From 3e48af6c369b19b9059d4f5f973e876ba60cdcd5 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 5 Oct 2023 07:44:38 +0200 Subject: [PATCH] confd: relocate auto-factory templates and prepare fail secure mode The template and scripts for generating per-device factory-config have been spread out across the repo. This is an attempt to gather all the pieces to a single location for better overview. Parts of factory-config will be reused for the new fail secure mode, in the file failure-config. The beginnings of which are in this commit. Other changes: - cfg-bootstrap and confd-bootstrap have been collapsed into one - let gen-hostname + gen-interfaces save to /cfg instead of /etc, we've moved the /etc directory to read-only storage in /usr/share - delay start of bootstrap and sysrepo-plugind after syslogd barrier - set 'norestart' when loading startup-confg and failure-config, no point in retrying if that fails, just go to error immediately Signed-off-by: Joachim Wiberg --- board/netconf/rootfs/lib/infix/cfg-bootstrap | 35 ---------------- package/confd/sysrepo.conf | 15 ++++--- src/confd/Makefile.am | 4 +- .../{confd-bootstrap.sh => bin/bootstrap} | 40 ++++++++++++++++--- .../factory => src/confd/bin}/gen-hostkeys | 0 .../factory => src/confd/bin}/gen-hostname | 0 .../factory => src/confd/bin}/gen-interfaces | 0 src/confd/{confd-load.sh => bin/load} | 1 - src/confd/configure.ac | 3 ++ src/confd/share/Makefile.am | 2 + src/confd/share/README | 1 + .../share/factory}/10-authentication.json | 0 .../confd/share/factory}/10-nacm.json | 0 .../share/factory}/10-netconf-server.json | 0 .../confd/share/factory}/10-system.json | 0 src/confd/share/factory/Makefile.am | 2 + .../share/failure/10-authentication.json | 13 ++++++ src/confd/share/failure/10-nacm.json | 1 + .../share/failure/10-netconf-server.json | 1 + src/confd/share/failure/10-system.json | 11 +++++ src/confd/share/failure/Makefile.am | 2 + 21 files changed, 83 insertions(+), 48 deletions(-) delete mode 100755 board/netconf/rootfs/lib/infix/cfg-bootstrap rename src/confd/{confd-bootstrap.sh => bin/bootstrap} (77%) rename {board/netconf/rootfs/lib/infix/factory => src/confd/bin}/gen-hostkeys (100%) rename {board/netconf/rootfs/lib/infix/factory => src/confd/bin}/gen-hostname (100%) rename {board/netconf/rootfs/lib/infix/factory => src/confd/bin}/gen-interfaces (100%) rename src/confd/{confd-load.sh => bin/load} (96%) create mode 100644 src/confd/share/Makefile.am create mode 100644 src/confd/share/README rename {board/netconf/rootfs/etc/auto-factory.d => src/confd/share/factory}/10-authentication.json (100%) rename {board/netconf/rootfs/etc/auto-factory.d => src/confd/share/factory}/10-nacm.json (100%) rename {board/netconf/rootfs/etc/auto-factory.d => src/confd/share/factory}/10-netconf-server.json (100%) rename {board/netconf/rootfs/etc/auto-factory.d => src/confd/share/factory}/10-system.json (100%) create mode 100644 src/confd/share/factory/Makefile.am create mode 100644 src/confd/share/failure/10-authentication.json create mode 120000 src/confd/share/failure/10-nacm.json create mode 120000 src/confd/share/failure/10-netconf-server.json create mode 100644 src/confd/share/failure/10-system.json create mode 100644 src/confd/share/failure/Makefile.am diff --git a/board/netconf/rootfs/lib/infix/cfg-bootstrap b/board/netconf/rootfs/lib/infix/cfg-bootstrap deleted file mode 100755 index 8749ea76..00000000 --- a/board/netconf/rootfs/lib/infix/cfg-bootstrap +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/sh -set -e - -PATH=/lib/infix/factory:$PATH - -[ "$FACTORY_D" ] || FACTORY_D=/etc/auto-factory.d -[ "$CFG_D" ] || CFG_D=/cfg -[ "$GENCFG_D" ] || GENCFG_D=/cfg/factory.d -mkdir -p $GENCFG_D - -gen-hostname >$FACTORY_D/20-auto-hostname.json -gen-interfaces >$FACTORY_D/20-auto-interfaces.json - -[ -s $GENCFG_D/20-auto-hostkey.json ] || gen-hostkeys >$GENCFG_D/20-auto-hostkey.json - -# Allow regenerating default factory-config, but keep it read-ony -# to prevent it from being overwritten by mistake by users. -rm -f $CFG_D/auto-factory-config.cfg -# shellcheck disable=SC2046 -jq -s 'reduce .[] as $item ({}; . * $item)' \ - $(find $FACTORY_D -name '*.json') \ - $(find $GENCFG_D -name '*.json') \ - >$CFG_D/auto-factory-config.cfg -chmod 444 $CFG_D/auto-factory-config.cfg - -# TODO: Look for statically defined factory-config, based on the -# system's product ID. - -# If we haven't found a better one, settle for auto-factory-config as -# the system's factory-config. -[ -h $CFG_D/factory-config.cfg ] || \ - ln -sf auto-factory-config.cfg $CFG_D/factory-config.cfg - -# Bootstrap sysrepo db with all modules required by confd -/usr/libexec/confd/confd-bootstrap.sh $CFG_D/factory-config.cfg $CFG_D/startup-config.cfg diff --git a/package/confd/sysrepo.conf b/package/confd/sysrepo.conf index f12904a9..184d69cd 100644 --- a/package/confd/sysrepo.conf +++ b/package/confd/sysrepo.conf @@ -1,16 +1,21 @@ #set DEBUG=1 -run name:bootstrap log:prio:user.notice \ - [S] /lib/infix/cfg-bootstrap -- Bootstrapping YANG models +run name:bootstrap log:prio:user.notice \ + [S] /usr/libexec/confd/bootstrap -- Bootstrapping YANG datastore -service name:sysrepo log \ +service name:sysrepo log \ [S12345789] sysrepo-plugind -f -p /run/sysrepo.pid -n -v3 -- Configuration daemon # Bootstrap system with startup-config -run name:startup log:prio:user.notice \ - [S] /usr/libexec/confd/confd-load.sh -b startup-config \ +run name:startup log:prio:user.notice norestart \ + [S] /usr/libexec/confd/load -b startup-config \ -- Loading startup-config +# Run if loading startup-config fails for some reason +run name:failure log:prio:user.critical norestart if: \ + [S] /usr/libexec/confd/load failure-config \ + -- Loading failure-config + service name:netopeer log \ [12345789] netopeer2-server -F -t 60 \ -- NETCONF server diff --git a/src/confd/Makefile.am b/src/confd/Makefile.am index 33fa7833..4962e440 100644 --- a/src/confd/Makefile.am +++ b/src/confd/Makefile.am @@ -1,5 +1,5 @@ -SUBDIRS = src yang +SUBDIRS = src yang share dist_doc_DATA = README.md LICENSE -pkglibexec_SCRIPTS = confd-bootstrap.sh confd-load.sh +pkglibexec_SCRIPTS = $(wildcard bin/*) DISTCLEANFILES = *~ *.d ACLOCAL_AMFLAGS = -I m4 diff --git a/src/confd/confd-bootstrap.sh b/src/confd/bin/bootstrap similarity index 77% rename from src/confd/confd-bootstrap.sh rename to src/confd/bin/bootstrap index 5dbd7aee..a36bb737 100755 --- a/src/confd/confd-bootstrap.sh +++ b/src/confd/bin/bootstrap @@ -1,4 +1,6 @@ #!/bin/sh +# Bootstrap sysrepo db with all modules required by confd +# # 1. Load all yang models with /cfg/factory-config # 2. [ if /cfg/startup-config is missing :: copy {factory} -> /cfg/startup-config ] # 3. Import /cfg/startup -> {startup} ] @@ -9,14 +11,42 @@ # It's all really simple ... this script takes care of 1-4 # -FACTORY=$1 -STARTUP=$2 +PATH=/usr/libexec/confd/:$PATH INIT_DATA=/etc/sysrepo/factory-default.json SEARCH=/usr/share/yang/modules/confd:/usr/share/yang/modules/libnetconf2:/usr/share/yang/modules/libyang:/usr/share/yang/modules/netopeer2:/usr/share/yang/modules/sysrepo -if [ -z "$FACTORY" -o -z "$STARTUP" ]; then - echo "Missing argument to sysrepo-bootstrap.sh $FACTORY $STARTUP" - exit 1 +[ "$FACTORY_D" ] || FACTORY_D=/usr/share/confd/factory +[ "$CFG_D" ] || CFG_D=/cfg +[ "$GENCFG_D" ] || GENCFG_D=/cfg/factory.d + +FACTORY=$CFG_D/factory-config.cfg +STARTUP=$CFG_D/startup-config.cfg + +# Generate device's factory-config at first boot +if [ ! -d "$GENCFG_D" ]; then + mkdir -p $GENCFG_D + + gen-hostname >$GENCFG_D/20-auto-hostname.json + gen-interfaces >$GENCFG_D/20-auto-interfaces.json + + [ -s $GENCFG_D/20-auto-hostkey.json ] || gen-hostkeys >$GENCFG_D/20-auto-hostkey.json + + # Allow regenerating default factory-config, but keep it read-ony + # to prevent it from being overwritten by mistake by users. + rm -f $CFG_D/auto-factory-config.cfg + # shellcheck disable=SC2046 + jq -s 'reduce .[] as $item ({}; . * $item)' \ + $(find $FACTORY_D -name '*.json') \ + $(find $GENCFG_D -name '*.json') \ + >$CFG_D/auto-factory-config.cfg + chmod 444 $CFG_D/auto-factory-config.cfg + + # TODO: Look for statically defined factory-config, based on the + # system's product ID, or just custom site-specific factory. + + # If we haven't found a better one, settle for auto-factory-config as + # the system's factory-config. + [ -h $FACTORY ] || ln -sf auto-factory-config.cfg $FACTORY fi # Drop all pre-initialized data from netopeer2 install, then re-create diff --git a/board/netconf/rootfs/lib/infix/factory/gen-hostkeys b/src/confd/bin/gen-hostkeys similarity index 100% rename from board/netconf/rootfs/lib/infix/factory/gen-hostkeys rename to src/confd/bin/gen-hostkeys diff --git a/board/netconf/rootfs/lib/infix/factory/gen-hostname b/src/confd/bin/gen-hostname similarity index 100% rename from board/netconf/rootfs/lib/infix/factory/gen-hostname rename to src/confd/bin/gen-hostname diff --git a/board/netconf/rootfs/lib/infix/factory/gen-interfaces b/src/confd/bin/gen-interfaces similarity index 100% rename from board/netconf/rootfs/lib/infix/factory/gen-interfaces rename to src/confd/bin/gen-interfaces diff --git a/src/confd/confd-load.sh b/src/confd/bin/load similarity index 96% rename from src/confd/confd-load.sh rename to src/confd/bin/load index f2b42f81..0f3e90ef 100755 --- a/src/confd/confd-load.sh +++ b/src/confd/bin/load @@ -29,7 +29,6 @@ fi if ! sysrepocfg -v3 -I"$fn" -f json; then if eval $bootstrap; then logger -sik -p user.error "Failed bootstrapping system, reverting to Fail Secure mode!" - initctl -nbq cond set fail-startup initctl -nbq runlevel 9 else logger -sik -p user.error "Failed loading $fn, aborting!" diff --git a/src/confd/configure.ac b/src/confd/configure.ac index 16533f14..be8c038a 100644 --- a/src/confd/configure.ac +++ b/src/confd/configure.ac @@ -5,6 +5,9 @@ AM_SILENT_RULES(yes) AC_CONFIG_FILES([ Makefile + share/Makefile + share/factory/Makefile + share/failure/Makefile src/Makefile yang/Makefile ]) diff --git a/src/confd/share/Makefile.am b/src/confd/share/Makefile.am new file mode 100644 index 00000000..062eb49c --- /dev/null +++ b/src/confd/share/Makefile.am @@ -0,0 +1,2 @@ +SUBDIRS = factory failure +pkgdata_DATA = $(wildcard share/*) diff --git a/src/confd/share/README b/src/confd/share/README new file mode 100644 index 00000000..c95b7e26 --- /dev/null +++ b/src/confd/share/README @@ -0,0 +1 @@ +Templates for generating device-specific factory-config and failure-config. diff --git a/board/netconf/rootfs/etc/auto-factory.d/10-authentication.json b/src/confd/share/factory/10-authentication.json similarity index 100% rename from board/netconf/rootfs/etc/auto-factory.d/10-authentication.json rename to src/confd/share/factory/10-authentication.json diff --git a/board/netconf/rootfs/etc/auto-factory.d/10-nacm.json b/src/confd/share/factory/10-nacm.json similarity index 100% rename from board/netconf/rootfs/etc/auto-factory.d/10-nacm.json rename to src/confd/share/factory/10-nacm.json diff --git a/board/netconf/rootfs/etc/auto-factory.d/10-netconf-server.json b/src/confd/share/factory/10-netconf-server.json similarity index 100% rename from board/netconf/rootfs/etc/auto-factory.d/10-netconf-server.json rename to src/confd/share/factory/10-netconf-server.json diff --git a/board/netconf/rootfs/etc/auto-factory.d/10-system.json b/src/confd/share/factory/10-system.json similarity index 100% rename from board/netconf/rootfs/etc/auto-factory.d/10-system.json rename to src/confd/share/factory/10-system.json diff --git a/src/confd/share/factory/Makefile.am b/src/confd/share/factory/Makefile.am new file mode 100644 index 00000000..10bdeaea --- /dev/null +++ b/src/confd/share/factory/Makefile.am @@ -0,0 +1,2 @@ +factorydir = $(pkgdatadir)/factory +factory_DATA = $(wildcard *.json) diff --git a/src/confd/share/failure/10-authentication.json b/src/confd/share/failure/10-authentication.json new file mode 100644 index 00000000..60935073 --- /dev/null +++ b/src/confd/share/failure/10-authentication.json @@ -0,0 +1,13 @@ +{ + "ietf-system:system": { + "authentication": { + "user": [ + { + "name": "admin", + "password": "$6$bKPp6xu45L1cmp70$fcwDhGZct4q8LxwPASf9iVHyWqnklcdjeYi/SupLo1K9nb.aAQUz48.3qTcW38XL6gQzfHyGoyeDG2orjPUwm1", + "infix-system:shell": "infix-shell-type:bash" + } + ] + } + } +} diff --git a/src/confd/share/failure/10-nacm.json b/src/confd/share/failure/10-nacm.json new file mode 120000 index 00000000..a0601992 --- /dev/null +++ b/src/confd/share/failure/10-nacm.json @@ -0,0 +1 @@ +../factory/10-nacm.json \ No newline at end of file diff --git a/src/confd/share/failure/10-netconf-server.json b/src/confd/share/failure/10-netconf-server.json new file mode 120000 index 00000000..82d0dcb7 --- /dev/null +++ b/src/confd/share/failure/10-netconf-server.json @@ -0,0 +1 @@ +../factory/10-netconf-server.json \ No newline at end of file diff --git a/src/confd/share/failure/10-system.json b/src/confd/share/failure/10-system.json new file mode 100644 index 00000000..e50edc51 --- /dev/null +++ b/src/confd/share/failure/10-system.json @@ -0,0 +1,11 @@ +{ + "ietf-system:system": { + "hostname": "failure" + }, + "ieee802-dot1ab-lldp:lldp": { + "infix-lldp:enabled": true + }, + "infix-services:mdns": { + "enabled": true + } +} diff --git a/src/confd/share/failure/Makefile.am b/src/confd/share/failure/Makefile.am new file mode 100644 index 00000000..3c0310ed --- /dev/null +++ b/src/confd/share/failure/Makefile.am @@ -0,0 +1,2 @@ +failuredir = $(pkgdatadir)/failure +failure_DATA = $(wildcard *.json)