core77: Only add timezone-transition rules when needed.
[people/teissler/ipfire-2.x.git] / config / rootfiles / core / 77 / update.sh
1 #!/bin/bash
2 ############################################################################
3 # #
4 # This file is part of the IPFire Firewall. #
5 # #
6 # IPFire is free software; you can redistribute it and/or modify #
7 # it under the terms of the GNU General Public License as published by #
8 # the Free Software Foundation; either version 3 of the License, or #
9 # (at your option) any later version. #
10 # #
11 # IPFire is distributed in the hope that it will be useful, #
12 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
14 # GNU General Public License for more details. #
15 # #
16 # You should have received a copy of the GNU General Public License #
17 # along with IPFire; if not, write to the Free Software #
18 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
19 # #
20 # Copyright (C) 2014 IPFire-Team <info@ipfire.org>. #
21 # #
22 ############################################################################
23 #
24 . /opt/pakfire/lib/functions.sh
25 /usr/local/bin/backupctrl exclude >/dev/null 2>&1
26
27 function add_to_backup ()
28 {
29 # Add path to ROOTFILES but remove old entries to prevent double
30 # files in the tar
31 grep -v "^$1" /opt/pakfire/tmp/ROOTFILES > /opt/pakfire/tmp/ROOTFILES.tmp
32 mv /opt/pakfire/tmp/ROOTFILES.tmp /opt/pakfire/tmp/ROOTFILES
33 echo $1 >> /opt/pakfire/tmp/ROOTFILES
34 }
35
36 #
37 # Remove old core updates from pakfire cache to save space...
38 core=77
39 for (( i=1; i<=${core}; i++ ))
40 do
41 rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
42 done
43
44 #
45 # Do some sanity checks.
46 case $(uname -r) in
47 *-ipfire-versatile )
48 /usr/bin/logger -p syslog.emerg -t ipfire \
49 "core-update-${core}: ERROR cannot update. versatile support is dropped."
50 # Report no error to pakfire. So it does not try to install it again.
51 exit 0
52 ;;
53 *-ipfire-xen )
54 BOOTSIZE=`df /boot -Pk | sed "s| * | |g" | cut -d" " -f2 | tail -n 1`
55 if [ $BOOTSIZE -lt 28000 ]; then
56 /usr/bin/logger -p syslog.emerg -t ipfire \
57 "core-update-${core}: ERROR cannot update because not enough space on boot."
58 exit 2
59 fi
60 ;;
61 *-ipfire* )
62 # Ok.
63 ;;
64 * )
65 /usr/bin/logger -p syslog.emerg -t ipfire \
66 "core-update-${core}: ERROR cannot update. No IPFire Kernel."
67 exit 1
68 ;;
69 esac
70
71
72 #
73 #
74 KVER="xxxKVERxxx"
75 MOUNT=`grep "kernel" /boot/grub/grub.conf 2>/dev/null | tail -n 1 `
76 # Nur den letzten Parameter verwenden
77 echo $MOUNT > /dev/null
78 MOUNT=$_
79 if [ ! $MOUNT == "rw" ]; then
80 MOUNT="ro"
81 fi
82
83 #
84 # check if we the backup file already exist
85 if [ -e /var/ipfire/backup/core-upgrade${core}_${KVER}.tar.xz ]; then
86 echo Moving backup to backup-old ...
87 mv -f /var/ipfire/backup/core-upgrade${core}_${KVER}.tar.xz \
88 /var/ipfire/backup/core-upgrade${core}_${KVER}-old.tar.xz
89 fi
90 echo First we made a backup of all files that was inside of the
91 echo update archive. This may take a while ...
92 # Add some files that are not in the package to backup
93 add_to_backup lib/modules
94 add_to_backup etc/udev
95 add_to_backup lib/udev
96 add_to_backup boot
97 add_to_backup etc/sysconfig/lm_sensors
98 add_to_backup etc/sysconfig/rc.local
99 add_to_backup srv/web/ipfire/html/themes/ipfire
100 add_to_backup usr/lib/engines
101 add_to_backup etc/rc.d/init.d/networking/red.up/22-outgoingfwctrl
102 add_to_backup etc/rc.d/init.d/networking/red.up/25-portfw
103 add_to_backup etc/rc.d/init.d/networking/red.up/26-xtaccess
104 add_to_backup usr/local/bin/setportfw
105 add_to_backup usr/local/bin/setdmzholes
106 add_to_backup usr/local/bin/setxtaccess
107 add_to_backup usr/local/bin/outgoingfwctrl
108 add_to_backup srv/web/ipfire/cgi-bin/{dmzholes,outgoingfw,portfw,xtaccess}.cgi
109 add_to_backup var/ipfire/{dmzholes,portfw,outgoing,xtaccess}
110 add_to_backup etc/inittab
111 add_to_backup etc/fstab
112 add_to_backup usr/share/usb_modeswitch
113 add_to_backup etc/rc.d/init.d/networking/red.down/99-D-dialctrl.pl
114 add_to_backup etc/rc.d/init.d/networking/red.up/99-U-dialctrl.pl
115 add_to_backup usr/local/bin/dialctrl.pl
116 add_to_backup usr/lib/locale/locale-archive
117
118 # Backup the files
119 tar cJvf /var/ipfire/backup/core-upgrade${core}_${KVER}.tar.xz \
120 -C / -T /opt/pakfire/tmp/ROOTFILES --exclude='#*' --exclude='/var/cache' > /dev/null 2>&1
121
122 # Check diskspace on root
123 ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1`
124
125 if [ $ROOTSPACE -lt 100000 ]; then
126 /usr/bin/logger -p syslog.emerg -t ipfire \
127 "core-update-${core}: ERROR cannot update because not enough free space on root."
128 exit 2
129 fi
130
131
132 echo
133 echo Update Kernel to $KVER ...
134 #
135 # Remove old kernel, configs, initrd, modules ...
136 #
137 rm -rf /boot/System.map-*
138 rm -rf /boot/config-*
139 rm -rf /boot/ipfirerd-*
140 rm -rf /boot/vmlinuz-*
141 rm -rf /boot/uImage-ipfire-*
142 rm -rf /boot/uInit-ipfire-*
143 rm -rf /lib/modules
144
145 # Remove old usb_modeswitch_data
146 rm -rf /usr/share/usb_modeswitch
147 # Remove old tzdata
148 rm -rf /usr/share/zoneinfo
149
150 # Remoce old locale-archive
151 rm -rf /usr/lib/locale/locale-archive
152
153 # Remove dialctrl.pl script
154 rm -f \
155 /etc/rc.d/init.d/networking/red.down/99-D-dialctrl.pl \
156 /etc/rc.d/init.d/networking/red.up/99-U-dialctrl.pl \
157 /usr/local/bin/dialctrl.pl
158
159 #
160 # Remove old udev rules.
161 #
162 if [ -e /etc/udev/rules.d/29-ct-server-network.rules ]; then
163 cp /etc/udev/rules.d/29-ct-server-network.rules /tmp/
164 fi
165 cp /etc/udev/rules.d/30-persistent-network.rules /tmp/
166 rm -rf /etc/udev
167 rm -rf /lib/udev
168 mkdir -p /etc/udev/rules.d
169 if [ -e /tmp/rules.d/29-ct-server-network.rules ]; then
170 mv /tmp/29-ct-server-network.rules /etc/udev/rules.d/
171 fi
172 mv /tmp/30-persistent-network.rules /etc/udev/rules.d/
173
174 case $(uname -m) in
175 i?86 )
176 #
177 # Backup grub.conf
178 #
179 cp -vf /boot/grub/grub.conf /boot/grub/grub.conf.org
180 ;;
181 esac
182 #
183 #Stop services
184 /etc/init.d/snort stop
185 /etc/init.d/squid stop
186 /etc/init.d/ipsec stop
187 /etc/init.d/apache stop
188
189 # Remove the old default theme
190 rm -rf /srv/web/ipfire/html/themes/ipfire
191
192 # rename /etc/modprobe.d files
193 for i in $(find /etc/modprobe.d/* | grep -v ".conf"); do
194 mv $i $i.conf
195 done
196
197 # Move /var/run to /run.
198 if [ -L "/run" ]; then
199 rm -f /run
200 fi
201
202 mkdir -p /run
203 if mountpoint /var/run; then
204 mount --move /var/run /run
205 rm -rf /var/run
206 fi
207
208 ln -svf ../run /var/run
209
210 # Creating directories for new firewall.
211 mkdir -p /var/ipfire/firewall
212 mkdir -p /var/ipfire/fwhosts
213
214 # Remove old ntp binaries
215 rm -f /usr/sbin/ntp-keygen
216 rm -f /usr/sbin/ntp-wait
217 rm -f /usr/sbin/ntpq
218 rm -f /usr/sbin/ntptime
219 rm -f /usr/sbin/ntptrace
220 rm -f /usr/sbin/tickadj
221
222 # Remove old firewall helper link
223 rm -f /etc/rc.d/init.d/networking/red.up/22-forwardfwctrl
224
225 #
226 #Extract files
227 tar xavf /opt/pakfire/tmp/files* --no-overwrite-dir -p --numeric-owner -C /
228
229 # Check diskspace on boot
230 BOOTSPACE=`df /boot -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1`
231
232 if [ $BOOTSPACE -lt 1000 ]; then
233 case $(uname -r) in
234 *-ipfire-kirkwood )
235 # Special handling for old kirkwood images.
236 # (install only kirkwood kernel)
237 rm -rf /boot/*
238 tar xavf /opt/pakfire/tmp/files* --no-overwrite-dir -p \
239 --numeric-owner -C / --wildcards 'boot/*-kirkwood*'
240 ;;
241 * )
242 /usr/bin/logger -p syslog.emerg -t ipfire \
243 "core-update-${core}: FATAL-ERROR space run out on boot. System is not bootable..."
244 /etc/init.d/apache start
245 exit 4
246 ;;
247 esac
248 fi
249
250 #
251 #Reload init to close old linker/glibc
252 telinit u
253
254 # Regenerate ipsec configuration files.
255 /srv/web/ipfire/cgi-bin/vpnmain.cgi
256
257 # Update Language cache
258 perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
259
260 # Remove old openssl engines
261 rm -rf /usr/lib/engines
262
263 # Remove old initscripts
264 rm -f /etc/rc.d/init.d/networking/red.up/22-outgoingfwctrl
265 rm -f /etc/rc.d/init.d/networking/red.up/25-portfw
266 rm -f /etc/rc.d/init.d/networking/red.up/26-xtaccess
267 rm -f /etc/rc.d/rcsysinit.d/S90sysctl
268
269 # Remove old firewallscripts
270 rm -f /usr/local/bin/setportfw
271 rm -f /usr/local/bin/setdmzholes
272 rm -f /usr/local/bin/setxtaccess
273 rm -f /usr/local/bin/outgoingfwctrl
274
275 # Remove old CGI files
276 rm -f /srv/web/ipfire/cgi-bin/{dmzholes,outgoingfw,portfw,xtaccess}.cgi
277
278 # Generate chains for new firewall
279 /sbin/iptables -N INPUTFW 2>/dev/null
280 /sbin/iptables -N FORWARDFW 2>/dev/null
281 /sbin/iptables -N POLICYFWD 2>/dev/null
282 /sbin/iptables -N POLICYIN 2>/dev/null
283 /sbin/iptables -N POLICYOUT 2>/dev/null
284 /sbin/iptables -t nat -N NAT_SOURCE 2>/dev/null
285 /sbin/iptables -t nat -N NAT_DESTINATION 2>/dev/null
286 /sbin/iptables -t mangle -N NAT_DESTINATION 2>/dev/null
287
288 # Create config files for firewall and fix permissions.
289 touch /var/ipfire/firewall/config
290 touch /var/ipfire/firewall/input
291 touch /var/ipfire/firewall/outgoing
292 touch /var/ipfire/firewall/settings
293 touch /var/ipfire/fwhosts/customhosts
294 touch /var/ipfire/fwhosts/customnetworks
295 touch /var/ipfire/fwhosts/customgroups
296 touch /var/ipfire/fwhosts/customservices
297 touch /var/ipfire/fwhosts/customservicegrp
298
299 if [ ! -s "/var/ipfire/fwhosts/customservices" ];then
300 cp /var/ipfire/fwhosts/customservices.default /var/ipfire/fwhosts/customservices
301 fi
302
303 # Fix ownership.
304 chown -R nobody:nobody /var/ipfire/firewall
305 chown -R nobody:nobody /var/ipfire/fwhosts
306
307 # Convert firewall configuration
308 /usr/sbin/convert-xtaccess
309 /usr/sbin/convert-outgoingfw
310 /usr/sbin/convert-portfw
311 /usr/sbin/convert-dmz
312
313 # Remove old firewall configuration files
314 rm -rf /var/ipfire/{dmzholes,portfw,outgoing,xtaccess}
315
316 # In previously released IPFire versions the DROPOUTPUT and DROPINPUT
317 # option have two identical lines in the optionsfw/settings file as long as
318 # the user hasn't done any changes on the WUI.
319 #
320 # To prevent from any kind of side effects we are going to solve this issue now.
321
322 # Fix doubble enties of DROPOUTPUT when the default settings are still in use
323 # (the save button on the WUI page never has been clicked) or convert to the
324 # new option name required by the firewall of IPFire 2.15.
325
326 optionsfw_file="/var/ipfire/optionsfw/settings"
327
328 if [ $(grep -c "DROPOUTPUT" ${optionsfw_file}) -gt 1 ] ; then
329
330 # Drop all DROPUTPUT entries.
331 sed -e "/DROPOUTPUT/d" -i ${optionsfw_file}
332
333 # Add default line for new option.
334 echo "DROPOUTGOING=on" >> ${optionsfw_file}
335 else
336
337 # Convert option name to new format.
338 sed -e "s/DROPOUTPUT/DROPOUTGOING/g" -i ${optionsfw_file}
339 fi
340
341 # Fix doubble enties of DROPINPUT when the default settings are still in use
342 # (the save button on the WUI page never has been clicked).
343 if [ $(grep -c "DROPINPUT" ${optionsfw_file}) -gt 1 ] ; then
344
345 # We only can remove all entries with an defined string.
346 sed -e "/DROPINPUT/d" -i ${optionsfw_file}
347
348 # Afterwards we have to add the required string with the default
349 # value again.
350 echo "DROPINPUT=on" >> ${optionsfw_file}
351 fi
352
353 # Add strings and default values for new options of the firewall.
354 echo "DROPFORWARD=on" >> ${optionsfw_file}
355 echo "FWPOLICY=DROP" >> ${optionsfw_file}
356 echo "FWPOLICY1=DROP" >> ${optionsfw_file}
357 echo "FWPOLICY2=DROP" >> ${optionsfw_file}
358 echo "DROPSAMBA=off" >> ${optionsfw_file}
359 echo "DROPPROXY=off" >> ${optionsfw_file}
360 echo "SHOWREMARK=on" >> ${optionsfw_file}
361 echo "SHOWCOLORS=on" >> ${optionsfw_file}
362 echo "SHOWTABLES=off" >> ${optionsfw_file}
363 echo "SHOWDROPDOWN=off" >> ${optionsfw_file}
364 echo "DROPWIRELESSINPUT=on" >> ${optionsfw_file}
365 echo "DROPWIRELESSFORWARD=on" >> ${optionsfw_file}
366
367 unset optionsfw_file
368
369 # Convert inittab and fstab
370 sed -i -e "s/tty1 9600$/tty1 9600 --noclear/g" /etc/inittab
371 sed -i -e "s/xvc0 9600$/xvc0 9600 --noclear/g" /etc/inittab
372 sed -i -e "s/^proc/#proc/g" /etc/fstab
373 sed -i -e "s/^sysfs/#sysfs/g" /etc/fstab
374 sed -i -e "s/^devpts/#devpts/g" /etc/fstab
375 sed -i -e "s|^none\s/var/run|#none /var/run|g" /etc/fstab
376
377 # Convert udev persistent network rules
378 sed -i -e "s/SYSFS{/ATTR{/g" /etc/udev/rules.d/30-persistent-network.rules
379
380 # Firstsetup was already run
381 touch /var/ipfire/main/firstsetup_ok
382
383 #
384 # Start services
385 #
386 /etc/init.d/apache start
387 /etc/init.d/squid start
388 /etc/init.d/snort start
389 if [ `grep "ENABLED=on" /var/ipfire/vpn/settings` ]; then
390 /etc/init.d/ipsec start
391 fi
392
393 #
394 # Rebuild qosscript if enabled
395 #
396 if [ -e /var/ipfire/qos/enable ]; then
397 /usr/local/bin/qosctrl stop
398 /usr/local/bin/qosctrl generate
399 /usr/local/bin/qosctrl start
400 fi
401
402 chown cron:cron /var/spool/cron
403 # Update crontab
404 grep -q timezone-transition /var/spool/cron/root.orig || cat <<EOF >> /var/spool/cron/root.orig
405
406 # Re-read firewall rules every Sunday in March, October and November to take care of daylight saving time
407 00 3 * 3 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl
408 00 2 * 10-11 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl
409 EOF
410 fcrontab -z &>/dev/null
411
412
413 case $(uname -m) in
414 i?86 )
415 #
416 # Modify grub.conf
417 #
418 echo
419 echo Update grub configuration ...
420 ROOT=`mount | grep " / " | cut -d" " -f1`
421
422 if [ ! -z $ROOT ]; then
423 ROOTUUID=`blkid -c /dev/null -sUUID $ROOT | cut -d'"' -f2`
424 fi
425
426 if [ ! -z $ROOTUUID ]; then
427 sed -i "s|ROOT|UUID=$ROOTUUID|g" /boot/grub/grub.conf
428 else
429 sed -i "s|ROOT|$ROOT|g" /boot/grub/grub.conf
430 fi
431 sed -i "s|KVER|$KVER|g" /boot/grub/grub.conf
432 sed -i "s|MOUNT|$MOUNT|g" /boot/grub/grub.conf
433
434 if [ "$(grep "^serial" /boot/grub/grub.conf.org)" == "" ]; then
435 echo "grub use default console ..."
436 else
437 echo "grub use serial console ..."
438 sed -i -e "s|splashimage|#splashimage|g" /boot/grub/grub.conf
439 sed -i -e "s|#serial|serial|g" /boot/grub/grub.conf
440 sed -i -e "s|#terminal|terminal|g" /boot/grub/grub.conf
441 sed -i -e "s| panic=10 | console=ttyS0,115200n8 panic=10 |g" /boot/grub/grub.conf
442 fi
443
444 #
445 # ReInstall grub
446 #
447 echo "(hd0) ${ROOT::`expr length $ROOT`-1}" > /boot/grub/device.map
448 grub-install --no-floppy ${ROOT::`expr length $ROOT`-1}
449 ;;
450 esac
451 #
452 # Delete old lm-sensor modullist to force search at next boot
453 #
454 rm -rf /etc/sysconfig/lm_sensors
455
456
457 # Force (re)install pae kernel if pae is supported
458 rm -rf /opt/pakfire/db/*/meta-linux-pae
459 if [ ! "$(grep "^flags.* pae " /proc/cpuinfo)" == "" ]; then
460 ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1`
461 BOOTSPACE=`df /boot -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1`
462 if [ $BOOTSPACE -lt 12000 -o $ROOTSPACE -lt 90000 ]; then
463 /usr/bin/logger -p syslog.emerg -t ipfire \
464 "core-update-${core}: WARNING not enough space for pae kernel."
465 else
466 echo "Name: linux-pae" > /opt/pakfire/db/installed/meta-linux-pae
467 echo "ProgVersion: 0" >> /opt/pakfire/db/installed/meta-linux-pae
468 echo "Release: 0" >> /opt/pakfire/db/installed/meta-linux-pae
469 echo "Name: linux-pae" > /opt/pakfire/db/meta/meta-linux-pae
470 echo "ProgVersion: 0" >> /opt/pakfire/db/meta/meta-linux-pae
471 echo "Release: 0" >> /opt/pakfire/db/meta/meta-linux-pae
472 fi
473 fi
474
475 # Force reinstall xen kernel if it was installed
476 if [ -e "/opt/pakfire/db/installed/meta-linux-xen" ]; then
477 echo "Name: linux-xen" > /opt/pakfire/db/installed/meta-linux-xen
478 echo "ProgVersion: 0" >> /opt/pakfire/db/installed/meta-linux-xen
479 echo "Release: 0" >> /opt/pakfire/db/installed/meta-linux-xen
480 echo "Name: linux-xen" > /opt/pakfire/db/meta/meta-linux-xen
481 echo "ProgVersion: 0" >> /opt/pakfire/db/meta/meta-linux-xen
482 echo "Release: 0" >> /opt/pakfire/db/meta/meta-linux-xen
483 # Add xvc0 to /etc/securetty
484 echo "xvc0" >> /etc/securetty
485 fi
486
487 #
488 # After pakfire has ended run it again and update the lists and do upgrade
489 #
490 echo '#!/bin/bash' > /tmp/pak_update
491 echo 'while [ "$(ps -A | grep " update.sh")" != "" ]; do' >> /tmp/pak_update
492 echo ' sleep 1' >> /tmp/pak_update
493 echo 'done' >> /tmp/pak_update
494 echo 'while [ "$(ps -A | grep " pakfire")" != "" ]; do' >> /tmp/pak_update
495 echo ' sleep 1' >> /tmp/pak_update
496 echo 'done' >> /tmp/pak_update
497 echo '/opt/pakfire/pakfire update -y --force' >> /tmp/pak_update
498 echo '/opt/pakfire/pakfire upgrade -y' >> /tmp/pak_update
499 echo '/opt/pakfire/pakfire upgrade -y' >> /tmp/pak_update
500 echo '/opt/pakfire/pakfire upgrade -y' >> /tmp/pak_update
501 echo '/usr/bin/logger -p syslog.emerg -t ipfire "Core-upgrade finished. If you use a customized grub.cfg"' >> /tmp/pak_update
502 echo '/usr/bin/logger -p syslog.emerg -t ipfire "Check it before reboot !!!"' >> /tmp/pak_update
503 echo '/usr/bin/logger -p syslog.emerg -t ipfire " *** Please reboot... *** "' >> /tmp/pak_update
504 echo 'touch /var/run/need_reboot ' >> /tmp/pak_update
505 #
506 killall -KILL pak_update
507 chmod +x /tmp/pak_update
508 /tmp/pak_update &
509
510 sync
511
512 #
513 #Finish
514 (
515 /etc/init.d/fireinfo start
516 sendprofile
517 ) >/dev/null 2>&1 &
518
519 # Update Package list for addon installation
520 /opt/pakfire/pakfire update -y --force
521
522 echo
523 echo Please wait until pakfire has ended...
524 echo
525 #Don't report the exitcode last command
526 exit 0
527