mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 04:33:00 +02:00
267 lines
9.8 KiB
Bash
Executable File
267 lines
9.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# Bootstrap system factory-config, failure-config and sysrepo db.
|
|
#
|
|
########################################################################
|
|
# The system factory-config and failure-config are derived from default
|
|
# settings snippets, from /usr/share/confd/factory.d, and some generated
|
|
# snippets, e.g., device unique password, hostname (based on base MAC
|
|
# address), and number of interfaces.
|
|
#
|
|
# The resulting factory-config is used to create the syrepo db (below)
|
|
# {factory} datastore. Hence, the factory-config file must match the
|
|
# the YANG models of the active image.
|
|
########################################################################
|
|
# NOTE: with the Infix defaults, a br2-external can provide a build-time
|
|
# /etc/factory-config.cfg to override the behavior of this script.
|
|
#
|
|
# This applies also for /etc/failure-config.cfg, but we recommend
|
|
# strongly that you instead provide gen-err-custom, see below.
|
|
#
|
|
# TODO: Look for statically defined factory-config, based on system's
|
|
# product ID, or just custom site-specific factory on /cfg.
|
|
########################################################################
|
|
STATUS=""
|
|
|
|
# When logging errors, generating /etc/issue* or /etc/banner (SSH)
|
|
. /etc/os-release
|
|
|
|
# /etc/confdrc controls the behavior or most of the gen-scripts,
|
|
# customize in an overlay when using Infix as an br2-external.
|
|
RC=/etc/confdrc
|
|
if [ "$1" = "-f" ] && [ -f "$2" ]; then
|
|
RC=$2
|
|
fi
|
|
|
|
if [ ! -f "$RC" ]; then
|
|
logger -sik -p user.error -t bootstrap "Missing rc file $RC" 2>/dev/null \
|
|
|| echo "Missing rc file $RC"
|
|
exit 99
|
|
fi
|
|
|
|
# shellcheck disable=SC1090
|
|
. "$RC"
|
|
|
|
# Gather all .json files in $dir, sort them numerically, and use jq
|
|
# magic to create a configuration file without duplicates. Allowing
|
|
# overrides of the Infix defaults in a br2-external.
|
|
#
|
|
# 10-foo.json -- Static Infix default
|
|
# 20-bar.json -- Generated Infix bar
|
|
# 30-config.json -- By br2-external provided gen-cfg-custom
|
|
# 30-foo.json -- Static br2-external replacing 10-foo.json
|
|
#
|
|
# Note: to override just the base hostname, used in gen-hostname, set
|
|
# BR2_TARGET_GENERIC_HOSTNAME in your br2-external's defconfig.
|
|
#
|
|
# shellcheck disable=SC2046,SC2086
|
|
collate()
|
|
{
|
|
gen=$1; shift
|
|
cfg=$1; shift
|
|
dir=$1
|
|
|
|
rm -f "$gen"
|
|
jq -s 'reduce .[] as $item ({}; . * $item)' $(find $dir -name '*.json' | sort) >"$gen"
|
|
chmod 444 "$gen"
|
|
|
|
if [ ! -f "$cfg" ]; then
|
|
cp "$gen" "$cfg"
|
|
fi
|
|
}
|
|
|
|
# Report error on console, syslog, and set login banners for getty + ssh
|
|
console_error()
|
|
{
|
|
logger -p user.crit -t bootstrap "$1"
|
|
|
|
# shellcheck disable=SC3037
|
|
/bin/echo -e "\n\n\e[31mCRITICAL BOOTSTRAP ERROR\n$1\e[0m\n" > /dev/console
|
|
|
|
[ -z "$STATUS" ] || return
|
|
STATUS="CRITICAL ERROR: $1"
|
|
|
|
printf "\n$STATUS\n" | tee -a \
|
|
/etc/banner \
|
|
/etc/issue \
|
|
/etc/issue.net \
|
|
>/dev/null
|
|
return 0
|
|
}
|
|
|
|
factory()
|
|
{
|
|
gen=$1
|
|
|
|
# Fetch defaults, simplifies sort in collate()
|
|
cp "$FACTORY_DEFAULTS_D"/* "$FACTORY_D/"
|
|
|
|
# Create an overlay for /etc/hostname to change the default in an br2-external
|
|
gen-hostname >"$FACTORY_D/20-hostname.json"
|
|
gen-motd >"$FACTORY_D/20-motd.json"
|
|
gen-hardware >"$FACTORY_D/20-hardware.json"
|
|
# shellcheck disable=SC2086
|
|
gen-interfaces $GEN_IFACE_OPTS >"$FACTORY_D/20-interfaces.json"
|
|
|
|
# Extract password for admin user from VPD
|
|
if ! gen-admin-auth infix-shell-type:bash >"$FACTORY_D/20-authentication.json"; then
|
|
console_error "Unable to create factory-config, gen-admin-auth failed"
|
|
return
|
|
fi
|
|
|
|
[ -s "$FACTORY_D/20-hostkey.json" ] || gen-hostkeys >"$FACTORY_D/20-hostkey.json"
|
|
|
|
# Optional commands (from an overlay) to run for br2-externals
|
|
[ -x "$(command -v gen-ifs-custom)" ] && gen-ifs-custom >"$FACTORY_D/20-interfaces.json"
|
|
[ -x "$(command -v gen-cfg-custom)" ] && gen-cfg-custom >"$FACTORY_D/30-config.json"
|
|
|
|
collate "$FACTORY_GEN" "$FACTORY_CFG" "$FACTORY_D"
|
|
}
|
|
|
|
failure()
|
|
{
|
|
gen=$1
|
|
|
|
# Fetch defaults, simplifies sort in collate()
|
|
cp "$FAILURE_DEFAULTS_D"/* "$FAILURE_D"
|
|
|
|
gen-hostname "$FAIL_HOSTNAME" >"$FAILURE_D/20-hostname.json"
|
|
gen-interfaces >"$FAILURE_D/20-interfaces.json"
|
|
|
|
# Same password as factory-config, but another login shell
|
|
if ! gen-admin-auth infix-shell-type:bash >"$FAILURE_D/20-authentication.json"; then
|
|
console_error "Invalid password hash in vital product data, failure-config incomplete!"
|
|
fi
|
|
|
|
[ -s "$FAILURE_D/20-hostkey.json" ] || gen-hostkeys >"$FAILURE_D/20-hostkey.json"
|
|
|
|
# Optional failure/error config to generate (or override) for br2-externals
|
|
[ -x "$(command -v gen-err-custom)" ] && gen-err-custom >"$FAILURE_D/30-error.json"
|
|
|
|
collate "$FAILURE_GEN" "$FAILURE_CFG" "$FAILURE_D"
|
|
}
|
|
|
|
factory "$FACTORY_GEN"
|
|
failure "$FAILURE_GEN"
|
|
|
|
if [ -n "$TESTING" ]; then
|
|
echo "Done."
|
|
exit 0
|
|
fi
|
|
|
|
# Drop all pre-initialized data from netopeer2 install, then re-create
|
|
# with required netopeer2 models, sysrepo implicitly installs its own,
|
|
# and then we initialize it all with our factory defaults.
|
|
rm -rf /etc/sysrepo/* /dev/shm/sr_*
|
|
mkdir -p /etc/sysrepo/
|
|
if [ -f "$FACTORY_CFG" ]; then
|
|
cp "$FACTORY_CFG" "$INIT_DATA"
|
|
else
|
|
cp "$FAILURE_CFG" "$INIT_DATA"
|
|
fi
|
|
|
|
sysrepoctl -s $SEARCH \
|
|
-i ietf-system@2014-08-06.yang -g wheel -p 0660 \
|
|
-e authentication \
|
|
-e local-users \
|
|
-e ntp \
|
|
-e ntp-udp-port \
|
|
-e timezone-name \
|
|
-i iana-timezones@2013-11-19.yang -g wheel -p 0660 \
|
|
-i nc-notifications@2008-07-14.yang -g wheel -p 0660 \
|
|
-i notifications@2008-07-14.yang -g wheel -p 0660 \
|
|
-i ietf-keystore@2019-07-02.yang -g wheel -p 0660 \
|
|
-e keystore-supported \
|
|
-e local-definitions-supported \
|
|
-e key-generation \
|
|
-i ietf-truststore@2019-07-02.yang -g wheel -p 0660 \
|
|
-e truststore-supported \
|
|
-e x509-certificates \
|
|
-i ietf-tcp-common@2019-07-02.yang -g wheel -p 0660 \
|
|
-e keepalives-supported \
|
|
-i ietf-ssh-server@2019-07-02.yang -g wheel -p 0660 \
|
|
-e local-client-auth-supported \
|
|
-i ietf-tls-server@2019-07-02.yang -g wheel -p 0660 \
|
|
-e local-client-auth-supported \
|
|
-i ietf-netconf-server@2019-07-02.yang -g wheel -p 0660 \
|
|
-e ssh-listen \
|
|
-e tls-listen \
|
|
-e ssh-call-home \
|
|
-e tls-call-home \
|
|
-i ietf-interfaces@2018-02-20.yang -g wheel -p 0660 \
|
|
-e if-mib \
|
|
-i ietf-ip@2018-02-22.yang -g wheel -p 0660 \
|
|
-e ipv6-privacy-autoconf \
|
|
-i ietf-network-instance@2019-01-21.yang -g wheel -p 0660 \
|
|
-i ietf-netconf-monitoring@2010-10-04.yang -g wheel -p 0660 \
|
|
-i ietf-netconf-nmda@2019-01-07.yang -g wheel -p 0660 \
|
|
-e origin \
|
|
-e with-defaults \
|
|
-i ietf-subscribed-notifications@2019-09-09.yang \
|
|
-g wheel -p 0660 \
|
|
-e encode-xml \
|
|
-e replay \
|
|
-e subtree \
|
|
-e xpath \
|
|
-i ietf-yang-push@2019-09-09.yang -g wheel -p 0660 \
|
|
-e on-change \
|
|
-i ietf-routing@2018-03-13.yang -g wheel -p 0660 \
|
|
-i ietf-ipv6-unicast-routing@2018-03-13.yang -g wheel -p 0660 \
|
|
-i ietf-ipv4-unicast-routing@2018-03-13.yang -g wheel -p 0660 \
|
|
-i ietf-ospf@2022-10-19.yang -g wheel -p 0660 \
|
|
-e bfd \
|
|
-e explicit-router-id \
|
|
-i iana-if-type@2023-01-26.yang -g wheel -p 0660 \
|
|
-i iana-hardware@2018-03-13.yang -g wheel -p 0660 \
|
|
-i ietf-hardware@2018-03-13.yang -g wheel -p 0660 \
|
|
-e hardware-state \
|
|
-i infix-hardware@2024-04-25.yang -g wheel -p 0660 \
|
|
-i ieee802-dot1q-types@2022-10-29.yang -g wheel -p 0660 \
|
|
-i infix-ip@2023-09-14.yang -g wheel -p 0660 \
|
|
-i infix-if-type@2024-01-29.yang -g wheel -p 0660 \
|
|
-i infix-routing@2024-03-06.yang -g wheel -p 0660 \
|
|
-i infix-interfaces@2024-01-15.yang -g wheel -p 0660 \
|
|
-e vlan-filtering \
|
|
-i ieee802-dot1ab-lldp@2022-03-15.yang -g wheel -p 0660 \
|
|
-i infix-lldp@2023-08-23.yang -g wheel -p 0660 \
|
|
-i infix-dhcp-client@2024-04-12.yang -g wheel -p 0660 \
|
|
-i infix-shell-type@2023-08-21.yang -g wheel -p 0660 \
|
|
-i infix-system@2024-04-12.yang -g wheel -p 0660 \
|
|
-i infix-services@2024-04-08.yang -g wheel -p 0660 \
|
|
-i ieee802-ethernet-interface@2019-06-21.yang -g wheel -p 0660 \
|
|
-i infix-ethernet-interface@2024-02-27.yang -g wheel -p 0660 \
|
|
-I "${INIT_DATA}"
|
|
rc=$?
|
|
|
|
# Unlike `sysrepoctl -i` the `-c` command requires separate invocations.
|
|
# NOTE: we ignore any errors from these at bootstrap since sysrepo may
|
|
# already enable some of these feature, resulting in error here.
|
|
# Enable features required by netopeer2
|
|
sysrepoctl -c ietf-netconf -g wheel -p 0660 \
|
|
-e writable-running \
|
|
-e candidate \
|
|
-e rollback-on-error \
|
|
-e validate \
|
|
-e startup \
|
|
-e url \
|
|
-e xpath \
|
|
-e confirmed-commit
|
|
# Allow wheel group users (admin) to modify NACM and do factory reset
|
|
sysrepoctl -c ietf-netconf-acm -g wheel -p 0660
|
|
sysrepoctl -c ietf-factory-default -g wheel -p 0660
|
|
sysrepoctl -c sysrepo-plugind -g wheel -p 0660
|
|
|
|
# On first boot, install factory-config as startup-config. Due to a
|
|
# limitation in sysrepo we cannot initialize ietf-netconf-acm, so we
|
|
# cheat, see sysrepo#3079
|
|
chgrp wheel /cfg
|
|
chmod g+w /cfg
|
|
if [ ! -f "$STARTUP_CFG" ]; then
|
|
sysrepocfg -f json -X"$STARTUP_CFG"
|
|
fi
|
|
|
|
# Clear running-config so we can load startup in the next step
|
|
echo "{}" > "$INIT_DATA"
|
|
sysrepocfg -f json -I"$INIT_DATA" -d running
|
|
|
|
exit $rc
|