From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 2/3] oci: Add automatic configuration script Date: Tue, 21 Jul 2020 10:36:40 +0000 Message-ID: <20200721103641.30305-2-michael.tremer@ipfire.org> In-Reply-To: <20200721103641.30305-1-michael.tremer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0763380402728446446==" List-Id: --===============0763380402728446446== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Signed-off-by: Michael Tremer --- config/rootfiles/common/aarch64/initscripts | 1 + config/rootfiles/common/armv5tel/initscripts | 1 + config/rootfiles/common/i586/initscripts | 1 + config/rootfiles/common/x86_64/initscripts | 1 + src/initscripts/helper/oci-setup | 308 +++++++++++++++++++ 5 files changed, 312 insertions(+) create mode 100644 src/initscripts/helper/oci-setup diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/c= ommon/aarch64/initscripts index 330bb532e..8140b9073 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup etc/rc.d/helper/azure-setup etc/rc.d/helper/gcp-setup etc/rc.d/helper/getdnsfromdhcpc.pl +etc/rc.d/helper/oci-setup #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/= common/armv5tel/initscripts index 330bb532e..8140b9073 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup etc/rc.d/helper/azure-setup etc/rc.d/helper/gcp-setup etc/rc.d/helper/getdnsfromdhcpc.pl +etc/rc.d/helper/oci-setup #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/comm= on/i586/initscripts index c0fc18705..4ec56f700 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup etc/rc.d/helper/azure-setup etc/rc.d/helper/gcp-setup etc/rc.d/helper/getdnsfromdhcpc.pl +etc/rc.d/helper/oci-setup #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/co= mmon/x86_64/initscripts index c0fc18705..4ec56f700 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup etc/rc.d/helper/azure-setup etc/rc.d/helper/gcp-setup etc/rc.d/helper/getdnsfromdhcpc.pl +etc/rc.d/helper/oci-setup #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/src/initscripts/helper/oci-setup b/src/initscripts/helper/oci-se= tup new file mode 100644 index 000000000..aca09e673 --- /dev/null +++ b/src/initscripts/helper/oci-setup @@ -0,0 +1,308 @@ +#!/bin/bash + +. /etc/sysconfig/rc +. ${rc_functions} + +# Set PATH to find our own executables +export PATH=3D/usr/local/sbin:/usr/local/bin:${PATH} + +# GCP only supports an MTU of 1460 +DEFAULT_MTU=3D1460 + +get() { + local file=3D"${1}" + + wget -qO - "http://169.254.169.254/opc/v1/${file}" +} + +to_address() { + local n=3D"${1}" + + local o1=3D$(( (n & 0xff000000) >> 24 )) + local o2=3D$(( (n & 0xff0000) >> 16 )) + local o3=3D$(( (n & 0xff00) >> 8 )) + local o4=3D$(( (n & 0xff) )) + + printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}" +} + +to_integer() { + local address=3D"${1}" + + local integer=3D0 + + local i + for i in ${address//\./ }; do + integer=3D$(( (integer << 8) + i )) + done + + printf "%d\n" "${integer}" +} + +prefix2netmask() { + local prefix=3D${1} + + local zeros=3D$(( 32 - prefix )) + local netmask=3D0 + + local i + for (( i=3D0; i<${zeros}; i++ )); do + netmask=3D$(( (netmask << 1) ^ 1 )) + done + + to_address "$(( netmask ^ 0xffffffff ))" +} + +oci_list_interfaces() { + get "vnics/" | python3 -c "import json, sys; print(\"\n\".join([vnic[\"vnic= Id\"] for vnic in json.load(sys.stdin)]))" +} + +oci_get_interface_param() { + local id=3D"${1}" + local param=3D"${2}" + + get "vnics/" | python3 -c "import json, sys; print(\"\n\".join(vnic.get(\"$= {param}\", \"\") for vnic in json.load(sys.stdin) if vnic[\"vnicId\"] =3D=3D = \"${id}\"))" +} + +import_oci_configuration() { + local instance_id=3D"$(get instance/id)" + + boot_mesg "Importing Oracle Cloud Infrastructure configuration for instance= ${instance_id}..." + + # Store instance ID + echo "${instance_id}" > /var/run/oci-instance-id + + # Initialise system settings + local hostname=3D$(get instance/hostname) + + # Set hostname + if ! grep -q "^HOSTNAME=3D" /var/ipfire/main/settings; then + echo "HOSTNAME=3D${hostname%%.*}" >> /var/ipfire/main/settings + fi + + # Set domainname + if ! grep -q "^DOMAINNAME=3D" /var/ipfire/main/settings; then + echo "DOMAINNAME=3D${hostname#*.}" >> /var/ipfire/main/settings + fi + + # Create setup user + if ! getent passwd setup &>/dev/null; then + useradd setup -s /usr/bin/run-setup -g nobody -m + + # Unlock the account + usermod -p "x" setup + fi + + # Import SSH keys for setup user + local line + while read -r line; do + # Strip the username part from the key + local key=3D"${line#*:}" + + if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_ke= ys" 2>/dev/null; then + mkdir -p "/home/setup/.ssh" + chmod 700 "/home/setup/.ssh" + chown setup.nobody "/home/setup/.ssh" + + echo "${key}" >> "/home/setup/.ssh/authorized_keys" + chmod 600 "/home/setup/.ssh/authorized_keys" + chown setup.nobody "/home/setup/.ssh/authorized_keys" + fi + done <<<"$(get instance/metadata/ssh_authorized_keys)" + + # Download the user-data script only on the first boot + if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then + # Download a startup script + local script=3D"$(get instance/metadata/user_data)" + + # Execute the script + if [ "${script:0:2}" =3D "#!" ]; then + echo "${script}" > /tmp/user-data.script + chmod 700 /tmp/user-data.script + + # Run the script + local now=3D"$(date -u +"%s")" + /tmp/user-data.script &>/var/log/user-data.log.${now} + + # Delete the script right away + rm /tmp/user-data.script + fi + fi + + # Import network configuration + # After this, no network connectivity will be available from this script du= e to the + # renaming of the network interfaces for which they have to be shut down + local config_type=3D1 + : > /var/ipfire/ethernet/settings + + local id + for id in $(oci_list_interfaces); do + local mac=3D"$(oci_get_interface_param "${id}" "macAddr")" + + # First IPv4 address + local ipv4_address=3D"$(oci_get_interface_param "${id}" "privateIp")" + local ipv4_address_num=3D"$(to_integer "${ipv4_address}")" + + local subnet=3D"$(oci_get_interface_param "${id}" "subnetCidrBlock")" + local prefix=3D"${subnet#*/}" + + local netmask=3D"$(prefix2netmask "${prefix}")" + local netmask_num=3D"$(to_integer "${netmask}")" + + # Calculate the network and broadcast addresses + local netaddress=3D"${subnet%/*}" + local broadcast=3D"$(to_address $(( ipv4_address_num | (0xffffffff ^ netma= sk_num) )))" + + local index=3D"$(oci_get_interface_param "${id}" "nicIndex")" + + # Set index to zero if it was empty + if [ -z "${index}" ]; then + index=3D0 + fi + + case "${index}" in + # RED + 0) + local interface_name=3D"red0" + local gateway=3D"$(oci_get_interface_param "${id}" "virtualRouterIp")" + + ( + echo "RED_TYPE=3DSTATIC" + echo "RED_DEV=3D${interface_name}" + echo "RED_MACADDR=3D${mac}" + echo "RED_DESCRIPTION=3D'${id}'" + echo "RED_ADDRESS=3D${ipv4_address}" + echo "RED_NETMASK=3D${netmask}" + echo "RED_NETADDRESS=3D${netaddress}" + echo "RED_BROADCAST=3D${broadcast}" + echo "RED_MTU=3D1500" + echo "DEFAULT_GATEWAY=3D${gateway}" + ) >> /var/ipfire/ethernet/settings + + # Import aliases for RED + #for alias in $(get "instance/network-interfaces/${device_number}/ip-ali= ases"); do + # echo "${alias},on," + #done > /var/ipfire/ethernet/aliases + ;; + + # GREEN + 1) + local interface_name=3D"green0" + + ( + echo "GREEN_DEV=3D${interface_name}" + echo "GREEN_MACADDR=3D${mac}" + echo "GREEN_DESCRIPTION=3D'${id}'" + echo "GREEN_ADDRESS=3D${ipv4_address}" + echo "GREEN_NETMASK=3D${netmask}" + echo "GREEN_NETADDRESS=3D${netaddress}" + echo "GREEN_BROADCAST=3D${broadcast}" + echo "GREEN_MTU=3D${DEFAULT_MTU}" + ) >> /var/ipfire/ethernet/settings + ;; + + # ORANGE + 2) + local interface_name=3D"orange0" + config_type=3D2 + + ( + echo "ORANGE_DEV=3D${interface_name}" + echo "ORANGE_MACADDR=3D${mac}" + echo "ORANGE_DESCRIPTION=3D'${id}'" + echo "ORANGE_ADDRESS=3D${ipv4_address}" + echo "ORANGE_NETMASK=3D${netmask}" + echo "ORANGE_NETADDRESS=3D${netaddress}" + echo "ORANGE_BROADCAST=3D${broadcast}" + echo "ORANGE_MTU=3D${DEFAULT_MTU}" + ) >> /var/ipfire/ethernet/settings + ;; + esac + done + + # Save CONFIG_TYPE + echo "CONFIG_TYPE=3D${config_type}" >> /var/ipfire/ethernet/settings + + # Actions performed only on the very first start + if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then + # Disable using ISP nameservers + sed -e "s/^USE_ISP_NAMESERVERS=3D.*/USE_ISP_NAMESERVERS=3Doff/" -i /var/ip= fire/dns/settings + + # Enable SSH + sed -e "s/ENABLE_SSH=3D.*/ENABLE_SSH=3Don/g" -i /var/ipfire/remote/settings + + # Disable SSH password authentication + sed -e "s/^ENABLE_SSH_PASSWORDS=3D.*/ENABLE_SSH_PASSWORDS=3Doff/" -i /var/= ipfire/remote/settings + + # Enable SSH key authentication + sed -e "s/^ENABLE_SSH_KEYS=3D.*/ENABLE_SSH_KEYS=3Don/" -i /var/ipfire/remo= te/settings + + # Apply SSH settings + /usr/local/bin/sshctrl + + # Mark SSH to start immediately (but not right now) + touch /var/ipfire/remote/enablessh + chown nobody:nobody /var/ipfire/remote/enablessh + + # Firewall rules for SSH and WEBIF + ( + echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_sr= v,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second" + echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_POR= T,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second" + ) >> /var/ipfire/firewall/input + + # This script has now completed the first steps of setup + touch /var/ipfire/main/firstsetup_ok + fi + + # All done + echo_ok +} + +case "${reason}" in + PREINIT) + # Bring up the interface + ip link set "${interface}" up + ;; + + BOUND|RENEW|REBIND|REBOOT) + # Remove any previous IP addresses + ip addr flush dev "${interface}" + + # Add (or re-add) the new IP address + ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}" + + # Add the default route + ip route add "${new_routers}" dev "${interface}" + ip route add default via "${new_routers}" + + # Setup DNS + for domain_name_server in ${new_domain_name_servers}; do + echo "nameserver ${domain_name_server}" + done > /etc/resolv.conf + + # The system is online now + touch /var/ipfire/red/active + + # Import OCI configuration + import_oci_configuration + ;; + + EXPIRE|FAIL|RELEASE|STOP) + # The system is no longer online + rm -f /var/ipfire/red/active + + # Remove all IP addresses + ip addr flush dev "${interface}" + + # Shut down the interface + ip link set "${interface}" down + ;; + + *) + echo "Unhandled reason: ${reason}" >&2 + exit 2 + ;; +esac + +# Terminate +exit 0 --=20 2.20.1 --===============0763380402728446446==--