Change Log ========== All notable changes to the project are documented in this file. [v26.08.0][UNRELEASED] ------------------------- ### Changes - Upgrade Linux kernel to 6.18.39 (LTS) - Upgrade Buildroot to 2025.02.15 (LTS) - Add support for firewall address-set (ipset): named sets of IP addresses and networks, usable as zone sources for per-IP access control, issue #1189 - Build RPi64 SD card images in release builds - Include .pkg files in release builds ### Fixes - Fix annoying "cannot deselect all services" or reset to YANG default in the web interface's firewall configuration page [v26.06.0][] - 2026-07-01 ------------------------- > [!NOTE] > Noteworthy changes and additions in this release: > > **๐ŸŒ Web Interface:** Infix gets its first-ever web interface! Browse live > status and a full operational tree, handle common tasks from curated > configuration pages, and drop into a YANG tree editor for everything else. > A maintenance section covers firmware upgrade, backup & restore, and more. > > **๐Ÿ“ถ Wi-Fi Roaming & Mesh:** Access points sharing an SSID can hand clients > off seamlessly with 802.11k/v/r, form a cable-free 802.11s mesh backhaul, > and steer dual-band clients onto the faster 5/6 GHz band. > > **๐Ÿ—“๏ธ System Scheduling:** Reusable time schedules based on ietf-schedule > (RFC 9922) let features like scheduled reboot and software update checks > run on a recurring, cron-style calendar. ### Changes - Upgrade Linux kernel to 6.18.37 (LTS) - Upgrade Buildroot to 2025.02.15 (LTS) - Add basic web interface: static status pages and a tree view of operational status. Curated configuration pages for some common tasks and a YANG tree editor for the rest. Also includes a maintenance section for firmware upgrade, backup & restore, and more - Add Wi-Fi roaming for fast, seamless handoff between access points that share an SSID: 802.11k, 802.11v and 802.11r (over-the-air FT). See the [Wi-Fi][wifi] guide for details - Add Wi-Fi 802.11s mesh support, letting access points form a wireless backhaul between each other without cabling - Add band steering for dual-band access points, nudging dual-band clients onto the faster 5/6 GHz band - Add `legacy-rates` option to re-enable 802.11b rates on 2.4 GHz for old IoT devices (disabled by default) - Add system scheduling based on ietf-schedule (RFC 9922), using the iCalendar recurrence grouping pruned to cron-expressible rules. Schedules are reusable time-specs; features (`scheduled-reboot`, `software/check-update`) trigger off them via a schedule reference - Configuring multiple BSS (more than one SSID) on a single Wi-Fi radio now requires an explicitly configured MAC address per BSS - New operational `advertised-pmd-types` leaf-list on each Ethernet interface, exposing the link modes currently advertised, to compare against the `supported-pmd-types` introduced in v26.05.0 - Release assets no longer ship separate `.sha256` checksum files; the download page now publishes a SHA-256 checksum for each asset directly ### Fixes - Fix #941: a VETH pair can now connect two containers directly, with both ends assigned to containers. - Enabling IP masquerading in the firewall no longer enables IP forwarding on all interfaces. This has been an issue ever since the firewall support was introduced in v25.10.0 - Fix file permission regression in `/cfg/startup-config.cfg`, causing the default `admin` user no permission to read or write the file from shell - Fix admin url shown for HTTP/HTTPS links in browser, used pre-conflict resolution hostname.local, instead of hostname-2.local - Fix unreadable per-port temperature sensor names in `show hardware` on Marvell based switches: each sensor is now named after the front-panel port it serves (e.g. `e1`, `e2`) instead of a raw device-tree path. `show system` also reports a representative SoC temperature on CN913x platforms - Fix missing `contact` and `location` settings in operational status; the values were configurable but never returned on RESTCONF/NETCONF reads - Fix spurious YANG validation warnings, for NTP and WireGuard configuration, emitted on every NETCONF session and schema load [wifi]: https://www.kernelkit.org/infix/latest/wifi/ [v26.05.0][] - 2026-05-29 ------------------------- ### Changes - Upgrade Linux kernel to 6.18.33 (LTS) - Upgrade Buildroot to 2025.02.14 (LTS) - Upgrade FRR to 10.5.4 - Add support for [Acer Connect Vero W6m][AcerConnectVero], a low-cost COTS home router, based on the same hardware as [Banana Pi BPI-R3][BPI-R3], but with a Wi-Fi 6E (6 GHz band) chip. - Add configurable channel-width in Wi-Fi configuration. - Upgrade `ieee802-ethernet-interface` YANG model to revision 2025-09-10 (IEEE Std 802.3.2-2025), adding the standard `phy-type` and `pmd-type` operational leaves. Speed is now exposed via `ietf-interfaces:speed` (bps, RFC 8343); the now obsolete `eth:speed` is no longer returned - Rework `show interface` summary output as layered protocol rows. When a port has link, a physical-medium row (e.g. `1000baseT`, `10GbaseLR`) appears above the `ethernet` row. VLAN, GRE, VXLAN and WiFi interfaces likewise get one row per protocol layer, with type-specific data on each (`vid:`, `remote:`, `vni:`, `station ssid:`, etc.), issue #530 - Add support for configurable auto-negotiation for Ethernet ports. A new `advertised-pmd-types` leaf-list replaces the fixed speed idiom for pinned link modes, issue #805. See the [Ethernet Interfaces][ethernet] section in the User Guide for details. Existing configurations using fixed speed are migrated automatically on upgrade - Add support for configurable MDI/MDI-X pinout on Ethernet ports. Needed on some PHYs where Auto-MDIX stops working once auto-negotiation is disabled - New operational `supported-pmd-types` leaf-list on each Ethernet interface, exposing the set of PMD types currently supported - New CLI command `show operational`, and optional XPath filtering for this and any of the other datastores, using `[path /path/to/subtree]` - CLI `show` commands now surface human-friendly error messages instead of a raw Python exceptions, e.g., `Interface "w" not found` ### Fixes - Fix #1493: container with a physical interface not properly removed when switching to a configuration without containers - Fix #1506: add documentation on how to configure VLAN interfaces, including stacked (Q-in-Q) VLAN interfaces, in a dedicated `vlan.md` - Handle unclean daemon exits better, e.g., `dbus-daemon` crashing and leaving a stale pidfile behind, causing it to refuse to be restarted - Fix occasional blank or garbled `[ OK ]` lines at startup - Disallow multicast MAC addresses in custom MAC address configuration - Fix broken Wi-Fi 6 GHz band configuration. - Fix operational read of `/containers` failing and thereby aborting all operational get-data, including RESTCONF/NETCONF reads โ€” for containers whose command contains shell metacharacters, e.g. `sh -c "... && ..."` - WireGuard interfaces are now regenerated when a referenced keystore key changes: the asymmetric `private-key`, and the symmetric `preshared-key` at both peer-group and per-peer level - Fix crash in operational data when a bridge has VLAN ranges configured: the kernel may report ranges (e.g. `vlan 1 vlanEnd 3`) from `bridge vlan global show`, which were not expanded, so `show interface` and other operational reads failed. Ranges are now expanded and listed correctly [ethernet]: https://www.kernelkit.org/infix/latest/ethernet/#restricting-advertised-link-modes [BPI-R3]: https://docs.banana-pi.org/en/BPI-R3/BananaPi_BPI-R3 [AcerConnectVero]: https://github.com/kernelkit/infix/tree/main/board/aarch64/acer-connect-vero-w6m [v26.04.0][] - 2026-04-30 ------------------------- ### Changes - Upgrade Linux kernel to 6.18.25 (LTS) - Upgrade Buildroot to 2025.02.13 (LTS) - Add support for per-bridge multicast router port in operational, issue #395 - Add support for static ARP (IPv4) and neighbor cache (IPv6) entries per interface, issue #819. Static entries are installed as permanent kernel neighbor table entries that are never evicted by normal ARP/NDP aging - Add support for PTP/gPTP (IEEE 1588-2019 / 802.1AS) clock synchronization. Supported clock types: Ordinary Clock, Boundary Clock, and Transparent Clock. See the User Guide for configuration details - Add support for [Banana Pi BPI-R4][BPI-R4], quad-core Cortex-A73 router with 4x 2.5 GbE switching, dual 10 GbE SFP+. Variants BPI-R4-2g5 and BPI-R4P have one SFP+ replaced by a 2.5 GbE RJ45, with optional PoE on the R4P - Update [Marvell ESPRESSObin][ESPRESSObin] board support. Allow booting with stock U-Boot, which only supports ext4 rootfs partitions; to use, apply the `ext4` developer snippet before building (`make apply-ext4 all`) - Fix onboard WiFi support on the Banana Pi BPi-R64 ### Fixes - Fix #520: warn in syslog if multicast flooding is disabled - Fix #769: document dummy interfaces in user guide - Fix #790: document static multicast filters in user guide - Fix #1439: changing hostname does not regenerate DHCP client conf until restart - Fix #1458: `show ntp tracking` displaying a truncated Reference ID, e.g., `92.2` instead of `92.246.137.39` - Fix #1466: `show container` showing no output for containers whose command line includes environment variables - Fix issue with IGMP queries sent with all-zeroes source MAC address - Fix missing IGMP query startup burst when assuming IGMP querier role, as defined in RFC3376 ยง8.6/ยง8.7 - Fix Raspberry Pi 4 and Pi 400 display instability after soft reboot. Previously the touchscreen/DSI display required a full power cycle to reinitialise correctly; it now works reliably after `reboot`. Please note, you need a fairly up-to-date EEPROM version as well - Fix [BPI-R4][] board README showing inverted DIP switch values for eMMC and SPI NAND boot modes, which would prevent the board from booting correctly - Fix [SAMA7G54][] U-Boot build system selection that caused build failures - Fix [BPI-R3][] PCIe devices failing to initialize on boot due to a missing clock definition in the device tree [BPI-R4]: https://docs.banana-pi.org/en/BPI-R4/BananaPi_BPI-R4 [ESPRESSObin]: https://espressobin.net/ [SAMA7G54]: https://www.microchip.com/en-us/development-tool/ev21h18a [v26.03.0][] - 2026-03-31 ------------------------- ### Changes - Upgrade Linux kernel to 6.18.20 (LTS) - Upgrade Buildroot to 2025.02.12 (LTS) - Upgrade FRR to 10.5.3 - Add support for [Banana Pi R64 Mini][BPI-R64], 5 port router with WiFi 5 - Add support for [Raspberry Pi 400][RPI-400], an RPi 4B built into a keyboard - Significant boot time improvements, issue #1284. The [InitViz][] boot profiling tool is now included for users who want to visualize and measure the boot process on their own hardware - Add OSPF point-to-multipoint (P2MP) and hybrid interface type support. This also includes support for setting static neighbors, issue #1426 - **Revamped device browser**. Device cards now show the IP address, product name, and firmware version from mDNS TXT records. the mDNS browser is now also available over plain HTTP - mDNS service records now embed the per-device hostname (using avahi's `%h` wildcard), so devices avoid the `#2`, `#3` suffix collisions on service names when multiple Infix devices share the same LAN - Add configurable mDNS hostname: set `services mdns hostname` to override the mDNS name advertised in A/AAAA records. Supports `%h` (default hostname), `%i` (hardware ID), and `%m` (MAC address) format specifiers - cli: new `show mdns` command to list mDNS-discovered devices on the LAN, with addresses and product model - Add SSH client commands to the CLI: - `ssh [user ] [port ] ` โ€” connect to a remote device - `set ssh known-hosts ` โ€” pre-enroll a host key received out-of-band, e.g. after a factory reset - `no ssh known-hosts ` โ€” remove a stale or changed host key entry - Add support for user-configurable HTTPS certificate: select any certificate stored in the keystore via `services web certificate `. The default auto-generated self-signed certificate is now stored in the keystore rather than in `/cfg/ssl` and existing certificates are auto-migrated on upgrade - Add NTP `stratum-weight` setting to fine-tune server selection when multiple NTP sources are available with different stratum levels - Enable HDMI console output on Raspberry Pi 4 and Pi 400. Previously the display was suppressed; a login prompt now appears on the HDMI monitor ### Fixes - Fix #892: suppress rousette RESTCONF server warnings from syslog - Fix #1122: add missing migration script for the YANG validation introduced in v25.10.0 that disallows IP addresses on bridge member ports. Without this script, upgrading with such a `startup-config` would prevent the device from booting. The migration removes all IP addresses from bridge member ports; any addresses that should be kept must be re-added to the bridge interface itself after upgrade - Fix #1387: `infix.local` now resolves to exactly one device per LAN. Previously all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi to append `#2`, `#3` suffixes to the shared alias on busy networks. Assignment is now first-come-first-served using standard mDNS conflict resolution - Fix #1389: firewall policies with names longer than 17 characters were silently rejected - Fix #1416: `show firewall` command show an error when the firewall is disabled - Fix #1438: default route from DHCP client not set at boot, regression in v26.02.0 - Fix #1446: suppress netopeer2-server NETCONF server warnings from syslog - Fix #1456: update project links in SUPPORT.md and README.md to point to the home page and blog at , and update the release link to always resolve to the latest stable release - Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx, 7k, 8k, and CN913x series). Firmware package lost in v26.01.0 - Fix DHCP client not sending hostname to server (e.g. for `dnsmasq` lease registration). All board factory configs had the hostname option without `value: auto`, so `udhcpc` only requested the option instead of sending it. Setting up a DHCP client manually was not affected. Also, the hostname format string (e.g. `rpi-%m`) was not expanded to the actual system hostname before being passed to `udhcpc` - Fix dnsmasq logging spurious "Ignoring duplicate dhcp-option" warnings for options 3 (router) and 6 (dns-server) on every DHCP transaction. Add `dhcp-authoritative` so clients with unexpired leases are not NAKed after a router crash or factory reset that clears the lease database [BPI-R64]: https://docs.banana-pi.org/en/BPI-R64/BananaPi_BPI-R64 [RPI-400]: https://www.raspberrypi.com/products/raspberry-pi-400/ [InitViz]: https://github.com/finit-project/InitViz [v26.02.0][] - 2026-03-01 ------------------------- > [!NOTE] > The blog and User Guide have a new address: ### Changes - Upgrade Linux kernel to 6.18.15 (LTS) - Upgrade Buildroot to 2025.02.11 (LTS) - Upgrade FRR to 10.5.1 - Add support for [Microchip SAMA7G54][SAMA7G54-EK] Evaluation Kit, Arm Cortex-A7 - Add support for [Banana Pi R3 Mini][BPI-R3-MINI], a 2 port router with 2 WiFi chip, uses the same bootloader as BPI-R3 (eMMC-version) - Add GPS/GNSS receiver support with NTP reference clock integration - Add `reset-volumes` option to `container upgrade foo` command ### Fixes - Fix CLI `copy` command problem to copy to scp/sftp destinations [BPI-R3-MINI]: https://docs.banana-pi.org/en/BPI-R3_Mini/BananaPi_BPI-R3_Mini [SAMA7G54-EK]: https://www.microchip.com/en-us/development-tool/ev21h18a [v26.01.0][] - 2026-02-03 ------------------------- > [!IMPORTANT] > This release includes **breaking changes** to WiFi configuration that will > result in existing configuration being disabled: > > - WiFi station/client configuration has been restructured. The `wifi` container > now requires a `radio` reference, and station configuration has moved under a > `wifi/station` container. Existing WiFi configurations must be manually updated > - WiFi radios are now configured via `ietf-hardware` instead of the interfaces module > > Also, **Raspberry Pi users must upgrade the bootloader** before upgrading to > this release. We recommend backing up your `startup-config.cfg` and reflash > the SD card with a new [sd card image][]. ### Changes Noteworthy changes and additions in this release are marked below in bold text. - **Upgrade Linux kernel from 6.12.65 to 6.18.8 (LTS)** - Upgrade Buildroot to 2025.02.10 (LTS) - Upgrade libyang to 4.2.2 - Upgrade sysrepo to 4.2.10 - Upgrade netopeer2 (NETCONF) to 2.7.0 - Add **RIPv2 routing support**, issue #582 - Add **NTP server support**, issue #904 - Migrate DHCPv6 client to odhcp6c for improved Router Advertisement integration. Adds support for hybrid RA+DHCPv6 deployments where SLAAC assigns addresses and DHCPv6 provides DNS (common ISP scenario) - Add support for configurable OSPF debug logging, issue #1281. Debug options can now be enabled per category (bfd, packet, ism, nsm, default-information, nssa). All debug options are disabled by default to prevent log flooding in production environments. See the documentation for usage examples - Add support for configurable container resource limits, memory and CPU. Resource usage is available through the operational datastore, where the currently active resource limits in the container runtime are also available - Add support for "routing interfaces", issue #647. Lists interfaces with IP forwarding. Inspect from CLI using `show interface`, look for `โ‡…` flag - Add operational data journal to statd with hierarchical time-based retention policy, keeping snapshots from every 5 minutes (recent) to yearly (historical) - Add support data collection script, useful when troubleshooting issues on deployed systems. Gathers system information, logs, and more. Issue #1287 - Add **WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3** security. **BREAKING:** WiFi architecture refactored with radios configured via `ietf-hardware` and interfaces requiring `radio` reference. Station config moved to `wifi/station` container. Existing Wi-Fi interfaces will be removed during upgrade (for the rest of the configuration to apply) and you need to reconfigure them again. See the [WiFi][] documentation for details - Add support for **WireGuard VPN tunnels**. - Updated CLI change command to support `cleartext-symmetric-key` (type binary). Used by both WireGuard and WiFi, with application-specific `key-format` for keys and passphrases - New default NACM privilege levels (user levels) in `factory-config`: `operator` (network & container manager) and `guest` (read-only). For details, see the updated system configuration documentation, as well as a new dedicated NACM configuration guide - New `show nacm` admin-exec command to inspect access control rules - CLI now supports Ctrl-@ and Ctrl-w/Meta-w to mark and copy test regions - CLI now uses `copy` and `rpc` tools instead of deprecated `sysrepocfg`. The latter now also require the use of `sudo` for `admin` level users - Enhanced `copy` command with XPath filtering support - Kernel now announces details of new USB devices - New `show keystore` admin-exec command to inspect stored keys and certificates without entering configure context - `show system` now displays CPU/SoC temperature on all supported platforms, including those that report it under the `soc` or `core` sensor name - CN913x (Marvell Octeon) platforms now use the hardware SBSA watchdog, ensuring the device recovers automatically from software lockups ### Fixes - Fix #515: add per-interface IPv6 forwarding control using the Linux 6.17+ `force_forwarding` sysctl. This provides true per-interface IPv6 forwarding similar to IPv4, correctly mapping to the ietf-ip.yang model semantics - Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the Wi-Fi concept in Infix - Fix #1292: watchdog not working on NanoPi R2S due to a broken DesignWare WDT on the RK3328 SoC; the hardware watchdog is now disabled on this board - Fix #1313: Container is not restarted if environment variable is changed - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot. This was due newer EEPROM firmware in newer boards require a newer rpi-firmware package - Fix #1345: firewall not updating when interfaces become bridge/lag ports - Fix #1346: firewall complains in syslog, missing `/etc/firewalld/firewalld.conf` - Fix Raspberry Pi 2B build, among other things, the `aarch32_defconfig` did not include a dtb. Please note, the platform has now been renamed to `arm` - Fix default password hash in `do password encrypt` command. New hash is the same as the more commonly used `change password` command, *yescrypt* - Fix BPI-R3 hardware watchdog, wrong kernel config option used โ€” the device would not recover automatically from a software lockup - Fix WiFi signal strength display showing inverted quality labels (`excellent` shown for weak signals, `bad` for strong) - Fix `follow` command (both shell and CLI) not properly handling log rotation; it now shows the full log and tails it correctly across rotations - Prevent MOTD from showing on non-shell user login attempts - Fix mDNS reflector never actually enabling โ€” the avahi config was written with `on`/`off` instead of the correct `yes`/`no` values, so enabling the reflector in the configuration had no effect [wifi]: https://www.kernelkit.org/infix/latest/wifi/ [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img [v25.11.0][] - 2025-12-02 ------------------------- > [!NOTE] > Noteworthy changes and additions in this release: > > - DHCPv6 client support > - Configurable support for TTL in GRE/VXLAN tunnels > - Extensive filtering support for syslog messages ### Changes - Upgrade Buildroot to 2025.02.8 (LTS) - Upgrade Linux kernel to 6.12.60 (LTS) - Initial support for 32-bit ARM systems, reference board: Raspberry Pi 2B - Enable MVEBU SafeXcel Crypto Engine firmware for Marvell Armada SOCs (37xx, 7k, 8k, and CN913x series). Fixes kernel warnings about firmware load failures and crypto-safexcel probe errors on affected boards - Major improvements to OSPF and BFD operational data and CLI commands: - CLI commands now use data from the operational datastore instead of calling vtysh directly, providing better integration and consistency - New `show ip ospf` command family (neighbor, interface, route) to align with industry standard CLI conventions. Legacy `show ospf` commands are deprecated but still work with warnings - The `show ip ospf database` subcommand has been dropped for now, the advanced user can still use `vtysh` from Bash if necessary, issue #1253 - Extended BFD commands: `show bfd` (status), `show bfd peers` (detailed), `show bfd peers brief` (table format), and `show bfd peer
` - All command names now use singular form (interface, route, neighbor) matching Cisco/FRR conventions, as well as configure context naming - New support for configuring OSPF interface priority for DR/BDR election - The DHCP client configuration has moved from `/infix-dhcp-client:dhcp-client` to `/interfaces/interface[name]/ipv4/infix-dhcp-client:dhcp`, issue #1109. The configuration is automatically migrated on upgrade. The DHCP client is now enabled using a presence container instead of a separate `enabled` leaf - The `enabled` node for IPv4 autoconf (ZeroConf) has been dropped, `autoconf` is now a presence container. Configuration automatically migrated on upgrade - Add DHCPv6 client support for per-interface IPv6 configuration, augmenting `/interfaces/interface[name]/ipv6/infix-dhcpv6-client:dhcp`, issue #1110 - Fix namespace for DHCPv4 client YANG module from `urn:ietf:params:xml:ns:yang` to `urn:infix:params:xml:ns:yang` to properly reflect custom implementation - Improvements to `sdcard.img` generation, useful for developers mostly: - The NanoPi R2S bootloader is now automatically built and uploaded to the [`latest-boot` release][latest-boot] tag - The `utils/mkimage.sh` script now supports fetching the bootloader - The raspberrypi-rpi64 board's bootloader is now aptly named rpi64 - Add support for configuring TTL, ToS/DSCP, and Path MTU Discovery on GRE and VXLAN tunnels. This also changes the default TTL of tunnels to 64, from the kernel default (*inherit*), which in turn fixes reported issues with dropped OSPF Hello frames in GRE tunnels - [Document][bpi-r3-emmc-documentation] how to go from SD card to eMMC on BPi-R3 - Add CLI commands for managing boot partition order: `show boot-order` and `set boot-order` allow viewing and changing the boot order from the CLI, complementing the existing YANG RPC support, issue #1032 - Extended syslog filtering capabilities, issue #1091: - Add support for pattern matching using POSIX extended regular expressions on message content (IETF `select-match` feature) - Add support for advanced severity comparison: exact match (`equals`) and exclusion (`block`/`stop`) in addition to the default equals-or-higher (IETF `select-adv-compare` feature) - Add support for hostname-based filtering, useful when acting as a log server to route messages from different devices to separate log files - Add support for property-based filtering with operators (contains, isequal, startswith, regex, ereregex) on message properties (msg, msgid, programname, hostname, source, data), with optional case-insensitive and negate modifiers - Update factory configuration for BPi-R3 and NanoPi R2S boards to enable DHCPv6 client on WAN interface and allow traffic forwarding from LAN to WAN zone in the firewall (this is what most users expect) - New `support` command for collecting system diagnostics to aid in both troubleshooting and support. Run `support collect > data.tar.gz` locally or remotely via SSH to gather configuration, logs, network state, and system information (encryption using `gpg` available too) ### Fixes - Fix #855: User admin sometimes fails to be added to `wheel` group - Fix #1112: setting hostname via DHCP client sometimes gets overridden by the configured system hostname - Fix #1247: Prevent invalid configuration of OSPF backbone area (0.0.0.0) as stub or NSSA. The backbone must always be a normal area per RFC 2328. Any existing invalid configurations are automatically corrected during upgrade - Fix #1255: serious regression in boot time, introduced in v25.10, delays the boot step "Mounting filesystems ...", from 30 seconds up to five minutes! - Fix #1289: SSH host key generation warning at boot after factory reset - Fix broken intra-document links in container and tunnel documentation - Fix `show dhcp-server` command crashing with invalid timestamp format. DHCP lease expiry timestamps had double timezone suffix causing libyang validation errors - Fix `show dhcp-server` output alignment. The EXPIRES column was misaligned when CLIENT ID field was empty, and CLIENT ID column was too narrow for typical 20-character client IDs [latest-boot]: https://github.com/kernelkit/infix/releases/latest-boot [bpi-r3-emmc-documentation]: https://github.com/kernelkit/infix/blob/main/board/aarch64/bananapi-bpi-r3/README.md [v25.10.0][] - 2025-10-31 ------------------------- > [!NOTE] > Noteworthy changes and additions in this release: > > **๐Ÿ›ก๏ธ Zone-Based Firewall (ZBF):** Protect your network with our zone-based > firewall powered by [firewalld][]. Define security zones, set policies > between them, and enable masquerading. > > **๐Ÿ“Š System & Hardware Monitoring:** CLI `show system`, `show services`, and > `show hardware` now give you instant visibility into CPU temperature, fan > speeds, memory, running services, and sensor data from SFP modules, WiFi radios, > and more. All operational data also available over NETCONF and RESTCONF. > > **๐Ÿš€ Expanded Hardware Support:** The NanoPi R2S is now included in the > default Aarch64 build, which also adds support for Raspberry Pi 3B, and > Raspberry Pi CM4 variants. All boards now benefit from automatic `/var` > partition expansion on first boot. [firewalld]: https://firewalld.org ### Changes - Upgrade Buildroot to 2025.02.7 (LTS) - Upgrade Linux kernel to 6.12.56 (LTS) - Extend NETCONF and RESTCONF scripting documentation with operational data examples, discovery patterns, and common workflow examples, issue #1156 - Initial support for a zone-based firewall, based on `firewalld`, issue #448 - Add `validate` option to CLI `copy` command. This can be used before doing a restore of a backup, or when having edited configuration files manually. With the validate flag (`-n` from the shell) the file is only loaded and validated against the YANG models, it is *not* rolled in if validation is successful. Example: `copy /media/backup/old.cfg running-config validate`, issue #373 - Automatically expand `/var` partition at first boot on all MMC-based devices - New `upgrade` RPC (action) for containers using images with mutable tags - Optimize startup of preexisting containers by adding metadata to track all OCI archives loaded into container store, and all container configurations used to create container instances. Instances are now only recreated when metadata from an existing instance does not match either the configuration or the image โ€” because of configuration changes or image upgrades - Updated container documentation on volumes, image tags, and image upgrade - Add new `show services` command to display running system services - Add new `show system` command with comprehensive system overview including hostname, uptime, load average, CPU/fan temperatures, memory, disk usage - Add hardware sensor monitoring support in `show hardware` with hierarchical display of temperature, fan, voltage, current, and power sensors - Add support for NanoPi R2S router platform to the default Aarch64 build, bumping it to Tier 2 support (SD-card images built separately) - Add support for Raspberry Pi 3B (BCM2837) - Add support for Raspberry Pi Compute Module 4 IoT Router Board Mini - Add support for Raspberry Pi Compute Module 4 NVME NAS box - Add `reboot` option to CLI `upgrade` command for automatic system restart ### Fixes - Fix #981: copying any file, including `running-config`, to the persistent back-end store for `startup-config`, does not take - Fix #1121: Ensure DHCP server does not crash if no address pool is set. This change infers a pool range (only) for /24 networks, and only when a pool is enabled. YANG validation for this and other use-cases is also included. As an unforeseen bonus, Infix now also support non-pool (static lease) setups - Fix #1122: Add YANG validation for consistency, IP addresses are not allowed on bridge port (interfaces). Even though Infix previously allowed this, but disregarded it operationally, it is no longer supported in the configuration - Fix #1146: Possible to set longer containers names than the system supports. Root cause, a limit of 15 characters implicitly imposed by the service mgmt daemon, Finit. The length has not been increased to 64 characters (min: 2) and the YANG model now properly warns if the name is outside of these limits - Fix #1147: Use container metadata to clean up lingering old container images instead of using the too broad `podman image prune -af` command - Fix #1148: Only retry container instance create on remote images - Fix #1149: Increase `podman stop` timeout, from 10 to 30 seconds, needed with bigger containers on heavily loaded systems - Fix #1194: CLI `text-editor` command does not do proper input sanitation - Fix #1197: RPi4 no longer boots after BPi-R3 merge, introduced in v25.09 - Upgrade fixes for containers with mutable images, e.g., `:latest`. Infix now always tries to fetch a new version of the OCI archive, for remote images, regardless of the transport. After upgrade the old image is pruned - Fix #1203: copying any file, including `startup-config`, to `running-config` does not take [v25.09.0][] - 2025-09-30 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.6 (LTS) - Upgrade Linux kernel to 6.12.49 (LTS) - Upgrade libyang to 3.13.5 - Upgrade sysrepo to 3.7.11 - Upgrade netopeer2 (NETCONF) to 2.4.5 - Upgrade rousette (RESTCONF) to v2 - Add support for [Banana Pi R3][BPI-R3], a 7 port switch with 2 WiFi chip - Add neofetch system information tool for system introspection, issue #1143 - Add mtr and iperf3 network diagnostic tools, issue #1144 - Improve default bash settings with better history handling and tab completion - cli: new `terminal reset` and `terminal resize` convenience commands ### Fixes - Fix #1080: Error message in log from rauc, deprecated 'Install' D-Bus method - Fix #1100: Reduce DHCP client logging verbosity by 70% and include interface names in log messages for easier troubleshooting - Fix #1119: CLI UX regression, restore proper behavior for `no enabled` command - Fix #1155: `show ospf` commands regression - Fix #1150: `show-legacy` wrapper permissions - Fix #1161: error in log during boot about unsupported command - Fix #1169: Expected neighbors not shown in sysrepocfg - Fixes for unicode translation in log and pager outputs as well as `syslogd` [BPI-R3]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3 [v25.08.0][] - 2025-09-01 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.5 (LTS) - Upgrade Linux kernel to 6.12.44 (LTS) - Raspberry Pi 4 is now a part of the aarch64 image. - Add support for [Raspberry Pi touch display][RPI-TOUCH] on Raspberry Pi 4 ### Fixes - Fix #1098: Prune dangling container images to reclaim disk space - Fix #1123: Disabling or removing a container may cause podman to hang - Fix #1124: Container setup with unreachable remote image spawns excessive `ip monitor` processes - Fix #1127: Silence libyang Obsolete schema node warnings in log [RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/ [v25.06.0][] - 2025-07-01 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.4 (LTS) - Upgrade Linux kernel to 6.12.35 (LTS) - Upgrade curiOS built-in containers to v25.06.0 - Add support for setting mode of a container content mount, issue #1070 - Add Wi-Fi client support and add support for some USB-Wi-Fi cards - New slogan: Infix OS โ€” Immutable.Friendly.Secure ### Fixes - cli: fix by-word movement, detect word barrier using non-alphanum chars - cli: fix delete word left/right, make sure to save word in kill buffer [v25.05.1][] - 2025-06-12 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.32 (LTS) ### Fixes - Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0 [v25.05.0][] - 2025-05-27 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.3 (LTS) - Upgrade Linux kernel to 6.12.30 (LTS) - Upgrade libyang to 3.12.2 - Upgrade sysrepo to 3.6.11 - Upgrade netopeer2 (NETCONF) to 2.4.1 - New hardware support: Raspberry Pi 4B (aarch64) - Add documentation on Infix upgrading and downgrading, issue #1009 - Add HDMI and USB support for iMX8MP-evk - Enforced strict format for LLDP destination MAC address: - Only accepts colon-separated format: `01:80:C2:00:00:0E` - Add `show lldp` command to show discovered neighbors per interface. - Add configuration support for per-interface LLDP administrative status ### Fixes - Fix containers with multiple mounts - Correct description for LAG LACP modes - Fix #1040: Add `mount` constraint for container config [v25.04.0][] - 2025-04-30 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.25 (LTS) - Upgrade Buildroot to 2025.02.1 (LTS) - Format for disk image (for QEMU) has changed to `qcow2` ### Fixes - Fix #1002: Broken symlink in release package - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0 - Bump R2S kernel, now same as tier one boards - Fix #1015: Not possible to save custom SSH settings in startup-config - Fix group owner and permissions of `/cfg/backup` directory - Fix extraction of old version for `/cfg/backup/` files - Fix configuration migration issues when upgrading [v25.03.0][] - 2025-03-31 ------------------------- > [!IMPORTANT] > This release is the first with the new Buildroot 2025.02 (LTS) ### Changes - Upgrade Linux kernel to 6.12.21 (LTS) - Upgrade Buildroot to 2025.02.0 (LTS) ### Fixes - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag - Fix #980: the system fails to reboot when a container is (stuck), for whatever reason, in its 'setup' state - Fix #990: web console, ttyd service, stopped working after upgrade to Buildroot 2025.02, caused by new (missing) option `--writable` - Fix TCAM memory corruption in `mvpp2` Ethernet controller - Fix annoying (but harmless) usage message from the logger tool when `startup-config` fails to load and the system reverts to failure mode - Fix harmless log warning for product specific init when no product specific init scripts are found - Backport fixes for sysklogd, affecting hostname filtering and periods in TAG names, pending official backport in Buildroot [v25.02.0][] - 2025-03-04 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.18 (LTS) - Upgrade Buildroot to 2024.02.11 (LTS) - Add support for link aggregation (lag), static (balance-xor) and LACP - Add support for the [i.MX 8M Plus EVK][EVK] - YANG type change for SSH private/public keys, from ietf-crypto-types to infix-crypto-types - Disable global IPv6 forwarding by default, enable by per-interface setting. Note, route advertisements are always accepted. Issue #785 - Drop automatic default route (interface route) for IPv4 autoconf, not necessary and causes more confusion than good. Issue #923 - Update scripting with new RESTCONF examples ### Fixes - Fix #896: `/etc/resolv.conf` not properly generated when system runs in fail secure mode (failing to load `startup-config`) - Fix #902: containers "linger" in the system (state 'exited') after having removed them from the configuration - Fix #930: container configuration changes does not apply at runtime only when saved to `startup-config` and system is rebooted - Fix #936: DHCP server reconfiguration does not always take effect. - Fix #956: CLI `copy` command complains it cannot change owner when copying `factory-config` to `running-config`. Bogus error, the latter is not really a file - Fix #977: "Operation not permitted" when saving `running-config` to `startup-config` (harmless warning but annoying and concerning) [EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK [v25.01.0][] - 2025-01-31 ------------------------- > [!NOTE] > This release contains breaking changes in the configuration file > syntax for DHCP clients. Specifically DHCP options *with value*, > i.e., the syntax for sending a hexadecimal value now require `hex` > prefix before a string of colon-separated pairs of hex values. ### Changes - Upgrade Linux kernel to 6.12.11 (LTS) - Upgrade Buildroot to 2024.02.10 (LTS) - Upgrade FRR from 9.1.2 to 9.1.3 - Add support for configuring SSH server, issue #441. As a result, both SSH and NETCONF now use the same host key in `factory-config` - Add operational support for reading DNS resolver info, issue #510 - Add operational support for NTP client, issue #510 - Add support for more mDNS settings: allow/deny interfaces, acting as "reflector" and filtering of reflected services. Issue #678 - Add DHCPv4 server support, multiple subnets with static hosts and DHCP options on global, subnet, or host level, issue #703. Contributed by [MINEx Networks](https://minexn.com/) - DHCP client options aligned with DHCP server, `startup-config` files with old syntax are automatically migrated - Breaking change in DHCP client options *with value*. Hexadecimal values must now be formatted as `{ "hex": "c0:ff:ee" }` (JSON) - Add documentation on management via SSH, Web (RESTCONF, Web Console), and Console Port, issue #787 - Add documentation of DNS client use and configuration, issue #798 - Add support for changing boot order for the system with an RPC, including support for reading boot order from operational datastore - Add support for GRE/GRETAP tunnels - Add support for STP/RSTP on bridges - Add support for VXLAN tunnels - Add support for configuring global LLDP `message-tx-interval` ### Fixes - Fix #777: Authorized SSH key not applied to `startup-config` - Fix #829: Avahi (mDNS responder) not starting properly on switches with *many* ports (>10). This led to a review of `sysctl`: - New for IPv4: - Adjust IGMP max memberships: 20 -> 1000 - Use neighbor information on nexthop selection - Use inbound interface address on ICMP errors - Ignore routes with link down - Disable `rp_filter` - ARP settings have been changed to better fit routers, i.e., systems with multiple interfaces: - Always use best local address when sending ARP - Only reply to ARP if target IP is on the inbound interface - Generate ARP requests when device is brought up or HW address changes - New for IPv6: - Keep static global addresses on link down - Ignore routes with link down - Fix #861: Fix error when running 251+ reconfigurations in test-mode - Fix #869: Setup of bridges is now more robust - Fix #899: DHCP client with client-id does not work - Minor cleanup of Networking Guide - Fix memory leaks in `confd` [v24.11.1][] - 2024-11-29 ------------------------- ### Changes - Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink messages and drifted out of sync with the kernel's view of addresses and interfaces available in the system - Allow setting IP address directly on VLAN filtering bridges. This only works when the bridge is an untagged member of a (single) VLAN. - cli: usability -- showing log files now automatically jump to the end of the file, where the latest events are - cli: usability -- showing container status, or other status that overflows the terminal horizontally, now wrap the lines and exit the pager immediately if the contents fit on the first screen - The default log level of the mDNS responder, `avahi-daemon`, has been adjusted to make it less verbose. Now only `LOG_NOTICE` and higher severity is logged -- making it very quiet ### Fixes - Fix #685: DSA conduit interface not always detected. Previous attempt at a fix (v24.10.2) mitigated the issue, but did not completely solve it. - Fix #835: redesign how the system creates/deletes containers from the `running-config`. Prior to this change, all removal and creation was handled by a separate queue that ran asynchronously from the `confd` process. This could lead to situations where new configurations are applied before the queue had been fully processed. After this change containers are deleted synchronously and new containers are created in the same flow as during normal runtime operation (start/upgrade) - Fix start of containers with `manual=True` option should now work again, regression in v24.11.0 - Fix loss of writable volumes when temporarily disabling a container in the configuration, now the container remains dormant with all its volumes still available - Fix presentation bug in CLI `show interfaces` where all line-drawing characters showed up as hexadecimal values. Regression in v24.11.0 - Fix missing log messages from Frr Zebra daemon - Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an interface, e.g., `br0` - Creating more than one container trigger restarts of previously set up containers. Which in some cases may cause these earlier ones to end up in an inconsistent state - Prevent traffic assigned to locally terminated VLANs from being forwarded, when the underlying ports are simultaneously attached to a VLAN filtering bridge. [v24.11.0][] - 2024-11-20 ------------------------- > [!CAUTION] > This release contains breaking changes for container users! As of > v24.11.0, all persistent[^1] containers always run in `read-only` mode > and the setting itself is deprecated (kept only for compatibility > reasons). The main reason for this change is to better serve users > with embedded container images in their builds of Infix. I.e., they > can now upgrade the OCI image in their build and rely on the container > being automatically upgraded when Infix is upgraded, issue #823. For > other users, the benefit is that *all* container configuration changes > take when activated, issue #822, without having to perform any tricks. ### Changes - Add validation of interface name lengths, (1..15), Linux limit - Add support for ftp/http/https URI:s in container image, with a new `checksum` setting for MD5/SHA256/SHA512 verification, issue #801 - Add a retry timer to the background container create service. This will ensure failing `docker pull` operations from remote images are retrying after 60 seconds, or quicker - CLI base component, `klish`, has been updated with better support for raw terminal mode and alternate quotes (' in addition to ") - Log silenced from container activation messages, only the very bare necessities are now logged, e.g., `podman create` command + status - Factory reset no longer calls `shred` to "securely erase" any files from writable data partitions. This will speed up the next boot considerably ### Fixes - Fix #659: paged output in CLI accessed via console port sometimes causes lost lines, e.g. missing interfaces. With updated `klish` and the terminal in raw mode, the pager (less) can now control both the horizontal and vertical - Fix #822: adding, or changing, an environment variable to a running container does not take without the `container upgrade NAME` trick - Fix #823: with an OCI image embedded in the Infix image, an existing container in the configuration is not upgraded to the new OCI image with the Infix upgrade. - Frr leaves log files in `/var/tmp/frr` on unclean shutdowns. This has now been fixed with a "tmpfiles" cleanup of that path at boot [^1]: I.e., set up in the configuration, as opposed to temporary ones started with `container run` from the CLI admin-exec context. [v24.10.2][] - 2024-11-08 ------------------------- ### Changes - Support for showing interfaces owned by running containers in the CLI command `show interfaces`. This also adds support for showing the peer interface of VETH pairs. Issue #626 - Reboot system on kernel "oops", on "oops" the kernel now panics and reboots after 20 seconds. Issue #740 - Update static factory-config for NanoPi R2S: enable NACM, securing all passwords, and enabling `iburst` for the NTP client. Issue #750 - Updated QoS documentation with pictures and more information on VLAN interface ingress/egress priority handling, issue #759 - Disable RTC device in Styx device tree, issue #794 - Support for saving and restoring system clock from a disk file. This allows restoring the system clock to a sane date in case the RTC is disabled or does not have a valid time, issue #794 - Update device discovery chapter with information on `infix.local` mDNS alias, `netbrowse` support to discover *all* local units, and command examples for disabling LLDP and mDNS services, issue #786 - Updated OSPF documentation to include information on *global OSPF settings* (`redistribution`, `explicit-router-id`, etc.), issue #812 - Added information on *forwarding of IEEE reserved group addresses* to bridge section of networking documentation, issue #788 - Add support for bootstrap conditions and early init product overrides - Styx: enable second Ethernet port LED in device tree, again, rename it: yellow -> aux, and make sure it is turned off at boot - Styx: disable second port LED for the 4xSFP slots, does not work - Styx: override iitod (LED daemon) with a product specific LED script ### Fixes - Fix #685: DSA conduit interface not always detected, randomly causing major issues configuring systems with multiple switch cores - Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S. This fixes a regression in v24.10.0 causing loss of NETCONF support - Fix #809: enable syslog logging for RAUC - Fix harmless bootstrap log error message on systems without USB ports: `jq: error (at :0): Cannot iterate over null (null)` - Change confusing `tc` log error message: `Error: does not support hardware offload` to `Skipping $iface, hardware offload not supported.` [v24.10.1][] - 2024-10-18 ------------------------- ### Changes - Add support for interface description, sometimes referred to as "ifAlias". Saved as an Linux interface alias (not `altname`), e.g., `/sys/class/interfaces/veth0a/ifalias`, includes operational support ### Fixes - Fix #735: `copy` and `erase` commands missing from CLI, regression in Infix v24.10.0 defconfigs, now added as dep. in klish package [v24.10.0][] - 2024-10-18 ------------------------- **News:** this release contains *breaking YANG changes* in custom MAC addresses for interfaces! For details, see below issue #680. Also, heads-up to all downstream users of Infix. YANG models have been renamed to ease maintenance, more info below. ### Changes - Software control of port LEDs on the Styx platform has been disabled. Default driver behavior, green link and green traffic blink, is kept as-is, which should mitigate issues reported in #670 - Correcting documentation on QoS. For packets containing both a VLAN tag and an IP header, PCP priority takes precedence over DSCP priority (not vice versa). - Update CONTRIBUTING.md for scaling core team and helping external contributors understand the development process, issue #672 - Updated branding documentation with more information on how dynamic and static factory-config work, including examples - Updated container documentation, improved images, detail how to set interface name inside the container, and some syntax fixes - Updated networking documentation, new General settings section, and more details added to initial section on network building blocks - As of this release, all Infix YANG models have dropped the `@DATE` suffix from the name, this type of versioning is not handled using symlinks instead. - Update Infix `provision` script, used to install Infix on eMMC, add example of how to erase partition table to be able to re-run the script on already provisioned devices, issue #671 - OSPF: Add limitation to allow an interface to be in one area only - Add support for "dummy" interfaces, mostly useful for testing - Add support for container hostname format specifiers, just like it already works for the host's hostname setting - Hide all `status obsolete` YANG nodes in CLI - Add YANG `units`, if available, to CLI help text (default value) - The CLI commands `copy` and `erase` are now available also from Bash - Greatly reduced size of bundled curiOS httpd OCI container image, reduced from 1.8 MiB to 281 KiB - Add deviation to ietf-interfaces.yang, `link-up-down-trap-enable` is not supported (yet) in Infix, issue #709 - The default builds now include the curiOS nftables container image, which can be used for advanced firewall setups. For an introduction see ### Fixes - Fix #499: add an NACM rule to factory-config, which by default deny everyone to read user password hash(es) - Fix #663: internal Ethernet interfaces shown in CLI tab completion - Fix #674: CLI `show interfaces` display internal Ethernet interfaces, regression introduced late in v24.09 release cycle - Fix #676: port dropped from bridge when changing its VLAN membership from tagged to untagged - Fix #680: replace deviation for `phys-address` in ietf-interfaces.yang with `custom-phys-address` to allow for constructing more free-form MAC addresses based on the chassis MAC (a.k.a., base MAC) address. For more information, see the YANG model, a few examples are listed in the updated documentation. The syntax will be automatically updated in the `startup-config` and `factory-config` -- make sure to verify the changes and update any static `factory-config` used for your products - Fix #690: CLI `show ip route` command stops working after 24 hours, this includes all operational data in ietf-routing:/routing/ribs. - Fix #697: password is not always set for new users, bug introduced in v24.06.0 when replacing Augeas with native user handling - Fix #700: add missing `admin-status` to interface operational data - Fix #701: make sure CLI (and Bash) `copy` command use same sysrepo timeout as other operations that load sysrepo. Was 10 second timeout, which caused some (really big) configurations not to apply from the CLI, but worked at boot, for instance. New timeout is 60 seconds - Fix #708: allow all container networks to set interface name inside container, not just auto-generated veth-pair ends for `docker0` bridge - Fix `show interfaces` on platforms like the NanoPi R2S, which does not support reading RMON counters in JSON format using `ethtool` - Fix #730: CLI command `show ntp [sources]` stopped working in v24.08. Missing access rights after massive CLI lock-down - Fix BFD in OSPF, previously you could not enable BFD on a single interface without enabling it on all interfaces [v24.09.0][] - 2024-09-30 ------------------------- **News:** this release enhances the integration of all types of static routes with FRRouting ([Frr][]), including all routes that can be set by DHCP and IPvLL (ZeroConf) clients. Due to this fundamental change, the system routing table is now primarily read from Frr, which increases the amount of relevant routing information available to the user. E.g., in the CLI exec command `show ip route` and `show ipv6 route`. Support for adjusting the administrative distance of all types of static routes has also been added to facilitate site specific adaptations. Please see the documentation for details. ### Known Issues - The CLI command `show interfaces` may for some terminal resolutions not display all interfaces (on systems with >20 interfaces). This problem is limited to the console port and only occurs for smaller terminals (30-50 rows height). Calling `show ifaces` from the shell, dumping `/ietf-interfaces:interfaces` XPath using `sysrepocfg`, or using the CLI from an SSH session, is not affected. Issue #659 ### Changes - Upgrade Buildroot to 2024.02.6 (LTS) - Upgrade Linux kernel to 6.6.52 (LTS) - Upgrade libyang to 3.4.2 - Upgrade sysrepo to 2.11.7 - Upgrade netopeer2 (NETCONF) to 2.2.31 - Updated `infix-routing.yang` to declare deviations for unsupported OSPF RPCs and Notifications in `ietf-ospf.yang` - The CLI admin-exec command `show dns` now also shows any configured name servers, not just ones acquired via DHCP. Issue #510 - Add support for IPv4 (autoconf) `request-address`. This instructs the ZeroConf client to start with the requested address. If this is not successful the client falls back to its default behavior. Issue #628 - Major speedup (10x) in operational data, in particular when querying interface status. Very noticeable in the CLI `show interfaces` command on devices with large port counts. Issue #651 - Silence `yanger` log warnings for failing `mctl` command. Caused by `mctl` reporting no multicast filtering enabled on bridge ### Fixes - Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be randomized. Problem caused by kernel setting a random MAC before any bridge port is added. Fixed by using the device's base MAC address on bridge interfaces. Possible to override using `phys-address` option - Fix #601: CLI regression in `show ospf` family of commands causing authorized users, like `admin`, to not being able to query status of OSPF or BFD. Workaround by using the UNIX shell `sudo vtysh`. Regression introduced in v24.08.0 - Fix #603: regression in GNS3 image, starts in test mode by default. Introduced in v24.08. - Fix #613: CLI regression in tab completion of container commands, e.g., `container shell `. Regression introduced in v24.08.0 - Fix #616: Silent failure when selecting bash as login shell for non-admin user, this silent lock has been removed - Fix #618: CLI command `show interfaces` does not show bridges and bridge ports, regression introduced in v24.08.0 -- only affects bridges without multicast snooping - Fix #623: CLI command `container upgrade NAME` does not work, regression introduced in v24.06.0 - Fix #625: initialize sysrepo startup datastore at boot. Improves usability when working directly against the sysrepo datastores from the shell with `sysrepocfg` and `sysrepoctl` tools - Fix #635: OSPF: all router neighbors reported as neighbor on every interface - Fix #638: Disabling IPv4LL (autoconf) on an interface does not clean up 169.254/16 addresses - Fix #640: unable to set static default route due to priority inversion from DHCP or IPv4LL (ZeroConf) clients setting their routes directly in the kernel. This has resulted in a complete overhaul of route management, using FRRouting for all routes, including DHCP and IPv4LL routes, presentation in the CLI, and also support for custom route preference for static routes - Fix #658: deleting VETH pairs does not work unless rebooting first. Creating a VETH pair, followed by at least one other reconfiguration before removing the pair, causes `confd` to fail when applying the interface changes (tries to delete both ends of the pair) - Spellcheck path to `/var/lib/containers` when unpacking OCI archives on container upgrade - cli: restore `tcpdump` permissions for administrator level users, regression introduced in v24.08.0 - The timeout before giving up on loading the `startup-config` at boot is now 1 minute, just like operations via other front-ends (NETCONF and RESTCONF). This was previously (incorrectly) set to 10 seconds [Frr]: https://frrouting.org/ [v24.08.0][] - 2024-08-30 ------------------------- **News:** this release adds full configuration support for syslog, with logging to local files, external media, remote log server, as well as support for acting as a log sink/server. External media can now be mounted automatically, very useful, not only for logging, but also for upgrading and container images. Finally, the following consumer boards are now fully supported: - NanoPi R2S (ARM) - StarFive VisionFive2 (RISC-V) ### Changes - Upgrade Buildroot to 2024.02.5 (LTS) - Upgrade Linux kernel to 6.6.46 (LTS) - Issue #158: enhance security of factory reset. All file content is now overwritten x3, the last time with zeroes, then removed. Example, on the NanoPi R2S this process takes ~30 seconds, but may take longer in setups with bigger configurations, e.g., containers - Issue #497: support for auto-mounting USB media. Useful for logging, upgrade, and container images. Mounted under `/media/