Infix v26.10.0

Important

This release includes breaking changes for x86_64 systems. The
bootloader and disk layout are new, see Boot Procedure, so an
existing x86_64 installation cannot be upgraded with a bundle:

• Back up your startup-config.cfg
• Reinstall from the new disk image, infix-x86_64.disk, or replace
  the disk of a virtual machine with infix-x86_64.qcow2
• Restore your startup-config.cfg

Other architectures are not affected.

Changes

• Upgrade Linux kernel to 6.18.60 (LTS)
• Upgrade libyang to 6.4.13, sysrepo to 5.2.27, libnetconf2 to 4.6.4, netopeer2 to 2.8.21, and rousette to the latest development version
• Operational data is returned much faster, from the CLI, NETCONF, RESTCONF and the WebUI, also on devices with many interfaces
• Add cellular modem (WWAN) support, not part of the default builds, see the Modem User's Guide
• PPPoE client support, issue #1569, for more information, see PPPoE Client in the User's Guide
• x86_64: GRUB is replaced by Barebox, and the system image is a signed Discoverable Disk Image (DDI), verified at boot with UEFI Secure Boot, see Boot Procedure
• Changing an interface setting that does not need it, e.g., an IP address or a bridge port's STP cost, no longer takes the link down
• New boards: - Banana Pi BPI-M1 (Allwinner A20), 32-bit Arm - Banana Pi BPI-R2 Pro (Rockchip RK3568), Aarch64 - Banana Pi BPI-F3 (SpacemiT K1), RISC-V
• New bootloader defconfig for the StarFive VisionFive2
• Board and factory configuration changes: - Boards without a VPD EEPROM can store their identity, base MAC included, in /mnt/aux/vpd.bin, see VPD - Banana Pi BPI-R3, R4, Vero W6m, Tactical 1000 and EV23X71A ports get permanent addresses derived from the chassis MAC - Banana Pi BPI-R4: EEPROM image for Wi-Fi cards without one, e.g., the BPI-MT7615, similar to /mnt/aux/vpd.bin (above) - Support for Intel AX210 Wi-Fi cards - The router factory configs enable IPv6 on the LAN bridge, and install new releases unattended every Sunday at 03:00. To stay on a release, remove unattended-update from the software settings - LAN969x boards: symreg switch register tool for debugging, see the board README
• Hardware changes: - USB ports are named usb, usb1, usb2 ..., lowercase like every other component. Existing configurations are migrated - show hardware lists the devices plugged into each USB port, see USB Ports in the User's Guide for more details - A GPS receiver can be anchored to its USB port, see GPS receivers - New locate command and RPC, blinks the board's LEDs to identify the chassis, see Locate
• Routing changes: - Add IPv6 dynamic routing: RIPng and OSPFv3 - Configurable OSPF auto-cost reference bandwidth, issue #1576 - The OSPF and RIP augments moved to the new YANG modules infix-ospf and infix-rip. NETCONF and RESTCONF clients must use the new names - Support building without FRR, static routing only, issue #1670. The minimal defconfigs and the 32-bit Arm build are built this way
• QoS changes, see QoS: - Per-port Quality of Service: trusted PCP or DSCP, priority maps, traffic classes with strict-priority or weighted transmission selection, and PCP and DSCP remarking. Every port gets IEEE 802.1Q defaults, replacing the fixed boot-time queue setup - Per-port egress rate limit - Marvell LinkStreet 88E6390 and 88E6393X offload QoS to the switch
• Bridge changes: - Unicast forwarding database (FDB), with static entries, a configurable aging time, and show bridge fdb, see FDB - MLD querier for IPv6 next to the IGMP querier, and the active querier in operational status, see Multicast Filtering and Snooping - CLI: check, commit, and leave warn about bridge ports with a missing or mismatched PVID, issue #354
• Wi-Fi changes: - 4-address (WDS) links for wireless bridges and repeaters, see WDS Backhaul and Repeaters - Configurable station roaming, see Station Roaming - Clients are moved to another access point before theirs stops, and access points on different devices share keys ahead of a roam - Band steering also moves clients already connected on 2.4 GHz - 802.11r key-holder-secret, see Fast Roaming - Lower latency for power-saving clients - The country code is one system-wide setting, hardware wifi country-code. Existing configurations are migrated - Wi-Fi interfaces get unique addresses derived from the chassis MAC - Channel survey and network scan are actions run on request, which replace the survey and scan-results containers, see Channel Survey - An open access point on 6 GHz is refused, the band requires WPA3
• Check for a new software release on demand, see [Unattended Software Updates][unattended]
• RESTCONF requests are rate limited per client, see RESTCONF Rate Limit
• Switch boards advertise one of their port addresses as LLDP chassis ID
• WebUI changes: - New Routing configuration page for OSPF and RIP - Ports and Health cards on the Overview page - Cellular modems and SIM cards on the Hardware page - Status pages refresh themselves, the interval is set in the user menu - A login lasts at most 24 hours, also with Auto-logout set to Off

Fixes

• Fix #1423: the route preference setting was ignored for the DHCPv6 default route
• The safe character set introduced in v26.09.0 was too strict for DHCP client options, syslog pattern-match and property-filter, and DHCP server client-id
• LAN clients could not reach the Internet with the factory config of the Banana Pi R3, R3 mini, R4, R64, NanoPi R2S and Vero W6m
• A bridge port recreated with a new address lost its tagged VLANs
• Removing the DHCPv6 client from an interface could leave its routes
• LLDP neighbors were listed without system name, descriptions, and capabilities
• Operational data journal snapshots held secrets and were readable by any local user
• Web server logs could fill up the disk, they now go to syslog and the rotated /var/log/web log file
• Firewall: dynamic address-set entries were lost on a reload, and the hosts they allow were blocked until the reload was done
• PTP fixes: - Ports with PHY timestamping, e.g., LAN969x copper ports, kept dropping to the faulty state - The IEEE 802.1AS link delay threshold defaults to 10 us with hardware timestamping, and can be set per port with mean-link-delay-thresh - Transparent clocks, and boundary clocks with the IEEE 802.1AS profile or a domain other than 0, logged "Waiting for ptp4l..." every second - The operational delay-mechanism of a common-p2p port, or of one with no mechanism, read e2e
• LAN969x fixes, e.g., Tactical 1000 and EV23X71A: - Ports outside a bridge could stop receiving multicast, e.g., IPv6 neighbor discovery and mDNS - The IP address of a bridge was unreachable from its ports, a bridge without VLANs forwarded nothing, and OSPF, IGMP and other link-local multicast did not reach the bridge - VLAN interfaces on bridge ports received nothing, or sent with an extra VLAN 0 tag - STP did not converge, and link aggregates in a bridge did not forward. Link aggregates are now offloaded to the switch - PTP could stop on every port until reboot - Traffic between 10 Gbps ports was limited to about 940 Mbps on the TSN and RED variants of the switch - Copper ports could stay down, or come up with one direction dead. PTP never worked on the Tactical 1000 copper ports
• Hardware fixes: - The VPD manufacturer was missing from operational status - Hardware status was missing when a sensor label had characters not allowed in a sensor name, e.g., on the Allwinner A20 - Banana Pi BPI-R4: no PCIe card was detected - Banana Pi BPI-R3 and R64: switch ports could get stuck without link, and STP did not work on a VLAN-aware bridge
• USB fixes: - On boards with a USB 3 port every port was listed twice, and locking one left it usable by USB 3 devices - Locking a USB port, or removing it from the configuration, left an already plugged-in device usable
• Wi-Fi fixes: - Fix #1679: a station added to a scan-only interface did not connect until a reboot - Stations could not connect to WPA3-only access points, e.g., all on 6 GHz, and scan results listed them as WPA2-Personal - Fast roaming (802.11r) between devices failed for WPA3 clients - Changing the MAC address of an access point could leave the access points on that radio down - Moving an access point to another radio did not work
• WebUI fixes: - RIP and OSPF could not be set up in the advanced editor - Uploading a software bundle failed on slow storage - The Overview page showed the hostname template and never the boot partition - A damaged schema cache crashed the WebUI at every start

Tip

Try Infix in GNS3! See the blog post for details https://www.kernelkit.org/posts/infix-in-gns3/