Mattias Walström ed6171f920 Upgrade FRR to 10.5.4
Summary of Changes:

bfdd:
    - cap IPv6 echo reflection to declared length
    - account for FP offset in echo length checks
    - fix recv errno filter logic in a few places
    - tighten SBFD reflector packet sanity checks
    - gate IPv6 echo reflection on known sessions
    - tighten auth header parsing skeleton
    - validate control packet length before session lookup

bgpd:
    - Fix memleak when configuring rd
    - Validate if NHC BGPID TLV value is non-zero
    - Avoid having a dangling pointer after we free NHC attribute
    - Check if BGPID NHC TLV exists when IPv6 next-hop is link-local
    - Do not allocate NHC TLV with an extra trailer
    - migrate timers during peer_xfer_conn to fix stale route cleanup
    - honor 'no activate' for dynamic neighbors in peer-group
    - Return immediately when dynamic capability action is not valid
    - Validate BGP role capability when handling it dynamically
    - fix neighbor IP comparison for IPv6 memcmp return values
    - Don't mark nexthop as changed if a set next-hop unchanged is applied
    - Return BGP_PEER_INTERNAL when first peer's as type is set to auto
    - Update peer sort cache when remote-as auto is used and AS number changed
    - Check dynamic capability action before validating ENHE capability
    - Do not allocate stream if route-refresh capability is not received
    - Move rpki strict check to bgp_accept()
    - Fix memory leak for nhc attribute if ipv6 is link-local address
    - Fix compilation for Debian 11 when printing uint64 values
    - Return zero labels if no BOS found and it's not a withdraw label
    - Fix signed overflow in hexstr2num()
    - Check the length also when parsing ENCAP attr sub-TLVs
    - Validate prefixlen before subtracting when parsing labeled unicast NLRI
    - Reset the stream to attr_start + attribute_len when WITHDRAWN
    - Revalidate locally originated routes against RPKI changes
    - Check if prefixlen is not 0 when parsing flowspec stuff
    - Prevent len_string going negative when trying to display flowspec entries
    - fix import vrf on non existing vrf
    - fix no vrf import command
    - Free hostname for FQDN capability if the parsing goes wrong
    - Validate MP_REACH_NLRI attribute against incorrect next-hop
    - Fix dynamic FQDN capability handling
    - Check if the remaining length for subtracting TLV length is enough
    - Fix the end pointer boundaries for dynamic graceful restart capability
    - Add missing returns when parsing enhanced route-refresh
    - Return original as-path when reconciling AS versus AS4
    - Do not process route-refresh for AFI/SAFI if it's not negotiated
    - Check if we are not overusing error_data buffer when unknown cap received
    - fix NHT for explicit link-local BGP peers
    - improve packet parsing for EVPN and ENCAP/VNC
    - Prevent heap use-after-free for tunnel encapsulation attribute
    - Return 0 if AS4 capability is malformed
    - close dynamic peer socket in ttl error path
    - fix logic handling EVPN_FLAG_DEFAULT_GW
    - avoid early return in MPLSVPN NLRI processing
    - remove unneeded asserts in packet reads

eigrpd:
    - fix byte order in Hello TLV decode functions
    - Handling for malformed update packets
    - enforce minimum TLV length in Hello handler
    - reject invalid prefix mask len
    - skip unknown and ignored TLVs
    - Improve packet validation

isisd:
    - Reject SRv6 Locator TLV with Loc-Size of zero
    - consume leftover bytes after FAD sub-sub-TLV loop
    - use correct min size values for srv6 subtlvs
    - improve validation of flex-algo decoder
    - Fix missing neighbor address Sub-TLVs after link-params change
    - add unit test for remove_excess_adjs() memory leak fix
    - fix memory leak in remove_excess_adjs()
    - fix edge condition in max_lsp_count computation

ldpd:
    - improve tlv validation in several places

lib:
    - Report IPv6 MTU and not IPv4 for if_update_state_mtu6
    - disable warning in zlog.c to match master

nhrpd:
    - stop debugging auth credentials
    - fix byte-order when comparing error code in shortcut path
    - guard against zbuf_pulln NULL on truncated packets
    - require auth for all received packet types
    - harden debug packet parsing against malformed input
    - validate AFI index in extension replies

ospf6d:
    - move log call out of priv block
    - remove asserts in packet-handling paths
    - fix issues in ospf6 auth trailer code

ospfd:
    - add LSA validation in the apiserver path
    - add validation in several places before accessing

pceplib:
    - validate during of_list TLV decoding

pimd:
    - fix NOCACHE MFC resync detection log, add vrf name too
    - use upstream-owned pim pointer in register and upstream timers
    - use upstream-owned pim pointer in MSDP update paths
    - avoid JP build deref through channel OIL
    - guard RP RPF-failure mroute delete on detached OIL
    - avoid null deref in upstream delete debug path
    - guard channel OIL detach against stale pointers
    - fix crash due to double free
    - Ensure igmp message is of proper size
    - Reject pim packets with a malformed header length
    - Fix out of bounds read in AutoRP code
    - igmpv3 never checks packet length and trusts the num-sources field
    - Do not allow a register-stop message if not received from the RP
    - Prevent received msg length from being larger than buffer
    - Remove unnecessary asserts
    - When receiving a register stop ensure we have enough data to read
    - Ensure a register packet has enough space to read S,G data
    - Ensure that header has space on packet

ripngd:
    - fix data handling in several places

tests:
    - Check if route-map with set nexthop unchanged does not prevent outgoing
    - Check if mixed peer-group remote-as types can be used with auto
    - Verify neighbor addr Sub-TLVs after link-params reset
    - Expect return code being 0, not -1 when AS4 is empty or ASN is 0

vrrpd:

    - replace some asserts
    - only support ethernet in GARP code
    - limit advertised timers to 12-bits

Signed-off-by: Mattias Walström <lazzer@gmail.com>
2026-05-16 20:56:56 +02:00
2026-05-16 20:56:56 +02:00
2026-05-16 06:06:55 +00:00
2026-05-16 20:56:56 +02:00
2026-05-16 20:56:56 +02:00
2026-05-12 11:49:45 +02:00
2022-12-05 21:09:05 +01:00

License Badge Release Badge GitHub Status Coverity Status Discord

Infix — Immutable.Friendly.Secure

Turn any ARM or x86 device into a powerful, manageable network appliance in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy routers, IoT gateways, edge devices, or custom network solutions that just work.

Our Values

🔒 Immutable
Your system never breaks. Read-only filesystem with atomic upgrades means no configuration drift, no corrupted updates, and instant rollback if something goes wrong. Deploy once, trust forever.

🤝 Friendly
Actually easy to use. Auto-generated CLI from standard YANG models comes with built-in help for every command — just hit ? or TAB for context-aware assistance.

Familiar NETCONF & RESTCONF APIs and comprehensive documentation mean you're never stuck. Whether you're learning networking or managing enterprise infrastructure.

🛡️ Secure
Built with security as a foundation, not an afterthought. Minimal attack surface, separation between system and data, and container isolation. Sleep better knowing your infrastructure is protected.

Why Choose Infix

Hardware Flexibility: Start with a $35 Raspberry Pi, scale to enterprise switching hardware. Same OS, same tools, same reliability.

Standards-Based: Built around YANG models and IETF standards. Learn once, use everywhere - no vendor lock-in.

Container Ready: Run your applications alongside networking functions. GPIO access, dedicated Ethernet ports, custom protocols — your device, your rules.

Use Cases

  1. Home Labs & Hobbyists:
    Transform a Raspberry Pi into a full-featured router with WiFi
  2. IoT & Edge Computing:
    Bridge devices to the cloud with reliable, updatable gateways
  3. Small Business Networks:
    Enterprise-grade features without the complexity or cost
  4. Developers & Makers:
    Test networking concepts, prototype IoT solutions, or build custom appliances
  5. Network Professionals:
    Consistent tooling from development to production deployment.
    How about a digital twin using raw Qemu or GNS3!

Quick Example

Configure an interface in seconds - the CLI guides you with built-in help:

admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interface eth0
admin@infix-12-34-56:/config/interface/eth0/> set ipv4 TAB
      address     autoconf      bind-ni-name     dhcp 
      enabled     forwarding    mtu              neighbor
admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
admin@infix-12-34-56:/config/interface/eth0/> show
type ethernet;
ipv4 {
  address 192.168.2.200 {
    prefix-length 24;
  }
}
admin@infix-12-34-56:/config/interface/eth0/> diff
interfaces {
  interface eth0 {
+    ipv4 {
+      address 192.168.2.200 {
+        prefix-length 24;
+      }
+    }
  }
}
admin@infix-12-34-56:/config/interface/eth0/> leave
admin@infix-12-34-56:/> show interfaces
INTERFACE       PROTOCOL   STATE       DATA                                  
lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
eth0            ethernet   UP          52:54:00:12:34:56
                ipv4                   192.168.2.200/24 (static)
                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
admin@infix-12-34-56:/> copy running startup

Notice how TAB completion shows available options, show displays current config, and diff shows exactly what changed before you commit your changes with the leave command.

For more information, see CLI documentation.

Get Started

Get pre-built images for your hardware. Use the CLI, web interface, or standard NETCONF/RESTCONF tools, e.g., curl. Add containers for any custom functionality you need.

Supported Platforms

  • Raspberry Pi 2B/3B/4B/CM4 - Perfect for home labs, learning, and prototyping
  • Banana Pi-R3 - Your next home router and gateway
  • NanoPi R2S - Compact dual-port router in a tiny package
  • x86_64 - Run in VMs or on mini PCs for development and testing
  • Marvell CN9130 CRB, EspressoBIN - High-performance ARM64 platforms
  • Microchip SparX-5i - Enterprise switching capabilities
  • Microchip SAMA7G54-EK - ARM Cortex-A7
  • NXP i.MX8MP EVK - Highly capable ARM64 SoC
  • StarFive VisionFive2 - RISC-V architecture support

Why start with Raspberry Pi? It's affordable, widely available, has built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy in production. Perfect for learning, prototyping, or even small-scale deployments.

📖 Complete documentation💬 Join our Discord

Technical Details

bitSign - Code Signing

Built on proven open-source foundations: Linux, Buildroot, and sysrepo — for reliability you can trust:

  • Immutable OS: Read-only filesystem, atomic updates, instant rollback
  • YANG Configuration: Industry-standard models with auto-generated tooling
  • Hardware Acceleration: Linux switchdev support for wire-speed packet processing
  • Container Integration: Docker support with flexible network and hardware access
  • Memory Efficient: Runs comfortably on devices with as little as 256 MB RAM
  • Code Signing: Releases are cryptographically signed for integrity verification

Perfect for everything from resource-constrained edge devices to high-throughput network appliances.

With the entire system modeled in YANG, scalability is no longer an issue, be it in development, testing, or end users deploying and monitoring their devices. All knobs and dials are accessible from the CLI (console/SSH), or remotely using the native NETCONF or RESTCONF APIs.

Check the Latest Build for bleeding-edge features.



Infix development is sponsored by Wires

Alt

Languages
Python 36.9%
C 16.3%
Go 16.1%
HTML 13.5%
Shell 8.2%
Other 8.9%