[PATCH 1/3] oci: Add detection for Oracle Cloud

[PATCH 1/3] oci: Add detection for Oracle Cloud

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1284 bytes --]

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/initscripts/system/cloud-init |  2 ++
 src/initscripts/system/functions  | 11 +++++++++++
 2 files changed, 13 insertions(+)

diff --git a/src/initscripts/system/cloud-init b/src/initscripts/system/cloud-init
index 284e24d7b..d39552b01 100644
--- a/src/initscripts/system/cloud-init
+++ b/src/initscripts/system/cloud-init
@@ -15,6 +15,8 @@ case "${1}" in
 			scriptname="/etc/rc.d/helper/azure-setup"
 		elif running_on_gcp; then
 			scriptname="/etc/rc.d/helper/gcp-setup"
+		elif running_on_oci; then
+			scriptname="/etc/rc.d/helper/oci-setup"
 		else
 			# This system is not running in the cloud
 			exit 0
diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions
index b6e6507d6..30119918c 100644
--- a/src/initscripts/system/functions
+++ b/src/initscripts/system/functions
@@ -834,4 +834,15 @@ running_on_gcp() {
 	return 1
 }
 
+running_on_oci() {
+	if [ -r "/sys/devices/virtual/dmi/id/chassis_asset_tag" ]; then
+		local asset_tag="$(</sys/devices/virtual/dmi/id/chassis_asset_tag)"
+
+		[ "${asset_tag}" = "OracleCloud.com" ] && return 0
+	fi
+
+	# We are not running on OCI
+	return 1
+}
+
 # End $rc_base/init.d/functions
-- 
2.20.1

[PATCH 2/3] oci: Add automatic configuration script

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 11253 bytes --]

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 config/rootfiles/common/aarch64/initscripts  |   1 +
 config/rootfiles/common/armv5tel/initscripts |   1 +
 config/rootfiles/common/i586/initscripts     |   1 +
 config/rootfiles/common/x86_64/initscripts   |   1 +
 src/initscripts/helper/oci-setup             | 308 +++++++++++++++++++
 5 files changed, 312 insertions(+)
 create mode 100644 src/initscripts/helper/oci-setup

diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts
index 330bb532e..8140b9073 100644
--- a/config/rootfiles/common/aarch64/initscripts
+++ b/config/rootfiles/common/aarch64/initscripts
@@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup
 etc/rc.d/helper/azure-setup
 etc/rc.d/helper/gcp-setup
 etc/rc.d/helper/getdnsfromdhcpc.pl
+etc/rc.d/helper/oci-setup
 #etc/rc.d/init.d
 etc/rc.d/init.d/acpid
 etc/rc.d/init.d/apache
diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index 330bb532e..8140b9073 100644
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup
 etc/rc.d/helper/azure-setup
 etc/rc.d/helper/gcp-setup
 etc/rc.d/helper/getdnsfromdhcpc.pl
+etc/rc.d/helper/oci-setup
 #etc/rc.d/init.d
 etc/rc.d/init.d/acpid
 etc/rc.d/init.d/apache
diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index c0fc18705..4ec56f700 100644
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup
 etc/rc.d/helper/azure-setup
 etc/rc.d/helper/gcp-setup
 etc/rc.d/helper/getdnsfromdhcpc.pl
+etc/rc.d/helper/oci-setup
 #etc/rc.d/init.d
 etc/rc.d/init.d/acpid
 etc/rc.d/init.d/apache
diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts
index c0fc18705..4ec56f700 100644
--- a/config/rootfiles/common/x86_64/initscripts
+++ b/config/rootfiles/common/x86_64/initscripts
@@ -5,6 +5,7 @@ etc/rc.d/helper/aws-setup
 etc/rc.d/helper/azure-setup
 etc/rc.d/helper/gcp-setup
 etc/rc.d/helper/getdnsfromdhcpc.pl
+etc/rc.d/helper/oci-setup
 #etc/rc.d/init.d
 etc/rc.d/init.d/acpid
 etc/rc.d/init.d/apache
diff --git a/src/initscripts/helper/oci-setup b/src/initscripts/helper/oci-setup
new file mode 100644
index 000000000..aca09e673
--- /dev/null
+++ b/src/initscripts/helper/oci-setup
@@ -0,0 +1,308 @@
+#!/bin/bash
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+# Set PATH to find our own executables
+export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
+
+# GCP only supports an MTU of 1460
+DEFAULT_MTU=1460
+
+get() {
+	local file="${1}"
+
+	wget -qO - "http://169.254.169.254/opc/v1/${file}"
+}
+
+to_address() {
+	local n="${1}"
+
+	local o1=$(( (n & 0xff000000) >> 24 ))
+	local o2=$(( (n & 0xff0000) >> 16 ))
+	local o3=$(( (n & 0xff00) >> 8 ))
+	local o4=$(( (n & 0xff) ))
+
+	printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
+}
+
+to_integer() {
+	local address="${1}"
+
+	local integer=0
+
+	local i
+	for i in ${address//\./ }; do
+		integer=$(( (integer << 8) + i ))
+	done
+
+	printf "%d\n" "${integer}"
+}
+
+prefix2netmask() {
+	local prefix=${1}
+
+	local zeros=$(( 32 - prefix ))
+	local netmask=0
+
+	local i
+	for (( i=0; i<${zeros}; i++ )); do
+		netmask=$(( (netmask << 1) ^ 1 ))
+	done
+
+	to_address "$(( netmask ^ 0xffffffff ))"
+}
+
+oci_list_interfaces() {
+	get "vnics/" | python3 -c "import json, sys; print(\"\n\".join([vnic[\"vnicId\"] for vnic in json.load(sys.stdin)]))"
+}
+
+oci_get_interface_param() {
+	local id="${1}"
+	local param="${2}"
+
+	get "vnics/" | python3 -c "import json, sys; print(\"\n\".join(vnic.get(\"${param}\", \"\") for vnic in json.load(sys.stdin) if vnic[\"vnicId\"] == \"${id}\"))"
+}
+
+import_oci_configuration() {
+	local instance_id="$(get instance/id)"
+
+	boot_mesg "Importing Oracle Cloud Infrastructure configuration for instance ${instance_id}..."
+
+	# Store instance ID
+	echo "${instance_id}" > /var/run/oci-instance-id
+
+	# Initialise system settings
+	local hostname=$(get instance/hostname)
+
+	# Set hostname
+	if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
+		echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
+	fi
+
+	# Set domainname
+	if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
+		echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
+	fi
+
+	# Create setup user
+	if ! getent passwd setup &>/dev/null; then
+		useradd setup -s /usr/bin/run-setup -g nobody -m
+
+		# Unlock the account
+		usermod -p "x" setup
+	fi
+
+	# Import SSH keys for setup user
+	local line
+	while read -r line; do
+		# Strip the username part from the key
+		local key="${line#*:}"
+
+		if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev/null; then
+			mkdir -p "/home/setup/.ssh"
+			chmod 700 "/home/setup/.ssh"
+			chown setup.nobody "/home/setup/.ssh"
+
+			echo "${key}" >> "/home/setup/.ssh/authorized_keys"
+			chmod 600 "/home/setup/.ssh/authorized_keys"
+			chown setup.nobody "/home/setup/.ssh/authorized_keys"
+		fi
+	done <<<"$(get instance/metadata/ssh_authorized_keys)"
+
+	# Download the user-data script only on the first boot
+	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
+		# Download a startup script
+		local script="$(get instance/metadata/user_data)"
+
+		# Execute the script
+		if [ "${script:0:2}" = "#!" ]; then
+			echo "${script}" > /tmp/user-data.script
+			chmod 700 /tmp/user-data.script
+
+			# Run the script
+			local now="$(date -u +"%s")"
+			/tmp/user-data.script &>/var/log/user-data.log.${now}
+
+			# Delete the script right away
+			rm /tmp/user-data.script
+		fi
+	fi
+
+	# Import network configuration
+	# After this, no network connectivity will be available from this script due to the
+	# renaming of the network interfaces for which they have to be shut down
+	local config_type=1
+	: > /var/ipfire/ethernet/settings
+
+	local id
+	for id in $(oci_list_interfaces); do
+		local mac="$(oci_get_interface_param "${id}" "macAddr")"
+
+		# First IPv4 address
+		local ipv4_address="$(oci_get_interface_param "${id}" "privateIp")"
+		local ipv4_address_num="$(to_integer "${ipv4_address}")"
+
+		local subnet="$(oci_get_interface_param "${id}" "subnetCidrBlock")"
+		local prefix="${subnet#*/}"
+
+		local netmask="$(prefix2netmask "${prefix}")"
+		local netmask_num="$(to_integer "${netmask}")"
+
+		# Calculate the network and broadcast addresses
+		local netaddress="${subnet%/*}"
+		local broadcast="$(to_address $(( ipv4_address_num | (0xffffffff ^ netmask_num) )))"
+
+		local index="$(oci_get_interface_param "${id}" "nicIndex")"
+
+		# Set index to zero if it was empty
+		if [ -z "${index}" ]; then
+			index=0
+		fi
+
+		case "${index}" in
+			# RED
+			0)
+				local interface_name="red0"
+				local gateway="$(oci_get_interface_param "${id}" "virtualRouterIp")"
+
+				(
+					echo "RED_TYPE=STATIC"
+					echo "RED_DEV=${interface_name}"
+					echo "RED_MACADDR=${mac}"
+					echo "RED_DESCRIPTION='${id}'"
+					echo "RED_ADDRESS=${ipv4_address}"
+					echo "RED_NETMASK=${netmask}"
+					echo "RED_NETADDRESS=${netaddress}"
+					echo "RED_BROADCAST=${broadcast}"
+					echo "RED_MTU=1500"
+					echo "DEFAULT_GATEWAY=${gateway}"
+				) >> /var/ipfire/ethernet/settings
+
+				# Import aliases for RED
+				#for alias in $(get "instance/network-interfaces/${device_number}/ip-aliases"); do
+				#	echo "${alias},on,"
+				#done > /var/ipfire/ethernet/aliases
+				;;
+
+			# GREEN
+			1)
+				local interface_name="green0"
+
+				(
+					echo "GREEN_DEV=${interface_name}"
+					echo "GREEN_MACADDR=${mac}"
+					echo "GREEN_DESCRIPTION='${id}'"
+					echo "GREEN_ADDRESS=${ipv4_address}"
+					echo "GREEN_NETMASK=${netmask}"
+					echo "GREEN_NETADDRESS=${netaddress}"
+					echo "GREEN_BROADCAST=${broadcast}"
+					echo "GREEN_MTU=${DEFAULT_MTU}"
+				) >> /var/ipfire/ethernet/settings
+				;;
+
+			# ORANGE
+			2)
+				local interface_name="orange0"
+				config_type=2
+
+				(
+					echo "ORANGE_DEV=${interface_name}"
+					echo "ORANGE_MACADDR=${mac}"
+					echo "ORANGE_DESCRIPTION='${id}'"
+					echo "ORANGE_ADDRESS=${ipv4_address}"
+					echo "ORANGE_NETMASK=${netmask}"
+					echo "ORANGE_NETADDRESS=${netaddress}"
+					echo "ORANGE_BROADCAST=${broadcast}"
+					echo "ORANGE_MTU=${DEFAULT_MTU}"
+				) >> /var/ipfire/ethernet/settings
+				;;
+		esac
+	done
+
+	# Save CONFIG_TYPE
+	echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
+
+	# Actions performed only on the very first start
+	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
+		# Disable using ISP nameservers
+		sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings
+
+		# Enable SSH
+		sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
+
+		# Disable SSH password authentication
+		sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
+
+		# Enable SSH key authentication
+		sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
+
+		# Apply SSH settings
+		/usr/local/bin/sshctrl
+
+		# Mark SSH to start immediately (but not right now)
+		touch /var/ipfire/remote/enablessh
+		chown nobody:nobody /var/ipfire/remote/enablessh
+
+		# Firewall rules for SSH and WEBIF
+		(
+			echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
+			echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
+		) >> /var/ipfire/firewall/input
+
+		# This script has now completed the first steps of setup
+		touch /var/ipfire/main/firstsetup_ok
+	fi
+
+	# All done
+	echo_ok
+}
+
+case "${reason}" in
+	PREINIT)
+		# Bring up the interface
+		ip link set "${interface}" up
+		;;
+
+	BOUND|RENEW|REBIND|REBOOT)
+		# Remove any previous IP addresses
+		ip addr flush dev "${interface}"
+
+		# Add (or re-add) the new IP address
+		ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
+
+		# Add the default route
+		ip route add "${new_routers}" dev "${interface}"
+		ip route add default via "${new_routers}"
+
+		# Setup DNS
+		for domain_name_server in ${new_domain_name_servers}; do
+			echo "nameserver ${domain_name_server}"
+		done > /etc/resolv.conf
+
+		# The system is online now
+		touch /var/ipfire/red/active
+
+		# Import OCI configuration
+		import_oci_configuration
+		;;
+
+	EXPIRE|FAIL|RELEASE|STOP)
+		# The system is no longer online
+		rm -f /var/ipfire/red/active
+
+		# Remove all IP addresses
+		ip addr flush dev "${interface}"
+
+		# Shut down the interface
+		ip link set "${interface}" down
+		;;
+
+	*)
+		echo "Unhandled reason: ${reason}" >&2
+		exit 2
+		;;
+esac
+
+# Terminate
+exit 0
-- 
2.20.1

[PATCH 3/3] smt: Do not disable SMT in virtual machines

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 914 bytes --]

Processors in virtual machines are *virtual*. Therefore this
only degrades the performance of the guest, but does not increase
it's security.

This patch always leaves SMT enabled in all virtual environments.

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/initscripts/system/smt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/initscripts/system/smt b/src/initscripts/system/smt
index cc4128b2d..bfa7d57b3 100644
--- a/src/initscripts/system/smt
+++ b/src/initscripts/system/smt
@@ -20,6 +20,11 @@ case "${1}" in
 			exit 0
 		fi 2>/dev/null
 
+		# Do not disable SMT inside virtual machines
+		if [ -d "/sys/hypervisor" ]; then
+			exit 0
+		fi
+
 		# Disable SMT when the processor is vulnerable to Foreshadow or Fallout/ZombieLoad/RIDL
 		for vuln in l1tf mds; do
 			if [ -r "/sys/devices/system/cpu/vulnerabilities/${vuln}" ] && \
-- 
2.20.1