Infix v26.01.0-rc2

Important

This release includes breaking changes to WiFi configuration that will
result in existing configuration being disabled:

• WiFi station/client configuration has been restructured. The wifi container
  now requires a radio reference, and station configuration has moved under a
  wifi/station container. Existing WiFi configurations must be manually updated
• WiFi radios are now configured via ietf-hardware instead of the interfaces module

Also, Raspberry Pi users must upgrade the bootloader before upgrading to
this release. We recommend backing up your startup-config.cfg and reflash
the SD card with a new sd card image.

Changes

Noteworthy changes and additions in this release are marked below in bold text.

• Upgrade Linux kernel from 6.12.65 to 6.18.8 (LTS)
• Upgrade Buildroot to 2025.02.10 (LTS)
• Upgrade libyang to 4.2.2
• Upgrade sysrepo to 4.2.10
• Upgrade netopeer2 (NETCONF) to 2.7.0
• Add RIPv2 routing support, issue #582
• Add NTP server support, issue #904
• Migrate DHCPv6 client to odhcp6c for improved Router Advertisement integration. Adds support for hybrid RA+DHCPv6 deployments where SLAAC assigns addresses and DHCPv6 provides DNS (common ISP scenario)
• Add support for configurable OSPF debug logging, issue #1281. Debug options can now be enabled per category (bfd, packet, ism, nsm, default-information, nssa). All debug options are disabled by default to prevent log flooding in production environments. See the documentation for usage examples
• Add support for configurable container resource limits, memory and CPU. Resource usage is available through the operational datastore, where the currently active resource limits in the container runtime are also available
• Add support for "routing interfaces", issue #647. Lists interfaces with IP forwarding. Inspect from CLI using show interface, look for ⇅ flag
• Add operational data journal to statd with hierarchical time-based retention policy, keeping snapshots from every 5 minutes (recent) to yearly (historical)
• Add support data collection script, useful when troubleshooting issues on deployed systems. Gathers system information, logs, and more. Issue #1287
• Add WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3 security. BREAKING: WiFi architecture refactored with radios configured via ietf-hardware and interfaces requiring radio reference. Station config moved to wifi/station container. Existing Wi-Fi interfaces will be removed during upgrade (for the rest of the configuration to apply) and you need to reconfigure them again. See the WiFi documentation for details
• Add support for WireGuard VPN tunnels.
• Updated CLI change command to support cleartext-symmetric-key (type binary). Used by both WireGuard and WiFi, with application-specific key-format for keys and passphrases
• New default NACM privilege levels (user levels) in factory-config: operator (network & container manager) and guest (read-only). For details, see the updated system configuration documentation, as well as a new dedicated NACM configuration guide
• New show nacm admin-exec command to inspect access control rules
• CLI now supports Ctrl-@ and Ctrl-w/Meta-w to mark and copy test regions
• CLI now uses copy and rpc tools instead of deprecated sysrepocfg. The latter now also require the use of sudo for admin level users
• Enhanced copy command with XPath filtering support
• Kernel now announces details of new USB devices

Fixes

• Fix #515: add per-interface IPv6 forwarding control using the Linux 6.17+ force_forwarding sysctl. This provides true per-interface IPv6 forwarding similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
• Fix #1082: Wi-Fi interfaces always scanned, introduce a scan-mode to the Wi-Fi concept in Infix
• Fix #1313: Container is not restarted if environment variable is changed
• Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot. This was due newer EEPROM firmware in newer boards require a newer rpi-firmware package
• Fix #1345: firewall not updating when interfaces become bridge/lag ports
• Fix #1346: firewall complains in syslog, missing /etc/firewalld/firewalld.conf
• Fix Raspberry Pi 2B build, among other things, the aarch32_defconfig did not include a dtb. Please note, the platform has now been renamed to arm
• Fix default password hash in do password encrypt command. New hash is the same as the more commonly used change password command, yescrypt
• Prevent MOTD from showing on non-shell user login attempts
• Fix mDNS reflector.

Tip

Try Infix in GNS3! Download the appliance from the GNS3 Marketplace to test Infix in a virtual network environment without hardware.