This update brings new support for editing cleartext-symmetric-keys with
the 'change' command. The cleartext-symmetric-key is of type binary and
its use differs between different key-formats.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix key format identities now derive from the IETF bases, so the standard
identityref accepts them without any need for deviations. This also preserves
the nacm default rules, which were inadvertently dropped before.
Also rename format identities for generality:
- wifi-preshared-key-format -> renamed: 'passphrase-key-format'
- wireguard-symmetric-key-format -> use IETF 'octet-string-key-format'
Since cleartext-symmetric-key is now type binary (base64-encoded), the
WiFi backends (station and AP) decode values before passing them to
wpa_supplicant and hostapd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Environment variables are stored in a separate .env file from the main
container script. The config SHA256 checksum only covered the script
file, so changes to env vars went undetected -- the container was not
recreated and kept running with stale values.
Include the env file contents in the config checksum calculation so that
any change to environment variables triggers a proper container restart.
Fixes#1313
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Type a command, regret you typed so much before checking something else,
comment it out for later with Meta-# (Alt-Shift-3). The whole line is
now commented out and saved to history. Recall it later with Ctrl-P or
Up arrow, delete the leading # with Ctrl-D, and run it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduced in Linux 6.17, the force_forwding flag corresponds to the
ipv4 forwarding flag, which maps perfectly to the ietf-ip.yang model.
Fixes#515
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All build scripts use $BR2_ARCH to determine location of critical board files
and configuration. As per previous decisions, the BR2_ARCH variable controls
all naming in Infix and for consistency the defconfig files are also renamed.
This fixes the issue with missing DTB file(s) for the Raspberry Pi 2B.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump toolchain to match other build targets GCC 13 -> 14
- Drop post-build.sh to match other build targets
- Add features to arm_defconfig, all except containers
- Enable chck hashes
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix locations of packages to match 'make update-defconfig' order
- Fix defconfig syntax for watchdogd tempmon ...
- Enable check hashes on all defconfigs
- Add missing wireguard and wifi support to RiscV
- Rename dongle support for X86_64 build
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The RTL8169 firmware was specifically added for the Raspberry Pi Compute
Module 4 IoT Router Board Mini, it does not need to be part of defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a warning from fakeroot by adjusting the type in the permission
table. Apparently the chown + chmod operations were always done even
though the type was wrong.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
RSSI is a vendor-specific relative index (0-255), while dBm is an
absolute power measurement. Since we report dBm values from iw,
rename the leaf to signal-strength for accuracy.
Also, add a check() function with a user-friendly reminder if the forget
to include the model prefix in the URL.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For some reason, during the last refactor possibly, the dhcp client
stopped sending the current hostname to the dhcp server. This is very
useful to check what devices are on your network by asking the home
router's dhcp server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, gcc complains that ap_op may be used unset, so let's set it to the
only safe default there is.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The trick to starting the scanner mode is to have a dummy network that
cannot associate with anything.
Fixes#1193
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Was set to informational, and Zebra to debug, which is mostly useful for
developers when debugging the integration of Frr daemons.
Example of before this patch:
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: staticd[4366], stopping, sending SIGTERM ...
Nov 4 13:44:09 infix-6f-05-e1 staticd[4366]: Terminating on signal
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [N5M5Y-J5BPG][EC 4043309121] Client 'static' (session id 0) encountered an error and is shutting down.
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [KQB7H-NPVW9] zebra/zebra_ptm.c:1333 failed to find process pid registration
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [JPSA8-5KYEA] client 26 disconnected 1 static routes removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [S929C-NZR3N] client 26 disconnected 0 static nhgs removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: Starting staticd[5529]
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [V98V0-MTWPF] client 26 says hello and bids fair to announce only static routes vrf=0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want the command to show the entire log file, but fast forward to and
tail at the end, handling any file rotations from syslogd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Learned one thing, a setting not set, is a safe setting.
bss_color made a lot of iPhones failed to connect.
Remove some more options with unknown impact.
The networking guide has grown out of control for quite some time, it is
time to split it up into multiple files. This will hopefully also make
it a bit more accessible to users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add missing SVG For dhcpv6 example
- Fix link to static routes in WireGuard doc
- Add WireGuard to a new VPN sub-section in nav bar
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure umask is properly managed around file creation
to maintain consistent behavior across the codebase.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If we time out waiting for a wifi dongle, or onboard chipset, instead of
causing fatal error in dagger and b0rking startup, we cheat and create a
dummy interface.
Also, fix bug in HEAD, the condition was == wifi_ap but the comment said
"if not station or scanning mode". Since wpa_supplicant is for station
mode (not AP), the cleanup should happen when != wifi_ap.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Simplify, prefer readability
- Fix nftw() 'nopenfd' argument
- Constify
The most interesting change is the argument to nftw(), 0 -> 20, to
ensure it is allowed to open enough file descriptors to descend.
In POSIX it is undefined if nopenfd is < 1.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, spruce up the table a bit. Allow it to resize, let the SSID column
be flexible, and right-align column(s) with numbers.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Extend the WiFi station mode with rx-speed and tx-speed leaves,
mirroring what already exists for AP mode connected stations.
Display bitrates in 'show interface <wifi>' detailed view.
Also standardize speed units to kbps/Mbps across the YANG model.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When fdopen() succeeds, the FILE stream takes ownership of the file
descriptor. Calling fclose() automatically closes the underlying fd, so
the subsequent close(fd) calls were double-close bugs that could cause
undefined behavior.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify USB device debugging by allowing USB core to always announce
details of every new USB device to syslog.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the shell is blocked on sleep, signal handlers don't execute until
the command completes. This caused the script to ignore SIGTERM at
shutdown, forcing Finit to wait and eventually SIGKILL it instead.
Fix by running sleep in the background and using wait, which is
interruptible by signals.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit bf1eca0567.
This mess up order if having more than 1 phy, have not been
reproduce the error that got me to introduce this fix from
the beginning.
This is obsolete. By remove this we expose radio as mandatory.
This since a Wi-Fi interface is not possible to create without
a radio to connect it to.
This is run per interface, not per radio so its place
in hardware.c was wrong. This also opens up for multiple
station interfaces per radio, but not for now that it locked
down in a must expression for now.
Then hostapd needs to be restarted, handle this by adding the wifi container
to the diff if a custom-phys-address has been changed on a Wi-Fi interface.
Ensure the 9pm report tool runs inside the container so that it has
permissions to write to the test/.log directory. Then mark the log
directory as 777 when done so the ghmoon 'git clean -ffdx' can clean
it up when switching between jobs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Need to verify that client hostnames have been set before starting the
client, otherwise the test will fail due to clients getting pool lease,
which is intended.
In a real-world scenario this is not a problem. Here we've booby trapped
the server to try to trip up errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Used by the new NACM basic test to verify ACL rules on explicit XPaths
or modules. For this we cannot rely on put_config_dict() since it now
uses the candidate datastore for all changes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Switch RESTCONF from PUT to PATCH for configuration updates. This gives
RESTCONF the same merge behavior as NETCONF edit-config, allowing NACM
to correctly enforce path-specific permissions instead of requiring
write access to the entire datastore.
Fixes#617
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Otherwise the file will not be updated by confd on datastore copy:
Jan 12 14:26:37 foo confd[3410]: Overwrite existing file /cfg/startup-config.cfg (y/N)? <FF>
Jan 12 14:26:37 foo confd[3410]: Error: OK, aborting.:Inappropriate ioctl for device
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- relocate src/show.py to src/bin/show/
- Refactor container() to use run_sysrepo() instead of rolling its own
- Replace sysrepocfg with copy which supports nacm
- Rename run_sysrepocfg() -> get_json()
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since sysrepocfg does not do any NACM based on the UNIX user, we expand
the scope of the copy tool slightly to allow outputting JSON to stdout.
This allows us to replace all sysrepocfg commands in the CLI used to
show runnining/startup/factory.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Previously the sys-cli group was for interactive shell access, but with
ever changing requirements this split has become necessary.
This commit introduces the 'sysrepo' group for low-level access to all
sysrepo commands, i.e., bootstrap only. For user-level shell access a
'klish' group is added which allows users to connect to the CLI. This
is now the only group users, including the default 'admin', are members
of, effectively making the new 'copy' tool the norm.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch enables umask and nacm defalts in the Buildoot sysrepo
package and a patch to sysrepo to set the sysrepo group also on the
event pipes in /etc/sysrepo/, without which it would be hard to inject
any type of new event as non-root user now since the umask now prevent
all 'other' users from interacting with sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We could go with the old default sha512crypt, but since the default has
changed to yescrypt, as used by the 'change password' command. We use
that for consistency.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- The new SocketGroup setting allows for configurable /run/klishd.sock
- Also a bug fix for async commands, needed to fix regressions in the
klish-plugin-sysrepo commands 'change passwordk' and 'text-editor'
after the latest upgrade to sysrepo + libyang v4
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysrepocfg tool does not set up nacm based on $USER, and we now have
the shell 'copy' tool which does. So drop 'cfg' and while we're at it
we also drop the 'edit' alias.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The wi-fi architecture in infix require udev to run and remove the kernel automatic wlan-interface
this. Unclear reason, but it seems that udev sometimes miss the add event.
This is a decision right now, that we support multi ssid AP, but
only one station interface, this is the only thing the c-code support
right now, so only allow this in the yang validation.
Service descriptions or command arguments may contain special characters
that need to be escaped in JSON strings.
Example:
{
...
"command": "udhcpc -f -p /run/dhcp-client-wan.pid -t 3 -T 5 -A 30 -a1000 -S -R -o -O 1 -O 3 -O 6 -O 12 -O 15 -O 28 -O 42 -i wan -V "NanoPi R2S"",
...
}
Also, wrap add_services() in a try/except instead of testing for keys.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The table_width() class method was lost in b826bcb9d, so we take the
opportunit to refactor to SimpleTable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verified with latest Finit 4.15 that reboot after resize works.
Added a comment to the board-specific .mk file about the broken
WDT on the RK3328 SoC, or rather the NanoPi R2S board.
Fixes#1292
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Board probing cannot copy board specific files to /usr (read-only), so
let's share this script with all other aarch64 boards.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When interfaces were moved from firewall zones to become bridge or LAG
ports (e.g., sfp1/sfp2 moved from WAN zone to lan-br), the firewall
configuration was not regenerated. This caused stale entries in
/etc/firewalld/zones/*.xml where interfaces remained listed in their
old zones despite no longer being L3 interfaces.
Root cause: firewall_change() only triggered on firewall model changes,
but interface membership changes (bridge-port/lag-port) occur in the
ietf-interfaces model. When interfaces become member ports, they
transition from L3 to L2, which affects the result of
interfaces_get_all_l3() used for default zone assignment.
Fix: Expand the diff check to also trigger firewall regeneration when
bridge-port or lag-port configuration changes, ensuring firewall zones
stay synchronized with actual L3 interface topology.
Fixes#1345
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When users modified firewall zone services (e.g., enabling SSH on WAN),
firewalld.conf would disappear from /etc/firewalld/, causing firewalld
to fail with "Failed to load '/etc/firewalld/firewalld.conf': [Errno 2]
No such file or directory".
Root cause: After switching to the "roll in" staging directory approach
late in development, firewalld.conf generation was still conditional on
changes to "default" or "logging" settings. When other changes (zones,
services, policies) were made:
1. Code created /etc/firewalld+/ staging directory
2. Skipped generating firewalld.conf (no default/logging in diff)
3. On commit: rm -rf /etc/firewalld (deleted firewalld.conf!)
4. Renamed /etc/firewalld+ → /etc/firewalld (incomplete config)
Fix: Always generate firewalld.conf whenever firewall configuration is
being staged, not just for default/logging changes.
Fixes#1346
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace BusyBox udhcpc6 with OpenWrt's odhcp6c for improved DHCPv6
functionality and better integration with Router Advertisements (RA).
The primary motivation is support for a common ISP deployment scenario
where IPv6 addresses are assigned via SLAAC (from Router Advertisements)
and DHCPv6 is used in stateless/information-only mode to provide DNS
servers and other configuration options. This hybrid RA+DHCPv6 setup is
standard practice for many ISPs but was not supported by udhcpc6, which
treats RA and DHCPv6 as separate, non-integrated mechanisms.
Additional benefits of odhcp6c:
- Better IPv6 Prefix Delegation (IA-PD) support with proper handling
of delegated prefix lifetimes and renewal
- Native integration of RA-provided configuration (DNS servers, routes,
addresses) with DHCPv6-provided options
- Support for stateless DHCPv6 via information-only mode
To verify stateless DHCPv6 integration with SLAAC addresses - the ISP
scenario that motivated this migration, a new test case has been added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Almost full support for WireGuard
admin@server:/> show interface wg0
name : wg0
type : wireguard
index : 10
mtu : 1420
operational status : up
ipv4 addresses : 10.0.0.1/24 (static)
ipv6 addresses : fd00::1/64 (static)
peers : 2
Peer 1:
public key : ROaZyvJc5DzA2XUAAeTj2YlwDsy2w0lr3t+rWj2imAk=
status : UP
endpoint : 192.168.10.2:51821
latest handshake : 2025-12-09T22:51:38+00:00
transfer tx : 1412 bytes
transfer rx : 1324 bytes
Peer 2:
public key : Om9CPLYdK3l93GauKrq5WXo/gbcD+1CeqFpobRLLkB4=
status : UP
endpoint : 2001:db8:3c4d:20::2:51822
latest handshake : 2025-12-09T22:51:38+00:00
transfer tx : 1812 bytes
transfer rx : 428 bytes
in-octets : 1752
out-octets : 3224
admin@server:/>
This is described on the internet as:
"If you are unlucky and have a device with wrong MAC address,
too bad"
For us: We set mac addresses static, and do not use hostapds, insane
MAC address allocation (radio MAC + n).
Upstream sysrepo commit 90ce1f7 modified sr_nacm_init() to explicitly switch
the session to SR_DS_RUNNING before initializing NACM. This broke our klish
workflow which started sessions on SR_DS_CANDIDATE.
This commit drops the sysrepo patch that reverts that behavior in favor of
explicitly starting sessions on SR_DS_RUNNING for NACM initialization, then
switch to SR_DS_CANDIDATE for editing operations. This works with sysrepo's
behavior: NACM reads rules from running datastore while our editing workflow
operates on candidate datastore.
Also, add prompt path shortening for deep configuration hierarchies.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If running outside container find the netns inside the container, then
enter that netns.
lazzer@tollan ~/src/github.com/kernelkit/infix3 (add-wireguard)$ sudo ./test/nsenter d2b
(netns:d2b) #
Example usage:
./src/statd/python/yanger/yanger -p wifi0 -x "ixll -A ssh enp195s0f0 sudo" ietf-hardware | ./board/common/rootfs/usr/libexec/infix/wifi-channel-map.py
Show the congestion in the 2.4 band.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
* Add support for AP (list connected stations)
* Add scan-mode (Scan without create a fully configured station)
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The original 'show firewall log' just did the same as the 'show log firewall'
command. This new implementation allows showing pretty-printed firewall log
which is admittedly easier on the eyes.
Also, add 'show firewall matrix' to just show the zone matrix overview.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Leverage the operational data to present a more human-friendly view of
containers in the CLI. Replacing the podman script wrapper.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The constaint was supposed to be 50% of one CPU core, or 500 millicores
as per Kubernetes nomenclature.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for flexible columns. When a column is marked
as flexible it means it can be stretched when printing the table to an
optional minimal table width. Multiple columns can be marked and when
this occurs the padding is applied equally to all columns.
Also, make sure to only add 2 char padding between columns, not always
at the end, or we will require larger terminal than necessary.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finit is capable of setting up all basic file systems, even /run but
Infix relies on it allowing executing scripts (dagger and container)
so leave that for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is most noticeable in interface context
admin@infix-00-00-00:/config/interface/e1/> set type wifi
admin@infix-00-00-00:/config/interface/e1/> set
bind-ni-name bridge-port container-network custom-phys-address description enabled ethernet
where you previously got *all* containers for all interface-types.
It changes the datastore to running when init nacm, this
make klish misbehave:
Klish open candidate -> init nacm -> now all changes are made in running
Schema node "type" for parent "/ietf-routing:routing/control-plane-protocols/control-plane-protocol/ietf-ospf:ospf" not found;
in expr "derived-from-or-self(../../rt:type"
The cfg.ext4 disk image was created but not formatted because mkfs.ext4
wasn't found. As sbin is not in PATH for an unprivileged user in
Debian.
This caused the VM boot to fail with "No persistent storage found for /cfg".
Signed-off-by: Richard Alpe <richard@bit42.se>
Attempt to fix permissions with sudo before falling back to $HOME,
and verify directory is actually writable before proceeding.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Actually disable iitod on Styx DCP-SC-28p to work around #670, this
prohibits software control of LEDs, leaving the default HW control,
which has proven more stable on this platform.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove fixed lengths from Column class
- Add dynamic width calculation to SimpleTable
- Update service table to use new batched printing
Signed-off-by: Richard Alpe <richard@bit42.se>
Add resource-limit and resource-usage containers to YANG model. Podman,
and later conmon, enforce CPU and memory limits in a delegated cgroupsv2
hierarchy managed by Finit.
Resource usage is queried from 'podman inspect', which has more nodes
than what is currently possible to limit.
Requires Finit 4.15, or later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace manual f-string formatting with SimpleTable/Column classes.
This new "framework" handles ANSI colors and padding. Removing the
hassle of manually calculating padding. You simply specify the header
with max number of chars the data can be and if you want left/right
padding and the "framework" calculates the padding for you.
We use this new "framework" to pretty print the newly added services
statistics.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add statistics container to service model with memory usage, uptime,
and restart count tracking.
Updates YANG revision to 2025-12-02.
Signed-off-by: Richard Alpe <richard@bit42.se>
This update got pretty messy, since libyang had some
breaking changes. And unfortunatly rousette, libyang-cpp
and sysrepo-cpp has not made any new release yet.
We previously run a draft version of a lot of YANG models,
netconf-server,ssh-server and mode. Now they are released
with minor changes.
infix-meta is an exception, here we had to remove the obsolete
marker of the node and value, since this is no longer allowed in
libyang.
Previously rousette did not install the yang models so we kept a copy
of them in confd. Now it is implemented in rousette, let them install
their models.
On platforms based on CN913{0,1,2}, collect all ECC related counters
so that we know if any correctable errors have been encountered since
the most recent boot.
Allow particular boards or platforms install hardware specific scripts
in /etc/support.d, via the usual /usr/share/product logic, which are
then run by /sbin/support and included in the resulting bundle.
This lets us collect hardware specific information, e.g., SoC-specific
error counters, without /sbin/support needing to know about all the
nitty gritty details.
Verify that if the system encounters a hard lockup, i.e., interrupts
are no longer being serviced, then the system's watchdog will
correctly reboot it.
Rev. A has a FLASH that Linux reconfigures to 4B-addressing, but must
be in 3B-addressing when accessed by the BootROM. Since it has no
reset input, this would not work on warm resets. Linux has a
workaround for this issue for the common case of a controlled reboot,
which this change enables on those boards (which are admittedly few
and far between, but still useful as testing vehicles).
(This won't take effect until Finit is updated to at least 4.15, which
switches over from watchdog- to reboot(2)- based reboot, by default)
By default, ensure that the target device accepts TCP connections on
the specified port before returning the device object. This aligns the
SSH implementation with {NET,REST}CONF.
This solves the issue where tests that use SSH commands early in their
execution would sometimes fail as the remote server had not started up
yet.
Store historical snapshots as compressed .json.gz files to reduce disk
usage. The operational.json file remains uncompressed for easy access.
Signed-off-by: Richard Alpe <richard@bit42.se>
Dump operational datastore to timestamped JSON snapshots every 5 minutes
(in /var/lib/statd/). The operational.json symlink always points to the
latest snapshot.
Implement hierarchical retention policy that keeps the first snapshot of
each time period (hour/day/week/month/year), providing fine-grained recent
history while preventing unbounded disk usage.
This will allow us to plot / track how the system state evolves as
well as give us somewhat fine-grained info in the case of an event,
such as a crash.
Add unit test simulating months of snapshots to verify retention
behavior using a statd stub that only runs the retention code locally
(unit test)
Signed-off-by: Richard Alpe <richard@bit42.se>
Turn on OOPS-to-panic, soft/hard lockup panic, hung-task panic, and
extra workqueue watchdog reporting. This makes latent stalls visible
instead of silently freezing, improving diagnosis of issues like the
recent resource-pressure lockup.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Newer board revisions of RPi4 and CM4, as well as older boards with
upgraded EEPROM, require newer firmware.
This is a backport of the latest rpi-firmware on Buildroot master.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds diagnostic data and additional logging to catch the root
cause for issue #1303:
- Exactly when and why cleanup is called
- Whether the cd /tmp command succeeds
- The actual tar exit code (not just 255 from SSH)
- Whether cleanup happens before tar completes (race condition)
- The full collection.log showing the sequence of events
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch unlocks "routing interfaces" support in the ietf-routing yang
model. An array of interface with IP forwarding enabled.
Note, because of #515 we skip IPv6 forwarding for now. This will in the
near future be handled by a per-interface force_forwarding sysctl flag.
The 'show interface [ifname]' admin-exec command has been extended with
a Flags field for a quick overview of which interfaces have forwarding
currently enabled.
Fixes#647
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After merging post-post-image, TRUSTED_KEYS must be set in order for
the keys to be injected into the U-Boot DTB, so we need to explicitly
enable it for all boards that use the generic secure boot scripts.
This was a stray config fragment used during development that was
accedentally included in the referenced commit.
Fixes: 0fe5964909 ("aarch64_qemu_boot: Restore build after removing post-image.sh")
Previously, post-image.sh was able to create QEMU images from an
existing release tarball. This was useful when you wanted to test a
new bootloader build without having to wait for a full Infix build.
Restore this capability by adding a separate image target for it, and
then allow image-itb-qcow to source its input images from that instead
of a locally build squash+aux.
Limit support to x86, like we do on the "official" appliances on the
marketplace. Aarch64 has never really been used AFAIK.
Avoid the os-release import, since all that info is not important now
that these appliance files are only for development scenarios. In all
other cases, the official one, based on a proper release, should be
used.
We have not installed .dtb:s to $O/images/ for quite some time, and
nobody cared. That goes to show that this is not really used.
The image is still useful at times, so if it needed in the future,
then we can resurrect it from the logs and refactor it to an image
package.
Add a generic image target to build aux.ext4, which can be used both
when creating target-specific SD-card images, and when creating
regular disk images.
While we're here, make sure that we don't need a RAUC bundle in order
to generate aux.ext4 (which mkrauc-status.sh did). This saves us time
on _every_ incremental build.
Rather than using the creation of a signed image as a proxy for
whether the trusted keys should be installed RAUC/U-Boot's trust
stores, use the dedicated option.
The board/*/*/*.mk is very broad, intended to hit all board specific
definitions, but may also cause duplicate inclusions, e.g., in
board/common.
Let each architecture do the inclusion instead.
A bunch of different artifacts should follow the same naming scheme,
depending on a bunch of config settings + whether we're building a
release or not.
Therefore, provide a single definition of this that we can reuse to
name disk images, upgrade packages, etc.
This commit adds optional support for encrypting the tarball before it
leaves the target system. Documentation and usage text updated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes the following log message on systems w/o firewall enabled
dumping operational data:
Dec 2 09:24:57 test-00-02-00 yanger[5352]: Failed to connect to firewalld D-Bus: org.freedesktop.DBus.Error.ServiceUnknown: The name org.fedoraproject.FirewallD1 was not provided by any .service files
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate keys in gen_hostkey() before passing empty keys to shell scripts,
preventing:
Nov 04 2024 10:54:25 confd[2697]: SSH key (genkey) does not exist, generating...
Nov 04 2024 10:54:25 confd[2697]: writing RSA key
Nov 04 2024 10:54:26 confd[2697]: do_convert_from_pkcs8: /tmp/tmp.FH1Hr1 is not a recognised public key format
Also, fix base64 content formatting with proper 64-character line wrapping
using printf+fold instead of echo.
Use PKCS#1 RSA format for public keys as required by netopeer2-server, while
keeping PKCS#8 format for private keys. Use proper ssh-keygen format flag
(PKCS8) for correct conversion.
Fixes#1289
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to their nature we cannot read out the RPM of the pwm fans on the
BPi-R3. But we can at least show it's alive, or steering out a signal
to the fan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The EXPIRES column was misaligned due to multiple issues:
- Column header used width 10 while data rows used width 9
- Expiry values had leading space intended for the narrower width
- CLIENT ID column width (19) was too narrow for typical client IDs
like "01:00:a0:85:00:01:05" (20 chars), causing overflow
Fixed by using consistent width for EXPIRES, removing the leading
space from expiry values, and widening CLIENT ID column to 22.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The isoformat() method already includes the timezone offset when the
datetime object has timezone info. Appending "+00:00" created an
invalid double-timezone suffix like "2025-11-30T13:13:49+00:00+00:00"
which failed YANG validation.
Error was:
admin@bpi-26-60-00:/> show dhcp-server
Error running sysrepocfg: Command '['sysrepocfg', '-f', 'json', '-X',
'-d', 'operational', '-x', '/infix-dhcp-server:dhcp-server']' returned
non-zero exit status 1.
No interface data retrieved.
With syslog showing:
statd[4291]: libyang[0]: Invalid union value
"2025-11-30T13:13:49+00:00+00:00" - no matching subtype found
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- firewall: allow traffic to be forwarded from lan to wan zone
- dhcpv6: enable client on wan interface
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we've got everything working, it's just annoying, so disable it
but leave it in with a comment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify fallback MAC detection to return lowest valid MAC address.
This is the easiest to document and explain to end users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When PR #1271 was merged (commit c34c8db4), it:
1. Created a new coverity-build target in src/Makefile
2. Updated .github/workflows/coverity.yml to call make coverity-build
3. Forgot to add coverity-build as an explicit target in the top-level Makefile
This commit also simplifies src/Makfile a lot for readability.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
SIMPLIFY, Simplify, simplify ... as my uni English professor always said.
> “Perfection is achieved not when there is nothing more to add, but when
> there is nothing left to take away.” -- Antoine de Saint-Exupéry
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This (new) test sometimes fail on HW, so let's hold off a while before
sending our log messages. Ths should allow the DUTs to settle.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's drop the leading IETF or Infix prefixes from tests. Initially the
idea was to mimnic the YANG models, but it's difficult to navigate and
does not provide any real benefit to developers or end-users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's give Coverity Scan its own make target so we can reuse 'make check'
for our own scan-build or cppcheck needs.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is the last commit in the series that extend syslog matching and sorting
to the level of sysklogd 2.7.0 and later. Like hostname filtering, property
based filtering is not supported natively in the IETF RFC, and the modeling is
unfortunately a bit clunky. The most confusing part is probably 'negate'
which is the '!' operator that inverts the matching, e.g., !icase_regex match
everthing *not* in the regexp.
Fixes#1091
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unlock more of the optional features in ietf-syslog.yang: select-match and
select-adv-compare, for regexp and advanced severity comparison operators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set LANG=C.UTF-8 in finit.conf for system-wide coverage, in profile.d
for login shells, and in bash.bashrc for interactive shells to ensure
comprehensive Unicode support across all user interactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set PYTHONPYCACHEDIR=/tmp/__pycache__ in test/env to avoid permission issues
during git cleanup operations. When tests run in Docker containers as root,
__pycache__ directories and .pyc files end up owned by root, preventing the
CI user from cleaning them up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change exposes the macvlan mode to tests, unlocking support for running
certain types of tests on systems with only a single Ethernet port.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Devices should tell the server what they are in case an administrator
wants to group or hand out dedicated leases and information to some
devices on the lan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This allows us to gather better product information in /run/system.json
also for x86 based systems. For Qemu x86_64 systems the 'product-name'
changes from 'VM' to 'Standard PC (i440FX + PIIX, 1996)'.
Also, add new 'product-version' field for, e.g., board revisions, and add
missing 'serial-number' value for systems like Rasperry Pi that inject it
in the device tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate that DHCP options were requested in the parameter request
list before applying them. This prevents malicious or misconfigured
DHCP servers from forcing unwanted configuration changes.
Validates: hostname (12), DNS (6), domain (15), search (119),
router (3), static routes (121), and NTP (42).
Fail-safe behavior: rejects options if config file unavailable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The vendor-class option was previously hard-coded to "Infix vXX.YY.Z",
but since this option usually describes the type of the device asking
for a lease, the default has been changed to use the product-name.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Resolve race condition between DHCP and configured hostname by introducing
priority-based hostname management using /etc/hostname.d/ directory pattern.
Priority order (highest wins):
90-dhcp-<iface> - DHCP assigned hostname
50-configured - YANG /system/hostname config
10-default - Bootstrap/factory default
The new /usr/libexec/infix/hostname helper reads all sources and applies the
highest priority hostname. It exits early if hostname unchanged, preventing
unnecessary service restarts.
Fixes#1112
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After some discussion we agreed that this operation is the domain of
confd (or dagger) and any DHCP client should not mess with the admin
state of the interface it runs on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Basic DHCPv6 client, request a lease and verify Linux installs a
default route from the Router Advertisements (option not included
in DHCPv6), hence the 'enable-ra' option to dnsmasq. Also verify
DNS resolution over IPv6, including the resolvconf dance
- Prefix delegation, verifies that the client can actually request
and receives a prefix from a DHCPv6 server. We don't do anything
with it today though
Two new DHCP server implementations, the basic test relies on dnsmasq
and the prefix delegation test requires an ISC based dhcp server with
server side support for ipv6 prefix delegation. We could reuse the
latter for both tests, but this way we get compatibility testing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, update docker/README, because after last confusing update I
couldn't follow my own instructions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Basic DHCPv6 support as a per-interface ipv6 setting, not in line with
the IETF YANG model, which has this as a root container.
Note, this also fixes DHCPv4 option inference after the relocation of
/dhcp-client to /interfaces, in 764bd8e.
Fixes#1110
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Send 10 pings, expect at least one. The GRE test passes with two
received ICMP messages on the Styx test rig, while the VXLAN test
fails with -c 3, so try waiting a bit longer.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Used in Marvell Armada SOCs like the 37xx, 7k, 8k, and CN913x series.
Fixes the following kernel warnings:
[ 16.074759] crypto-safexcel f2800000.crypto: Firmware load failed.
[ 16.087330] crypto-safexcel f2800000.crypto: HW init failed (-2)
[ 16.102696] crypto-safexcel f2800000.crypto: probe with driver crypto-safexcel failed with error -2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The put_config() retry loop was catching and printing RpcError
exceptions but never re-raising them after exhausting retries.
This caused tests to silently continue despite configuration
failures, masking validation errors.
Now properly propagates errors after all retries are exhausted,
matching the error handling behavior of the RESTCONF backend.
Fixes#1250
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We use the infinitive, or basic form, in configure context, as do most
other network vendors, so let's do the same in admin exec context.
Also, drop the 'name' qualifier, it is not needed in configure context
so we shouldn't have to use it in admin exec either.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In an effort to consolidate and use familiar command paths for our most
common commands, let's follow suite with Cisco, vtysh, et al.
Add deprecation warning to legacy 'show route [ip|ipv6]' command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since we just un-deviated this node to be able to create operational
data for ospf interfaces, we should also allow users to set it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Collect more data from FRR to the OSPF and BFD operational datastore.
Refactor CLI commands to use the YANG datastore instead of vtysh.
Additionally, the BFD command(s) have been moved to the top level of
admin-exec, which is where vtysh has them.
Finally, preparing for future OSPFv3 support, all commands have been
given a new context under 'show ip ospf'. Deprecation warnings have
been added to the existing 'show ospf' commands.
Also, for consistency, all commands names in plural have been changed to
their singular form: routes -> route, interfaes -> interface, etc. This
is what vtysh, Cisco, and others do as well.
Fixes#1190
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Silently drop any area-type setting for ospf backbone in a migrate
script to prevent any field issues after upgrading to this fix.
Fixes#1247
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Release tarballs waste ~131MB per architecture by including both
rootfs.itb and rootfs.squashfs, even though rootfs.itb already
contains the squashfs (itb = 4096-byte header + squashfs).
This change removes rootfs.squashfs from releases and provides two
solutions for users who need it:
1. utils/extract-squashfs.sh - Full-featured utility for extracting
squashfs from release tarballs or .itb files. Includes validation
and helpful error messages.
2. board/common/qemu/qemu.sh - Auto-extraction support. When running
in initrd mode, automatically extracts rootfs.squashfs from
rootfs.itb if missing. Zero user impact - ./qemu.sh just works!
Space savings: ~262MB per release (2 architectures × 131MB)
Fixes#858
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prevent patch releases from stealing the "latest" tag from newer minor
versions. Only vXX.YY and vXX.YY.0 releases should be marked as latest.
Fixes#1187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Collect only the most relevant info for SBOM. The CycloneDX format seems
to be what most tools are standardizing around, and they suggest saving
manifest.csv and cpe.json files. This commit includes all *.csv files
and drops sources and licenses for release builds, as decided in #1192Fixes#1217resolves#1192
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In bf2e739 a downgrade of Buildroot to 2025.02.6 was mistakenly merged,
this commit restores the submodule to the git revision prior to that,
Buildroot 2025.02.7-kkit, with KernelKit backports and upgrades.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds support for configuring TTL, ToS/DSCP, and Path MTU Discovery
on GRE and VXLAN tunnels. TTL defaults to 64 instead of inherit to
prevent issues with routing protocols like OSPF that use TTL=1.
Refactors tunnel YANG models by merging local-remote into a unified
tunnel-common grouping for cleaner organization.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Many of the example prompts used in the documentation are very long and
do not fit in generated documentation (web/pdf). This is a proposal to
shorten them, sometimes significantly, by keeping only the start and end
of an xpath, replacing everything in between with '/…/'.
This is a feature that also could be added to the klish-plugin-sysrepo
to improve usability.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The callback refactoring forgot to call ietf_interfaces_cand_init(),
breaking inference of interface types and DHCP client options.
Also fixes UPDATE event handling for ietf-keystore and infix-meta.
Fixes#1244
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Neither the IPv6 autonconf container, nor the recently moved DHCP client
container have an 'enabled' flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If ping succeed but fail to check if netconf port is open,
the testsystem will hang forever.
This will allow totally broken images to be loaded at the device.
This fixes the annoying libyang warning after commit da29771.
confd[3375]: libyang[0]: Invalid argument ctx_node (lyd_find_xpath()).
This happens when the diff is used in the wrong event when it is NULL.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if partition/LABEL is available before trying to run tune2fs and
mount commands on it. This change masks the kernel output:
LABEL=var: Can't lookup blockdev
commne when running `make run` on x86_64 builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 45efa94 we introduced new mount options for the: 'aux', 'cfg', and
'var' partitions. To save boot time, we also disabled the periodic fsck
check, which does not affect journal replay or other Ext4 safety or
integrity checks. The latter involved calling tune2fs at runtime, but
this caused the following to appear for the 'aux' partition, which is a
reduced ext4 for systems that need to change U-Boot settings, e.g., to
set MAC address on systems without a VPD.
EXT4-fs: Mount option(s) incompatible with ext2
Note, this is a "bogus" warning, setting the fstypt to ext2 in fstab is
not the way around this one. That's been tried.
To make matters worse, the new mount option(s), e.g., 'commit=30', gave
us another set of warnings from the kernel. This was due to the fstype
being 'auto', so the kernel objected to options not being applicable to
every filesystem it tried before ending up with extfs:
squashfs: Unknown parameter 'commit'
vfat: Unknown parameter 'commit'
exfat: Unknown parameter 'commit'
fuseblk: Unknown parameter 'commit'
btrfs: Unknown parameter 'errors'
This commit explicitly sets cfg and var to ext4, leaving mnt as auto, we
also check before calling tune2fs that the partition/disk image is ext4.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split download and MD5 computation into separate functions for clarity.
Add proper error handling for HTTP 404 and network errors. Improve help
text to mention appliances/ directory location.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow a workflow caller to run pre-build scripts though a workflow
call variable. This is potentially dangerous as code can be injected
here. If for example a malicious actor wants to run there C2 code in
the context of someone else they could perhaps inject it here. I
assume this is protected by the same mecahism as the workflow files
themself. I.e. github users untrusted to the Infix org won't be able
to trigger workflows before being explicitly allowed to do so.
This patch also adds a checkout secret. This allows upstream callers
to fetch there own spin / fork though the infix workflows, if they
provide a checkout token with the correct permissions to do so.
Signed-off-by: Richard Alpe <richard@bit42.se>
Reduce /var image size to 128M (resized at first boot anyway) and tune
mke2fs options for faster mounting. Set ext4 'uninit_bg' feature and
use '-m 0 -i 4096' extraargs in genimage to optimize filesystem creation
and reduce overhead. The genimage tool has several tweaks enabled by
default already, the 'uninit_bg' feature speeds up the time to check
the file system.
Disable periodic fsck with tune2fs at boot while keeping safety checks
intact. Adjust mount options in fstab to reduce journal syncs and
improve boot time.
Fix severe performance regression in find_partition_by_label() that was
calling sgdisk on every block device including virtual devices (ram, loop,
dm-mapper). This caused boot delays of up to 24 seconds on systems with
many block devices. Now skip virtual devices that don't have GPT tables,
reducing the delay to ~2 seconds.
Also clean up is_mmc() function to use cached result.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support to simplify sdcard.img generation by downloading the
latest bootloader build for a board from the 'latest-boot' release tag. The
tarball is saved in dl/bootloader/ and is extracted to a temporary directory
in output/build/boot-$board-xxxx on every invocation of mkimage.sh. This is
used for invoking genimage and bmaptool before copying the resulting images
to output/images/. (If $O is set, it is used instead of output/, above).
New options:
-d Download latest bootloader build for the given board
-f Force re-download even if bootlaoder tarball existgs
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Update board paths to match the restructuring in commit ab56c1be.
Fixes rpi4, cn9130_crb, and aarch64_qemu bootloader builds.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Wrap wpa_cli operations in try-except blocks to ensure WiFi errors don't
cause sysrepocfg to fail. Interface queries now return data for working
interfaces even when WiFi has issues.
Fixes:
admin@rpi-79-41-1d:/> show interfaces
Error running sysrepocfg: Command '['sysrepocfg', '-f', 'json', '-X', '-d', 'operational', '-x', '/ietf-interfaces:interfaces']' returned non-zero exit status 1.
No interface data retrieved.
admin@rpi-79-41-1d:/>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit consolidates mkimage.sh scripts into a unified SD card image
creation tool that works for all boards. It needs a bootloader an $ARCH
rootfs.squashfs image and a genimage.cfg.in template.
- Detects build directories from `O=` environment variable or `output/`
- Sources `.config` to discover Buildroot paths
- Uses Buildroot's `support/scripts/genimage.sh` when available
- Automatically generates `.bmap` files if `bmaptool` is available
- Fallback to direct `genimage` invocation if wrapper not found
See the online instructions for usage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add new interface quirk to allow skipping disabling of flow control on
all RPi 3B/4B devices that have the smsc95xx driver.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The xPi's usually don't have a VPD so the chassis mac-address probed at
boot is usually null in /run/system.json. This commit adds a fallbkack
mechanism to populate this field so it can be used for unique hostnames
even on these boards.
Ths ietf-hardware.yang model does not have a notion of physical address,
so we augment one tht is generic enought to be used for other hardware
components than Ethernet, similar to what ietf-interfaces.yang use.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable bridging of LAN ports in br0, default IP: 192.168.0.1/24
- Enable firewall with two zones: 'wan' and 'lan', policy: lan-to-wan
- Enable DHCP server on br0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit drops the board specific defconfig in favor of proper BSP
support for the FriendlyARM NanoPi R2S to Infix as part of the default
Aarch64 build.
The name FriendlyARM was elected over FriendlyELEC ("new" name) to be
consistent with both kernel and Buildroot naming standards.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit consolidates all BSP support files into the Buildroot standard
board/ directory. The concept of selectable boards in menuconfig remains
as-is but now lives in board/ instead.
Drop support for board-specific post-build.sh scripts, not needed atm. and
we should really use Buildroot _POST_INSTALL_HOOKS in the board .mk files
instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the additional support for RPi3, including Zero 2W, this commit renames
all relevant directories and Config.In options to match.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For more advanced hardware with multiple sensor types per device
(e.g., SFP modules with temperature, voltage, current, and power
sensors), use the YANG parent/child relationship to group related
sensors together for better presentation.
Changes:
- Remove parent/parent-rel-pos deviations from infix-hardware.yang
- Create parent components (class: module) for multi-sensor devices
- Add parent references to child sensor components
- Add human-readable descriptions from hwmon labels
- Extend hwmon discovery to support voltage, current, and power
- Normalize sensor names: strip vendor prefixes (mt7915_phy0 -> phy0)
- Remove redundant TYPE column, clarify units (V -> VDC, add spaces)
- Simplify child sensor display by stripping parent prefix
- Fix "show system" to only show CPU temperature and fan speed
Example output from "show hardware":
NAME VALUE STATUS
===================================================
sfp1:
Rx Power 0.000 W ok
Tx Power 0.001 W ok
Vcc 3.35 VDC ok
Bias 0.006 A ok
Temperature 30.3 °C ok
sfp2:
Rx Power 0.000 W ok
Tx Power 0.001 W ok
Vcc 3.34 VDC ok
Bias 0.006 A ok
Temperature 32.0 °C ok
cpu 42.8 °C ok
phy0 47.0 °C ok
phy1 53.0 °C ok
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds resource usage: memory, loadavg, and filesystem usage
by augmenting ietf-system:/system-state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove class deviation to allow iana-hardware:sensor
- Populate sensor operational data from /sys/class/thermal
- Extend 'show hardware'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually, when upgrading a system, you want to reboot it so the upgrade
takes effect. This commit adds a 'reboot' option/flag, alongside the
'force' option, to facilitate this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The DWC2 controller is a very common IP block in ARM and RiscV SoCs. With the
USB subsystem back to a built-in we can now enable host mode for the DWC2 (USB
2.0) ports on RPi. It also opens up for merging the NanoPi R2S into the
generic aarch64 build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some boards, and in particular with a hybrid mbr/gpt partition table,
like on the RPi64, we must resize ext *after* reboot.
Also, do some cleanup and consolidation of error handling to prevent us
from entering an endless boot loop.
Follow-up to 391e9715
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit refactors USB port probing to:
- Eliminate duplicates: previously, 'authorized' and 'authorized_default'
were listed as separate USB port entries (confusing). Now each USB
port is represented once, with the path pointing to the USB device
directory, confd appends the appropriate attribute file as needed
- Add support for Raspberry Pi 4B and CM4 USB port(s) using a generic
discovery function that scans /sys/bus/usb/devices for USB root hubs.
This should work seamlessly across all platforms
- For backwards compatibility and better UX:
- Single USB port systems: Named "USB" (no number)
- Multi-port systems: Named "USB1", "USB2", etc.
- Device tree-based discovery is tried first (for boards like Alder with
explicit DT USB port definitions), with fallback to generic discovery
for boards without DT
Fixes: #315
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for the Raspberry Pi CM4 based mini DFRobot IoT
Router board, SKU:DFR0767. It comes with an additional RTL8111 PCIe NIC
hence the addidtional kernel module and firmware. The latter fixes:
r8169 0000:01:00.0: Direct firmware load for rtl_nic/rtl8168h-2.fw failed with error -2
r8169 0000:01:00.0: Unable to load firmware rtl_nic/rtl8168h-2.fw (-2)
Please note, the change in BCMGENET from module to built-in is to ensure
it is probed before any PCIe NIC, both this board and the CM4-based NVME
NAS base board enumerate the built-in MAC as eth0.
Also, unlike the RPi 3B/4B, it is not a given fact that a CM4 based board
comes with WiFi onboard, and since most compute module setups are DYI, we
take the easy way out and leave it as an exercise to the user to add WiFi
interface to the config.
https://wiki.dfrobot.com/Compute_Module_4_IoT_Router_Board_Mini_SKU_DFR0767
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The BCM2837 core is used not just in the RPi 3B but also in the Zero 2W,
both device trees have been added to the board config.
The BCM2711 support has been extended to include RPi 400 and CM4 I/O.
To support the BCM2837 family more firmware options habe been enabled,
since the RPi3 does not have bootcode.bin flashed in the SoC. The SD
card image now uses a hybrid GPT/MBR format so the RPi3 bootcode.bin
can read all files from the first VFAT partition.
The default device tree for Linux is now chosen by the U-Boot probe and
the only exception is the "laundry room" detector that looks for a RPi4
with a 7" touch screen, which then selects the DSI enabled RPi4 variant.
This is enough to properly load an RPi 3B and a CM4 based router board.
The BCM2837 does not have PCI/PCIe or a built-in MAC so it relies on the
USB to Ethernet LAN78xx which does not support disabling pause frames.
I have opted for checking for EOPNOTSUPP instead of adding yet another
quirk, because it is likely to be a common limitation of more drivers
and chipsets, and this code is best-effort anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use kernel cmdline option 'usbcore.authorized_default=2' to lock all
external/user-visible USB ports by default.
The kernel distinguishes internal vs external USB ports using ACPI
methods (_UPC and _PLD) on x86/x86_64 systems. On ACPI systems, ports
marked as non-visible but connectable are considered internal (e.g.,
hard-wired USB-to-Ethernet adapters) and are automatically authorized,
while user-visible external ports require manual authorization.
However, on device tree systems the kernel lacks a standard mechanism
for identifying internal ports. The 'authorized_default=2' setting falls
back to requiring authorization for all devices on these platforms,
We list user-accessible USB ports in the device tree ('usb-ports' and
'usb-port-names'), with unlisted ports being implicitly internal and
managed separately.
Fixes#1065
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sysrepo lack the functionallity for if change in model A also
should demand actions of model B. Previous we have handled this by
having callbacks for keystore changes in for example infix-services
to be able to reconfigure SSH on asymmetric key changes.
This commit instead add a pass where dependencies are found and added
to the diff.
Sysrepo only care about model changes, but we want the system
configuration. Therefore add a common callback for all modules
and handle dependencies between the modules, if someone should be
run before another for example.
This will make sure to apply NACM rules for all the data. It also
makes it possible for a luser access a subset of the data, even if
they to do not have read access to /cfg/startup-config.cfg.
This will fix#1106, in time, but only allows manual trigger for now,
needs more test and verification
utils/kernel-upgrade.sh at least automate all the manual manual processes
for upgrading the kernel.
Bridge ports should not have IP addresses configured. The IP address
should be configured on the bridge interface itself, not its member ports.
Add YANG must expression to enforce this rule at configuration time.
Fixes#1122
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A valid DHCP server setup for a subnet is one of pool and/or at least one
static host entry/lease. If pool is enabled the pool must have a start
and an end address.
To allow setting up a DHCP server with no pool and at least one static host
entry/lease, we make the pool a presence container, otherwise the pool will
always be set and trigger the below inference.
When an interactive CLI/Web user enables the address pool we infer a default
range .100-.250, but only for /24, C-class networks. This is what most users
know and expect.
The YANG model now validates that:
- If an address pool is created, both start-address and end-address must be set
- Each subnet must have either a pool or at least one static host entry
- The pool container is now a presence container, so "no pool" fully deletes it
Fixes#1121
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Addresses disk space issues in GitHub Actions for generic x86_64 builds
by removing unused tools (Android SDK, .NET, Docker images, etc.) before
the build starts. This frees up ~30GB of space.
Fixes#1210
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Multiple services can have PID 0 when stopped/done, making PID
unsuitable as a unique key. There could also be multiple services with
the same name (I would assume?).
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds operational data support for system services. The
data is in a generic format but is intended to be able to represent
finit information (initctl) nicely.
The reason for augmenting this to ietf-system and not to
infix-services is that we consider this generic system information
which is totally disconnected from what ever services infix might
provide.
In this first state we only support pid, name, description and state.
Making the data look something like:
"infix-system:services": {
"service": [
{
"pid": 1185,
"name": "udevd",
"status": "running",
"description": "Device event daemon (udev)"
}]
Signed-off-by: Richard Alpe <richard@bit42.se>
Address two issues identified by Coverity Scan:
1. CID 550484 (TOCTOU): Remove access() check before realpath()
- realpath() already fails if file doesn't exist, making the
access() check redundant and introducing a TOCTOU race
- Simplifies code while improving security
2. CID 550483 (CHECKED_RETURN): Mark unchecked remove() calls
- Add (void) cast to two remove() calls to explicitly indicate
we don't care about the return value
- These are cleanup operations for temp files where failure
is acceptable, even expected
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Much of the content was made obsolete by recent changes, we now optimize
the experience for users, avoiding recreate at boot unless checksums for
configuration or base image have changed.
This was also a good time to explain the difference between mutable and
immutable tags, which sometimes is a cause for great confusion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since there is no safe way (unique hash/id) to identify unused named
volumes, we cannot automate removal of them. Since volume data, when
compared to a container image, is quite small, it was decided that we
document this instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The regular file-to-file copy, was missing calls to cfg_adjust(), this
commit fixes that and adds some helpful comments for each use-case.
Also, drop insecure mktemp() in favor of our own version which uses the
basename of the remote source file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to PR #717 where path traversal protection was
discussed. A year later and it's clear that having a user-friendly
copy tool in the shell is a good thing, but that we proably want to
restrict what it can do when called from the CLI.
A sanitize flag (-s) is added to control the behavior, when used in the
shell without -s, both commands act like traditional UNIX tools and do
assume . for relative paths, and allow ../, whereas when running from
the CLI only /media/ is allowed and otherwise files are assumed to be
in $HOME or /cfg
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds config file validation to the copy command, discussed
in #373. Allowing users to test their config files before restoring a
backup. The feature could also be used for the automatic rollback when
downgrading to an earlier version of the OS.
Fixes#373
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When copying to the running datastore we cannot use sr_copy_config(),
instead we must use sr_replace_config(). This fix covers both the case
of 'copy startup-config running-config' and 'copy FILE running-config'.
Fixes#1203
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename test directories in infix_containers/ to remove the redundant
'container_' prefix since they already live under infix_containers/:
container_basic -> basic
container_bridge -> bridge
container_enabled -> enabled
container_environment -> environment
container_firewall_basic -> firewall_basic
container_host_commands -> host_commands
container_phys -> phys
container_veth -> veth
container_volume -> volume
Also update references in all.yaml and Readme.adoc files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds four (small) container images to the Infamy test container
which are used in the new container upgrade test. The test verifies that a
mutable container can be upgraded and that old images are properly cleaned
up from the container store.
Fixes#624
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Already supported in the CLI. This makes it official, and quite handy
for users that run mutable containers.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Shell script:
- Factor out big portions of code into more logical helper functions
- Simplify calling setup script by checking for remote image first
- Simplify meta/sha up-to-date handling and clarify terminology
- Consistent use of -f instead of -e in file-exists checks
- Fix unsafe use of 'mktemp -u'
C code:
- Clarify meta/sha terminology: rename meta-sha256 -> meta-image-sha256
- Refactor weird archive_offset() function to local_path() helper
- Factor out helper function calc_sha()
- Check len of sha256 >= 64
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
One unique feature of Infix OS is that you can embed your OCI archive in
the rootfs.squashfs. This way your container instance does not need to
download anything from the network. To upgrade you drop in a new image
and rebuild Infix, when the new Infix boots the container script 'setup'
command will recognize that the OCI archive has changed and will reload
it into the container store.
This patch is an improvement of the way too generic 'podman image prune'
command used previously. Instead of looking for any dangling image, we
now surgically remove the old image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Container instances that run with mutable images, e.g., tagged with `:latest`
or similar non-versioned tags, can be upgraded without changing the config.
This commit fixes two issues found with this support:
- force container image re-fetch on upgrade, even if the file exists locally
- surgically remove old image from container store after upgrade
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually, when your system is up and running properly, you want to clean
up anything unused from your previous experiments. This change alllows
that by calling the interactive 'podman image prune -a -f' command from
the CLI command 'container remove all'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When loading big OCI images at boot the `podman load` process completely
monopolizes all cores of an Arm Cortex-A72. It blocks on I/O, sure, but
with 'nice' we can get some attention at least to more critical services
at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit reverts 477f7ae and bb19d06, which intended to fix an issue
with lingering old images, see #1098. However, as detailed in #1147,
this caused severe side effects while working with multiple larger
containers. Basically, the prune operation of one container removed
images of other containers that are just being created in parallel.
Instead of using the podman prune command we can use the meta datain the
start script to pinpoint exactly which image(s) to remove, including any
downloaded OCI archives when the container instance is removed.
Fixes#1147
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds metadata to track loaded OCI archives to allow skipping
'delete + load' of OCI images when restarting either the container or the
system as a whole. The sha256 of all loaded OCI archives is stored in a
sidecar file in our downloads directory. Then we verify the checksum of
the OCI archives against their same-named sidecar to determine if the OCI
archive is already loaded or not.
Additionally, the instance using the image is labled with metadata to detect
changes in the container configuration. This in turn allow skipping the
delete + create phase also of the instance.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default timeout for 'podman stop foo' is 10 seconds, which for
heavily loaded systems with intricate shutdown process is *waaaay*
too short. Increase it to the container script default 30s, which
coincidentally is also the container@.conf template's kill delay.
Fixes#1149
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not only great for debugging, but also allows users to start their
containers manually in another way. But yeah, mostly for debug.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This rectifies an omission from the initial yang model. Not all
charachters are supported in container and volume names. E.g.,
simply attempting to create a volume or container with a space
in the name causes this error message from podman:
podman: Error: running volume create option: names must match [a-zA-Z0-9][a-zA-Z0-9_.-]*: invalid argument
In addition to the regexp, the new 'ident' type also enforces a
minimum and maximum length. Sure, technically a single char is
allowed, but let's be reasonable, and who in their right mind
wants an identifier > 64 chars? We have description for that.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Slight refactor of page, adding another badge for the latest release,
and restructuring the Technical Details section a bit.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The curl.sh wrapper script had several issues:
- Used 'shift 2' incorrectly without proper argument validation
- Required hostname as enviroment variable instead of option
- Lacked proper option parsing, should behave like a cross between
curl and sysrepocfg
All examples have been updated to match the refactored script, and
a local copy in utils/curl.sh has been added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a minor regression after merge of BPi-R3. The RPi4 device tree,
specifically regulator-sd-io-1v8 in bcm2711-rpi-4-b.dts, requires the
GPIO voltage regulator be built-in for the SD card controller.
Fixes#1197
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Coverity scan detected a memory leak in the new firewall change() cb
where allocated memory from ietf_interfaces_get_all_l3() was not freed
on error paths when srx_get_diff() failed or returned NULL.
This commit consolidates all cleanup paths to use the 'done:' label,
ensuring ifaces, diff, and cfg are properly freed in all exit scenarios.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Used by infix-firewall.c when figuring out interfaces that are not
explicitly assigned to any zone. Placing them in the default zone
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The 'brief' keyword has been gone for a while now. Also, update the
ouput to match the "new" cli-pretty formatting.
Fixes#1174
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With all jobs now depending on check-trigger we can do the evaluations
there and set some variables that can be reused later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Here we use a check-trigger job that all the others depend on, which
should prevent duplicate workflows starting a bit more elegantly than
killing one of them with the concurrency checker.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In setups like this...
CPU
eth0
|
.----0----.
| dst0sw0 |
'-1-2-3-4-'
|
.----0----.
| dst1sw0 |
'-1-2-3-4-'
...both eth0 and dst0sw0p4 are DSA ports. But the latter is _also_ a
physical port as far as devlink is concerned. As a result, it would
first be marked as "internal" and is then instantly reclassified as a
"port".
Catch this condition and stick with the initial "internal"
classification.
In addition to matching on interface names, add support for matching
on ethtool information.
Example:
{
"@ethtool:driver=st_gmac": {
"broken-mqprio": true
}
}
This would mark any interface using the "st_gmac" driver as having a
broken mqprio implementation. Whereas this:
{
"@ethtool:driver=st_gmac;bus-info:30bf0000.ethernet": {
"broken-mqprio": true
}
}
Only matches an st_gmac-backed interface at the specified location.
As matching becomes more complicated, use the shell implementation
from confd as well, to make sure that they are always in agreement.
Fix a bug where systems with OSPF enabled on some, but not all,
interfaces would cause the OSPF iterator to fail when accessing
iface['area'], which was missing. This caused the ospf_status.py
tool to return {}, resulting in empty OSPF data in sysrepo.
Fixes#1169 Expected neighbors not shown in sysrepocfg
Signed-off-by: Richard Alpe <richard@bit42.se>
The xpath_to_uri() method only processed the first predicate in XPath
expressions with multiple [key='value'] patterns. Each re.sub() call
was performed on the original xpath instead of the result the previous
substitutions, causing subsequent predicates to be ignored.
Example XPath that would fail:
/infix-firewall:firewall/zone[name='untrusted']/interface[.='e2']
Would incorrectly convert to:
/infix-firewall:firewall/zone[name='untrusted']/interface=e2
Instead of the correct RESTCONF URL:
/infix-firewall:firewall/zone=untrusted/interface=e2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:33:00)
# Traceback (most recent call last):
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# AssertionError: Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
After this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:35:00)
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
Slightly shorter and arguably easier to read for a non-pythonic human.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very common pattern in our tests is:
if (condition):
print(f"the condition failed with {output}")
test.fail()
This change allows us to write:
if (condition):
test.fail(f"the condition failed with {output}")
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The rauc event logger is a separate glib logger that by default logs to
the system console, with annoying ANSI escape sequences. This commit
drops the default stdout/stderr redirect of these log messages and adds
a more exhaustive bundle install and event log, in json format, instead.
For more information about event logging, see the rauc documentation:
https://rauc.readthedocs.io/en/latest/advanced.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop 'local', not available in POSIX shell scripts
- Check for an assortment of backup file combos
- Simplify nested if-statements, skip whitelist first
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default 'trace' log level is quite verbose for our production systems.
This commit changes the default to 'info' and adds a command line option
to control the log level if needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to maintain our own set of patches on top rousette, a kkit
branch have been set up with a reduced set of backported fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- cli: add '-r' to log/pager/follow for "raw" control chars, including unicode
- sysklogd: backport unicode fix for em-dash character (—) in slogan
- sysklogd: drop old patches
- sysklogd: run in 8-bit safe mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is currently a standalone workflow that needs manual trigger via
workflow_dispatch, but the end goal here is to chain it to the release
job.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add concurrency control to trigger workflow to cancel in-progress builds
when new events (like adding ci:main label) occur on the same PR. This
prevents resource waste from duplicate builds and handles the common
workflow where developers add the ci:main label after PR creation.
Fixes#1154
Adjust DHCP client retry behavior:
-t 3 (was -t 10) : Maximum discovery attempts per cycle
-T 5 (was -T 3) : Seconds to wait between attempts
-A 30 (was -A 10) : Seconds to wait after all attempts fail
Before: 10 attempts × 3 seconds = 30 seconds of rapid trying, then 10
second pause = 40 second total cycle
After: 3 attempts × 5 seconds = 15 seconds of trying, then 30 second
pause = 45 second total cycle
=> 70% fewer log messages during active attempts, with longer quiet
periods between cycles.
Fixes#1100
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add HISTCONTROL=ignoreboth to ignore duplicate commands and those
starting with space, enable histappend, and improve tab completion
behavior. Also add /etc/inputrc for better readline key bindings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To reduce the duplication of effort between 9pm and the Infamy framework
this change consolidates the move from local 'infamy: title:' extension
to 9pm 'name:'.
For the parameterized tunnel tests we leverage the 9pm dynamic test-spec
variable, which looks for a correspodning <case>.adoc instead of static
Readme.adoc, when generating the test report.
Each test documentation should cover all aspects of the test, much like
the usage text of a UNIX program. To this end, the tunnel test docs are
now more spelled out, including all invariants.
Some refactoring of these tests were also necessary, e.g., replacing any
reserved Python keywords like 'type', and other PEP-8 fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Import new 9pm version for improved test report generation. With this
in place we can take the opportunity to also refactor and simplify the
test spec. generation.
Fixes#1129
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit greatly simplifies AsciiDoc image references in generated
Readme.adoc files. The two focused use-cases that remain after this
change are working references in:
- Generated output/images/test-report.pdf
- Viewing test's Readme.adoc from GitHub
Previously we aimed to have working images also when the test's Readme
was included in the parent directory's Readme.adoc. This, however, is
not supported as of this commit. It seems unlikely also to ever be a
supported feature of AsciiDoc on GitHub, for details, see the following
issue: <https://github.com/github/markup/issues/1095>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
It should be possible to create test reports manually, so logically
the GitHub workflow should call a make rule in test.mk
Untested: branding, or any case where Infix is used as a BR2_EXTERNAL
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Banana Pi R3 is a high-performance networking board featuring:
- MediaTek MT7986 ARM Cortex-A53 quad-core processor
- 4x Gigabit LAN ports (lan1-lan4)
- 1x Gigabit WAN port
- 2x SFP ports (sfp1, sfp2) for fiber connectivity
- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
- USB support
- SD card boot support
The motd-banner was behind on the new slogan:
.-------.
| . . | Infix OS — Immutable.Friendly.Secure
|-. v .-| https://kernelkit.org
'-'---'-'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit completes the collection. We now have small, medium, and
large sizes. Useful for easy conversion to other formats, e.g., bmp.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
You need first to clone gns3-registry from https://github.com/GNS3/gns3-registry
Follow this steps:
1. ./utils/bump-gns3.py 25.08.0 ../../gns3/gns3-registry/appliances/infix.gns3a
2. TEST in gns3, just add the new version, start it.
3. run python3 check.py inside gns3-registry, verify infix is ok.
4. Create a pull request to gns3-registry
This fix#1107
This branch can be used to test push events which is especially
useful when working on the CI infrastructure.
Signed-off-by: Richard Alpe <richard@bit42.se>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually the CNI bridge plugin "takes care" of enabling IPv4 forwarding
on all interfaces, see issue #1125, but when the container tests are run
in a different order from the infix_containers.yaml, Infix may reset the
IPv4 forwarding on this critical interface.
This change is both future proof and also ensures the test works as it
was intended even if tests are run out-of-order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As Infix matures as an operating system it is quickly becoming more and
more useful also for end-device use-cases. The README should reflect
this change in focus.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
From the documentation:
> 'podman image prune' removes all dangling images from local storage.
> With the all option, all unused images are deleted (i.e., images not
> in use by any container).
>
> The image prune command does not prune cache images that only use
> layers that are necessary for other images.
So, when the container script is called in the cleanup phase of the
lifetime of a container, we can use the '--all' option to ensure we also
remove this container's loaded image. In the case this happens before
a reboot of the system, there will be no old version of the image loaded
to /var/lib/containers after boot.
Issue #1098
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
There are 2 main reasons for this:
1) It's almost impossible to write complex logical expressions in GH
workflows. I wanted to pass "" as flavor when not building _minimal.
So that the end target string would become TARGET + FLAVOR where
FLAVOR is empty, making it x86_64 for example.
As it turns out "" is false in GH workflow logical expressions, this
in conjunction with the limitations the interpreter has made it hard
to actually write sane expressions in the "with:" variables when
calling downstream jobs via workflow calls.
Here's an example of what I was trying to do and could not:
with:
flavor: ${{ (
github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'ci:main')
) && '' || '_minimal' }}
As '' is false, the first sets of expressions always evaluates to
false making the string "_minimal". I tried bracing this in various
ways and to use "null" or various JSON objects, all in vain.
2) It reduces complexity instead of adding additional.
Signed-off-by: Richard Alpe <richard@bit42.se>
Previously, upgrading Podman containers with the same tag left
behind dangling images, causing overlay storage to grow and fill
disk space.
This change ensures dangling images are cleaned up using
podman image prune. The command is run without -a, so only
unreferenced images are removed. This provides safe cleanup while
preventing unnecessary overlay growth.
Fixes#1098
Signed-off-by: Richard Alpe <richard@bit42.se>
The defconfigs for all architectures other than x86_64 has this
enabled, so align it with the rest.
This has no on-target impact, but it enables us to attach to a live VM
instance and debug it, or do offline debugging like resolving stack
trace lines from oops messages to source locations.
The board/common/uboot/extras.config was updated with CONFIG_MMC_PCI
*after* we last built the SparX5i bootloader, and this was really only
needed for the Qemu build, so let's move the requirement there.
Also, we now (Buildroot 2025.02) need to update the dependencies for the
Fireant bootloader with libbsd (for some reason) and dtc, of course.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit migrates the bootloader build from Raspberry Pi 4 board
package to a dedicated bootloader defconfig. The idea is to set up
dedicated wokflows for building bootloaders, which change rarely,
streamlining the Infix image builds.
A dedicated workflow, or job in an existing workflow, can then do
the composition to minimal SD-card images useful for starting up
Infix on boards where SD-card is the primary boot source.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this commit yanger looked at the running system using
os.path..., this meant that the static reply / capture data wasn't
used properly. This resulted in strange behavior during unit testing
on GitHub runners where USB ports are missing.
Signed-off-by: Richard Alpe <richard@bit42.se>
The execd runner has not been used since Nov, 2024, ca0e54b. This
weekend it started triggering a warning from Coverity Scan, so let
us drop it for good this time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commits tweaks the material orange theme to use the exact color hue
of Jackys footies. To match this and give a slightly better contrast we
also change Jacksy border and logo text color to a slightly darker tone.
The original logo.svg is retained for reference, the new logo is logo2,
which all the .png variants have now been updated to.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the spirit of my uni English teacher; "simplify, Simplify, SIMPLIFY!"
This commit collapses the About and Introduction into a single document,
doc/index.md.
Also, relocate the System Boot section to doc/boot.md, which we alrady
have and covers the initial bootloader part of it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lot of work still remains, but this new disposition should serve as a
more representative template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Files in doc/cli/*.md are used in and displayed as help text in the CLI
admin-exec level. So we cannot use standard admonitions (yet) since the
terminal markdown converter (lowdown) doesn't support the syntax.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want to discourage people to use sysrepocfg and instead move to use
NETCONF, or even better, RESTCONF. When something's missing we should
add it to these two official, and standardized, interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
And make the ASCII image more generic to ease any branding work we may
need to do for certain customers later on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- custom cover page for pdf
- Center and resize logo
- Place slogan just below logo
- Ensure all text on cover page is in matching grey
Please note, the mkdocs-to-pdf plugin works, but it has a bug in the
enumeration of sections. We may need to fork it to make it work the
way users expect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Way too long. By splitting it in multiple files we can also user
simpler (shorter) headings, which makes navigation easier.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Python tool 'mike'[1] helps manage multiple versions of MkDocs-powered
documentation. Only required when building the kernelkit.org site docs!
For each new tag, that steps year or month, a new version of is created of
the documentation, in a separate sub-directory on the gh-pages branch.
Strategy - Version Grouping with Early Publishing:
- Extract YEAR.MONTH from tag
E.g., v25.06.0-beta1, v25.06.0-rc1, v25.06.0, v25.06.1 → become version 25.06
- From first pre-release onwards:
- v25.06.0-beta1 → creates docs version 25.06
- v25.06.0-rc1 → updates docs version 25.06
- v25.06.0 (GA) → updates docs version 25.06
- v25.06.1 (patch) → updates docs version 25.06
- New major/minor series:
- v25.07.0-beta1 → creates new docs version 25.07
Benefits:
- Users get docs as soon as beta/rc is available
- Patches update existing docs (logical since patches rarely change docs significantly)
- Clean version grouping by YEAR.MONTH
- Mike handles create vs update automatically
[1]: https://github.com/jimporter/mike
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Major overhaul and simplification of both language and structure to
improve accessibility and UX in new documentation framework.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note, this change breaks some links on GitHub due to the difference in
how MkDocs and GitHub implement "autolinking" and anchors. Since the
idea is to make MkDocs our primary documentation framework, breaking
links on GitHub in favor of MkDocs is the best compromise.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it a lot easier to find relevant information on how to
perform a system upgrade. Further consolidation may come later.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Redesign how GH actions are triggered. This new design uses a
self-trigger to start jobs which are only started via workflow_calls.
The main benefit of this is to be able to start workflows from various
Infix Spins without needing to duplicate the workflow files in them.
Upcoming patches are intended to parameterize to allow Spins to pass
different architectures, brand names and such.
Signed-off-by: Richard Alpe <richard@bit42.se>
We was missing the firmware required for this, and for this to work
cfg80211 needs to be as module since the rootfs is not loaded when it
is loaded if compiled in kernel.
And add iw since it very useful for debugging.
Add test to verify a container on Infix can execute commands on the
host by mounting a script to `/etc/rc.local` with proper permissions.
The test confirms host hostname change using `nsenter` from inside
a privileged container.
Resolves#1024
- Fix by-word movement, detect word barrier using non-alphanum chars
- Fix delete word left/right, make sure to save word in kill buffer
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Buildroot updated to v25.02.3
- Tefactor of nftables container
The nftables container now includes BusyBox, a shell with vi and some
basic filesystem tools, as well as nsenter and unshare, suitable for
testing and other more advanced tasks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
If a extra infix feature require features to be added to an already
loaded module. Instead of have the exact module definition in multiple
places (with date), this will allow a much more flexible sytax:
MODULES=(
"infix-interfaces -e containers"
)
This require that the infix-interfaces is loaded *before* this file
is run.
This since the feature is called 'wifi' in Infix, this makes the naming
consistent over the system.
Also trigger start of a wpa_supplicant, for scanning in the background.
The scanning results is available operational.
Some CLI commands where inadvertently moved from the global CLI
context into the show context.
For example the upgrade command.
As a result, commands like upgrade were unavailable at the top-level
prompt:admin@ix-00-00-00:/> upgrade ?
Error: Command not found, or incomplete.
However, these commands remained accessible under the "show" context
as a temporary workaround:
admin@ix-00-00-00:/> show upgrade ?
URI [(ftp|tftp|http|https|ftp)://(dns.name | ip.address)/path/to/]upgrade-bundle.pkg
This patch restores the affected commands to the global CLI context so
that commands like upgrade function as intended at the root prompt.
Fixes: 9c0a8e39 klish-plugin-infix: fix indentation in infix.xml
Signed-off-by: Richard Alpe <richard@bit42.se>
title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
head: '${{ steps.branch.outputs.name }}',
base: 'main',
body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.infix_version }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
