Change Log ========== All notable changes to the project are documented in this file. [v25.11.0][] - 2025-11-28 ------------------------- > [!NOTE] > Noteworthy changes and additions in this release: > > - DHCPv6 client support > - Configurable support for TTL in GRE/VXLAN tunnels > - Extensive filtering support for syslog messages ### Changes - Upgrade Buildroot to 2025.02.8 (LTS) - Upgrade Linux kernel to 6.12.59 (LTS) - Enable MVEBU SafeXcel Crypto Engine firmware for Marvell Armada SOCs (37xx, 7k, 8k, and CN913x series). Fixes kernel warnings about firmware load failures and crypto-safexcel probe errors on affected boards - Major improvements to OSPF and BFD operational data and CLI commands: - CLI commands now use data from the operational datastore instead of calling vtysh directly, providing better integration and consistency - New `show ip ospf` command family (neighbor, interface, route) to align with industry standard CLI conventions. Legacy `show ospf` commands are deprecated but still work with warnings - The `show ip ospf database` subcommand has been dropped for now, the advanced user can still use `vtysh` from Bash if necessary, issue #1253 - Extended BFD commands: `show bfd` (status), `show bfd peers` (detailed), `show bfd peers brief` (table format), and `show bfd peer
` - All command names now use singular form (interface, route, neighbor) matching Cisco/FRR conventions, as well as configure context naming - New support for configuring OSPF interface priority for DR/BDR election - The DHCP client configuration has moved from `/infix-dhcp-client:dhcp-client` to `/interfaces/interface[name]/ipv4/infix-dhcp-client:dhcp`, issue #1109. The configuration is automatically migrated on upgrade. The DHCP client is now enabled using a presence container instead of a separate `enabled` leaf - The `enabled` nore for IPv4 autoconf (ZeroConf) has been dropped, `autoconf` is now a presence container. Configuration automatically migrated on upgrade - Add DHCPv6 client support for per-interface IPv6 configuration, augmenting `/interfaces/interface[name]/ipv6/infix-dhcpv6-client:dhcp`, issue #1110 - Fix namespace for DHCPv4 client YANG module from `urn:ietf:params:xml:ns:yang` to `urn:infix:params:xml:ns:yang` to properly reflect custom implementation - Improvements to `sdcard.img` generation, useful for developers mostly: - The NanoPi R2S bootloader is now automatically built and uploaded to the [`latest-boot` release][latest-boot] tag - The `utils/mkimage.sh` script now supports fetching the bootloader - The raspberrypi-rpi64 board's bootloader is now aptly named rpi64 - Add support for configuring TTL, ToS/DSCP, and Path MTU Discovery on GRE and VXLAN tunnels. This also changes the default TTL of tunnels to 64, from the kernel default (*inherit*), which in turn fixes reported issues with dropped OSPF Hello frames in GRE tunnels - [Document][bpi-r3-emmc-documentation] how to go from SD card to eMMC on bpi-r3 - Add CLI commands for managing boot partition order: `show boot-order` and `set boot-order` allow viewing and changing the boot order from the CLI, complementing the existing YANG RPC support, issue #1032 - Extended syslog filtering capabilities, issue #1091: - Add support for pattern matching using POSIX extended regular expressions on message content (IETF `select-match` feature) - Add support for advanced severity comparison: exact match (`equals`) and exclusion (`block`/`stop`) in addition to the default equals-or-higher (IETF `select-adv-compare` feature) - Add support for hostname-based filtering, useful when acting as a log server to route messages from different devices to separate log files - Add support for property-based filtering with operators (contains, isequal, startswith, regex, ereregex) on message properties (msg, msgid, programname, hostname, source, data), with optional case-insensitive and negate modifiers ### Fixes - Fix #855: User admin sometimes fails to be added to `wheel` group - Fix #1112: setting hostname via DHCP client sometimes gets overridden by the configured system hostname - Fix #1247: Prevent invalid configuration of OSPF backbone area (0.0.0.0) as stub or NSSA. The backbone must always be a normal area per RFC 2328. Any existing invalid configurations are automatically corrected during upgrade - Fix #1255: serious regression in boot time, introduced in v25.10, delays the boot step "Mounting filesystems ...", from 30 seconds up to five minutes! - Fix broken intra-document links in container and tunnel documentation [latest-boot]: https://github.com/kernelkit/infix/releases/latest-boot [bpi-r3-emmc-documentation]: https://github.com/kernelkit/infix/blob/main/board/aarch64/bananapi-bpi-r3/README.md [v25.10.0][] - 2025-10-31 ------------------------- > [!NOTE] > Noteworthy changes and additions in this release: > > **🛡️ Zone-Based Firewall (ZBF):** Protect your network with our zone-based > firewall powered by [firewalld][]. Define security zones, set policies > between them, and enable masquerading. > > **📊 System & Hardware Monitoring:** CLI `show system`, `show services`, and > `show hardware` now give you instant visibility into CPU temperature, fan > speeds, memory, running services, and sensor data from SFP modules, WiFi radios, > and more. All operational data also available over NETCONF and RESTCONF. > > **🚀 Expanded Hardware Support:** The NanoPi R2S is now included in the > default Aarch64 build, which also adds support for Raspberry Pi 3B, and > Raspberry Pi CM4 variants. All boards now benefit from automatic `/var` > partition expansion on first boot. [firewalld]: https://firewalld.org ### Changes - Upgrade Buildroot to 2025.02.7 (LTS) - Upgrade Linux kernel to 6.12.56 (LTS) - Extend NETCONF and RESTCONF scripting documentation with operational data examples, discovery patterns, and common workflow examples, issue #1156 - Initial support for a zone-based firewall, based on `firewalld`, issue #448 - Add `validate` option to CLI `copy` command. This can be used before doing a restore of a backup, or when having edited configuration files manually. With the validate flag (`-n` from the shell) the file is only loaded and validated against the YANG models, it is *not* rolled in if validation is successful. Example: `copy /media/backup/old.cfg running-config validate`, issue #373 - Automatically expand `/var` partition at first boot on all MMC-based devices - New `upgrade` RPC (action) for containers using images with mutable tags - Optimize startup of preexisting containers by adding metadata to track all OCI archives loaded into container store, and all container configurations used to create container instances. Instances are now only recreated when metadata from an existing instance does not match either the configuration or the image — because of configuration changes or image upgrades - Updated container documentation on volumes, image tags, and image upgrade - Add new `show services` command to display running system services - Add new `show system` command with comprehensive system overview including hostname, uptime, load average, CPU/fan temperatures, memory, disk usage - Add hardware sensor monitoring support in `show hardware` with hierarchical display of temperature, fan, voltage, current, and power sensors - Add support for NanoPi R2S router platform to the default Aarch64 build, bumping it to Tier 2 support (SD-card images built separately) - Add support for Raspberry Pi 3B (BCM2837) - Add support for Raspberry Pi Compute Module 4 IoT Router Board Mini - Add support for Raspberry Pi Compute Module 4 NVME NAS box - Add `reboot` option to CLI `upgrade` command for automatic system restart ### Fixes - Fix #981: copying any file, including `running-config`, to the persistent back-end store for `startup-config`, does not take - Fix #1121: Ensure DHCP server does not crash if no address pool is set. This change infers a pool range (only) for /24 networks, and only when a pool is enabled. YANG validation for this and other use-cases is also included. As an unforeseen bonus, Infix now also support non-pool (static lease) setups - Fix #1122: Add YANG validation for consistency, IP addresses are not allowed on bridge port (interfaces). Even though Infix previously allowed this, but disregarded it operationally, it is no longer supported in the configuration - Fix #1146: Possible to set longer containers names than the system supports. Root cause, a limit of 15 characters implicitly imposed by the service mgmt daemon, Finit. The length has not been increased to 64 characters (min: 2) and the YANG model now properly warns if the name is outside of these limits - Fix #1147: Use container metadata to clean up lingering old container images instead of using the too broad `podman image prune -af` command - Fix #1148: Only retry container instance create on remote images - Fix #1149: Increase `podman stop` timeout, from 10 to 30 seconds, needed with bigger containers on heavily loaded systems - Fix #1194: CLI `text-editor` command does not do proper input sanitation - Fix #1197: RPi4 no longer boots after BPi-R3 merge, introduced in v25.09 - Upgrade fixes for containers with mutable images, e.g., `:latest`. Infix now always tries to fetch a new version of the OCI archive, for remote images, regardless of the transport. After upgrade the old image is pruned - Fix #1203: copying any file, including `startup-config`, to `running-config` does not take [v25.09.0][] - 2025-09-30 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.6 (LTS) - Upgrade Linux kernel to 6.12.49 (LTS) - Upgrade libyang to 3.13.5 - Upgrade sysrepo to 3.7.11 - Upgrade netopeer2 (NETCONF) to 2.4.5 - Upgrade rousette (RESTCONF) to v2 - Add support for [Banana Pi R3][BPI-R3], a 7 port switch with 2 WiFi chip - Add neofetch system information tool for system introspection, issue #1143 - Add mtr and iperf3 network diagnostic tools, issue #1144 - Improve default bash settings with better history handling and tab completion - cli: new `terminal reset` and `terminal resize` convenience commands ### Fixes - Fix #1080: Error message in log from rauc, deprecated 'Install' D-Bus method - Fix #1100: Reduce DHCP client logging verbosity by 70% and include interface names in log messages for easier troubleshooting - Fix #1119: CLI UX regression, restore proper behavior for `no enabled` command - Fix #1155: `show ospf` commands regression - Fix #1150: `show-legacy` wrapper permissions - Fix #1161: error in log during boot about unsupported command - Fix #1169: Expected neighbors not shown in sysrepocfg - Fixes for unicode translation in log and pager outputs as well as `syslogd` [BPI-R3]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3 [v25.08.0][] - 2025-09-01 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.5 (LTS) - Upgrade Linux kernel to 6.12.44 (LTS) - Raspberry Pi 4 is now a part of the aarch64 image. - Add support for [Raspberry Pi touch display][RPI-TOUCH] on Raspberry Pi 4 ### Fixes - Fix #1098: Prune dangling container images to reclaim disk space - Fix #1123: Disabling or removing a container may cause podman to hang - Fix #1124: Container setup with unreachable remote image spawns excessive `ip monitor` processes - Fix #1127: Silence libyang Obsolete schema node warnings in log [RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/ [v25.06.0][] - 2025-07-01 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.4 (LTS) - Upgrade Linux kernel to 6.12.35 (LTS) - Upgrade curiOS built-in containers to v25.06.0 - Add support for setting mode of a container content mount, issue #1070 - Add Wi-Fi client support and add support for some USB-Wi-Fi cards - New slogan: Infix OS — Immutable.Friendly.Secure ### Fixes - cli: fix by-word movement, detect word barrier using non-alphanum chars - cli: fix delete word left/right, make sure to save word in kill buffer [v25.05.1][] - 2025-06-12 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.32 (LTS) ### Fixes - Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0 [v25.05.0][] - 2025-05-27 ------------------------- ### Changes - Upgrade Buildroot to 2025.02.3 (LTS) - Upgrade Linux kernel to 6.12.30 (LTS) - Upgrade libyang to 3.12.2 - Upgrade sysrepo to 3.6.11 - Upgrade netopeer2 (NETCONF) to 2.4.1 - New hardware support: Raspberry Pi 4B (aarch64) - Add documentation on Infix upgrading and downgrading, issue #1009 - Add HDMI and USB support for iMX8MP-evk - Enforced strict format for LLDP destination MAC address: - Only accepts colon-separated format: `01:80:C2:00:00:0E` - Add `show lldp` command to show discovered neighbors per interface. - Add configuration support for per-interface LLDP administrative status ### Fixes - Fix containers with multiple mounts - Correct description for LAG LACP modes - Fix #1040: Add `mount` constraint for container config [v25.04.0][] - 2025-04-30 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.25 (LTS) - Upgrade Buildroot to 2025.02.1 (LTS) - Format for disk image (for QEMU) has changed to `qcow2` ### Fixes - Fix #1002: Broken symlink in release package - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0 - Bump R2S kernel, now same as tier one boards - Fix #1015: Not possible to save custom SSH settings in startup-config - Fix group owner and permissions of `/cfg/backup` directory - Fix extraction of old version for `/cfg/backup/` files - Fix configuration migration issues when upgrading [v25.03.0][] - 2025-03-31 ------------------------- > [!IMPORTANT] > This release is the first with the new Buildroot 2025.02 (LTS) ### Changes - Upgrade Linux kernel to 6.12.21 (LTS) - Upgrade Buildroot to 2025.02.0 (LTS) ### Fixes - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag - Fix #980: the system fails to reboot when a container is (stuck), for whatever reason, in its 'setup' state - Fix #990: web console, ttyd service, stopped working after upgrade to Buildroot 2025.02, caused by new (missing) option `--writable` - Fix TCAM memory corruption in `mvpp2` Ethernet controller - Fix annoying (but harmless) usage message from the logger tool when `startup-config` fails to load and the system reverts to failure mode - Fix harmless log warning for product specific init when no product specific init scripts are found - Backport fixes for sysklogd, affecting hostname filtering and periods in TAG names, pending official backport in Buildroot [v25.02.0][] - 2025-03-04 ------------------------- ### Changes - Upgrade Linux kernel to 6.12.18 (LTS) - Upgrade Buildroot to 2024.02.11 (LTS) - Add support for link aggregation (lag), static (balance-xor) and LACP - Add support for the [i.MX 8M Plus EVK][EVK] - YANG type change for SSH private/public keys, from ietf-crypto-types to infix-crypto-types - Disable global IPv6 forwarding by default, enable by per-interface setting. Note, route advertisements are always accepted. Issue #785 - Drop automatic default route (interface route) for IPv4 autoconf, not necessary and causes more confusion than good. Issue #923 - Update scripting with new RESTCONF examples ### Fixes - Fix #896: `/etc/resolv.conf` not properly generated when system runs in fail secure mode (failing to load `startup-config`) - Fix #902: containers "linger" in the system (state 'exited') after having removed them from the configuration - Fix #930: container configuration changes does not apply at runtime only when saved to `startup-config` and system is rebooted - Fix #936: DHCP server reconfiguration does not always take effect. - Fix #956: CLI `copy` command complains it cannot change owner when copying `factory-config` to `running-config`. Bogus error, the latter is not really a file - Fix #977: "Operation not permitted" when saving `running-config` to `startup-config` (harmless warning but annoying and concerning) [EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK [v25.01.0][] - 2025-01-31 ------------------------- > [!NOTE] > This release contains breaking changes in the configuration file > syntax for DHCP clients. Specifically DHCP options *with value*, > i.e., the syntax for sending a hexadecimal value now require `hex` > prefix before a string of colon-separated pairs of hex values. ### Changes - Upgrade Linux kernel to 6.12.11 (LTS) - Upgrade Buildroot to 2024.02.10 (LTS) - Upgrade FRR from 9.1.2 to 9.1.3 - Add support for configuring SSH server, issue #441. As a result, both SSH and NETCONF now use the same host key in `factory-config` - Add operational support for reading DNS resolver info, issue #510 - Add operational support for NTP client, issue #510 - Add support for more mDNS settings: allow/deny interfaces, acting as "reflector" and filtering of reflected services. Issue #678 - Add DHCPv4 server support, multiple subnets with static hosts and DHCP options on global, subnet, or host level, issue #703. Contributed by [MINEx Networks](https://minexn.com/) - DHCP client options aligned with DHCP server, `startup-config` files with old syntax are automatically migrated - Breaking change in DHCP client options *with value*. Hexadecimal values must now be formatted as `{ "hex": "c0:ff:ee" }` (JSON) - Add documentation on management via SSH, Web (RESTCONF, Web Console), and Console Port, issue #787 - Add documentation of DNS client use and configuration, issue #798 - Add support for changing boot order for the system with an RPC, including support for reading boot order from operational datastore - Add support for GRE/GRETAP tunnels - Add support for STP/RSTP on bridges - Add support for VXLAN tunnels - Add support for configuring global LLDP `message-tx-interval` ### Fixes - Fix #777: Authorized SSH key not applied to `startup-config` - Fix #829: Avahi (mDNS responder) not starting properly on switches with *many* ports (>10). This led to a review of `sysctl`: - New for IPv4: - Adjust IGMP max memberships: 20 -> 1000 - Use neighbor information on nexthop selection - Use inbound interface address on ICMP errors - Ignore routes with link down - Disable `rp_filter` - ARP settings have been changed to better fit routers, i.e., systems with multiple interfaces: - Always use best local address when sending ARP - Only reply to ARP if target IP is on the inbound interface - Generate ARP requests when device is brought up or HW address changes - New for IPv6: - Keep static global addresses on link down - Ignore routes with link down - Fix #861: Fix error when running 251+ reconfigurations in test-mode - Fix #869: Setup of bridges is now more robust - Fix #899: DHCP client with client-id does not work - Minor cleanup of Networking Guide - Fix memory leaks in `confd` [v24.11.1][] - 2024-11-29 ------------------------- ### Changes - Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink messages and drifted out of sync with the kernel's view of addresses and interfaces available in the system - Allow setting IP address directly on VLAN filtering bridges. This only works when the bridge is an untagged member of a (single) VLAN. - cli: usability -- showing log files now automatically jump to the end of the file, where the latest events are - cli: usability -- showing container status, or other status that overflows the terminal horizontally, now wrap the lines and exit the pager immediately if the contents fit on the first screen - The default log level of the mDNS responder, `avahi-daemon`, has been adjusted to make it less verbose. Now only `LOG_NOTICE` and higher severity is logged -- making it very quiet ### Fixes - Fix #685: DSA conduit interface not always detected. Previous attempt at a fix (v24.10.2) mitigated the issue, but did not completely solve it. - Fix #835: redesign how the system creates/deletes containers from the `running-config`. Prior to this change, all removal and creation was handled by a separate queue that ran asynchronously from the `confd` process. This could lead to situations where new configurations are applied before the queue had been fully processed. After this change containers are deleted synchronously and new containers are created in the same flow as during normal runtime operation (start/upgrade) - Fix start of containers with `manual=True` option should now work again, regression in v24.11.0 - Fix loss of writable volumes when temporarily disabling a container in the configuration, now the container remains dormant with all its volumes still available - Fix presentation bug in CLI `show interfaces` where all line-drawing characters showed up as hexadecimal values. Regression in v24.11.0 - Fix missing log messages from Frr Zebra daemon - Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an interface, e.g., `br0` - Creating more than one container trigger restarts of previously set up containers. Which in some cases may cause these earlier ones to end up in an inconsistent state - Prevent traffic assigned to locally terminated VLANs from being forwarded, when the underlying ports are simultaneously attached to a VLAN filtering bridge. [v24.11.0][] - 2024-11-20 ------------------------- > [!CAUTION] > This release contains breaking changes for container users! As of > v24.11.0, all persistent[^1] containers always run in `read-only` mode > and the setting itself is deprecated (kept only for compatibility > reasons). The main reason for this change is to better serve users > with embedded container images in their builds of Infix. I.e., they > can now upgrade the OCI image in their build and rely on the container > being automatically upgraded when Infix is upgraded, issue #823. For > other users, the benefit is that *all* container configuration changes > take when activated, issue #822, without having to perform any tricks. ### Changes - Add validation of interface name lengths, (1..15), Linux limit - Add support for ftp/http/https URI:s in container image, with a new `checksum` setting for MD5/SHA256/SHA512 verification, issue #801 - Add a retry timer to the background container create service. This will ensure failing `docker pull` operations from remote images are retrying after 60 seconds, or quicker - CLI base component, `klish`, has been updated with better support for raw terminal mode and alternate quotes (' in addition to ") - Log silenced from container activation messages, only the very bare necessities are now logged, e.g., `podman create` command + status - Factory reset no longer calls `shred` to "securely erase" any files from writable data partitions. This will speed up the next boot considerably ### Fixes - Fix #659: paged output in CLI accessed via console port sometimes causes lost lines, e.g. missing interfaces. With updated `klish` and the terminal in raw mode, the pager (less) can now control both the horizontal and vertical - Fix #822: adding, or changing, an environment variable to a running container does not take without the `container upgrade NAME` trick - Fix #823: with an OCI image embedded in the Infix image, an existing container in the configuration is not upgraded to the new OCI image with the Infix upgrade. - Frr leaves log files in `/var/tmp/frr` on unclean shutdowns. This has now been fixed with a "tmpfiles" cleanup of that path at boot [^1]: I.e., set up in the configuration, as opposed to temporary ones started with `container run` from the CLI admin-exec context. [v24.10.2][] - 2024-11-08 ------------------------- ### Changes - Support for showing interfaces owned by running containers in the CLI command `show interfaces`. This also adds support for showing the peer interface of VETH pairs. Issue #626 - Reboot system on kernel "oops", on "oops" the kernel now panics and reboots after 20 seconds. Issue #740 - Update static factory-config for NanoPi R2S: enable NACM, securing all passwords, and enabling `iburst` for the NTP client. Issue #750 - Updated QoS documentation with pictures and more information on VLAN interface ingress/egress priority handling, issue #759 - Disable RTC device in Styx device tree, issue #794 - Support for saving and restoring system clock from a disk file. This allows restoring the system clock to a sane date in case the RTC is disabled or does not have a valid time, issue #794 - Update device discovery chapter with information on `infix.local` mDNS alias, `netbrowse` support to discover *all* local units, and command examples for disabling LLDP and mDNS services, issue #786 - Updated OSPF documentation to include information on *global OSPF settings* (`redistribution`, `explicit-router-id`, etc.), issue #812 - Added information on *forwarding of IEEE reserved group addresses* to bridge section of networking documentation, issue #788 - Add support for bootstrap conditions and early init product overrides - Styx: enable second Ethernet port LED in device tree, again, rename it: yellow -> aux, and make sure it is turned off at boot - Styx: disable second port LED for the 4xSFP slots, does not work - Styx: override iitod (LED daemon) with a product specific LED script ### Fixes - Fix #685: DSA conduit interface not always detected, randomly causing major issues configuring systems with multiple switch cores - Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S. This fixes a regression in v24.10.0 causing loss of NETCONF support - Fix #809: enable syslog logging for RAUC - Fix harmless bootstrap log error message on systems without USB ports: `jq: error (at :0): Cannot iterate over null (null)` - Change confusing `tc` log error message: `Error: does not support hardware offload` to `Skipping $iface, hardware offload not supported.` [v24.10.1][] - 2024-10-18 ------------------------- ### Changes - Add support for interface description, sometimes referred to as "ifAlias". Saved as an Linux interface alias (not `altname`), e.g., `/sys/class/interfaces/veth0a/ifalias`, includes operational support ### Fixes - Fix #735: `copy` and `erase` commands missing from CLI, regression in Infix v24.10.0 defconfigs, now added as dep. in klish package [v24.10.0][] - 2024-10-18 ------------------------- **News:** this release contains *breaking YANG changes* in custom MAC addresses for interfaces! For details, see below issue #680. Also, heads-up to all downstream users of Infix. YANG models have been renamed to ease maintenance, more info below. ### Changes - Software control of port LEDs on the Styx platform has been disabled. Default driver behavior, green link and green traffic blink, is kept as-is, which should mitigate issues reported in #670 - Correcting documentation on QoS. For packets containing both a VLAN tag and an IP header, PCP priority takes precedence over DSCP priority (not vice versa). - Update CONTRIBUTING.md for scaling core team and helping external contributors understand the development process, issue #672 - Updated branding documentation with more information on how dynamic and static factory-config work, including examples - Updated container documentation, improved images, detail how to set interface name inside the container, and some syntax fixes - Updated networking documentation, new General settings section, and more details added to initial section on network building blocks - As of this release, all Infix YANG models have dropped the `@DATE` suffix from the name, this type of versioning is not handled using symlinks instead. - Update Infix `provision` script, used to install Infix on eMMC, add example of how to erase partition table to be able to re-run the script on already provisioned devices, issue #671 - OSPF: Add limitation to allow an interface to be in one area only - Add support for "dummy" interfaces, mostly useful for testing - Add support for container hostname format specifiers, just like it already works for the host's hostname setting - Hide all `status obsolete` YANG nodes in CLI - Add YANG `units`, if available, to CLI help text (default value) - The CLI commands `copy` and `erase` are now available also from Bash - Greatly reduced size of bundled curiOS httpd OCI container image, reduced from 1.8 MiB to 281 KiB - Add deviation to ietf-interfaces.yang, `link-up-down-trap-enable` is not supported (yet) in Infix, issue #709 - The default builds now include the curiOS nftables container image, which can be used for advanced firewall setups. For an introduction see ### Fixes - Fix #499: add an NACM rule to factory-config, which by default deny everyone to read user password hash(es) - Fix #663: internal Ethernet interfaces shown in CLI tab completion - Fix #674: CLI `show interfaces` display internal Ethernet interfaces, regression introduced late in v24.09 release cycle - Fix #676: port dropped from bridge when changing its VLAN membership from tagged to untagged - Fix #680: replace deviation for `phys-address` in ietf-interfaces.yang with `custom-phys-address` to allow for constructing more free-form MAC addresses based on the chassis MAC (a.k.a., base MAC) address. For more information, see the YANG model, a few examples are listed in the updated documentation. The syntax will be automatically updated in the `startup-config` and `factory-config` -- make sure to verify the changes and update any static `factory-config` used for your products - Fix #690: CLI `show ip route` command stops working after 24 hours, this includes all operational data in ietf-routing:/routing/ribs. - Fix #697: password is not always set for new users, bug introduced in v24.06.0 when replacing Augeas with native user handling - Fix #700: add missing `admin-status` to interface operational data - Fix #701: make sure CLI (and Bash) `copy` command use same sysrepo timeout as other operations that load sysrepo. Was 10 second timeout, which caused some (really big) configurations not to apply from the CLI, but worked at boot, for instance. New timeout is 60 seconds - Fix #708: allow all container networks to set interface name inside container, not just auto-generated veth-pair ends for `docker0` bridge - Fix `show interfaces` on platforms like the NanoPi R2S, which does not support reading RMON counters in JSON format using `ethtool` - Fix #730: CLI command `show ntp [sources]` stopped working in v24.08. Missing access rights after massive CLI lock-down - Fix BFD in OSPF, previously you could not enable BFD on a single interface without enabling it on all interfaces [v24.09.0][] - 2024-09-30 ------------------------- **News:** this release enhances the integration of all types of static routes with FRRouting ([Frr][]), including all routes that can be set by DHCP and IPvLL (ZeroConf) clients. Due to this fundamental change, the system routing table is now primarily read from Frr, which increases the amount of relevant routing information available to the user. E.g., in the CLI exec command `show ip route` and `show ipv6 route`. Support for adjusting the administrative distance of all types of static routes has also been added to facilitate site specific adaptations. Please see the documentation for details. ### Known Issues - The CLI command `show interfaces` may for some terminal resolutions not display all interfaces (on systems with >20 interfaces). This problem is limited to the console port and only occurs for smaller terminals (30-50 rows height). Calling `show ifaces` from the shell, dumping `/ietf-interfaces:interfaces` XPath using `sysrepocfg`, or using the CLI from an SSH session, is not affected. Issue #659 ### Changes - Upgrade Buildroot to 2024.02.6 (LTS) - Upgrade Linux kernel to 6.6.52 (LTS) - Upgrade libyang to 3.4.2 - Upgrade sysrepo to 2.11.7 - Upgrade netopeer2 (NETCONF) to 2.2.31 - Updated `infix-routing.yang` to declare deviations for unsupported OSPF RPCs and Notifications in `ietf-ospf.yang` - The CLI admin-exec command `show dns` now also shows any configured name servers, not just ones acquired via DHCP. Issue #510 - Add support for IPv4 (autoconf) `request-address`. This instructs the ZeroConf client to start with the requested address. If this is not successful the client falls back to its default behavior. Issue #628 - Major speedup (10x) in operational data, in particular when querying interface status. Very noticeable in the CLI `show interfaces` command on devices with large port counts. Issue #651 - Silence `yanger` log warnings for failing `mctl` command. Caused by `mctl` reporting no multicast filtering enabled on bridge ### Fixes - Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be randomized. Problem caused by kernel setting a random MAC before any bridge port is added. Fixed by using the device's base MAC address on bridge interfaces. Possible to override using `phys-address` option - Fix #601: CLI regression in `show ospf` family of commands causing authorized users, like `admin`, to not being able to query status of OSPF or BFD. Workaround by using the UNIX shell `sudo vtysh`. Regression introduced in v24.08.0 - Fix #603: regression in GNS3 image, starts in test mode by default. Introduced in v24.08. - Fix #613: CLI regression in tab completion of container commands, e.g., `container shell `. Regression introduced in v24.08.0 - Fix #616: Silent failure when selecting bash as login shell for non-admin user, this silent lock has been removed - Fix #618: CLI command `show interfaces` does not show bridges and bridge ports, regression introduced in v24.08.0 -- only affects bridges without multicast snooping - Fix #623: CLI command `container upgrade NAME` does not work, regression introduced in v24.06.0 - Fix #625: initialize sysrepo startup datastore at boot. Improves usability when working directly against the sysrepo datastores from the shell with `sysrepocfg` and `sysrepoctl` tools - Fix #635: OSPF: all router neighbors reported as neighbor on every interface - Fix #638: Disabling IPv4LL (autoconf) on an interface does not clean up 169.254/16 addresses - Fix #640: unable to set static default route due to priority inversion from DHCP or IPv4LL (ZeroConf) clients setting their routes directly in the kernel. This has resulted in a complete overhaul of route management, using FRRouting for all routes, including DHCP and IPv4LL routes, presentation in the CLI, and also support for custom route preference for static routes - Fix #658: deleting VETH pairs does not work unless rebooting first. Creating a VETH pair, followed by at least one other reconfiguration before removing the pair, causes `confd` to fail when applying the interface changes (tries to delete both ends of the pair) - Spellcheck path to `/var/lib/containers` when unpacking OCI archives on container upgrade - cli: restore `tcpdump` permissions for administrator level users, regression introduced in v24.08.0 - The timeout before giving up on loading the `startup-config` at boot is now 1 minute, just like operations via other front-ends (NETCONF and RESTCONF). This was previously (incorrectly) set to 10 seconds [Frr]: https://frrouting.org/ [v24.08.0][] - 2024-08-30 ------------------------- **News:** this release adds full configuration support for syslog, with logging to local files, external media, remote log server, as well as support for acting as a log sink/server. External media can now be mounted automatically, very useful, not only for logging, but also for upgrading and container images. Finally, the following consumer boards are now fully supported: - NanoPi R2S (ARM) - StarFive VisionFive2 (RISC-V) ### Changes - Upgrade Buildroot to 2024.02.5 (LTS) - Upgrade Linux kernel to 6.6.46 (LTS) - Issue #158: enhance security of factory reset. All file content is now overwritten x3, the last time with zeroes, then removed. Example, on the NanoPi R2S this process takes ~30 seconds, but may take longer in setups with bigger configurations, e.g., containers - Issue #497: support for auto-mounting USB media. Useful for logging, upgrade, and container images. Mounted under `/media/