Infix defines its own Kconfig options with unprefixed names (IMAGE_*,
QEMU_*, TRUSTED_KEYS*) and an INFIX_ prefix. Unprefixed names risk
clashing with Buildroot and with other br2-externals/spins that source
our tree.
Rename all 86 options to a common IX_ prefix, collapsing the existing
INFIX_ ones, e.g. INFIX_IMAGE_ID becomes IX_IMAGE_ID. The os-release
INFIX_DESC field is a runtime interface, not a Kconfig option, and is
kept; the qemu Config.in generator's @ARCH@ symbol is updated to match.
Closes#1305
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Releases exposed the RAUC upgrade bundle only inside the per-arch
tarball, and shipped no ready-to-flash Raspberry Pi image; users had
to unpack the tarball or assemble an image from a separate bootloader.
Upload output/images/*.pkg as its own artifact, and build an rpi64 SD
card image in the aarch64 release leg before rootfs.squashfs is
stripped from the tarball, combining it with the rpi64 bootloader from
the latest-boot release. Publish both as release assets; the tarball
still carries the .pkg too.
Closes#1084
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Services could not bind to addresses not yet present on an interface,
e.g. floating VIPs managed by a routing daemon, since nonlocal bind
was left at the kernel default of disabled.
Enable net.ipv4.ip_nonlocal_bind and net.ipv6.ip_nonlocal_bind among
the router defaults in /etc/sysctl.d.
Closes#1022
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Developer builds report the bare upstream U-Boot version, e.g.
2025.01, and are easily mistaken for release builds. Nothing stamps
a local version on non-release builds to tell them apart.
Write a .scmversion of -DEVEL from a pre-build hook when INFIX_RELEASE
is unset, so developer builds report 2025.01-DEVEL. Release builds
are left untouched.
Closes#919
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Three more RESTCONF wrappers assume the response to a keyed GET is the
bare node, when the server nests it under the full parent path: the
container resource-usage stats always read zero, the WireGuard listen
port never populated, and resetting advertised link modes silently
re-enabled auto-negotiation on links where it was forced off.
Same class of bug as the firewall zone reset fix: the decode matches
nothing and the zero value is used as if valid. Model the full nesting
in all three wrappers, reusing the existing container list wrapper.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Resetting a zone's services (or interfaces) wiped the entire zone:
action, interfaces, address-sets, everything but the name.
The keyed zone GET decodes into a wrapper expecting the node bare, but
the server nests it under the full parent path:
{"infix-firewall:firewall": {"zone": [ ... ]}}
The decode silently matched nothing, so the reset handler rebuilt the
zone from an empty struct and PUT only the zone name. The same
mismatch also broke network preservation when saving a zone.
Clear leaf-lists by deleting each instance instead of rebuilding the
zone with PUT, so a reset cannot touch anything else. Fix the wrapper
shape, document the nesting convention on the RESTCONF client Get, and
log a warning when a non-empty response decodes to a zero-valued
wrapper. When saving zones, omit empty leaf-lists and a defaulted
action. Refresh the firewall page after resets and update the handler
tests to mock the real response shape.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add firewall address-sets: named sets of IP addresses and networks,
usable as zone sources for per-IP access control, issue #1189. Static
entries are part of the configuration; dynamic entries are managed at
runtime with new add/remove/flush actions, from the CLI or over
NETCONF/RESTCONF. Dynamic entries survive firewall configuration
changes but are not saved to the configuration. Sets with a timeout
expire their entries automatically.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verify that the device's factory-default configuration boots cleanly and
that the device remains usable afterwards -- i.e. it does not fall back to
the fail-secure failure-config.
The test exercises the device's own first-boot bootstrap path: it clears
the startup-config and reboots with the test-mode startup override set, so
confd initialises running from the factory-config (its first-boot path).
That mirrors a factory-fresh / factory-reset device and avoids applying a
full config swap over the live management session -- confd cannot replace
the whole running datastore from within an RPC without timing out, and a
factory config may reconfigure the very transport we are connected over.
The test is image-generic, using whatever factory-config the running image
was built with, so it covers both the stock Infix factory config and any
spin factory config. A single-node (1x1) topology is used on purpose: a
factory config is not written with a lab full of peers in mind, so booting
it across a multi-node topology could trigger broadcast storms or similar.
NETCONF only, as it is the one management transport present in every
factory config.
Signed-off-by: Richard Alpe <richard@bit42.se>
gen-hostname baked the last three MAC octets straight into the generated
hostname, so the actual MAC ended up stored in the configuration. Copy
that config to another device and its hostname no longer matched the
hardware.
Emit the %h and %m format specifiers and let confd expand them when the
config is applied, so the MAC is resolved per device and never written
to a saved config. This also drops the /run/system.json lookup.
Closes#1554
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On weekly builds INFIX_RELEASE is "latest", and it fed straight into
INFIX_VERSION, so the keyword showed up as VERSION, VERSION_ID and
PRETTY_NAME in /etc/os-release, in /etc/version (show version), in the
ietf-system os-version operational leaf, and in the mDNS advertisement.
None of those pinned down the source revision; only BUILD_ID did.
Tie INFIX_VERSION to INFIX_BUILD_ID (git describe). INFIX_RELEASE now
only labels the release channel (IMAGE_VERSION) and names the published
artifacts.
Also exclude the moving 'latest*' tags from git describe, so the build
id can never resolve to "latest" should that tag land on, or nearest to,
the built commit.
Fixes#1524
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In netdag_gen_ethtool_autoneg() the unmapped and "exactly one entry"
checks already guarantee a forced PMD link mode is selected, but
Coverity cannot see the correlation and flags the later deref. Fold
!forced into the entry-count guard to make the invariant explicit.
Fixes Coverity CID 561388.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
lydx_get_cattr() yields NULL for an absent leaf or a failed radio
component lookup; that NULL was passed straight to strcmp() on several
WiFi paths (wifi_chan_to_freq, the wifi_gen_mesh width branches,
wifi_find_higher_band_twin, dep_radio_components), risking a crash.
Guard each value before use.
Fixes Coverity CID 561387, 561389, 561390, 561391, 561392.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.
The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end. Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.
Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.
Fixes: #1546
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
crond shipped auto-enabled in finit (symlinked into enabled/), so it ran
on every boot. With no cron jobs /var/spool/cron/crontabs does not exist
and 'crond -f' exits non-zero, which finit then crash-loops until it gives
up ("Service crond keeps crashing, not restarting").
Ship crond available-only and let confd manage it: the schedule plugin
already rebuilds the crontab on every change, so enable + touch crond when
at least one consumer is active and disable it otherwise. No jobs, no
crond, no crash loop.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Previously at least one end of a veth pair had to remain in the host
namespace, because that end created and destroyed the pair. Assigning
both ends to containers left no one to create it.
Select a deterministic primary end so exactly one side creates the pair.
When the primary is itself a container interface, create the pair in the
host namespace before the container starts; CNI host-device then moves
each end into its container. Teardown is deferred to the container
removal script so the pair does not linger and block re-creation.
Drop the now-obsolete limitation notes from the documentation and YANG,
and add a regression test connecting two containers over a veth pair.
Fixes: #941
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The per-port PHY temperature sensors on Marvell DSA switches show up in
'show hardware' with the name the kernel derives from the full device
tree path, e.g. cp0busbusf2000000mdio12a200switch2mdio01, which honestly
is completely unreadable and also overruns the value column. Name each
sensor after the front-panel port it serves (e1, e2, ...) by matching
the PHY's device-tree phandle against each interface's phy-handle.
Also:
- show system: report a representative SoC temperature on CN913x by
matching the ap-* and cp<N>-* thermal zones, hottest wins.
- cli-pretty: truncate over-long sensor names so they can never spill
into the value column again.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Reorder the README so newcomers see the product before the philosophy:
CLI demo and web UI up top, a "Try it in 5 minutes" section linking the
GNS3 and build-from-source guides, then hardware and the rest. Tone
down the remaining marketing prose in the hardware and use-case lists.
Rename CODE-OF-CONDUCT.md to CODE_OF_CONDUCT.md so GitHub recognises it
as the community code of conduct, and link the .github/ health files
from the README.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GitHub now publishes a sha256 checksum for each release asset, so the
separately generated .sha256 files are redundant.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor to use a dummy interface instead of wasting a dut. This not
only simplifies the test but also increases test coverage on test rigs
with a single DUT.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add govulncheck CI and Dependabot for the two Go modules, src/webui
and src/netbrowse, so vendored dependencies don't quietly accumulate
CVEs between manual updates.
The workflow reports every finding in the run summary but only fails
on vulnerabilities our code actually calls in a dependency. Called
stdlib vulnerabilities are surfaced too, but they're fixed by bumping
the Buildroot host Go rather than a module's go.mod, so they don't
gate the build.
Dependabot ignores openconfig/goyang: it's pinned to our kernelkit
fork via a replace directive and stepped by hand.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The three YANG 1.1 fixes lived as a frozen, one-shot copy of goyang
v1.6.3 under internal/goyang (via a local `replace`) — invisible to
dependency/CVE tracking and impossible to update. Move them to the
maintained kernelkit/goyang fork (v1.6.3-kkit branch) and depend on it
through go.mod, pinned by commit hash; drop the in-tree copy. getopt
falls out of the dependency set since it was only used by goyang's CLI,
not pkg/yang.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The "unsaved changes" banner was set unconditionally at every site that
touches config, so it could appear when running-config actually equals
startup — contradicting the "Show diff" modal, which correctly showed
nothing. A shared updateCfgUnsaved helper now compares running against
startup (the same datastore pair the diff uses) and sets or clears the
banner cookie to match:
- Apply and restore-to-running clear it when an Apply/restore reverts
an out-of-band (e.g. CLI) change back to match startup, instead of
always showing it.
- The advanced-tree presence toggle writes only the candidate
datastore, so it no longer sets the running-vs-startup banner at all
(matching the other candidate-only tree handlers).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These two shortcuts are toggleable in the configuration but were only
detected once at login and baked into the session, so disabling them
didn't drop the topbar icon / user-menu entry until re-login.
Refresh just those two from running-config on full page loads (htmx
swaps and pollers, which never re-draw them, are skipped), so toggling
takes effect on the next reload without logging out.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a Hash dropdown to the add-user and change-password forms — yescrypt
(default), SHA-512, SHA-256, MD5 — passed through to mkpasswd. These are
exactly the four hashes the infix-system:crypt-hash YANG type accepts;
unknown values fall back to the default. Password inputs switch to the
CSS-masked type=text used by keystore secrets, which keeps the browser
password manager from offering to save device credentials. Each add-user
field gets a YANG description as a hover tooltip.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds a button next to "Save to startup" that opens a modal showing a
unified diff between startup-config and running-config, so the pending
changes can be reviewed before persisting them. The handler fetches
both datastores over RESTCONF (same serializer → low-noise diff),
writes them to temp files, and runs busybox `diff -u`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Move the per-user shell editor out of the always-visible row into the
expanded detail; the summary now reports the shell as plain text. This
also fixes the editor showing "bash" for non-bash users: the dropdown
matched the module-prefixed option value against the bare stored shell,
so it never matched and fell back to the first option.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add conditional YANG feature 'web-ui' to infix-services.yang, set when
the webui is built. This feature is what the test now looks for to
determine if it should be skipped or not.
Also, clean up remnant of old test, which was entirely replaced by
Mattias' login/csrf test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finishes the migration started in 63f46d4d: setup-mkdocs was still
referenced via a relative ./.github/actions path, which GitHub resolves
against the calling repo, not infix, breaking spins (e.g. Styx) that
reuse build.yml/build-release.yml. Use kernelkit/actions/setup-mkdocs@v1.2.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit increases attempts on checks in this particular test from default 10 to 60.
This has been introduced to match worst case scenario where after 3 retries(5s) each dhcp waits 30 seconds before next 3 retries.
Commits yields to much more stable test behaviour.
Resolves: #1515
Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
Verify:
- Unauthenticated GET / -> 303 to /login
- Bad-password rejection -> no session is created
- Session cookie is flagged HttpOnly
- Authenticated GET /interfaces -> 200
- with htmx-config meta tag check
- State-changing POST without CSRF token -> 403
- POST with X-CSRF-Token header -> succeeds
- After logout the session no longer grants access
The cookie-preserving WebUI helper class also folds in the IPv6
link-local zone-id workaround (re-encode %25 back to %) that
infamy.restconf already uses.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Surface network diagnostics the Overview lacked: default gateway(s) with
a live reachability dot, an Internet reachability check, the effective DNS
resolvers (origin static vs DHCP, plus the interface), search domains, NTP
sync, and the IP addresses of every L3 interface.
All from the operational datastore. Reachability is an async per-address
ping (pulsing green dot on reply, red cross on none).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Auto-logout was client-side only while the server kept a fixed 1h idle
timeout, so "Off" still logged you out. Sessions now carry a per-session
timeout the client syncs from the menu (0 = never), capped at 24h.
Theme: the login toggle icon was never initialised on load (stuck on the
'auto' glyph); add color-scheme so native controls follow the OS on
'auto', and re-apply on OS theme change.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add missing Configure -> shortcuts
- For shortcuts into YANG tree, expand and mark the tree node
- Revamp the /mdns status page to mimic /ntp => more vertical space
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Surface the configured hostname right of the logo, pinned to the
sidebar's right edge so it reads as the start of the content area. When
location and/or contact are set they appear in a hover/focus popover, so
the bar stays uncluttered; the name links to Configure > System.
Loaded asynchronously (hx-trigger="load") to keep it out of every page's
data path — the topbar persists across htmx swaps, so it fetches once per
full page load and renders nothing on error or when no hostname is set.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
External services like the mdns-browser and the web console belong in
the User Menu next to the bundled user guide. They all open another
browser tab and provide another service.
Place common tasks close to each other and high up: Interface overview,
routing table, and firewall. Feels slightly better imo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The collapsed Interfaces list left DHCP/SLAAC/zeroconf invisible until a
row was unfolded, so L3 interfaces showed only empty cells. Replace the
Addresses column with a Config column whose pills are chosen by role,
mirroring the Status > Interfaces data column but slanted to configured
intent: vid for VLANs, mode for WiFi, 802.1Q for filtering bridges, and
DHCPv4/DHCPv6/SLAAC/Zeroconf for IP interfaces, alongside any static
addresses.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the single bulk-PUT form + client-side row cloning (which broke
when these pages were split out of System settings) with the
server-driven list pattern used by Keystore/Users: each server is a row
keyed by name that expands to edit, with per-row delete and a dedicated
add form. DNS search domains become add/delete rows. Server creates
its container on first use, and field-info ⓘ help is sourced from the
YANG descriptions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Surface confd-inferred values (DHCP option lists, etc.) on the curated
Interfaces page: SaveIPv4/IPv6Settings re-render just the interface's IP
block from the fresh candidate, swapped in place via outerHTML, so the
row stays expanded. The DHCP foldout auto-expands after a save to reveal
the inferred options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd infers Infix-suggested values (DHCP option lists, related leaves,
normalised values) into the candidate when a change is written, but the
tree editor's write handlers only wrote — SaveLeaf echoed the typed value
back, SaveGroup returned 204 — so the inferred values never appeared
until a manual page reload.
After a save (cfgSaved) re-fetch the current tree page from the now
up-to-date candidate and re-render it, so inference surfaces wherever it
landed on the page. SaveLeaf now emits cfgSaved + 204 like SaveGroup
(its form uses hx-swap="none") instead of echoing the raw input.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
SaveIPv4Settings/SaveIPv6Settings PATCHed the ietf-ip:ipv4 container to
set forwarding, but a plain PATCH 400s ("Target resource does not exist")
when the interface has no L3 config yet — exactly the first-time
DHCP-enable case. PATCH the interface instead, with the family container
nested in a single-element list entry (rousette rejects the bare-object
form with LY_EVALID once an augmented container is nested), so the
container is created on first use.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When we reconnect to a device we should reload the page instead of
silently resume. Because the device may have been rebooted from the
CLI or experienced power loss. Either way, our session in RAM only
is likely gone, and if so we'll be redirected to /login again.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Build the mkdocs User's Guide into WebUI images and surface it in the UI.
post-build.sh runs `mkdocs build` from the top-level mkdocs.yml into
/var/www/guide when the webui package is selected and mkdocs is on the
build host; nginx serves it read-only at /guide/. The build is
best-effort — a missing mkdocs warns and ships without the guide rather
than failing — and minimal images (no webui) skip it.
The WebUI gates a book icon in the topbar and a User Guide item in the
user menu on the docs being present on disk (os.Stat, fail-closed), both
opening /guide/ in a new tab.
CI: a local setup-mkdocs composite action installs mkdocs and the
plugins from mkdocs.yml; the build and release workflows run it before
the build so images produced in CI include the guide. developers-guide
documents the new build dependency and restores the missing
mkdocs-glightbox plugin.
Fixes#633
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Surface the mDNS network browser (netbrowse at network.local) from the
WebUI: a radar icon in the topbar and a Network Browser entry under
Status > Network, both opening it in a new tab.
Like the console, this is a config-gated capability; fold the console and
netbrowse enable flags into a single infix-services web read at login
(DetectWebShortcuts) and render each entry only when enabled, fail-closed
on a read error. The link is a static https://network.local/ since
netbrowse is a fixed name-based vhost.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Surface the ttyd web console (port 7681) from the WebUI: a terminal icon
in the topbar and a Console entry under Maintenance, both opening the
console in a new tab. The link target is built client-side from the
current hostname since the console runs on its own HTTPS port.
The console is a config-gated capability (infix-services web/console
enabled), so both entries are detected at login and rendered only when
it is enabled — a disabled console shows no entry rather than a dead
link. Detection fails closed: a config read error hides the entry.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename the Maintenance > Backup & Restore page to Backup & Support and
add a Support Bundle card. Download support runs the on-device
`support collect` tool, which gathers configuration, logs, routing,
interfaces, hardware inventory, and container and service status into a
single archive; the WebUI runs as root so the collection is complete.
The handler buffers the archive and only commits response headers once
collection succeeds, so a mid-collection failure is a clean error rather
than a truncated download. An optional password encrypts the bundle via
the tool's GPG support, fed on stdin so it never reaches the process
list. Collection blocks for up to a minute with no output, so the write
deadline is extended past the server's 15s WriteTimeout and nginx gets a
matching read timeout; the browser shows a "collecting" state and saves
the blob client-side using the server's filename.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New Diagnostics page under Maintenance runs ping, traceroute, mtr and
nmap with live output, plus a one-shot DNS lookup. A tab per tool
shares a target field, source-interface and address-family selectors,
and per-tool options; the field is focused on load and Enter runs the
active tool from any field.
Ping and traceroute stream their output line by line over SSE. mtr
runs --raw and its records are translated into a live hop table —
Loss%, Snt, Last, Avg, Best, Worst updating in place — running
continuously until Stop, or for a set number of cycles. nmap offers a
fixed set of scan profiles (quick, standard, service/version, host
discovery); a CIDR target sweeps a subnet.
Address family is forced with an explicit -4/-6 flag on the base
binary, so a dual-stack hostname no longer follows the system's
IPv6-first resolver preference on hosts that only have IPv4 routes.
The streamer hands the child a real OS pipe and reaps it on exit, so a
client disconnect (Stop closing the EventSource) kills the tool without
leaking processes. User input is guarded: targets reject a leading
dash and whitespace, the source interface is allow-listed against
configured interfaces, and arguments are always passed as a slice. The
target field keeps a history in localStorage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New Logs page under Maintenance presents the on-disk syslog files
(messages, syslog, kern, auth, routing, firewall, upgrade, debug,
container, mail) with a tab per source and an (empty) chip for files
with no content.
The buffer loads the last 250 lines and pins to the bottom on open and
on tab change, with keyboard focus on the pane so PageUp/PageDown work
immediately. Load earlier pages back 250 lines at a time, preserving
the reader's scroll position as older lines fill in above; once the
current file is exhausted the button re-labels to "Load previous from
<rotation>" and walks back through rotated and gzipped archives.
Live tail streams new entries over SSE. The server runs tail -F -n 0
and debounces output; the client follows the bottom unless the reader
has scrolled up. A status pill shows connecting/live/disconnected.
nginx gets a no-buffering location for the tail stream, mirroring the
software progress endpoint.
Download returns the full archive — current file plus every rotated and
gzipped predecessor — concatenated chronologically.
Severity is coloured by a keyword heuristic since sysklogd writes no
<PRI> to disk; BSD-format lines are shown unconditionally. Filter is
client-side substring or /regex/, focusable with Ctrl/Cmd-F.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GET /keystore was just an http.Redirect to /configure/keystore — no
actual status view ever existed; the link landed users in Configure
and folded the Status group on the way, which was confusing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Vendor a Lucide icon set under static/img/icons/ and partial:ize the
inline SVGs across base, login, firmware, sidebar, and yang-tree.
Reorganize the sidebar with mirrored Status/Configure section labels.
Rename NACM to Users & Groups and Firmware to Software; swap Routes and
Routing between Status and Configure.
Split Configure > System into General, NTP Client, and DNS Client pages,
which opens up for relocating the Set Time RPC from the Maintenance
section to a new Date & Time card in the System General config page.
Update browser tab title on htmx navigation via an HX-Trigger
setPageTitle event; encode the payload as 7-bit ASCII so the middle
dot in "Page · Context" survives header transit.
Add missing hover-help ⓘ icons to bridge port configuration, and adjust
their alignment slightly. While in interface configuration:
- fix the annoying Save => collapse so one can edit multiple
interface sections without having to re-expand the iface
- add missing dhcpv4 settings
- add missing custom mac (use advanced view for other settings)
- clean up Save button mess (consolidate)
Rename Firmware -> Software everywhere in the Maintenance section and
fix "Install progress stuck at 10%" issue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Status overview gains a Speed column reading ietf-interfaces:speed +
ethernet/duplex. Interface detail page surfaces PHY type, PMD type,
supported and advertised PMDs.
Configure > Interfaces gains a per-row Ethernet panel: auto-negotiation
toggle, advertised PMDs picker, duplex tri-state, mdi-x tri-state. Each
has a reset-to-YANG-default button. Backend writes leaf-by-leaf via
PATCH+DELETE since a single PUT silently drops the duplex leaf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds an nginx-side rate limit on POST /login so a brute-force or DoS
attempt can't pin the box on the bcrypt-shaped credential check inside
rousette/PAM. Configuration:
- Keyed on $binary_remote_addr (per source IP), 5 requests/minute
sustained with a burst of 3 nodelay, a real user fumbling their
password three times in a row sails through; the 4th attempt in
the same window returns 429.
- GET /login is unmetered (the keyed map yields the empty string,
which limit_req treats as "no key, no limit"), so a 401-driven
HX-Redirect bouncing the user back to the login page doesn't
eat into the budget.
- 32k zone (~500 IPs, the minimum nginx accepts). At cache
saturation an attacker rotating addresses still tops out around
~2500 attempts/min, all serialised through bcrypt one at a time.
- 429 instead of the default 503 keeps the response out of the
/50x.html error_page rewrite (which auto-refreshes and would
loop a throttled client straight back to /login).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The webui Go code now lives in the infix source tree rather than being
imported as an external module. Switch the module path to match that
reality so the imports read coherently with the rest of the codebase.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
renderSaveError lost the HX-Trigger header during the Configure-mode
fold, leaving forms with hx-swap="none" silent on validation errors.
Re-emit `{"cfgError":...}` so the toast layer still gets the event.
DeleteKey's response goes back to a bare 200 to match the other
configure_users.go endpoints; the activity-log redirect form belongs
on the Add/Edit flows.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The "Running config has unsaved changes" banner kept showing after a
power cycle even though the device reloaded running from startup at
boot. The cookie was just "1" with a 24-hour MaxAge, so the browser
held on to it and the banner stayed up — but the state it referred to
was long gone.
Carry a unix timestamp in the cookie value (when set) and compare
against a webuiStartTime captured at process start. Cookies whose
timestamp predates this run are from a previous boot or webui restart;
running was reloaded from startup since then, so they no longer
describe reality and the banner must stay hidden.
- Apply / Restore-to-running: cookie = now → banner shown.
- Power cycle, page load: webuiStartTime > cookie ts → banner hidden.
- Save / Apply-and-Save: cookie cleared (unchanged).
- Legacy "1" / unparseable values: treated as stale.
Also centre the "Device unreachable" connectivity banner past the
sidebar on desktop — left:0 leaves its text drifting behind the
sidebar's z-index. On ≤1024px the sidebar slides off-screen so the
banner reclaims full width.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Five pages drew their per-row delete control as a bespoke <svg> "X"
glyph instead of the icon-trash partial used by Hardware, Routes,
Firewall, Interfaces and the yang tree fragments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Clicking a section header (Status / Configure / Maintenance) used to
fold the previously-open section AND fire a click on the first page
link inside the just-opened section. That meant going from
"Status > Overview" to "Configure > Hardware" was three clicks worth
of page loads: Configure header expands and lands you on Configure >
Interfaces, then you click Hardware and wait again.
Toggle now just expands or collapses its own section. Sibling
sections stay open until a real page-link click, at which point
updateActiveNav() already closes the others to leave only the
section containing the active page open.
Configure's enter-POST (running → candidate snapshot) still fires
the first time the Configure accordion opens per page lifecycle, so
the candidate datastore is ready by the time the user clicks a
Configure page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mirrors the CLI's "show hardware" command — a single page that summarises
everything ietf-hardware exposes about the device:
- Board (chassis info: model, manufacturer, serial, base MAC)
- USB Ports (state + description)
- WiFi Radios (bands, standards, max-AP)
- GPS Receivers
- Sensors (grouped by parent component, all status values)
- Other Components (fallback so the page is exhaustive)
This is Phase 1 of webui-roadmap-v2. Phase 2 will trim the dashboard's
Sensors card to a few key vitals with an "All sensors →" link here,
fixing the existing height-clipping regression in the process.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The NTP page showed a red "Failed to fetch NTP data" banner whenever
/data/ietf-ntp:ntp returned 404 — which is the normal RESTCONF response
when NTP isn't configured at all. Treat 404 as the not-configured case
and render the empty-state card with a Configure → link, mirroring the
DHCP status page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The errors.As(err, &rcErr) + StatusCode == http.StatusNotFound boilerplate
was repeated across six handlers. Replace with the IsNotFound helper
introduced in restconf/errors.go, dropping the now-unused errors import
from each affected file along the way.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds a per-user inactivity countdown that POSTs /logout after a
configurable timeout (default 15 min, persisted in localStorage)
and navigates to /login. Background pollers (watchdog, *counters
refresh) are excluded from the activity reset so they don't keep
the session alive indefinitely. htmx:responseError on 401 short-
circuits straight to /login so a server-side expiration doesn't
leave the UI failing silently.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Idea of wizard is to simplify:
- Re-adding Ethernet interfaces you've accidentally removed
- Setting up WiFi access point/station, incl. radio & PSK
- VLAN filtering bridges
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds Configure > Routes page for viewing, adding, editing, and deleting
IPv4 and IPv6 static routes. Each route row expands in-place to an edit
form; YANG field descriptions are shown as ⓘ tooltips.
Also fixes a goyang bug where inline augments inside a uses block were
never applied to the expanded tree, making it so next-hop-address and
outgoing-interface were missing from the schema — and therefore had no
tooltip text.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces xpath coverage test report. It plugs into transport layer of test system and generates .md report.
Commit also introduces "make xpath-coverage-report" used to generate pdf out of md.
Resolves: #581
Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
Navigating interfaces now work, and the tree follows the accordion style
like the rest of the UI.
Also, some updates to the curated pages: online help, lists of leafrefs
instead of hard-coded list options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Implements the configure accordion section with a candidate datastore
workflow: opening Configure copies running → candidate (Enter), each
card saves directly to candidate, Apply copies candidate → running
atomically, and Abort discards by resetting candidate from running.
- RESTCONF client: add Put, Patch, Delete, GetDatastore, PutDatastore,
CopyDatastore, and a shared doRequest/writeJSON helper
- Handlers: ConfigureHandler (enter/apply/abort), ConfigureSystemHandler
(hostname, clock, NTP, DNS, motd, editor), ConfigureUsersHandler
(add/delete user, shell, password, SSH keys, NACM group membership)
- Status > NACM page: read-only group permission matrix derived from
ietf-netconf-acm groups + rule-list mappings
- Sticky Apply/Abort toolbar with custom confirm dialog; server returns
HX-Redirect:/ so HTMX does a full-page reload, keeping sidebar in sync
- Accordion persistence fixed: Configure excluded from localStorage so it
never auto-reopens after Abort/Apply; restore no longer closes an
accordion that contains the active page
- Password hashing by shelling out to mkpasswd(1)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Group nav items by purpose:
- Security: Firewall, WireGuard, NACM
- Services: Services, DHCP, NTP, LLDP, mDNS (moved from Network)
- Network trimmed to: Interfaces, Routing, WiFi
Rename Dashboard → Overview for clearer Status > System > Overview
navigation hierarchy.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a zone-to-zone traffic matrix matching the CLI's traffic_flow logic:
- HOST row/column always present; zone→HOST uses zone action + services
(not policies), producing allow/conditional/deny verdicts correctly
- Clicking a matrix cell shows a detail panel with the policy or zone
reason for the verdict
- Conditional (⚠) detection for zones with services or port-forwarding
Enrich the policy and zone tables:
- Immutable (built-in) policies flagged with ⚷ in column header and row
- Policy rows show description as tooltip; sorted by priority
- Zones table renamed "Host Services" column; Policies drops Priority column
- Wide tables (Zones, Policies) span two grid columns like Dashboard WiFi
Fix the info-grid layout: #content lacked width:100% so margin:0 auto
was overriding flex stretch, collapsing the grid to a single column on
both the firewall and dashboard pages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Display interfaces in a hierarchical tree: bridge and LAG parent rows
show a ▼ toggle in the tree column that collapses/expands their member
ports. The vertical connector line disappears when collapsed. Member
ports within each group are sorted alphabetically; loopback interfaces
always appear first, the rest alphabetically.
A ⚑ forwarding-flag column indicates which interfaces have IP
forwarding enabled, fetched concurrently from ietf-routing:routing.
The "Address" and "Detail" columns are replaced by a single "Data"
column matching the CLI layout: IP addresses, VLAN id, WiFi SSID/mode,
WireGuard peer count, etc. Table rows are top-aligned so interfaces
with multiple addresses don't cause odd vertical centering on other
cells; the two narrow icon columns (⚑ and tree) stay middle-aligned.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Expandable detail row per key. Clicking the ▶ arrow left of the name
unfolds a full-width row showing labeled key fields (Value / Public Key
/ Private Key) as word-wrapped monospace blocks (max-width: 72ch),
making base64 data easy to read and copy.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split the old monolithic Hardware card into dedicated Board, WiFi, and
Sensors cards, matching the structure of `show system` / `show hardware`
in the CLI:
- System Information: add Current Time row, rename Firmware → Boot Partition
- Board: model, manufacturer, Base MAC only (no sensors)
- WiFi (new, conditional): all radios with supported bands, standards
(11n/11ac/11ax), and max AP count; card spans 2 grid columns so the
table never needs horizontal scroll
- Sensors (new, conditional, collapsible): all hardware sensors grouped
by parent component (SFP sub-sensors indent under sfp1/sfp2 headings);
JS "Show more" button injected only when content overflows 300 px
- Disk Usage: replaced wide multi-column table with a per-mount widget
(path + % on one line, health bar, "X free of Y" below); health colour
follows the same warn/crit thresholds as the memory bar
- Fix humanKiB to output IEC units (MiB / GiB) with a space, matching
the memory display style
- Fix info-table th wrapping (width:1%; white-space:nowrap)
- Fix JS collapsible init to run on DOMContentLoaded, not immediately in
<head>, so scrollHeight check has a real DOM to inspect
- CSS scroll-shadow on data-table-wrap: pure-CSS right-edge shadow
indicates overflow without needing JS or a scroll listener
- Equal-height grid rows via align-items:stretch; info-grid-span-2 for
cards with wide tables
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the RAUC-centric firmware page with a cleaner layout:
- Show software slots (primary/secondary) using their bootnames rather
than internal RAUC slot names; filter to rootfs-class slots only
- Add boot order display (mirrors `show software` in the CLI)
- Show installed timestamp per slot (truncated to second precision)
- Fix Booted flag comparison: compare against bootname not slot name
- Lay out all three cards (Software, Install from URL, Upload & Install)
in a responsive grid instead of full-width stacked sections
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop the useless 768–1024px icon-only sidebar mode; everything up to
1024px now uses the hamburger overlay and full-width sidebar.
Fix the user dropdown on touch devices: click now toggles aria-expanded
so CSS-driven visibility works without hover. A document click listener
closes the menu when tapping outside.
Give the sidebar proper light/dark tokens instead of hardcoded dark
values. Introduce --sidebar-hover-fg (primary in light, white in dark)
so nav-link hover text is legible in both themes.
Fix dropdown hover background using --border instead of --border-subtle,
which had zero contrast against the surface in dark mode.
Keep active nav link in sync with the current URL via JS so it updates
correctly after htmx navigation instead of staying on the initial
server-rendered page. Also, add YouTube-style progress when laoding
pages that take time, e.g., Dashboard.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Anonymise the login page: generic "Login" title, lock icon instead
of product logo — makes the device harder to fingerprint.
Add a floating theme toggle button to the login page so users can
switch theme before logging in (cycles auto→light→dark).
Replace the four cluttered sidebar footer buttons (theme, download
config, reboot, logout) with an always-visible topbar user menu.
The dropdown shows the username, three theme options with a checkmark
on the active one, download config, reboot, and logout.
Refactor all handler page-data structs to embed PageData instead of
repeating the four base fields, and add Username (sourced from the
request context) so the topbar can display the logged-in user.
Polish pass on the login card: spacing, focus styles, button weights.
Replace the AES-encrypted-cookie session model with an opaque random
token backed by an in-memory map. The vendored design embedded the
user's username, password, CSRF, and feature flags into the cookie
and persisted the AES key under /var/lib/misc, making the keyfile a
passive credential-recovery oracle — anyone who could read it could
decrypt any captured cookie and recover the plaintext admin password.
Now: cookie is 32 bytes of crypto/rand, base64-url-encoded; sessions
live only in process memory; reboot/respawn/upgrade drops every
active session and the UI's 401 handler bounces the user to /login.
Sliding-window refresh on user activity, janitor goroutine sweeps
expired entries. --session-key flag and /var/lib/misc/webui-session.key
are gone.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace flat nav-section-header labels with collapsible <details>/<summary>
accordion groups (Network, Wireless, VPN, Services, System). Groups default
open; user state persists via localStorage. Tablet icon-only mode always
shows all items regardless of open/closed state.
Add badge-up/down/warning/info/neutral utility classes with full dark mode
support, complementing the existing firewall-specific badge variants.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
avahi resolves mDNS hostname conflicts at runtime by appending -2, -3, …
but the advertiser writes its adminurl TXT record with the configured
hostname and never updates it. A device renamed infix-2.local thus keeps
advertising adminurl=http://infix.local, so its card linked to the other
device. Rebase the adminurl onto the actually-resolved host (keeping
scheme, port, and path); a no-op in the common single-device case.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Include /run and /tmp in mount-points, likely more interesting than /.
- Include advertised link modes in operational to compare with supported
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The contact and location leaves were absent from the operational
datastore. Fetch each leaf from the running ds tool and inject
into ietf-system:system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The test-report target fed a pre-baked report.adoc to asciidoctor-pdf.
Let 9pm's report.py, the author of result.json, both generate and
render the report instead. It is invoked with Infix's own theme, fonts
and logo so the output is unchanged; downstream projects need only
override LOGO to rebrand it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Two unrelated must expressions referenced schema nodes that don't exist,
emitting warnings on every schema load (and in netopeer2-cli):
- NTP: the iburst/burst deviations put the must on the leaf, so
"ntp:iburst"/"ntp:burst" resolved as a child of the leaf. Use ".".
- WireGuard: deref() of a key *-ref lands on the key's "name" leaf, so
"deref(.)/ks:public-key-format" looked under "name". Use
"deref(.)/../...", and descend into the "public-key" list for the
truststore public-key-bag.
hostapd limit hard what BSSID to use, this since hosatpd is desinged
to use radio-mac+n as default. We demand the user to select the MAC
address, if having multiple BSS.
Material's defaults (Roboto, bluish slate dark mode) looked dull next
to the Chirpy-based kernelkit.org blog. Match its typography and colors
via extra.css, no engine change:
- Lato headings + Source Sans 3 body + system monospace for code
- Dark mode: neutral near-black background, soft-gray text, darker code
blocks, Chirpy blue links (replacing Material's high-contrast slate)
- Light mode: warmer body text, blue links, tinted sidebars
- Keep the orange brand on the masthead; links use Chirpy blue
Set theme.font: false so Material no longer also fetches Roboto.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Extend the existing 'show <running|startup|factory>-config' family with an
optional 'path /XPATH' argument that maps straight to the underlying 'copy
-x' flag, and add 'show operational [path /XPATH]' for symmetry with the
configuration datastores.
admin@example:/> show running-config path /ietf-interfaces:interfaces
admin@example:/> show operational path /ietf-system:system-state
Also, improve error feedback from the copy command slightly.
Before:
admin@example:~$ copy running -x /foo
Error: (null) (5)
Error: failed retrieving running-config data
After:
admin@example:~$ copy running -x /foo
Error: Couldn't parse path "/foo": Prefix "foo" not defined. (5)
Error: failed retrieving running-config data
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
cli-pretty prints a friendly message on stdout before any sys.exit(1)
— 'Interface "w" not found', 'Error, top level "ietf-routing:routing"
missing', etc. The wrapper used subprocess.run(..., check=True) and
on non-zero exit caught CalledProcessError, throwing away the captured
stdout and printing the generic exception message instead.
Drop the check=True / try-except dance, always relay stdout, and only
fall back to the generic 'Error running cli-pretty' line when the
subprocess crashed without producing any output.
Before:
admin@bpi:/> show interface w
Error running cli-pretty: Command '['/usr/libexec/statd/cli-pretty',
'show-interfaces', '-n', 'w']' returned non-zero exit status 1.
After:
admin@bpi:/> show interface w
Interface "w" not found
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Ethernet packet/RMON counters at the bottom of 'show interface
<name>' were appended with a wider label column than the operational
data above them, breaking visual alignment. Group them under an
"Ethernet Statistics" section heading (Decore.title), same convention
as 'Available Networks' in the wifi scan view.
Narrow the operational-data label column from 20 to 19 chars so the
title bar exactly matches the heading text — a tighter and more
deliberately aligned look. All labels in pr_iface fit within 19
chars except 'lacp system priority' (20); rename it to 'lacp sys
priority' for consistency with the other 'lacp ...' labels (lacp
aggregate id, lacp partner mac, ...) so the new field width works
universally.
Refresh CLI snapshots and doc samples to match.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix#1506: restore the VLAN interface documentation that was lost when
networking.md was split into per-topic pages. Content adapted from the
v25.11.0 networking.md VLAN section, plus a new "Stacked (Q-in-Q)"
section showing `eth0.10.20`-style nesting and the layered `show
interface` rendering of the parent chain.
Update the interface-type table in networking.md to point at the new
vlan.md instead of the dangling ethernet.md#vlan-interfaces anchor.
ChangeLog: document the user-facing changes on this branch (YANG model
upgrade, layered show interface output, auto-negotation typo fix) and
the new VLAN documentation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Update CLI samples across the documentation to the new layered
presentation: physical-medium row when linked (1000baseT/...), bare
MACs, and key: value DATA tokens. Add a short prose block in
ethernet.md and iface.md explaining the layering.
Drop the historical 'show interfaces' (plural) form — removed from
klish years ago — from all user-facing examples and the landing page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Import ieee802-ethernet-interface@2025-09-10.yang, from IEEE 802.3.2-2025,
and companion ieee802-ethernet-phy-type.yang, replacing the 2019 revision.
Operational interface speed moves to ietf-interfaces:speed, RFC 8343,
eth:speed is now obsolete. Bump infix-interfaces.yang revision to track
the upgrade.
The CLI 'show interface' command renders interfaces as bottom-up layered
protocol rows. Ethernet interfaces a new IEEE link-mode row (1000baseT,
10GbaseLR, ...) is added with 'duplex: full|half' in the DATA column.
Without link the ethernet row is the first row. Tunnels and wifi follow
the same layering: gre/vxlan rows carry remote:/vni: tokens with optional
ethernet sub-row for the L2-bearing variants; wifi rows carry 'station' or
'access-point' ssid:, signal:, stations: tokens.
admin@bpi-76-8f-c2:/> show interface
⚑ INTERFACE PROTOCOL STATE DATA
⇅ lo loopback UP
ipv4 127.0.0.1/8 (static)
ipv6 ::1/128 (static)
⇅ br0 bridge DOWN
│ ethernet 32:2e:3f:76:8f:c2
│ ipv4 192.168.0.1/24 (static)
⇅ ├ lan0 bridge LOWER-DOWN
⇅ ├ lan1 bridge LOWER-DOWN
⇅ ├ lan2 bridge LOWER-DOWN
⇅ └ lan3 bridge LOWER-DOWN
⇅ gre0 gre UP remote: 198.51.100.7
ipv4 10.255.0.1/30 (static)
⇅ sfp1 ethernet DOWN ca:59:f0:77:80:5b
⇅ wan 1000baseT UP duplex: full
ethernet 32:2e:3f:76:8f:c2
ipv4 192.168.0.235/24 (dhcp)
ipv6 fe80::302e:3fff:fe76:8fc2/64 (link-layer)
⇅ wan.10 vlan UP vid: 10
│ ipv4 10.0.10.1/24 (static)
└ wan
⇅ wan.10.20 vlan UP vid: 20
│ ipv4 10.0.10.20/28 (static)
└ wan.10
⇅ wifi0 wifi UP station ssid: corp-net signal: good
ethernet dc:a6:32:00:11:22
ipv4 192.168.7.42/24 (dhcp)
yanger populates phy-type and pmd-type from a static ETHTOOL link-mode
identity table keyed on (port, speed, duplex). Both leaves are populated
for unambiguous media (copper, DAC, copper-T); for generic fiber where
the (port, speed, duplex) tuple can map to multiple PMDs (SR vs LR vs
ER, etc.) only the phy-type family identity is emitted — guessing the
PMD would be misleading. cli_pretty prefers pmd-type (specific) and
falls back to phy-type (family) for display.
yanger also emits ietf-interfaces:speed and fixes a long-standing
'auto-negotation' typo (yanger had never matched ethtool's correctly-
spelled JSON field, so operational auto-negotiation always read
'unknown').
Filling the WG's gap on fixed-speed config
------------------------------------------
IEEE Std 802.3.2-2025 obsoleted the eth:speed leaf without providing a
config-true replacement; the standards-correct way to express what
older Infix configurations called 'fixed speed' is to restrict the set
of PMDs auto-negotiation may advertise. Augment auto-negotiation with
two leaf-lists:
auto-negotiation/advertised-pmd-types config-true, leaf-list of pmd-type
ethernet/supported-pmd-types config-false, leaf-list of pmd-type
Pinning a port to a single mode is now expressed as a single-entry
advertised-pmd-types list. The kernel-supported set is exposed as
operational state for diagnosis — SFP/SFP+ cages report the inserted
module's capabilities, narrowing the list to a single PMD when the
optic only supports one mode (as suggested by @wkz in PR review).
When the supported list collapses to a single entry, yanger uses it
to refine the operational pmd-type leaf — more accurate than the
(port, speed, duplex) lookup for fiber.
confd C apply path (src/confd/src/ieee802-ethernet-interface.c)
translates each advertised pmd-type identity to the corresponding
ETHTOOL_LINK_MODE_*_BIT_*, ORs them into a mask, and emits
'ethtool --change <if> autoneg on advertise 0x<mask>'. An empty
list keeps the historical default of advertising every supported
mode. The (legacy) 'auto-negotiation/enable = false' + speed/duplex
branch is removed — it has no model representation any more.
cli_pretty's detail view gains 'advertised' and 'supported' rows
listing the PMDs in each set. A new _pr_label_list() helper unifies
multi-row rendering across these new rows and the pre-existing
ipv4/ipv6 address rows.
The detailed interface view also gains a 'link mode' row carrying the
pmd-type / phy-type-derived label.
Migration of existing startup configurations
--------------------------------------------
Bump confd version 1.8 → 1.9 to trigger the migration on upgrade.
share/migrate/1.9/10-ethernet-advertise.sh translates old configs of
the form
ethernet { auto-negotiation { enable false; } speed S; duplex D; }
into
ethernet { auto-negotiation { advertised-pmd-types [PMD]; } duplex D; }
mapping (S, D) → PMD via a static lookup covering the copper-T speeds
the deprecated speed leaf historically supported (10/100/1000/2.5G/
5G/10G). Interfaces that don't disable auto-negotiation, or that
lack a speed leaf, are passed through untouched.
Closes#530Closes#805
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
bridge -j vlan global show can return VLAN ranges as
{"vlan": 1, "vlanEnd": 3} instead of individual entries.
The vlans dict was only keyed on the start value, causing
port VLANs 2 and 3 to be reported as "Unexpected".
Also fix typo in error message (brpvlans -> brpvlan).
Move the hostname-triggers-dhcp-client logic from dhcp-client.c into
the centralized dep_hostname() dependency tracker. When the hostname
changes, all interfaces with DHCP client configured are now added to
the diff by the core dependency resolver, so dhcp_client_change() picks
them up through its normal diff-based interface iteration.
When keystore keys change, trigger regeneration of wireguard
interfaces that reference them:
- Asymmetric key change: triggers interfaces using it as private-key
- Symmetric key change: triggers interfaces using it as preshared-key
(both at peers bag-level and individual peer-level)
The 'command' leaf is config, with a strict pattern that doesn't allow
'&', quotes or pipes. Yanger was populating it from podman's full,
untruncated container command -- so any container whose entrypoint
uses shell metacharacters (e.g. sh -c "... && ...") failed YANG
validation.
The symptom: every operational read of /infix-containers:containers
returns SR_ERR_INTERNAL, which in turn fails the whole get-data on
the operational datastore. This breaks case/misc/operational_all and
any RESTCONF/NETCONF read that touches containers.
This was introduced in 59028c4 ("Fix #1466: 'show container' shows no
output"), which added the operational, pattern-less 'cmdline' leaf
but left the old 'command' assignment in place. Drop it -- 'cmdline'
already carries the full command line, and 'command' belongs to
running config.
Note: the failure can look intermittent across test runs because
podman storage is persistent. It only triggers once a container with
a bad-pattern command ends up in 'podman ps -a', including stale or
exited leftovers from earlier runs.
Signed-off-by: Richard Alpe <richard@bit42.se>
Was not correct handled before, a few assumptions was made,
but did not work in reality.
* Fix correct channels for WiFi 6E
* Add missing parameters required for 6ghz to work
Summary of Changes:
bfdd:
- cap IPv6 echo reflection to declared length
- account for FP offset in echo length checks
- fix recv errno filter logic in a few places
- tighten SBFD reflector packet sanity checks
- gate IPv6 echo reflection on known sessions
- tighten auth header parsing skeleton
- validate control packet length before session lookup
bgpd:
- Fix memleak when configuring rd
- Validate if NHC BGPID TLV value is non-zero
- Avoid having a dangling pointer after we free NHC attribute
- Check if BGPID NHC TLV exists when IPv6 next-hop is link-local
- Do not allocate NHC TLV with an extra trailer
- migrate timers during peer_xfer_conn to fix stale route cleanup
- honor 'no activate' for dynamic neighbors in peer-group
- Return immediately when dynamic capability action is not valid
- Validate BGP role capability when handling it dynamically
- fix neighbor IP comparison for IPv6 memcmp return values
- Don't mark nexthop as changed if a set next-hop unchanged is applied
- Return BGP_PEER_INTERNAL when first peer's as type is set to auto
- Update peer sort cache when remote-as auto is used and AS number changed
- Check dynamic capability action before validating ENHE capability
- Do not allocate stream if route-refresh capability is not received
- Move rpki strict check to bgp_accept()
- Fix memory leak for nhc attribute if ipv6 is link-local address
- Fix compilation for Debian 11 when printing uint64 values
- Return zero labels if no BOS found and it's not a withdraw label
- Fix signed overflow in hexstr2num()
- Check the length also when parsing ENCAP attr sub-TLVs
- Validate prefixlen before subtracting when parsing labeled unicast NLRI
- Reset the stream to attr_start + attribute_len when WITHDRAWN
- Revalidate locally originated routes against RPKI changes
- Check if prefixlen is not 0 when parsing flowspec stuff
- Prevent len_string going negative when trying to display flowspec entries
- fix import vrf on non existing vrf
- fix no vrf import command
- Free hostname for FQDN capability if the parsing goes wrong
- Validate MP_REACH_NLRI attribute against incorrect next-hop
- Fix dynamic FQDN capability handling
- Check if the remaining length for subtracting TLV length is enough
- Fix the end pointer boundaries for dynamic graceful restart capability
- Add missing returns when parsing enhanced route-refresh
- Return original as-path when reconciling AS versus AS4
- Do not process route-refresh for AFI/SAFI if it's not negotiated
- Check if we are not overusing error_data buffer when unknown cap received
- fix NHT for explicit link-local BGP peers
- improve packet parsing for EVPN and ENCAP/VNC
- Prevent heap use-after-free for tunnel encapsulation attribute
- Return 0 if AS4 capability is malformed
- close dynamic peer socket in ttl error path
- fix logic handling EVPN_FLAG_DEFAULT_GW
- avoid early return in MPLSVPN NLRI processing
- remove unneeded asserts in packet reads
eigrpd:
- fix byte order in Hello TLV decode functions
- Handling for malformed update packets
- enforce minimum TLV length in Hello handler
- reject invalid prefix mask len
- skip unknown and ignored TLVs
- Improve packet validation
isisd:
- Reject SRv6 Locator TLV with Loc-Size of zero
- consume leftover bytes after FAD sub-sub-TLV loop
- use correct min size values for srv6 subtlvs
- improve validation of flex-algo decoder
- Fix missing neighbor address Sub-TLVs after link-params change
- add unit test for remove_excess_adjs() memory leak fix
- fix memory leak in remove_excess_adjs()
- fix edge condition in max_lsp_count computation
ldpd:
- improve tlv validation in several places
lib:
- Report IPv6 MTU and not IPv4 for if_update_state_mtu6
- disable warning in zlog.c to match master
nhrpd:
- stop debugging auth credentials
- fix byte-order when comparing error code in shortcut path
- guard against zbuf_pulln NULL on truncated packets
- require auth for all received packet types
- harden debug packet parsing against malformed input
- validate AFI index in extension replies
ospf6d:
- move log call out of priv block
- remove asserts in packet-handling paths
- fix issues in ospf6 auth trailer code
ospfd:
- add LSA validation in the apiserver path
- add validation in several places before accessing
pceplib:
- validate during of_list TLV decoding
pimd:
- fix NOCACHE MFC resync detection log, add vrf name too
- use upstream-owned pim pointer in register and upstream timers
- use upstream-owned pim pointer in MSDP update paths
- avoid JP build deref through channel OIL
- guard RP RPF-failure mroute delete on detached OIL
- avoid null deref in upstream delete debug path
- guard channel OIL detach against stale pointers
- fix crash due to double free
- Ensure igmp message is of proper size
- Reject pim packets with a malformed header length
- Fix out of bounds read in AutoRP code
- igmpv3 never checks packet length and trusts the num-sources field
- Do not allow a register-stop message if not received from the RP
- Prevent received msg length from being larger than buffer
- Remove unnecessary asserts
- When receiving a register stop ensure we have enough data to read
- Ensure a register packet has enough space to read S,G data
- Ensure that header has space on packet
ripngd:
- fix data handling in several places
tests:
- Check if route-map with set nexthop unchanged does not prevent outgoing
- Check if mixed peer-group remote-as types can be used with auto
- Verify neighbor addr Sub-TLVs after link-params reset
- Expect return code being 0, not -1 when AS4 is empty or ASN is 0
vrrpd:
- replace some asserts
- only support ethernet in GARP code
- limit advertised timers to 12-bits
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Backport two fixes addressing a critical failure reported by a customer:
an unclean dbus-daemon exit leaves a lingering /run/messagebus.pid, the
daemon then refuse to start, and Finit's restart loop gives up.
0001 service: clean stale pidfile after unclean daemon exit
Drop a daemon-owned (pid:!) pidfile when it still names the
just-reaped PID and that PID is no longer alive.
0002 service: log signal name and core dumps in death message
"by signal: 9" -> "killed by SIGKILL", with ", core dumped"
when applicable. Stronger breadcrumb for sudden deaths.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The \r-overwrite of an in-progress line breaks when something else
writes to stderr between conout(3) and the final call, leaving blank
"[ OK ]" lines. Cache the description and reprint it whole, so the
final status line is robust to intervening output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When an interface has been handed off to a container it lives in
another netns, so `ip neigh/addr flush dev FOO` fails on the host.
The failure aborts dagger, and since interfaces_change() runs before
containers_change() in change_cb(), the container delete path is
never reached -- the stale container keeps the interface trapped in
its netns, breaking the next reconfiguration.
Guard both the neighbor and address flush exit scripts with
`if_nametoindex(ifname)` -- true exactly when the interface is in
the host netns, false for both "in a container" and "already gone".
This replaces the pre-existing `!cni_find(ifname) && if_nametoindex(
ifname)` guard at the addr site: cni_find() added no information
for this check and would popen(container find) for nothing when the
interface had been deleted entirely.
Also harden wrap() in /usr/sbin/container so a stale setup pidfile
doesn't short-circuit Finit's stop attempt -- kill the setup PID and
still ask podman to stop the container.
Fixes#1493
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The regression tests do not pass for some reason, could be faulty test
runner (Lifeboat) -- container and DHCP tests failing since Apr 30), so
tests are disabled until the runner is fixed.
[skip ci]
Issue #1392
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without INFIX_RELEASE, make test resolves INFIX_ARTIFACT to the
unversioned infix-x86_64, but release builds produce versioned
artifacts (infix-x86_64-v26.04.0-rc1.qcow2 etc.), causing the
test environment to fail with "No such file or directory".
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add an x86_64 regression test job to release.yml that runs after the
build and gates publishing — the release job now requires both build
and test to succeed.
Update test.yml's artifact restore step to use a glob so it handles
both the unversioned CI artifact name (infix-x86_64.tar.gz) and the
versioned release artifact name (infix-x86_64-26.04.0.tar.gz).
Fixes#1392
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for static ARP (IPv4) and neighbor cache (IPv6) entries per
interface. Static entries are installed as permanent kernel neighbor
table entries that are never evicted by normal ARP/NDP aging.
Fixes#819
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The mt7622 soc has a built-in wmac, same driver as the mt7615, but
it lacked MODULE_DEVICE_TABLE() so udev could not autoload driver
and firmware.
This commit also adds the wmac+bluetooth specific firmware.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The U-Boot env file is generated by
mkenvimage, which prefixes the variable data with a 4-byte CRC32 by default.
ixpreboot.sh previously imported it with `env import -b` as per uboot docs(-b assume binary format (’0’ separated, “00” terminated).),
which treats the buffer as raw binary and does not strip the CRC.
As a result the first variable's name is parsed a part of CRC.
Later variables import correctly because by then the parser is past the CRC.
Switching to `env import -c` as per uboot docs (-c assume checksum protected environment format.)
makes U-Boot validate and strip the CRC before parsing, so the first variable imports under its real name.
Tested on:
- QEMU
Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
On multi-chip DSA hardware (e.g., boards with multiple mv88e6xxx
chips), each switch chip has its own independent PHC device. With
boundary_clock_jbod enabled, ptp4l starts but only disciplines the
active slave port's PHC — the others drift.
Automatically start phc2sys -a alongside any BC or TC instance using
hardware timestamping. It subscribes to ptp4l's UDS socket, tracks
BMCA, and disciplines all non-active PHCs to match the active one.
On single-chip hardware it is a harmless no-op.
CLOCK_REALTIME is intentionally left untouched. Syncing the system
clock to PTP (phc2sys -rr), feeding the PHC from GPS/NTP (ts2phc,
phc2sys reverse), and full multi-source coordination (timemaster) are
planned as follow-on phases; see the issue tracker for the roadmap.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
NOTE: this is intended only for use on devboards like EspressoBin where
the onboard bootloader only understands fat and ext2 file systems.
To enable, use 'make apply-ext4'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Inverted values for eMMC and SPI NAND. Also use ABCD instead of
Position as column name to match board markings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add a board README to explain how to get Infix running
- Update mkimage.sh to allow creating images without boot loader
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A container's command line, as reported by podman, may comtain environment
variables, which the current regexp (added in ed4fe58) does not support.
Extend the regexp to allow environment variables and add an operational,
config false, 'cmdline' leaf node to allow any characters to be reported
for the full command line in the operational output.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, simplify board README a bit now that we know that you don't need
to flip the boot switch to program eMMC.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Missing BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y caused Buildroot to default
to legacy Makefile build system, which requires BR2_TARGET_UBOOT_BOARDNAME
instead of BR2_TARGET_UBOOT_BOARD_DEFCONFIG, resulting in a build error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add missing *.hash files for all board packages using the ix-board macro;
they declare LICENSE_FILES = LICENSE but had no hash file, producing a
warning during make legal-info.
Fix the date-cpp package where the hash file was named date.hash instead
of date-cpp.hash (package name is derived from the directory, not the mk
filename), causing Buildroot to skip the hash check entirely.
Add hash files for local-site packages confd-test-mode, netd, and
onieprom that declared LICENSE_FILES but provided no hash.
Also, rename package/date-cpp/date.mk to date-cpp.mk. Buildroot derives
the package name from the directory name, so the mk file must match. To
handle the archive name different we set DATE_CPP_SOURCE.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add board support for the BananaPi BPI-R4 router board, based on the
MediaTek MT7988A (Filogic 880) SoC with quad-core Cortex-A73 CPU.
The BPI-R4 is the successor to the BPI-R3 but uses entirely different
silicon: the internal switch runs at 2.5 GbE per port, the two SFP+
uplinks use native USXGMII at up to 10 Gbps, and WiFi is provided by
a MediaTek MT7996E PCIe module supporting tri-band WiFi 7 (2.4/5/6 GHz).
Two board variants, BPI-R4-2g5 and BPI-R4P, replace one SFP+ cage with
a 2.5 GbE RJ45 port (using the MT7988A internal 2.5G PHY); the R4P adds
an optional PoE daughterboard on that port. Both use the upstream
mt7988a-bananapi-bpi-r4-2g5 device tree.
Interfaces:
- Standard R4: eth1 (gmac1/sfp2 LAN cage) → sfp2, eth2 (gmac2/sfp1 WAN cage) → sfp1
- R4-2g5/R4P: eth1 (2.5G PHY) → wan, eth2 (gmac2/sfp1 WAN cage) → sfp1
Factory reset / WPS button (GPIO14, active-low): detected by U-Boot at
boot for factory reset; reused by Linux as KEY_WPS_BUTTON at runtime.
eMMC install note: the MT7988A eMMC (pins 38-49) and SD card (pins 32-37)
use separate physical pads so there is no electrical bus sharing, unlike
some BPi-R3 configurations. However, a single MMC controller
(mmc@11230000) handles both, so only one is active per boot session.
The eMMC install procedure therefore still requires an intermediate SPI
NAND bootloader step until a Linux-side install path is tested.
SD card build (bpi_r4_sd_boot_defconfig) now uses the new
mt7988a_bpir4_sd U-Boot defconfig with cap-sd-highspeed enabled,
giving 50 MHz SD transfers instead of the previous 25 MHz legacy mode.
Also adds MT7988/MT7996 firmware support to the buildroot linux-firmware
package, for 2.5 GbE port PHY and WiFi7 extension board, and updates the
aarch64_defconfig, aarch64_minimal_defconfig, the arch README, CI
boot/image workflows, mkimage.sh, and the ChangeLog.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fix the instability of the display on soft reboots,
previous it required a powercycle to get display to work properly
Add patches from rpi-linux, and a small fixup from me.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Issue #1461 turned out to just be a flaky test, the change in this
commit only bumps the release date.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add several entries that were missing from the original release notes,
most notably the SBSA watchdog fix for CN913x (Marvell Octeon) platforms
and the BPI-R3 watchdog fix, plus show keystore, ixll scan, show system
temperature, WiFi signal strength inversion fix, and follow command fix.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a YANG model change breaks existing startup configs, a migration
script must be included or devices in the field may be left unbootable
after upgrade. Add a dedicated section explaining when scripts are
needed, where they live, and how they work.
Fixes#1459
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unfortunatly the fix was entered in 25.10, but confd was not stepped
up until 25.11, so this should be for 25.10 but now it is for confd
version 1.6 (infix 25.11), as close as we can get.
this is a follwup for commit 7e37fc49a3
confd: prevent IP addresses on bridge ports
Bridge ports should not have IP addresses configured. The IP address
should be configured on the bridge interface itself, not its member ports.
Add YANG must expression to enforce this rule at configuration time.
Fixes#1122
Add a second discovery backend that reads mDNS neighbor data directly
from the sysrepo operational datastore via `copy operational-state -x
/mdns`, selectable with --backend operational.
Add an auto backend (the new default) that tries the operational data
first and falls back to avahi-browse if the `copy` command is
unavailable or mDNS is disabled (visible via "enabled": false in the
JSON). This makes the service work correctly in all configurations
without manual tuning.
Refactor TXT record parsing into parseTxt() and service/host assembly
into buildHosts(), shared by both backends. Extract fetchOpRoot() and
parseOperational() so scanOperational() and scanAuto() share the same
JSON fetch/decode and host-building logic without duplication.
Fix a bug where TXT values containing semicolons were truncated
(parts[9] → strings.Join(parts[9:], ";")), and apply decode() to TXT
values so avahi \DDD escapes are resolved. Add Apple device model
support via the am= (RAOP/AirPlay 1) and model= (AirPlay 2) TXT keys.
Display the last-updated timestamp in 24-hour format regardless of the
browser's locale.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add reliable avahi client reconnect via explicit free+recreate, reduced
log verbosity (single 10s warning instead of 3×2s loop). Also, binary
TXT record filtering (UTF-8 + XML validity), and finally add a SIGHUP
handler for on-demand reconnect.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix now advertises _workstation._tcp, making devices appear
automatically in Windows Explorer's Network folder (Win 10 1709+).
Lead with this, show .local hostname usage for ping/SSH, and demote
the IPv6 multicast ping caveat to a note.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
statd now uses avahi-client for mDNS neighbor tracking, so the
native build needs libavahi-client-dev to satisfy pkg-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
has_fix() only checks that fix-mode is set (2d/3d), but altitude and
other fields may not yet be populated in the operational datastore when
gpsd is still processing its first NMEA cycles after boot. Calling
verify_position() immediately after has_fix() passes can therefore race
and fail with:
KeyError: 'altitude'
This manifests reliably on the second GPS receiver (gps1) after reboot,
because it is initialized slightly later than gps0 and hits the window
where fix-mode is set but altitude has not yet appeared.
not ok 11 - Verify gps1 position is near the coordinates
# Traceback (most recent call last):
# File "test/case/hardware/gps_simple/test.py", line 29, in verify_position
# alt = float(state["altitude"])
# ~~~~~^^^^^^^^^^^^
# KeyError: 'altitude'
Add has_position() to infamy/gps.py, which gates on fix-mode AND all
position fields (latitude, longitude, altitude, satellites-used) being
present. Replace the has_fix() polls in both the pre- and post-reboot
verify steps with has_position().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace fragile SSH+jq approach for reading the chassis MAC with a
NETCONF query to ietf-hardware:hardware/component[name='mainboard'],
reading phys-address directly from the YANG model.
Also add until() polling to the chassis MAC and chassis+offset MAC
verification steps, consistent with the reset-to-default steps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A service restart triggered by finit during sysrepo callbacks can drop
an in-flight HTTP connection, causing copy("candidate", "running") to
fail with RemoteDisconnected. Add retry logic consistent with the
existing PATCH retry pattern in put_config_dict().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
test_reset() triggers a config reload which causes services such as
rousette to restart. Wait for the transport to become reachable again
before returning from attach(), preventing subsequent API calls from
racing with a still-restarting backend.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add --log-level command line option to filter out log messages from
lower log levels. Then fix the annoying CzechLight warning message
and useless "NACM config validation" log. Then add audit trail as
we have in netopeer2-server, and finish off by stripping redundant
fields from log message: timestamp, identity, and log level.
Fixes#892
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The setting 'stratumweight 0.0' disables stratum in Chrony source
selection (pure distance-based), making client_stratum_selection
non-deterministic on a LAN. Setting it to 1.0 gives srv1 a 1-second
effective advantage per stratum level, which no realistic distance
fluctuation can overcome.
Also correct the YANG descriptions in infix-system and infix-ntp which
had the semantics backwards — claiming 0.0 "ensures lower stratum is
always preferred" when in fact higher values do that.
Fixes#1361
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After a successful bootstrap confd writes a sentinel to /run/confd.boot
If Finit restarts confd — whether after a crash or a clean exit — the
sentinel is found and the destructive bootstrap phases are skipped:
- gen-config fork (factory/failure configs already exist)
- wipe_sysrepo_shm() (other daemons, e.g. statd, are live)
- sr_install_factory_config() (datastores are already initialised)
- sr_replace_config(NULL, NULL) (running datastore is consistent)
- bootstrap_config() / load startup-config (not needed; sysrepo has
the right state; plugins resync via SR_EV_ENABLED on re-subscribe)
On restart confd reconnects to sysrepo, re-initialises plugins (which
re-subscribe and receive SR_EV_ENABLED to resync with the live running
datastore), then enters the steady-state event loop.
The sentinel lives on tmpfs so a real reboot always produces a clean
slate. Crash-loop protection is delegated to Finit's max-restarts (10).
As a side-effect this also enables a future "run-once" mode for resource
constrained systems: confd can exit after bootstrap and the sentinel
ensures any later restart just re-attaches without re-bootstrapping.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a finit_enable/disable/reload() family in core.c that directly
manipulates Finit's service state without fork+exec overhead:
finit_enable(svc) -- create symlink in /etc/finit.d/enabled/
finit_disable(svc) -- remove symlink from /etc/finit.d/enabled/
finit_delete(svc) -- remove both symlink and service entirely
finit_reload(svc) -- utimensat() on .conf to schedule reload
Printf-style variants (finit_enablef/disablef/reloadf) handle
template instance names such as container@foo and hostapd@wlan0.
All systemf("initctl ... enable/disable/touch ...") call sites across
containers, dhcp-server, firewall, hardware, ntp, routing, services,
syslog, and system are converted to the new API.
As a related cleanup in services.c, drop the remaining srx_enabled()
calls in favour of reading the already-fetched config tree directly
via lydx_is_enabled(lydx_get_xpathf(config, ...)), eliminating the
last sysrepo round-trips from that module.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Previously svc_enadis() would call 'initctl enable + touch' for every
config change event, even when the service's enabled state was unchanged.
This caused rousette to be unnecessarily restarted on every test_reset(),
racing with the active RESTCONF connection on slow hardware.
Replace svc_enadis() and svc_change() with svc_enable() which only
manages nginx symlinks and calls 'initctl enable/disable' -- never touch.
Each handler now checks the diff for the specific leaf that changed:
- If /enabled appears in diff: call svc_enable() to start or stop it
- If other config leaves changed with service already enabled: touch only
This ensures rousette, ttyd, netbrowse, avahi, sshd, and lldpd are only
restarted when their configuration actually requires it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Save a few CPU cycles by skipping a new dagger generation when no
interfaces have been modified/added/deleted.
Uses d->next_fp as the sentinel: NULL means no claim was made for this
transaction. dagger_evolve() and dagger_abandon() now NULL it after
fclose, so subsequent unclaimed transactions also get the clean early
return.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The operator sees Infix through YANG models and should not need to know
which library implements a given feature. Rename the public-facing
parts of the avahi module to use the mdns vocabulary:
- Log strings: "avahi: ..." → "mdns: ..."
- Public API: avahi_ctx_init/exit → mdns_ctx_init/exit
- Main type: struct avahi_ctx → struct mdns_ctx
- statd field: statd.avahi → statd.mdns
Internal types (struct avahi_neighbor, avahi_service, …) and file names
(avahi.c, avahi.h) are kept as-is — developers debugging at the C level
benefit from knowing the underlying implementation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the mdns service is stop-started (e.g. after a config change),
statd's avahi client fires AVAHI_CLIENT_FAILURE momentarily. With
AVAHI_CLIENT_NO_FAIL the client reconnects automatically, but the
immediate ERROR log is misleading:
ERROR: avahi: client failure: Daemon connection failed
New behavior:
- On AVAHI_CLIENT_FAILURE: start a 2 s deferred timer (no immediate log)
- Timer fires up to 3 times (~6 s total); on the 3rd attempt, check if
mDNS is enabled in the running config via a temporary sysrepo session
- Log ERROR only if the daemon is still down AND mDNS is enabled
- On AVAHI_CLIENT_S_RUNNING: cancel the timer, reset the counter, and
log NOTE "mDNS daemon reconnected" if a failure had been seen
This silences the error entirely when the operator has disabled mDNS
(expected), and defers it by ~6 s for a brief restart (self-heals
before the timer fires).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Use same log frameworks as reset of confd
- Use existing primitives from libite + libsrx
- Drop remaining pthreads
- Coding style fixes
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace logging + logging.handlers with a lightweight syslog wrapper,
and argparse with manual argv parsing. On a sama7g54, this cuts yanger
startup from ~770ms to ~470ms by eliminating ~300ms of stdlib imports.
Also batch external command invocations:
- ietf_routing: two sysctl calls instead of two per interface
- ietf_hardware: one ls per hwmon device instead of six
- bridge: fetch mctl querier data once instead of once per VLAN
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only install the keys on CHANGE event, fixes this annoying issue:
Nov 5 01:32:10 ix confd[2011]: Installing HTTPS gencert certificate "self-signed"
Nov 5 01:32:10 ix confd[2011]: Installing SSH host key "genkey".
Nov 5 01:32:11 ix confd[2011]: Installing HTTPS gencert certificate "self-signed
Nov 5 01:32:11 ix confd[2011]: Installing SSH host key "genkey".
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use SR_SUBSCR_NO_THREAD for all subscriptions and integrate sysrepo
event pipes into a libev event loop. This eliminates approximately 30
per-subscription threads, reducing overhead on embedded ARM hardware.
A temporary poll-based "event pump" thread handles callback dispatch
during bootstrap (where sr_replace_config blocks waiting for callbacks),
then exits. After bootstrap, the single-threaded libev loop takes over
for steady-state event processing.
Note, the confd-test-mode plugin still requires use of threads so we do
not create deadlocks when calling sr_replace_config().
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add x509-public-key-format identity to crypto-types
- Add certificate node to web services container
- Use certificate from ietf-keystore as web cert
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Neither the Raspberry Pi 2B or the Microchip SAMA7G54-EK board have WiFi
hardware by default so drop WiFi, and GPS, support to allow for smaller
builds with only the bare essentials in kernel and system.
Minimal builds in general don't need WiFi or GPS either, so let's disable
them from all. This may become a central theme going forward, keeping
the minimal builds ... minimal.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
netopeer2 and rousette were starting as soon as confd had a PID, while
confd was still loading the startup config via sr_replace_config(). This
held a write lock on the running datastore. A test calling test/reset
shortly after the NETCONF port opened would have its own sr_replace_config()
block on that lock for up to 60 s, at which point sysrepo timed out the
whole RPC with "SHM event 'rpc' processing timed out".
Fix by adding the usr/bootstrap condition to both management servers so
they don't accept connections until confd signals that bootstrap is complete.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate probe of wifi radios from gen-hardware to 00-probe. This saves
one python invocation and some precious CPU cycles at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Follow-up to 90f619b which first introduced the /etc/hostname.d concept.
This commit moves the setup of /etc/hostname.d to post-build.sh dropping
the initial call to the hostname activation script a bit, since it is
called anyway after bootstrap has finished. The scrip is also given a
bit of a refrehs, reducing overhead and needless log messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow confd to start even earlier at boot and call 'gen-config' as a
background task, pending on it to complete before we load the sysrepo
factory datastore.
Also, add Finit style progress to console so users can see the phases
of the bootstrap process.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Infix technically does not need to start dbus and dnsmasq before confd
has loaded the system startup-config. So we move it in time to save
some CPU cycles for confd & C:o.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On single-core Cortex-A7, the YANG bootstrap and config loading is the
dominant boot bottleneck. The current sequence spawns three serial
phases (bootstrap, sysrepo-plugind, load), each performing independent
sr_connect()/sr_disconnect() cycles, and every sysrepoctl/sysrepocfg
invocation is a fork+exec that rebuilds SHM from scratch.
Replace all three with a single confd binary that does one sr_connect()
and performs all datastore operations in-process:
- Wipe stale /dev/shm/sr_* for a clean slate
- sr_install_factory_config() from the generated JSON
- Smart migration: compare config version via libjansson, only
fork+exec the migrate script when versions actually differ
- Load startup-config (or test-config) via lyd_parse_data() +
sr_replace_config(), mirroring what sysrepocfg -I does internally
- On failure: revert to factory-default, load failure-config, set
login banners (Fail Secure mode)
- On first boot: copy factory-default to running, export to file
- dlopen plugins and enter event loop
The bootstrap shell script is split: config generation (gen-hostname,
gen-interfaces, etc.) stays in the new gen-config script, while all
sysrepo operations move into the C daemon. The finit boot sequence
collapses from 5 stanzas to 2 (gen-config -> confd).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport fixes from upstream post v4.16 release. Mainly to fix
mdns-alias crash+restart counter issue when avahi-daemon has to
be restarted. Finit did not properly clear the dependency that
mdns-alias had on avahi-daemon, causing it to crash and have its
restart counter incremented.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The v2025.01 release supports the Microchip SamA7G5* eval kit(s), which
means we can enjoy the same patch level of U-Boot as other Infix boards
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- The biggest changes are syncing with latest BusyBox (busybox-update-config)
- Disable optimize for size
- Enable feature "SH_NOFORK" which allows /bin/sh to call applet_main()
directly without having to fork+exec busybox
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a regression from 0c11cea where local composite actions
(.github/actions/) were referenced with relative paths. When spins
reuse our reusable workflows, GitHub resolves relative action paths
in the context of the calling repo, not infix — breaking the build.
Replace all uses of ./.github/actions/{cache-restore,podman-cleanup}
with kernelkit/actions/{cache-restore,podman-cleanup}@v1 (new repo).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace ERROR() with ERRNO() in all error paths following POSIX API
calls (fopen, rename, realloc, fmkpath, etc.), removing redundant
manual strerror(errno) formatting where present.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before netd starts confd might want to create .conf file for it to run,
so we sort of depend on /etc/net.d existing at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set dhcp-authoritative so clients with unexpired leases are not NAKed
after a router crash or factory reset that clears the lease database.
Drop the untagged suppress directives for options 3 (router) and 6
(dns-server): they conflict with the global options confd writes to
dnsmasq.d/, causing spurious "Ignoring duplicate dhcp-option" warnings.
Per-subnet tagged options already suppress auto-detection, and without
an active dhcp-range there is nothing to suppress anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure we translate the hostname before we generate the udhcpc command
line options, otherwise we'll send '-x hostname:rpi-%m' to udhcpc.
Also update all board specific factory configs with the missing setting
'"value": "auto"' for the DHCP hostname option. This to match what we
already do when we infer options when enabling a DHCP client in the CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Two races could prevent DHCP-learned default routes from being installed
at boot:
1. The signal from the DHCP client script could be lost leaving conf.d
updated but frr.conf stale.
2. Even when the signal was received, 'vtysh -b' could fail because the
FRR daemon chain (mgmtd→zebra→staticd) writes PID files before being
fully operational, causing netd to give up with no retry.
Fix both by refactoring netd to use libev:
- Use an inotify watch of CONF_DIR, so netd reacts directly to file
changes without depending on signal delivery.
- On backend_apply() failure, schedule a retry in 5s and call pidfile()
unconditionally so dependent services are not blocked waiting for the
Finit condition 'pid/netd' to be satisfied.
We also take this opportunity to rename /etc/netd/conf.d/ to /etc/net.d/
The extra /etc/netd/ directory level served no purpose — nothing else
lives there. Flatten to /etc/net.d/ which reads more naturally as the
drop-in directory for network configuration snippets.
Also, reduce logging a bit since each netd backend already logs success
or fail which is sufficient to know that a configuration change has been
applied or not.
Finally, with the new inotify processing in netd it's redundant to call
'initctl reload netd' from the udhcpc script, in fact it will only cause
unnecessary overhead, so we drop it.
Fixes#1438
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a must expression to ensure users do not set static neighbors when
the interface type is not point-to-multipoint or non-broadcast.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add board support for the BananaPi BPi-R64 router board, based on the
MediaTek MT7622 SoC and MT7531 Gigabit Ethernet switch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In a hybrid MBR the conventional layout (used by gdisk and others) is:
MBR[0] = 0xEE (GPT protective, covers whole disk)
MBR[1..3] = user-selected GPT partitions with legacy type codes
genimage currently appends the 0xEE entry after the data partitions,
producing the opposite order. This is fine for most platforms, but
breaks firmware that detects GPT by inspecting only MBR entry 0: seeing
a non-0xEE type there it falls into pure-MBR mode and cannot look up
GPT partitions by name.
The TF-A partition driver (drivers/partition/partition.c) exhibits
exactly this behaviour: load_mbr_header() copies entry[0] and checks
type == 0xEE to select between MBR and GPT mode. The MediaTek MT7622
platform (BananaPi BPI-R64) is a concrete example where this matters.
On the other hand, Raspberry Pi firmware scans all MBR slots for a
bootable FAT32 partition. If slot 0 holds a 0xEE protective entry the
firmware switches to GPT detection, looks for an EFI System Partition
UUID, and reports "no bootable partitions" when none is found.
Add an opt-in hdimage option `gpt-protective-first = true` that places
the 0xEE entry at slot 0 and shifts data partitions to slots 1..3.
The default (false) preserves the existing genimage behaviour so that
platforms like Raspberry Pi continue to work without any changes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Raspberry Pi 400 shares hardware with the RPi 4B but differs in one
important way: it has an internal keyboard and mouse connected through a
VIA Labs USB hub on the VL805 xHCI controller. Break the symlink to
raspberrypi,4-model-b and maintain a dedicated product directory.
Factory config changes from the 4B default:
- USB1/USB2/USB3 all unlocked: USB2 carries the internal keyboard hub
and USB3 the superspeed companion; all are unlocked as this is a
desktop device
- DHCP vendor-class corrected to "Raspberry Pi 400"
Also add interface-quirks.json for the eth0 PHY detach behaviour and
the smsc95xx broken flow-control quirk (inherited from the 4B config
but now explicit), and remove the spurious bootable flag from the
primary and secondary rootfs partitions in genimage.cfg.in.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Remove console=map:0 from the [pi4] section which was suppressing HDMI
output and disabling the display getty. Making it really difficult to
use it as a regular console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Two related problems prevented devices behind an intermediate hub (e.g.
the VIA Labs hub on the RPi 400's VL805 xHCI) from being authorized
when confd unlocks a USB bus:
1. Cascade ordering: usb_authorize() ran nftw() with FTW_DEPTH, which
visits children before the root-hub entry. The hub was authorized
while authorized_default was still 2, so when the kernel probed the
hub's children it immediately denied them. Fix: write
authorized_default=1 on the bus before entering nftw.
2. Slow/async probe: hub port enumeration is asynchronous — devices
behind a hub may appear in sysfs after nftw has already finished.
Fix: add a udev rule that catches usb_device add events on buses
where authorized_default=1 is already set on any ancestor root hub
and authorizes them immediately.
The ATTRS{} matcher in udev walks the full sysfs parent chain, so
authorized_default=1 on the root hub is visible even for devices several
hubs deep. Buses still locked at authorized_default=0 are left alone.
Also expand the docstring in generic_usb_ports() to document the
design: each root hub gets its own uniquely-named entry (USB, or USB1/
USB2/... when multiple) so buses can be individually controlled, and
boards needing finer control should use DT usb-ports annotations.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the costly read-only filter loop (awk+tr per line) with a
stderr redirect, use /sys/class/net/ instead of ip+jq, and batch
all sysctl writes into a single call.
Reduces boot time by ~4s on 32-bit Arm systems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling tune2fs for ext4 partitions at boot costs more than one second
boot time on 32-bit Arm systems, with very little gain. Dropping this
restores the default periodic fsck *and* saves boot time.
Instead of calling sgdisk four times, call it only when resizing and
instead use sysfs to find named paritions. Saves seconds on boards
with weaker CPU and slow media.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The MVEBU SafeXcel Crypto Engine firmware (linux-firmware minifw) was
originally added in 70c12c3 to the generic aarch64 defconfigs to silence
kernel probe failures on Marvell Armada SoCs (37xx, 7k, 8k, CN913x):
crypto-safexcel f2800000.crypto: Firmware load failed.
crypto-safexcel f2800000.crypto: HW init failed (-2)
It was then accidentally dropped in 0e2d12e (kernel upgrade to 6.18),
which rebased on a tree that predated the firmware addition.
Rather than restoring it to the generic defconfigs, move it to the two
Marvell board Config.in files where it actually belongs — consistent
with how RTL8169 firmware was handled for the Raspberry Pi CM4 IoT
Router Board Mini in 68313773.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The awk insertion path used getline to peek at the line right after the
"### Changes", but only printed it when NF == 0 (blank line). If the
section already had a non-blank entry (e.g. a Buildroot upgrade line),
getline consumed it silently and the kernel line was written in its
place.
Fix by adding the missing else branch so the consumed line is always
re-emitted — blank lines before the new entry, non-blank lines after it.
Also demote the missing-UNRELEASED guard from exit 1 to a warning with
return 0, so the workflow doesn't abort when a new release cycle hasn't
had its ChangeLog section opened yet.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add three SSH-related commands to the operational CLI:
ssh [user <name>] [port <num>] <host>
Connect to a remote device over SSH, running as the
CLI user (not root) by dropping privileges before exec.
set ssh known-hosts <host> <keytype> <pubkey>
Pre-enroll a host public key received out-of-band (e.g.
via email after a factory reset) into ~/.ssh/known_hosts,
avoiding a TOFU prompt on first connect.
no ssh known-hosts <host>
Remove a stale host key entry using ssh-keygen -R, e.g.
after a device factory reset causes a key mismatch.
Tab completion is provided for key types (ssh-ed25519,
ecdsa-sha2-nistp256, etc.) and for known host names/IPs.
A new run_as_user() helper is introduced alongside the existing
run(), factoring out the fork+setuid+execvp pattern used by
infix_shell() so it can be shared across the SSH functions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A legacy name length limit in firewalld triggered problems with longer
policy names. This patch to firewalld lifts that limit by checking the
backend in use, no limit for nftables.
Fixes#1389
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Always emit the "1..N" plan line before exiting with error so test
harnesses don't report "test error, no plan" for failed or aborted
tests.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Increase Zebra NETLINK buffer to fix reported issues with zebra being
out of sync with kernel routes and interface changes.
Also, try '-a' option to allow other processes to delete zebra routes.
Other changes in this commit:
- Minor fixes to Finit service files for consistency
- Empty daemon.conf stub files to silence bogus mgmtd errors at startup
- Relocate all skeleton files from board/common to separate from files
that are actual Infix additions and what's package system integration
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
network.local is a discovery/browse page, not a management interface.
Serving it over HTTP eliminates the self-signed certificate warning
browsers show for .local mDNS names without changing the security
posture of the actual device management pages (still HTTPS-only).
The new port-80 server_name block takes precedence over the catch-all
HTTP → HTTPS redirect in default.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
avahi-browse returns 127.0.0.1 (or ::1) when resolving services on the
same machine netbrowse is running on. These addresses are meaningless
for display and misleading as click targets. Skip the entire 127.x/::1
range and link-local (fe80:) when choosing the preferred address for a
host card; the card addr field is simply omitted if no routable address
is seen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- IP address shown in soft parens on the card header line, e.g.
"infix.local (192.168.1.10)"; IPv4 preferred over IPv6, link-local
skipped
- Product name and OS version (from mDNS TXT records "product=" and
"ov=") shown as a secondary line below the header when available
- Theme toggle icons changed from ◐/●/○ to ◐/☽/☀ (system/dark/light)
- browse.go: introduce Host struct (addr, product, version, other, svcs)
replacing the flat []Service map; scan() now returns map[string]Host
- Search also matches against IP, product, and version fields
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apple devices (e.g. Apple TV) publish vv=1 in their AirPlay/RAOP TXT
records, causing a false positive with our Infix platform marker.
Tighten the filter to require vv=1 together with at least one management
service type (ssh, https, http, netconf, restconf), which Apple devices
never advertise. Keep on=Infix as a fallback for older firmware that
predates vv=1.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
avahi's parseable output uses \DDD decimal escape sequences, not octal.
The previous decoder treated them as octal, causing digits 8 and 9 to
fall through undecoded (e.g. \058 → ':' and \091 → '[' were shown
literally). Also handle \X non-digit escapes (e.g. \. → '.') used for
dots in service instance names.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a `hostname` leaf to the `mdns` YANG container with default `"%h"`,
allowing operators to override the avahi host-name used for mDNS A/AAAA
records without reflashing. The default expands to DEFAULT_HOSTNAME from
os-release, preserving existing behaviour for unconfigured deployments.
Format specifiers %h/%i/%m are supported via the existing hostnamefmt()
infrastructure, which is also fixed to copy the const fmt argument to a
local buffer before modification (UB when called with a libyang-owned
string).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use avahi's %h wildcard in service names so each device's hostname is
included, avoiding collision suffixes (#2, #3) when multiple Infix
devices are on the same network.
Skip TXT records whose JSON value is null rather than emitting empty
key= fields. Add _workstation._tcp (with chassis MAC) and
_device-info._tcp (with model= from product-name) as always-on records
tied to mDNS being active.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify and consolidate generation of mdns service records from an
external script to C. This reduces fork + exec and saves two seconds
of boot time on single core Cortex-A7 systems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of publishing A/AAAA records for $(hostname).loocal with a CNAME
infix.local, we flip it around to take advantage of the mDNS conflict
resolution rules. This gives us infix.local for one device ont the LAN
and infix-2.local for the next.
Update all service records to *not* advertise hostname, but instead to
let Avahi imply that from the advertised A/AAAA and CNAME records.
Fixes#1387
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Introduce libfleet.sh and a new 'fleet' subcommand to ixll for managing
and operating enrolled Infix devices via RESTCONF.
Device configuration is stored in ~/.config/infix/config.json
(chmod 600): and organised by profile, allowing bulk operations across
groups of devices (e.g. all aarch64 targets).
New commands:
ixll fleet enroll [-d] [-p profile] [-u user] [-w password] <name> <address>
ixll fleet list
ixll fleet upgrade <name|profile> <url>
ixll fleet backup [-o dir] <name|profile>
ixll fleet reboot <name|profile>
Upgrade runs in parallel across a fleet and shows a live per-device
progress bar by polling the infix-system:install-bundle RPC and the
installer state from the YANG operational data store.
The global -A flag (admin/admin) is honoured as a credential fallback
for devices enrolled without an explicit password.
Also fix a pre-existing typo: ">2" → ">&2" in the error path.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for chronyd's stratumpweight both in the NTP
client (ietf-system) and client+server (ietf-ntp) should fix the flaky
NTP stratum test.
Also, make sure to *not* 'rm -rf /etc/chrony/conf.d/*' in system.c to
prevent clobbering settings potentially made in ntp.c
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to c559b8f2 (new-frr) where netd now is responsible
for funneling static routes, as well as routes from DHCP clients, into
the kernel via Frr.
For this to work, in particular at boot, any DHCP client must wait for
netd to have started or any default routes learned will be lost.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org),
so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A
www subdomain can carry a CNAME pointing directly to kernelkit.github.io,
giving GitHub full control over the mapping and making the redirect work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The weird `if env | grep -q 'reset-volumes'` construct is due to Klish
not sanitizing names before constructing variables, which leads to env
variables with '-' in them, not allowed in POSIX sh.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
curl's SCP/SFTP backend (libssh2) does not support interactive password
prompting — it fails with an authentication error unless credentials are
supplied non-interactively.
Replace the curl path for SSH URIs with native scp(1), which inherits
the TTY and prompts the user for a password as expected. Both scp://
and sftp:// URIs are handled by parsing the URI into a [user@]host:path
argument. Port is extracted if present and passed via -P. If no user
is embedded in the URI, the -u flag value (remote_user) is used instead.
Host-key verification is skipped with -o StrictHostKeyChecking=no, the
same trade-off already made by the test framework.
When the destination URI ends with '/', a meaningful remote filename is
derived from the source: the datastore's on-disk filename (e.g.,
startup-config.cfg), the datastore short-name for in-memory stores, or
the source file's own basename for plain file copies.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add input validation patterns to string-type leaves in container,
firewall, DHCP, and interface YANG models. Also use mkdtemp() for
temporary key files in keystore.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Any exception raised by fn() propagated immediately out of the retry
loop, effectively making until() a single-shot call the moment any
transient error occurred.
Fix by wrapping fn() in a try/except inside the loop and treating any
exception as a "not yet" result. The last exception is preserved and
re-raised if all attempts are exhausted, so failure output is still
meaningful. Also fix a missing newline at end of file.
Fixes#1403
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Python's urllib.request wraps OSError in URLError during the connection
phase, but NOT during response reading (getresponse()). This means a
timeout that fires after the TCP handshake completes, e.g. when a service
accepts the connection but hasn't sent a response yet, propagates as a
bare TimeoutError that bypasses the exception handler, killing the entire
until() retry loop on the first attempt.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename BR2_PACKAGE_NETD_FRR to BR2_PACKAGE_NETD_FRR_GRPC to match the
naming convention of the other FRR backends (VTYSH, CONF) and make the
intent self-evident.
Have the gRPC backend select BR2_PACKAGE_FRR_GRPC so FRR is built with
gRPC support when — and only when — this backend is chosen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a simpler approach than both grpc and watchfrr. Since we only
really need dynamic handling of static routes (for DHCP), we can track
changes made and maintain a "diff engine" for the resulting frr.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all systems are equally quick, let's give it while to set before
bailing out because we test too soon.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest backported fixes to Finit, we no longer need to remove
/run/netd.pid to trigger a reload (restart) of staticd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This includes adding a netd-daemon since FRR has gone towards all
daemons should be configured from mgmtd using YANG, netd uses gRPC to
reconfigure in mgmtd
Signed-off-by: Enable grpc
This is a simple two port router board, with the same
WiFi chips as BPI-r3.
The bootloader shall be the same as the BPI-r3, the bootloader
now probes which of the two is booting by checking for the PHYS
that only exist on BPI-r3-mini.
This patch adds a background gps monitor to statd because the gpspipe
program, normally used to interface with gpsd, slows down access to the
operational datastore with *seconds*.
This background monitor is not load bearing for how chrony accesses the
gps + nmea information from gpsd, this is handled separately in SHM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Enable gpsd and override package defaults to integrate in Infix.
- Sync with rules disabled downstream in Debian project to prevent
clashes with common vendor/device ids used for other device types
- Start gpsd instance with '-n' to ensure /dev/shm is udpated for chrony
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add documentation noting that at least one side of a VETH pair must
remain in the host namespace. Both ends cannot be assigned to different
containers.
Updates:
- container.md: Added IMPORTANT note in Container Host Interface section
- infix-if-veth.yang: Added note in module description
- infix-if-container.yang: Added note in host identity description
Fixes: #947
Related: #941
Co-authored-by: troglobit <183517+troglobit@users.noreply.github.com>
Enable IPv6 forwarding on the left DUT's tunnel interface, matching
the IPv4 tunnel config. Without it, IPv6 packets are not forwarded
through the tunnel, causing all tunnel_basic IPv6 tests to fail.
Regression introduced when fixing issue #515 in 717c1c0.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add Raspberry Pi 2B to the bootloader build matrix and raspberrypi-rpi2
to the SD card image builder, enabling full RPi 2B image creation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Catch ARM 32-bit build regressions early by adding arm targets
to the familty of Infix image and release builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2026-02-05 08:50:09 +01:00
1231 changed files with 106843 additions and 12037 deletions
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
