From bd3bcb45d611f1e5f39fae07f6c5b189c1e64560 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Mon, 25 Jun 2018 10:55:39 +0100 Subject: [PATCH] AWS: Import aws setup script Signed-off-by: Michael Tremer --- config/rootfiles/common/aarch64/initscripts | 1 + config/rootfiles/common/armv5tel/initscripts | 1 + config/rootfiles/common/i586/initscripts | 1 + config/rootfiles/common/x86_64/initscripts | 1 + lfs/flash-images | 5 - src/initscripts/helper/aws-setup | 215 +++++++++++++++++++ src/initscripts/system/aws | 34 +-- 7 files changed, 226 insertions(+), 32 deletions(-) create mode 100644 src/initscripts/helper/aws-setup diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts index 6a40bc1ff0..3cb05d95f2 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -1,6 +1,7 @@ etc/init.d #etc/rc.d #etc/rc.d/helper +etc/rc.d/helper/aws-setup etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index 6a40bc1ff0..3cb05d95f2 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -1,6 +1,7 @@ etc/init.d #etc/rc.d #etc/rc.d/helper +etc/rc.d/helper/aws-setup etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index f3ea792230..2c23069754 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -1,6 +1,7 @@ etc/init.d #etc/rc.d #etc/rc.d/helper +etc/rc.d/helper/aws-setup etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index f3ea792230..2c23069754 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -1,6 +1,7 @@ etc/init.d #etc/rc.d #etc/rc.d/helper +etc/rc.d/helper/aws-setup etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid diff --git a/lfs/flash-images b/lfs/flash-images index 79fa75ba80..40aca53770 100644 --- a/lfs/flash-images +++ b/lfs/flash-images @@ -128,10 +128,6 @@ ifneq "$(BUILD_PLATFORM)" "arm" else tar -x -C $(MNThdd)/ -f /install/cdrom/distro.img endif - echo "LANGUAGE=en" >> $(MNThdd)/var/ipfire/main/settings - echo "HOSTNAME=$(SNAME)" >> $(MNThdd)/var/ipfire/main/settings - echo "THEME=ipfire" >> $(MNThdd)/var/ipfire/main/settings - -touch $(MNThdd)/lib/modules/$(KVER)-ipfire/modules.dep mkdir $(MNThdd)/proc mount --bind /proc $(MNThdd)/proc @@ -153,7 +149,6 @@ ifeq "$(BOOTLOADER)" "grub" # Enable also serial console on GRUB echo "GRUB_TERMINAL=\"serial console\"" >> $(MNThdd)/etc/default/grub echo "GRUB_SERIAL_COMMAND=\"serial --unit=0 --speed=115200\"" >> $(MNThdd)/etc/default/grub - echo "GRUB_TIMEOUT=-1" >> $(MNThdd)/etc/default/grub # Add additional entry for Serial console cp $(DIR_SRC)/config/flash-images/grub/11_linux_scon \ diff --git a/src/initscripts/helper/aws-setup b/src/initscripts/helper/aws-setup new file mode 100644 index 0000000000..791bbb2512 --- /dev/null +++ b/src/initscripts/helper/aws-setup @@ -0,0 +1,215 @@ +#!/bin/bash + +. /etc/sysconfig/rc +. ${rc_functions} + +get() { + local file="${1}" + + wget -qO - "http://169.254.169.254/latest/meta-data/${file}" +} + +to_address() { + local n="${1}" + + local o1=$(( (n & 0xff000000) >> 24 )) + local o2=$(( (n & 0xff0000) >> 16 )) + local o3=$(( (n & 0xff00) >> 8 )) + local o4=$(( (n & 0xff) )) + + printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}" +} + +to_integer() { + local address="${1}" + + local integer=0 + + local i + for i in ${address//\./ }; do + integer=$(( (integer << 8) + i )) + done + + printf "%d\n" "${integer}" +} + +prefix2netmask() { + local prefix=${1} + + local zeros=$(( 32 - prefix )) + local netmask=0 + + local i + for (( i=0; i<${zeros}; i++ )); do + netmask=$(( (netmask << 1) ^ 1 )) + done + + to_address "$(( netmask ^ 0xffffffff ))" +} + +import_aws_configuration() { + local instance_id="$(get instance-id)" + + boot_mesg "Importing AWS configuration for instance ${instance_id}..." + + # Initialise system settings + if [ ! -s "/var/ipfire/main/settings" ]; then + local hostname=$(get local-hostname) + + ( + echo "HOSTNAME=${hostname%%.*}" + echo "DOMAINNAME=${hostname#*.}" + ) > /var/ipfire/main/settings + fi + + # Import any DNS server settings + eval $(/usr/local/bin/readhash <(grep -E "^DNS([0-9])=" /var/ipfire/ethernet/settings 2>/dev/null)) + + # Import network configuration + ( + # RED + GREEN + echo "CONFIG_TYPE=1" + ) > /var/ipfire/ethernet/settings + + for mac in $(get network/interfaces/macs/); do + # Remove trailing slash + mac="${mac//\//}" + + local device_number="$(get "network/interfaces/macs/${mac}/device-number")" + local interface_id="$(get "network/interfaces/macs/${mac}/interface-id")" + + # First IPv4 address + local ipv4_address="$(get "network/interfaces/macs/${mac}/local-ipv4s" | head -n1)" + local ipv4_address_num="$(to_integer "${ipv4_address}")" + + # Get subnet size + local subnet="$(get "network/interfaces/macs/${mac}/subnet-ipv4-cidr-block")" + + local prefix="${subnet#*/}" + local netmask="$(prefix2netmask "${prefix}")" + local netmask_num="$(to_integer "${netmask}")" + + # Calculate the network and broadcast addresses + local netaddress="${subnet%/*}" + local netaddress_num="$(to_integer "${netaddress}")" + local broadcast="$(to_address $(( ipv4_address_num | (0xffffffff ^ netmask_num) )))" + + # The gateway is always the first IP address in the subnet + local gateway="$(to_address $(( netaddress_num + 1 )))" + + # The AWS internal DNS service is available on the fourth IP address of each subnet + local dns1="$(to_address $(( netaddress_num + 4 )))" + local dns2= + + case "${device_number}" in + # RED + 0) + ( + echo "RED_TYPE=STATIC" + echo "RED_DEV=red0" + echo "RED_MACADDR=${mac}" + echo "RED_DESCRIPTION='${interface_id}'" + echo "RED_ADDRESS=${ipv4_address}" + echo "RED_NETMASK=${netmask}" + echo "RED_NETADDRESS=${netaddress}" + echo "RED_BROADCAST=${broadcast}" + echo "DEFAULT_GATEWAY=${gateway}" + echo "DNS1=${DNS1:-${dns1}}" + echo "DNS2=${DNS2:-${dns2}}" + ) >> /var/ipfire/ethernet/settings + + # Import aliases for RED + for alias in $(get "network/interfaces/macs/${mac}/local-ipv4s" | tail -n +2); do + echo "${alias},on," + done > /var/ipfire/ethernet/aliases + ;; + + # GREEN + 1) + ( + echo "GREEN_DEV=green0" + echo "GREEN_MACADDR=${mac}" + echo "GREEN_DESCRIPTION='${interface_id}'" + echo "GREEN_ADDRESS=${ipv4_address}" + echo "GREEN_NETMASK=${netmask}" + echo "GREEN_NETADDRESS=${netaddress}" + echo "GREEN_BROADCAST=${broadcast}" + ) >> /var/ipfire/ethernet/settings + ;; + esac + done + + # DEBUG + cat /var/ipfire/ethernet/settings + + # Import SSH keys + local line + for line in $(get "public-keys/"); do + local key_no="${line%=*}" + + local key="$(get public-keys/${key_no}/openssh-key)" + if [ -n "${key}" ] && ! grep -q "^${key}$" /root/.ssh/authorized_keys 2>/dev/null; then + mkdir -p /root/.ssh + chmod 700 /root/.ssh + + echo "${key}" >> /root/.ssh/authorized_keys + chmod 600 /root/.ssh/authorized_keys + fi + done + + # Enable SSH + touch /var/ipfire/remote/enablessh + chown nobody:nobody /var/ipfire/remote/enablessh + + # Enable SSH key authentication + sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings + + # Actions performed only on the very first start + if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then + # Firewall rules for SSH and WEBIF + ( + echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second" + echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second" + ) >> /var/ipfire/firewall/input + + # This script has now completed the first steps of setup + touch /var/ipfire/main/firstsetup_ok + fi + + # All done + echo_ok +} + +case "${reason}" in + PREINIT) + # Bring up the interface + ip link set "${interface}" up + ;; + + BOUND|RENEW|REBIND|REBOOT) + # Remove any previous IP addresses + ip addr flush dev "${interface}" + + # Add (or re-add) the new IP address + ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}" + + # Add the default route + ip route add default via "${new_routers}" + + # Import AWS configuration + import_aws_configuration + ;; + + EXPIRE|FAIL|RELEASE|STOP) + # Remove all IP addresses + ip addr flush dev "${interface}" + ;; + + *) + echo "Unhandled reason: ${reason}" >&2 + exit 2 + ;; +esac + +# Terminate +exit 0 diff --git a/src/initscripts/system/aws b/src/initscripts/system/aws index a61834b610..1810f3372e 100644 --- a/src/initscripts/system/aws +++ b/src/initscripts/system/aws @@ -6,8 +6,6 @@ . /etc/sysconfig/rc . ${rc_functions} -MD_URL="http://169.254.169.254/latest/meta-data" - # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/identify_ec2_instances.html running_on_ec2() { local uuid @@ -33,9 +31,7 @@ running_on_ec2() { case "${1}" in start) # Do nothing if we are not running on AWS EC2 - running_on_ec2 || exit 0 - - boot_mesg "Setting up system to run on AWS EC2..." + #running_on_ec2 || exit 0 # Find the first interface to use for i in /sys/class/net/*; do @@ -58,30 +54,14 @@ case "${1}" in boot_mesg "" ${NORMAL} fi - # Assign ourselves an IP address to communicate with the meta-data service - ip addr add 169.254.169.1/24 dev "${intf}" - ip link set "${intf}" up - - # Initialise system settings - if [ ! -s "/var/ipfire/main/settings" ]; then - hostname=$(curl ${MD_URL}/local-hostname) - - ( - echo "HOSTNAME=${hostname%%.*}" - echo "DOMAINNAME=${hostname#*.}" - echo "THEME=ipfire" - echo "LANGUAGE=en" - echo "KEYMAP=/lib/kbd/keymaps/i386/qwerty/us.map.gz" - echo "TIMEZONE=/usr/share/zoneinfo/posix/UTC" - ) > /var/ipfire/main/settings - fi + # Run a DHCP client and set up the system accordingly + dhclient -sf /etc/rc.d/helper/aws-setup "${intf}" - # Remove any IP addresses - ip addr flush dev "${intf}" - echo_ok + # End DHCP client immediately + dhclient -sf /etc/rc.d/helper/aws-setup -r "${intf}" - # This script has now completed the first steps of setup - touch /var/ipfire/main/firstsetup_ok + # Trigger udev again to rename interfaces + udevadm trigger && udevadm settle ;; status) -- 2.39.2