mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-02 05:43:02 +02:00
Joachim Wiberg
ed88a92fac
With the recent changes to confd to support: hostname format specifiers, $factory$ default keyword for password, and on-the-fly generation of the NETCONF SSH host keys, the system no longer depend on the very intricate confd gen-* scripts to create factory-config and failure-config. This patch set adds support for detecting and installing product/vendor specific static factory-config and failure-config files. See the confd README for details. To facilitate generation, e.g., of the NETCONF SSH host keys, the confd daemon must be running when bootstrapping the first startup-config from eithe generated or static factory-config. This is why the bootstrap and load helper scripts have been changed. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
107 lines
2.4 KiB
Bash
Executable File
107 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# load [-b] <startup-config | failure-config>
|
|
#
|
|
# Import a configuration to the sysrepo datastore using `sysrepocfg -Ifile`
|
|
#
|
|
# If the '-b' option is used we set the Finit <usr/bootstrap> condition if
|
|
# sysrepocfg returns OK. This to be able to detect and trigger the Infix
|
|
# Fail Secure Mode at boot.
|
|
#
|
|
|
|
banner_append()
|
|
{
|
|
printf "\n$@\n" | tee -a \
|
|
/etc/banner \
|
|
/etc/issue \
|
|
/etc/issue.net \
|
|
>/dev/null
|
|
return 0
|
|
}
|
|
|
|
# Ensure correct ownership and permissions, in particular after factory reset
|
|
# Created by the system, writable by any user in the admin group.
|
|
perms()
|
|
{
|
|
chown root:wheel "$1"
|
|
chmod 0660 "$1"
|
|
}
|
|
|
|
note()
|
|
{
|
|
logger -s -I $$ -p user.notice -t load "$*"
|
|
}
|
|
|
|
err()
|
|
{
|
|
logger -s -I $$ -p user.error -t load "$*"
|
|
}
|
|
|
|
|
|
# shellcheck disable=SC1091
|
|
. /etc/confdrc
|
|
|
|
config=$1
|
|
if [ -f "$config" ]; then
|
|
fn="$config"
|
|
else
|
|
if [ -f "$CFG_PATH_/${config}.cfg" ]; then
|
|
fn="$CFG_PATH_/${config}.cfg"
|
|
else
|
|
fn="$SYS_PATH_/${config}.cfg"
|
|
fi
|
|
fi
|
|
|
|
if [ ! -f "$fn" ]; then
|
|
case "$config" in
|
|
startup-config)
|
|
note "startup-config missing, initializing running datastore from factory-config"
|
|
sysrepocfg -C factory-default
|
|
rc=$?
|
|
note "saving factory-config to $STARTUP_CFG ..."
|
|
sysrepocfg -f json -X"$STARTUP_CFG"
|
|
perms "$STARTUP_CFG"
|
|
exit $rc
|
|
;;
|
|
*)
|
|
err "No such file, $fn, aborting!"
|
|
exit 1
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
note "Loading $config ..."
|
|
if ! sysrepocfg -v3 -I"$fn" -f json; then
|
|
case "$config" in
|
|
startup-config)
|
|
err "Failed loading $fn, reverting to Fail Secure mode!"
|
|
# On failure to load startup-config the system is in an undefined state
|
|
cat <<-EOF >/tmp/factory.json
|
|
{
|
|
"infix-factory-default:factory-default": {}
|
|
}
|
|
EOF
|
|
# Default timeout is 2 seconds, allow time to clean up shm
|
|
if ! sysrepocfg -f json -t 10 -R /tmp/factory.json; then
|
|
rm -f /etc/sysrepo/data/*startup*
|
|
rm -f /etc/sysrepo/data/*running*
|
|
rm -f /dev/shm/sr_*
|
|
killall sysrepo-plugind
|
|
fi
|
|
;;
|
|
failure-config)
|
|
err "Failed loading $fn, aborting!"
|
|
banner_append "CRITICAL ERROR: Logins are disabled, no credentials available"
|
|
initctl -nbq runlevel 9
|
|
;;
|
|
esac
|
|
|
|
exit 1
|
|
fi
|
|
|
|
note "Loaded $fn successfully."
|
|
if [ "$config" = "failure-config" ]; then
|
|
banner_append "ERROR: Corrupt startup-config, system has reverted to default login credentials"
|
|
else
|
|
perms "$fn"
|
|
fi
|