | `broadcast` | Yes | Broadcast address, calculated if disabled |
|
||||
| 42 | `ntp-server` | Yes | NTP server(s), static ones take precedence |
|
||||
| 50 | `address` | Yes | Request (previously cached) address |
|
||||
| 61 | `client-id` | Yes | Default MAC address (and option 12) |
|
||||
| 81 | `fqdn` | Yes | Similar to option 12, request FQDN update in DNS |
|
||||
| 119 | `search` | Yes | Request domain search list |
|
||||
| 121 | `classless-static-route` | Yes | Classless static routes |
|
||||
| 249 | `ms-classless-static-route` | Yes | Microsoft static route, same as option 121 |
|
||||
| | | | |
|
||||
| **Opt** | **Name** | **Cfg** | **Description** |
|
||||
|---------|------------------|---------|-----------------------------------------------------|
|
||||
| 1 | `subnet` | No | Request IP address and netmask |
|
||||
| 3 | `router` | Yes | Default route(s), see also option 121 and 249 |
|
||||
| 6 | `dns` | Yes | DNS server(s), static ones take precedence |
|
||||
| 12 | `hostname` | Yes | DHCP cannot set hostname, only for informing server |
|
||||
| 15 | `domain` | Yes | Default domain name, for name resolution |
|
||||
| 28 | `broadcast` | Yes | Broadcast address, calculated if disabled |
|
||||
| 42 | `ntpsrv` | Yes | NTP server(s), static ones take precedence |
|
||||
| 50 | `address` | Yes | Request (previously cached) address |
|
||||
| 61 | `clientid` | Yes | Default MAC address (and option 12) |
|
||||
| 81 | `fqdn` | Yes | Similar to option 12, request FQDN update in DNS |
|
||||
| 119 | `search` | Yes | Request domain search list |
|
||||
| 121 | `staticroutes` | Yes | Classless static routes |
|
||||
| 249 | `msstaticroutes` | Yes | Microsoft static route |
|
||||
| | | | |
|
||||
|
||||
**Default:** `router`, `dns-server`, `domain`, `broadcast`, `ntp-server`, `search`,
|
||||
`address`, `classless-static-route`, `ms-classless-static-route`
|
||||
**Default:** `router`, `dns`, `domain`, `broadcast`, `ntpsrv`, `search`,
|
||||
`address`, `staticroutes`, `msstaticroutes`
|
||||
|
||||
When configuring a DHCP client, ensure that the NTP client is enabled
|
||||
for the `ntp-server` DHCP option to be processed correctly. If the NTP
|
||||
for the `ntpsrv` DHCP option to be processed correctly. If the NTP
|
||||
client is not enabled, any NTP servers provided by the DHCP server will
|
||||
be ignored. For details on how to enable the NTP client, see the [NTP
|
||||
Client Configuration](system.md#ntp-client-configuration) section.
|
||||
be ignored. For details on how to enable the NTP client, see the
|
||||
[NTP Client Configuration](system.md#ntp-client-configuration) section.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Per [RFC3442][4], if the DHCP server returns both a Classless Static
|
||||
> Routes option (121) and Router option (3), the DHCP client *must*
|
||||
> ignore the latter.
|
||||
> **Note:** as per [RFC3442][4], if the DHCP server returns both a
|
||||
> Classless Static Routes option (121) and Router option (3), the
|
||||
> DHCP client *must* ignore the latter.
|
||||
|
||||
|
||||
### IPv6 Address Assignment
|
||||
@@ -1040,6 +727,7 @@ will be used, otherwise it falls back to the default algorithm.
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit dhcp-client
|
||||
admin@example:/config/dhcp-client/> set client-if eth0
|
||||
admin@example:/config/dhcp-client/> set enabled true
|
||||
admin@example:/config/dhcp-client/> leave
|
||||
admin@example:/> show interfaces
|
||||
INTERFACE PROTOCOL STATE DATA
|
||||
@@ -1059,7 +747,7 @@ The resulting address (10.1.2.100/24) is of type *dhcp*.
|
||||
The (only) way to disable IPv6 link-local addresses is by disabling IPv6
|
||||
on the interface.
|
||||
|
||||
```
|
||||
```(disabling
|
||||
admin@example:/> configure
|
||||
admin@example:/config/> edit interface eth0 ipv6
|
||||
admin@example:/config/interface/eth0/ipv6/> set enabled false
|
||||
@@ -1173,38 +861,33 @@ have changed type to *random*.
|
||||
To be able to route (static or dynamic) on the interface it is
|
||||
required to enable forwarding. This setting controls if packets
|
||||
received on this interface can be forwarded.
|
||||
|
||||
```
|
||||
admin@example:/config/> edit interface eth0
|
||||
admin@example:/config/interface/eth0/> set ipv4 forwarding
|
||||
admin@example:/config/interface/eth0/> leave
|
||||
admin@example:/>
|
||||
```
|
||||
```
|
||||
admin@example:/config/> edit interface eth0
|
||||
admin@example:/config/interface/eth0/> set ipv4 forwarding
|
||||
admin@example:/config/interface/eth0/> leave
|
||||
admin@example:/>
|
||||
```
|
||||
|
||||
|
||||
### IPv6 forwarding
|
||||
|
||||
Due to how the Linux kernel manages IPv6 forwarding, we can not fully
|
||||
control it per interface via this setting like how IPv4 works. Instead,
|
||||
IPv6 forwarding is globally enabled when at least one interface enable
|
||||
forwarding, otherwise it is disabled.
|
||||
This flag behaves totally different than for IPv4. For IPv6 the
|
||||
ability to route between interfaces is always enabled, instead this
|
||||
flag controls if the interface will be in host/router mode.
|
||||
|
||||
The following table shows the system IPv6 features that the `forwarding`
|
||||
setting control when it is *Enabled* or *Disabled:
|
||||
| **Feature** | **Forward enabled** | **Forward disabled** |
|
||||
|:-----------------------------------------|:--------------------|:---------------------|
|
||||
| IsRouter set in Neighbour Advertisements | Yes | No |
|
||||
| Transmit Router Solicitations | No | Yes |
|
||||
| Router Advertisements are ignored | No | Yes |
|
||||
| Accept Redirects | No | Yes |
|
||||
|
||||
| **IPv6 Feature** | **Enabled** | **Disabled** |
|
||||
|:-----------------------------------------|:------------|:-------------|
|
||||
| IsRouter set in Neighbour Advertisements | Yes | No |
|
||||
| Transmit Router Solicitations | No | Yes |
|
||||
| Router Advertisements are ignored | Yes | Yes |
|
||||
| Accept Redirects | No | Yes |
|
||||
|
||||
```
|
||||
admin@example:/config/> edit interface eth0
|
||||
admin@example:/config/interface/eth0/> set ipv6 forwarding
|
||||
admin@example:/config/interface/eth0/> leave
|
||||
admin@example:/>
|
||||
```
|
||||
```
|
||||
admin@example:/config/> edit interface eth0
|
||||
admin@example:/config/interface/eth0/> set ipv6 forwarding
|
||||
admin@example:/config/interface/eth0/> leave
|
||||
admin@example:/>
|
||||
```
|
||||
|
||||
|
||||
## Routing support
|
||||
@@ -1223,10 +906,9 @@ The base model, ietf-routing, is where all the other models hook in. It
|
||||
is used to set configuration and read operational status (RIB tables) in
|
||||
the other models.
|
||||
|
||||
> [!NOTE]
|
||||
> The standard IETF routing models allows multiple instances, but Infix
|
||||
> currently *only support one instance* per routing protocol! In the
|
||||
> examples presented here, the instance name `default` is used.
|
||||
> **Note:** the standard IETF routing models allows multiple instances,
|
||||
> but Infix currently *only support one instance* per routing protocol!
|
||||
> In the examples presented here, the instance name `default` is used.
|
||||
|
||||
|
||||
### IPv4 Static routes
|
||||
@@ -1252,7 +934,6 @@ router 192.168.1.1, using the highest possible distance:
|
||||
admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
|
||||
admin@example:/>
|
||||
|
||||
> [!TIP]
|
||||
> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
|
||||
> interfaces you want to route between.
|
||||
|
||||
@@ -1276,7 +957,6 @@ enable OSPF and set one active interface in area 0:
|
||||
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
|
||||
admin@example:/>
|
||||
|
||||
> [!TIP]
|
||||
> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for all the
|
||||
> interfaces you want to route between.
|
||||
|
||||
@@ -1331,38 +1011,6 @@ an Ethernet interface can be done as follows.
|
||||
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
|
||||
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>
|
||||
|
||||
#### OSPF global settings
|
||||
|
||||
In addition to *area* and *interface* specific settings, OSPF provides
|
||||
global settings for route redistribution and OSPF router identifier.
|
||||
|
||||
```
|
||||
admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
|
||||
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set ?
|
||||
area List of OSPF areas.
|
||||
default-route-advertise Distribute default route to network
|
||||
explicit-router-id Defined in RFC 2328. A 32-bit number
|
||||
redistribute Redistribute protocols into OSPF
|
||||
admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set
|
||||
```
|
||||
|
||||
- Explicit router ID: By default the router will pick an IP address
|
||||
from one of its OSPF interfaces as OSPF router ID. An explicit ID is
|
||||
used to get a deterministic behavior, e.g., `set explicit-router-id
|
||||
1.1.1.1`.
|
||||
- Redistribution: `set redistribute static` and `set redistribute connected`
|
||||
can be used to include static or connected routes into the OSPF routing
|
||||
domain. These routes are redistributed as *external type-2* (E2)
|
||||
routes.
|
||||
- Advertising default route: An OSPF router can be made to distribute
|
||||
a default route into the OSPF domain by command `set
|
||||
default-route-advertise enabled`. This route is distributed as long
|
||||
as the router itself has an *active* default route in its routing
|
||||
table. By adding command `set default-route-advertise always` the
|
||||
router will distribute a default route even when it lacks a default
|
||||
route. The default route will be distributed as an *external type-2*
|
||||
(E2) route.
|
||||
|
||||
|
||||
#### Debug OSPFv2
|
||||
|
||||
@@ -1465,11 +1113,10 @@ different next-hop, learned from a DHCP server wins over an OSPF route.
|
||||
The distance used for static routes and DHCP routes can be changed by
|
||||
setting a different *routing preference* value.
|
||||
|
||||
> [!NOTE]
|
||||
> The kernel metric is an unsigned 32-bit value, which is read by Frr as
|
||||
> (upper) 8 bits distance and 24 bits metric. But it does not write it
|
||||
> back to the kernel FIB this way, only selected routes are candidates
|
||||
> to be installed in the FIB by Frr.
|
||||
> **Note:** the kernel metric is an unsigned 32-bit value, which is read
|
||||
> by Frr as (upper) 8 bits distance and 24 bits metric. But it does not
|
||||
> write it back to the kernel FIB this way, only selected routes are
|
||||
> candidates to be installed in the FIB by Frr.
|
||||
|
||||
|
||||
#### Source protocol
|
||||
@@ -1492,7 +1139,7 @@ currently supported, namely `ipv4` and `ipv6`.
|
||||
[4]: https://www.rfc-editor.org/rfc/rfc3442
|
||||
[0]: https://frrouting.org/
|
||||
|
||||
[^1]: `(source MAC XOR destination MAC XOR EtherType) MODULO num_links`
|
||||
[^1]: Please note, link aggregates are not yet supported in Infix.
|
||||
[^2]: Link-local IPv6 addresses are implicitly enabled when enabling
|
||||
IPv6. IPv6 can be enabled/disabled per interface in the
|
||||
[ietf-ip][2] YANG model.
|
||||
@@ -1503,10 +1150,11 @@ currently supported, namely `ipv4` and `ipv6`.
|
||||
[^4]: A YANG deviation was previously used to make it possible to set
|
||||
`phys-address`, but this has been replaced with the more flexible
|
||||
`custom-phys-address`.
|
||||
[^5]: MAC bridges on Marvell Linkstreet devices are currently limited to
|
||||
a single MAC database, this may be a problem if the same MAC address
|
||||
appears in different MAC bridges.
|
||||
[^6]: Ethernet counters are described in *ieee802-ethernet-interface.yang*
|
||||
and *infix-ethernet-interface.yang*. There is a dedicated document on
|
||||
[Ethernet Counters](eth-counters.md) that provide additional details
|
||||
on the statistics support.
|
||||
[^5]: Infix MAC bridges on Marvell Linkstreet devices are currently
|
||||
limited to use a single MAC database, causing issues if the same
|
||||
MAC address appears on different MAC bridges.
|
||||
[^6]: Ethernet counters are described in
|
||||
*ieee802-ethernet-interface.yang* and
|
||||
*infix-ethernet-interface.yang*. [Ethernet
|
||||
Counters](eth-counters.md) page provides additional details on
|
||||
statistics support.
|
||||
|
||||
+3
-120
@@ -653,70 +653,6 @@ on interface *e0*.
|
||||
~$
|
||||
```
|
||||
|
||||
### Change a Binary Setting
|
||||
|
||||
A YANG `binary` type setting is Base64 encoded and requires a little bit
|
||||
more tricks. We take the opportunity to showcase a shell script helper:
|
||||
`/usr/bin/text-editor`, which works just like the `text-editor` command
|
||||
in the CLI, but this one takes an XPath argument to the binary leaf to
|
||||
edit.
|
||||
|
||||
Stripped down, it looks something like this:
|
||||
|
||||
```bash
|
||||
if tmp=$(sysrepocfg -G "$xpath"); then
|
||||
file=$(mktemp)
|
||||
|
||||
echo "$tmp" | base64 -d > "$file"
|
||||
if edit "$file"; then
|
||||
tmp=$(base64 -w0 < "$file")
|
||||
sysrepocfg -S "$xpath" -u "$tmp"
|
||||
fi
|
||||
|
||||
rm -f "$file"
|
||||
else
|
||||
echo "Failed to retrieve value for $xpath"
|
||||
exit 1
|
||||
fi
|
||||
```
|
||||
|
||||
An example container configuration, with an embedded file that is
|
||||
mounted to `/var/www/index.html` can look like this:
|
||||
|
||||
```json
|
||||
"infix-containers:containers": {
|
||||
"container": [
|
||||
{
|
||||
"name": "web",
|
||||
"image": "oci-archive:/lib/oci/curios-httpd-latest.tar.gz",
|
||||
"hostname": "web",
|
||||
"network": {
|
||||
"interface": [
|
||||
{
|
||||
"name": "veth-sys0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"mount": [
|
||||
{
|
||||
"name": "index.html",
|
||||
"content": "PCFET0NUWVBFIGh0bWwjibberish.shortened.down==",
|
||||
"target": "/var/www/index.html"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
The command to edit this file, and restart the container with the new
|
||||
contents, look like this:
|
||||
|
||||
```
|
||||
admin@infix:~$ cfg edit "/infix-containers:containers/container[name='web']/mount[name='index.html']/content"
|
||||
```
|
||||
|
||||
|
||||
### <a id="backup"></a> Backup Configuration Using sysrepocfg And scp
|
||||
|
||||
Displaying running or startup configuration is possible with
|
||||
@@ -853,18 +789,14 @@ models for details.
|
||||
### Factory Reset
|
||||
|
||||
```
|
||||
~$ curl -kX POST -u admin:admin \
|
||||
-H "Content-Type: application/yang-data+json" \
|
||||
https://example.local/restconf/operations/ietf-factory-default:factory-reset
|
||||
~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-factory-default:factory-reset -u admin:admin
|
||||
curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0
|
||||
```
|
||||
|
||||
### System Reboot
|
||||
|
||||
```
|
||||
~$ curl -kX POST -u admin:admin \
|
||||
-H "Content-Type: application/yang-data+json" \
|
||||
https://example.local/restconf/operations/ietf-system:system-restart
|
||||
~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:system-restart -u admin:admin
|
||||
```
|
||||
|
||||
### Set Date and Time
|
||||
@@ -872,11 +804,7 @@ curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while r
|
||||
Here's an example of an RPC that takes input/argument:
|
||||
|
||||
```
|
||||
~$ curl -kX POST -u admin:admin \
|
||||
-H "Content-Type: application/yang-data+json" \
|
||||
-d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}' \
|
||||
https://example.local/restconf/operations/ietf-system:set-current-datetime
|
||||
|
||||
~$ curl -kX POST -H "Content-Type: application/yang-data+json" https://example.local/restconf/operations/ietf-system:set-current-datetime -u admin:admin -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}'
|
||||
```
|
||||
|
||||
You can verify that the changes took by a remote SSH command:
|
||||
@@ -887,51 +815,6 @@ Wed Apr 17 14:48:12 UTC 2024
|
||||
~$
|
||||
```
|
||||
|
||||
### Read Hostname
|
||||
|
||||
Example of fetching JSON configuration data to stdout:
|
||||
|
||||
```
|
||||
~$ curl -kX GET -u admin:admin \
|
||||
-H 'Accept: application/yang-data+json' \
|
||||
https://example.local/restconf/data/ietf-system:system/hostname
|
||||
{
|
||||
"ietf-system:system": {
|
||||
"hostname": "foo"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Set Hostname
|
||||
|
||||
Example of inline JSON data:
|
||||
|
||||
```
|
||||
~$ curl -kX PATCH -u admin:admin \
|
||||
-H 'Content-Type: application/yang-data+json' \
|
||||
-d '{"ietf-system:system":{"hostname":"bar"}}' \
|
||||
https://example.local/restconf/data/ietf-system:system
|
||||
```
|
||||
|
||||
### Copy Running to Startup
|
||||
|
||||
No copy command available yet to copy between datastores, and the
|
||||
Rousette back-end also does not support "write-through" to the
|
||||
startup datastore.
|
||||
|
||||
To save running-config to startup-config, use the following example to
|
||||
fetch running to a local file and then update startup with it:
|
||||
|
||||
```
|
||||
~$ curl -kX GET -u admin:admin -o running-config.json \
|
||||
-H 'Accept: application/yang-data+json' \
|
||||
https://example.local/restconf/ds/ietf-datastores:running
|
||||
|
||||
~$ curl -kX PUT -u admin:admin -d @running-config.json \
|
||||
-H 'Content-Type: application/yang-data+json' \
|
||||
https://example.local/restconf/ds/ietf-datastores:startup
|
||||
```
|
||||
|
||||
|
||||
## Miscellaneous
|
||||
|
||||
|
||||
+59
-106
@@ -11,10 +11,9 @@ specific string followed by the last three octets of the system base MAC
|
||||
address, e.g., `switch-12-34-56`. An example of how to change the
|
||||
hostname is included below.
|
||||
|
||||
> [!NOTE]
|
||||
> When issuing `leave` to activate your changes, remember to also save
|
||||
> your settings, `copy running-config startup-config`. See the [CLI
|
||||
> Introduction](cli/introduction.md) for a background.
|
||||
> **Note:** when issuing `leave` to activate your changes, remember to
|
||||
> also save your settings, `copy running-config startup-config`. See
|
||||
> the [CLI Introduction](cli/introduction.md) for a background.
|
||||
|
||||
|
||||
## Changing Password
|
||||
@@ -25,14 +24,14 @@ available in the system authentication configuration context.
|
||||
```
|
||||
admin@host:/config/> edit system authentication user admin
|
||||
admin@host:/config/system/authentication/user/admin/> change password
|
||||
New password:
|
||||
Retype password:
|
||||
New password:
|
||||
Retype password:
|
||||
admin@host:/config/system/authentication/user/admin/> leave
|
||||
```
|
||||
|
||||
The `change password` command starts an interactive dialogue that asks
|
||||
for the new password, with a confirmation, and then salts and encrypts
|
||||
the password with sha512crypt.
|
||||
the password with sha512crypt.
|
||||
|
||||
It is also possible to use the `set password ...` command. This allows
|
||||
setting an already hashed password. To manually hash a password, use
|
||||
@@ -40,8 +39,7 @@ the `do password encrypt` command. This launches the admin-exec command
|
||||
to hash, and optionally salt, your password. This encrypted string can
|
||||
then be used with `set password ...`.
|
||||
|
||||
> [!TIP]
|
||||
> If you are having trouble thinking of a password, there is a nifty
|
||||
> **Tip:** if you are having trouble thinking of a password, Infix has a
|
||||
> `password generate` command in admin-exec context which generates
|
||||
> random passwords using the UNIX command `pwgen`. Use the `do` prefix
|
||||
> when inside any configuration context to access admin-exec commands.
|
||||
@@ -57,7 +55,7 @@ With SSH keys in place it is possible to disable password login, just
|
||||
remember to verify SSH login and network connectivity before doing so.
|
||||
|
||||
```
|
||||
admin@host:/config/> edit system authentication user admin
|
||||
admin@host:/config/> edit system authentication user admin
|
||||
admin@host:/config/system/authentication/user/admin/> edit authorized-key example@host
|
||||
admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set algorithm ssh-rsa
|
||||
admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> set key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTTH8SKvAE4g8Rr97KOz/8PFtOObBrE9G21K7d6UBuPqmd0RUF2CkXXN/eN2PBSHJ50YprRFt/z/304bsBYkDdflKlPDjuSmZ/+OMp4pTsq0R0eNFlX9wcwxEzooIb7VPEdvWE7AYoBRUdf41u3KBHuvjGd1M6QYJtbFLQMMTiVe5IUfyVSZ1RCxEyAB9fR9CBhtVheTVsY3iG0fZc9eCEo89ErDgtGUTJK4Hxt5yCNwI88YaVmkE85cNtw8YwubWQL3/tGZHfbbQ0fynfB4kWNloyRHFr7E1kDxuX5+pbv26EqRdcOVGucNn7hnGU6C1+ejLWdBD7vgsoilFrEaBWF41elJEPKDzpszEijQ9gTrrWeYOQ+x++lvmOdssDu4KvGmj2K/MQTL2jJYrMJ7GDzsUu3XikChRL7zNfS2jYYQLzovboUCgqfPUsVba9hqeX3U67GsJo+hy5MG9RSry4+ucHs=
|
||||
@@ -67,10 +65,9 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
|
||||
admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The `ssh-keygen` program already base64 encodes the public key data,
|
||||
> so there is no need to use the `text-editor` command, `set` does the
|
||||
> job.
|
||||
> **Note:** the `ssh-keygen` program already base64 encodes the public
|
||||
> key data, so there is no need to use the `text-editor` command, `set`
|
||||
> does the job.
|
||||
|
||||
|
||||
## Multiple Users
|
||||
@@ -148,7 +145,7 @@ is committed by issuing the `leave` command.
|
||||
admin@host:/config/> edit system
|
||||
admin@host:/config/system/> set hostname example
|
||||
admin@host:/config/system/> leave
|
||||
admin@example:/>
|
||||
admin@host:/>
|
||||
```
|
||||
|
||||
The hostname is advertised over mDNS-SD in the `.local` domain. If
|
||||
@@ -157,24 +154,8 @@ case, mDNS will advertise a "uniqified" variant, usually suffixing with
|
||||
an index, e.g., `example-1.local`. Use an mDNS browser to scan for
|
||||
available devices on your LAN.
|
||||
|
||||
In some cases you may want to set the device's *domain name* as well.
|
||||
This is handled the same way:
|
||||
|
||||
```
|
||||
admin@host:/config/> edit system
|
||||
admin@host:/config/system/> set hostname foo.example.com
|
||||
admin@host:/config/system/> leave
|
||||
admin@foo:/>
|
||||
```
|
||||
|
||||
Both host and domain name are stored in the system files `/etc/hosts`
|
||||
and `/etc/hostname`. The latter is exclusively for the host name. The
|
||||
domain *may* be used by the system DHCP server when handing out leases
|
||||
to clients, it is up to the clients to request the domain name *option*.
|
||||
|
||||
> [!NOTE]
|
||||
> Critical services like syslog, mDNS, LLDP, and similar that advertise
|
||||
> the hostname, are restarted when the hostname is changed.
|
||||
> **Note:** critical services like syslog, mDNS, LLDP, and similar that
|
||||
> advertise the hostname, are restarted when the hostname is changed.
|
||||
|
||||
|
||||
## Changing Login Banner
|
||||
@@ -183,9 +164,8 @@ The `motd-banner` setting is an Infix augment and an example of a
|
||||
`binary` type setting that can be changed interactively with the
|
||||
built-in [`text-editor` command](cli/text-editor.md).
|
||||
|
||||
> [!TIP]
|
||||
> See the next section for how to change the editor used to something
|
||||
> you may be more familiar with.
|
||||
> **Tip:** see the next section for how to change the editor used
|
||||
> to something you may be more familiar with.
|
||||
|
||||
```
|
||||
admin@host:/config/> edit system
|
||||
@@ -216,90 +196,43 @@ admin@host:/config/system/> leave
|
||||
admin@host:/>
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Configuration changes only take effect after issuing the `leave`
|
||||
> command. I.e., you must change the editor first, and then re-enter
|
||||
> configure context to use your editor of choice.
|
||||
|
||||
|
||||
## DNS Resolver Configuration
|
||||
|
||||
The system supports both static and dynamic (DHCP) DNS setup. The
|
||||
locally configured (static) server is preferred over any acquired
|
||||
from a DHCP client.
|
||||
|
||||
```
|
||||
admin@host:/> configure
|
||||
admin@host:/config/> edit system dns-resolver
|
||||
admin@host:/config/system/dns-resolver/> set server google udp-and-tcp address 8.8.8.8
|
||||
admin@host:/config/system/dns-resolver/> show
|
||||
server google {
|
||||
udp-and-tcp {
|
||||
address 8.8.8.8;
|
||||
}
|
||||
}
|
||||
admin@host:/config/system/dns-resolver/> leave
|
||||
```
|
||||
|
||||
It is also possible to configure resolver options like timeout and
|
||||
retry attempts. See the YANG model for details, or use the built-in
|
||||
help system in the CLI.
|
||||
|
||||
> [!NOTE]
|
||||
> When acting as a DHCP server and DNS proxy for other devices, any
|
||||
> local DNS server configured here is automatically used as upstream DNS
|
||||
> server.
|
||||
> **Note:** as usual, configuration changes only take effect after
|
||||
> issuing the `leave` command. I.e., you must change the editor first,
|
||||
> and then re-enter configure context to use your editor of choice.
|
||||
|
||||
|
||||
## NTP Client Configuration
|
||||
|
||||
Below is an example configuration for enabling NTP with a specific
|
||||
server and the `iburst` option for faster initial synchronization.
|
||||
Below is an example configuration for enabling NTP
|
||||
with a specific server and the `iburst` option for faster initial
|
||||
synchronization.
|
||||
|
||||
```
|
||||
admin@host:/> configure
|
||||
admin@host:/config/> edit system ntp
|
||||
admin@host:/config/system/ntp/> set enabled
|
||||
admin@host:/config/system/ntp/> set server ntp-pool
|
||||
admin@host:/config/system/ntp/> set server ntp-pool udp address pool.ntp.org
|
||||
admin@host:/config/system/ntp/> set server ntp-pool iburst
|
||||
admin@host:/config/system/ntp/> set server ntp-pool prefer
|
||||
admin@host:/config/system/ntp/> leave
|
||||
admin@host:/config/> set system ntp enabled
|
||||
admin@host:/config/> set system ntp server ntp-pool
|
||||
admin@host:/config/> set system ntp server ntp-pool udp address pool.ntp.org
|
||||
admin@host:/config/> set system ntp server ntp-pool iburst
|
||||
admin@host:/config/> set system ntp server ntp-pool prefer
|
||||
```
|
||||
|
||||
This configuration enables the NTP client and sets the NTP server to
|
||||
`pool.ntp.org` with the `iburst` and `prefer` options. The `iburst`
|
||||
option ensures faster initial synchronization, and the `prefer` option
|
||||
This configuration enables the NTP client and sets the NTP server to
|
||||
`pool.ntp.org` with the `iburst` and `prefer` options. The `iburst`
|
||||
option ensures faster initial synchronization, and the `prefer` option
|
||||
designates this server as preferred.
|
||||
|
||||
* `prefer false`: The NTP client will choose the best available source
|
||||
based on several factors, such as network delay, stratum, and other
|
||||
based on several factors, such as network delay, stratum, and other
|
||||
metrics (default config).
|
||||
* `prefer true`: The NTP client will try to use the preferred server
|
||||
* `prefer true`: The NTP client will try to use the preferred server
|
||||
as the primary source unless it becomes unreachable or unusable.
|
||||
|
||||
|
||||
### Show NTP Sources
|
||||
|
||||
The status for NTP sources is availble in YANG and accessable with
|
||||
CLI/NETCONF/RESTCONF.
|
||||
|
||||
To view the sources being used by the NTP client, run:
|
||||
```
|
||||
admin@target:/> show ntp
|
||||
ADDRESS MODE STATE STRATUM POLL-INTERVAL
|
||||
192.168.1.1 server candidate 1 6
|
||||
192.168.2.1 server candidate 1 6
|
||||
192.168.3.1 server selected 1 6
|
||||
```
|
||||
|
||||
### Show NTP Status
|
||||
|
||||
To check the status of NTP synchronization (only availble in CLI), use
|
||||
the following command:
|
||||
To check the status of NTP synchronization, use the following command:
|
||||
|
||||
```
|
||||
admin@host:/> show ntp tracking
|
||||
admin@host:/> show ntp
|
||||
Reference ID : C0248F86 (192.36.143.134)
|
||||
Stratum : 2
|
||||
Ref time (UTC) : Mon Oct 21 10:06:45 2024
|
||||
@@ -316,14 +249,34 @@ Leap status : Normal
|
||||
admin@host:/>
|
||||
```
|
||||
|
||||
This output provides detailed information about the NTP status, including
|
||||
This output provides detailed information about the NTP status, including
|
||||
reference ID, stratum, time offsets, frequency, and root delay.
|
||||
|
||||
> [!TIP]
|
||||
> The system uses `chronyd` Network Time Protocol (NTP) daemon. The
|
||||
> output shown here is best explained in the [Chrony documentation][4].
|
||||
### Show NTP Sources
|
||||
|
||||
To view the sources being used by the NTP client, run:
|
||||
|
||||
```
|
||||
admin@host:/> show ntp sources
|
||||
|
||||
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
|
||||
/ .- Source state '*' = current best, '+' = combined, '-' = not combined,
|
||||
| / 'x' = may be in error, '~' = too variable, '?' = unusable.
|
||||
|| .- xxxx [ yyyy ] +/- zzzz
|
||||
|| Reachability register (octal) -. | xxxx = adjusted offset,
|
||||
|| Log2(Polling interval) --. | | yyyy = measured offset,
|
||||
|| \ | | zzzz = estimated error.
|
||||
|| | | \
|
||||
MS Name/IP address Stratum Poll Reach LastRx Last sample
|
||||
===============================================================================
|
||||
^* 192.36.143.134 1 6 177 9 +278ms[ -3845s] +/- 514ms
|
||||
admin@host:/>
|
||||
```
|
||||
|
||||
> The system uses `chronyd` for Network Time Protocol (NTP)
|
||||
> synchronization. The output shown here is best explained in the
|
||||
> [Chrony documentation](https://chrony-project.org/doc/4.6.1/chronyc.html).
|
||||
|
||||
[1]: https://www.rfc-editor.org/rfc/rfc7317
|
||||
[2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
|
||||
[3]: https://www.rfc-editor.org/rfc/rfc8341
|
||||
[4]: https://chrony-project.org/doc/4.6.1/chronyc.html
|
||||
|
||||
+16
-8
@@ -243,15 +243,23 @@ spanning tree matches the expected one.
|
||||
|
||||
Integration to Infix
|
||||
--------------------
|
||||
When the test environment is started with Qeneth, it doesn't use the
|
||||
base image directly. Instead, it creates a copy and inserts a `test-mode`
|
||||
flag into it. During the bootstrap phase, the system checks for the
|
||||
presence of the test-mode flag (file).
|
||||
To successfully run all Infix tests, the image must be built in
|
||||
'test-mode'. This can be achieved by setting the DISK_IMAGE_TEST_MODE
|
||||
parameter to true. Although this is the default setting, it’s advisable
|
||||
to verify it by running:
|
||||
|
||||
If the flag exists, a 'test-config.cfg' file is generated. In the
|
||||
following step, the system loads the 'test-config' instead of the
|
||||
standard `startup-config` (or `factory-config`). This configuration
|
||||
is simple and safe, equivalent to the one used in 'Secure Mode'
|
||||
$ make menuconfig
|
||||
(External Options --> -*- Disk image --> [*] Enable Test Mode)
|
||||
|
||||
Building an image in 'test-mode' results in the creation of a 'test-mode'
|
||||
file within the auxiliary (aux) partition of the Infix disk image
|
||||
(/mnt/aux/test-mode).
|
||||
|
||||
During the bootstrap phase, the system checks for the presence of this
|
||||
test-mode flag (file). If the flag exists, a 'test-config.cfg' file is
|
||||
generated. In the following step, the system loads the 'test-config'
|
||||
instead of the standard startup-config (or factory-config). This
|
||||
configuration is simple and safe, equivalent to the one used in 'Secure Mode'
|
||||
(also known as 'failure-config').
|
||||
|
||||
Additionally, the configuration enables extra RPCs related to system
|
||||
|
||||
+12
-51
@@ -25,6 +25,17 @@ for `x86_64`:
|
||||
$ make
|
||||
$ make test
|
||||
|
||||
It is important to mention that Infix build system by default creates
|
||||
an image in 'test-mode'. The mode is set by DISK_IMAGE_TEST_MODE
|
||||
parameter (default=true). To generate a standard image set the
|
||||
DISK_IMAGE_TEST_MODE to 'false'. However, only the test mode ensures
|
||||
that all Infix tests are executed properly. Prior to the set of commands
|
||||
above, it is always good to check that DISK_IMAGE_TEST_MODE is properly
|
||||
set by running:
|
||||
|
||||
$ make menuconfig
|
||||
(External Options --> -*- Disk image --> [*] Enable Test Mode)
|
||||
|
||||
### Physical Devices
|
||||
|
||||
To run the tests on a preexisting topology from the host's network
|
||||
@@ -88,11 +99,8 @@ arguments:
|
||||
To run a suite of tests, e.g., only the DHCP client tests, pass the
|
||||
suite as an argument to [9PM][]:
|
||||
|
||||
11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml
|
||||
11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/all.yaml
|
||||
|
||||
To run the suite of all tests:
|
||||
|
||||
11:42:53 infamy0:test # ./9pm/9pm.py case/all.yaml
|
||||
|
||||
### Connecting to Infamy
|
||||
|
||||
@@ -307,52 +315,5 @@ The test specifaction can be genererated with:
|
||||
|
||||
$ make test-spec
|
||||
|
||||
### Test Development
|
||||
|
||||
For adding a new test to the automated regression test suite, it's best
|
||||
to start by reviewing an existing test case.
|
||||
|
||||
All tests are located in the `infix/test/case` repository and are
|
||||
grouped by the features they verify. For example,
|
||||
`infix/test/case/infix_services` contains tests for various Infix
|
||||
services, such as LLDP and mDNS.
|
||||
|
||||
While test grouping is flexible, each test should be placed in a
|
||||
logically relevant category.
|
||||
|
||||
When creating a new test group, add it to `infix/test/case/all.yaml`,
|
||||
to enable it to run as a
|
||||
[subset of the test suite](#running-subsets-of-tests):
|
||||
|
||||
```
|
||||
- name: infix-services
|
||||
suite: infix_services/infix_services.yaml
|
||||
```
|
||||
|
||||
A new test (e.g., lldp_enable_disable) should be added to the
|
||||
corresponding test group .yaml file, such as
|
||||
`infix/test/cases/infix_services.yaml`:
|
||||
|
||||
```
|
||||
- name: lldp_enable_disable
|
||||
case: lldp_enable_disable/test.py
|
||||
```
|
||||
|
||||
It is necessary to include the test in
|
||||
`infix/test/case/infix_services/Readme.adoc` to ensure proper test
|
||||
specification generation:
|
||||
|
||||
```
|
||||
include::lldp_enable_disable/Readme.adoc[]
|
||||
```
|
||||
|
||||
Each test case should have its own directory under,
|
||||
`infix/test/case/infix_services`, containing:
|
||||
- `test.py` - the test script
|
||||
- `topology.dot` - the logical topology definition.
|
||||
|
||||
When the [test specification](#test-specification) is generated,
|
||||
`topology.svg` and `Readme.adoc` should also be created.
|
||||
|
||||
[9PM]: https://github.com/rical/9pm
|
||||
[Qeneth]: https://github.com/wkz/qeneth
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
# Tunnel configuration
|
||||
|
||||
Tunnel traffic from point A to point B
|
||||
|
||||
|
||||
## Generic Routing Encapsulation (GRE)
|
||||
|
||||
The support for GRE tunnels includes IPv4 and IPv6 tunnels both in GRE
|
||||
(IP) and GRETAP (MAC) modes.
|
||||
```
|
||||
admin@example:/config/> edit interface gre1
|
||||
admin@example:/config/interface/gre1/> set type gretap
|
||||
admin@example:/config/interface/gre1/> set gre local 192.168.3.1 remote 192.168.3.2
|
||||
admin@example:/config/interface/gre1/> leave
|
||||
admin@example:/>
|
||||
```
|
||||
|
||||
## Virtual eXtensible Local Area Network (VXLAN)
|
||||
|
||||
The support for VXLAN tunnels includes IPv4 and IPv6.
|
||||
|
||||
```
|
||||
admin@example:/config/> edit interface vxlan100
|
||||
admin@example:/config/interface/vxlan100/> set vxlan local 192.168.3.1
|
||||
admin@example:/config/interface/vxlan100/> set vxlan remote 192.168.3.2
|
||||
admin@example:/config/interface/vxlan100/> set vxlan vni 100
|
||||
admin@example:/config/interface/vxlan100/> leave
|
||||
```
|
||||
+3
-1
@@ -1,7 +1,9 @@
|
||||
include $(BR2_EXTERNAL_INFIX_PATH)/infix.mk
|
||||
IXMSG = printf "\e[37;44m>>> $(call qstrip,$(1))\e[0m\n"
|
||||
|
||||
include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/*/*.mk))
|
||||
include $(BR2_EXTERNAL_INFIX_PATH)/board/common/common.mk
|
||||
-include $(BR2_EXTERNAL_INFIX_PATH)/board/$(patsubst "%",%,$(BR2_ARCH))/board.mk
|
||||
include $(BR2_EXTERNAL_INFIX_PATH)/infix.mk
|
||||
include $(BR2_EXTERNAL_INFIX_PATH)/test/test.mk
|
||||
|
||||
.PHONY: local.mk
|
||||
|
||||
@@ -1,12 +1 @@
|
||||
IXMSG = printf "\e[37;44m>>> $(call qstrip,$(1))\e[0m\n"
|
||||
|
||||
oem-dir := $(call qstrip,$(INFIX_OEM_PATH))
|
||||
INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))
|
||||
|
||||
# Unless the user specifies an explicit build id, source it from git.
|
||||
# The build id also becomes the image version, unless an official
|
||||
# release is being built.
|
||||
export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
|
||||
export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
|
||||
|
||||
INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral
|
||||
|
||||
@@ -1,9 +1,5 @@
|
||||
menu "Packages"
|
||||
|
||||
comment "Hardware Support"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
|
||||
|
||||
comment "Software Packages"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/confd-test-mode/Config.in"
|
||||
@@ -34,13 +30,11 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
|
||||
source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
|
||||
|
||||
endmenu
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user