Repository navigation
Yangerd - #1536
Draft
mattiaswal wants to merge 25 commits into
Draft
Yangerd#1536mattiaswal wants to merge 25 commits into
mattiaswal wants to merge 25 commits into
Conversation
mattiaswal
force-pushed
the
yangerd
branch
3 times, most recently
from
June 19, 2026 09:38
3ec2747 to
71d50ea
Compare
mattiaswal
force-pushed
the
yangerd
branch
3 times, most recently
from
August 17, 2026 11:52
7537929 to
8e6b2a1
Compare
mattiaswal
force-pushed
the
yangerd
branch
4 times, most recently
from
October 5, 2026 11:22
01b4d8f to
ba1a1b3
Compare
mattiaswal
force-pushed
the
yangerd
branch
6 times, most recently
from
October 12, 2026 15:51
bcaa779 to
1dc7c7e
Compare
mattiaswal
force-pushed
the
yangerd
branch
5 times, most recently
from
October 16, 2026 10:55
ad98067 to
48f831c
Compare
A Go daemon replacing the Python yanger scripts that statd forked on
every GET. It keeps operational state in memory, driven by netlink,
nl80211, D-Bus, ZAPI, inotify and the FRR vty sockets, polls only what
has no events, and serves it to statd over a Unix socket as JSON.
Covers interfaces, routing, system, hardware, NTP, LLDP, containers,
firewall, DHCP, TFTP, PTP and WiFi. The RIB comes from zebra when
built with FRR and from the kernel table otherwise.
Interface queries go through a long-lived 'ip -batch' process. A
failing command prints nothing, [] or [{}] before its "Command failed"
line depending on the iproute2 version, and stdout and stderr race on
separate pipes, so the pipes are merged and every command is followed
by one that always fails, whose failure line delimits the answer.
inotify and the wireguard device dump are thin layers over x/sys/unix
and the mdlayher/genetlink stack already used for ethtool and nl80211,
rather than fsnotify and wgctrl, which brought their BSD, Darwin and
Windows backends and x/crypto into vendor. The inotify watcher must
not leave a goroutine blocked in poll(2) per event: each pinned an OS
thread, 1300 of them after an hour of tests on a DUT.
A route change is the one event FRR gives for a neighbor loss, so the
ZAPI watcher pokes the routing collector instead of waiting for the
10 s poll, and the rauc software object is re-read once rauc appears
on the bus, since on the styx boards yangerd came up before it.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Buildroot builds with -mod=vendor and no network access. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Finit service with readiness notification. Build-time feature flags in /etc/default/yangerd mirror the packages selected, so yangerd only runs the monitors that have something to monitor. GOMEMLIMIT caps the Go heap at 64 MiB. The live tree is under 1 MiB but RSS drifted past 100 MiB, enough for the OOM killer to pick yangerd while rauc held a bundle in tmpfs on a 512 MiB box. Dependabot tracks the Go dependencies on the same weekly schedule as webui and netbrowse, and re-vendors on every bump. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Replaces forking the Python yanger scripts with a query over yangerd's Unix socket. Nested subscriptions graft only the requested node into the parent sysrepo passes, control-plane-protocols is one merged subscription so config-only instances stay, and an empty answer from a yangerd still starting is no data rather than an error. Entries libyang rejects are dropped instead of failing the whole GET. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Nudges yangerd to re-read its polled sources after a configuration change. Best effort, the commit must not fail when yangerd is not installed or not yet running. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Room for yangerd on the virtual DUTs. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Operational data now comes from yangerd. Interfaces, routes and containers are reactive, the rest is polled, so checks that read a value once right after a change now poll with until(). Also dumps AP and client state when a WiFi check gives up, and updates the generated test specifications. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Loading all modules took ~0.7 s per DUT before a test could even ask has_feature() and skip. The module list is enough for that. Signed-off-by: Mattias Walström <lazzer@gmail.com>
PPPoE is the only PPP transport, the kernel cannot tell. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Interfaces without carrier handling, AP_VLAN ports and tunnels, stay in UNKNOWN; the UP and LOWER_UP flags tell the real state. Loopback is now up rather than unknown. Signed-off-by: Mattias Walström <lazzer@gmail.com>
A wds-link port is an AP_VLAN interface without a control socket of its own, its state is the one station the kernel has bound to it. hostapd binds the station without an nl80211 event for the port, so the station events on the access point refresh the ports too. Signed-off-by: Mattias Walström <lazzer@gmail.com>
wpa_supplicant labels every RSN network WPA2, the key management tells them apart: SAE only is WPA3, SAE next to PSK is a transition network. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Survey data is collected on request by the channel-survey action since infix-hardware@2026-10-06, the container is gone from the model. Signed-off-by: Mattias Walström <lazzer@gmail.com>
confd sets force_forwarding for IPv6, the aggregator reads it, but only the plain forwarding file was watched. An IPv6-only change was picked up solely because the IPv4 sysctl is written at the same time. Signed-off-by: Mattias Walström <lazzer@gmail.com>
The bridge/vlans container and the bridge-port pvid leaf were never produced, so any view of VLAN membership came up empty. Read `bridge vlan show` and the per-bridge global table, follow RTNLGRP_BRVLAN when the kernel has it and bridge link events otherwise. A VLAN filtering bridge carries its multicast state per VLAN, a plain bridge at the bridge level, as the YANG choice says. Signed-off-by: Mattias Walström <lazzer@gmail.com>
A refresh started before a disconnect could publish over it, leaving a gone association in the operational data. Hold a per-interface lock from read to publish. Signed-off-by: Mattias Walström <lazzer@gmail.com>
hostapd announces its shutdown with CTRL-EVENT-TERMINATING, but the attach kept waiting for the keepalive to time out, ten seconds in which the restarted hostapd bound its stations again unseen. End the attach on the event, and re-read the wds-link ports whenever a control socket is gained or lost, since their state is the kernel's and the station events that would have refreshed them never arrived. Signed-off-by: Mattias Walström <lazzer@gmail.com>
The dev/vid filters and the JSON port in progress are statics that leak from one batch command to the next: a 'vlan show' after 'vlan global show dev br0' lists br0 only, and the next 'vlan global show' aborts on the json_writer depth assertion. yangerd runs bridge as a batch and lost VLAN members and its bridge subprocess this way. Signed-off-by: Mattias Walström <lazzer@gmail.com>
RTNLGRP_BRVLAN is 33, not 35; 35 is RTNLGRP_TUNNEL. No VLAN event ever arrived, so a VLAN added to an existing port only showed up when some interface came or went. A bridge whose global query fails now keeps the globals it had instead of losing its VLAN list until the next event. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Every access point is created with its address, custom or derived, before hostapd starts. Without use_driver_iface_addr hostapd gives a second BSS on the radio the primary's address plus one and changes the interface under us, so operational data read right after the commit disagrees with the air. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Main's Python yanger reports it since 2052260 and the ospf_auto_cost test reads it. FRR has no JSON for it, so take it from the daemon's running-config, which only lists it when it differs from 100000. Signed-off-by: Mattias Walström <lazzer@gmail.com>
Main dropped it as unused, this branch polls boot-order with it. Also poll in cleanup, boot-order can still be empty right after the reboot. Signed-off-by: Mattias Walström <lazzer@gmail.com>
A remove sent while firewalld reloads is served after the sets are rebuilt but before the dynamic entries are re-applied, and fails. Wait for the operational logging mode to flip, which follows the Reloaded signal, before checking the entry and calling remove. Signed-off-by: Mattias Walström <lazzer@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Checklist
Tick relevant boxes, this PR is-a or has-a: