:xMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch-to-libloc

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

src/initscripts/helper/aws-setup

@@ -6,6 +6,9 @@
 # Set PATH to find our own executables
 export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
 
+# AWS supports an MTU of up to 9001 bytes
+DEFAULT_MTU=9001
+
 get() {
 	local file="${1}"
 
@@ -167,6 +170,7 @@ import_aws_configuration() {
 					echo "RED_NETMASK=${netmask}"
 					echo "RED_NETADDRESS=${netaddress}"
 					echo "RED_BROADCAST=${broadcast}"
+					echo "RED_MTU=1500"
 					echo "DEFAULT_GATEWAY=${gateway}"
 				) >> /var/ipfire/ethernet/settings
 
@@ -188,6 +192,7 @@ import_aws_configuration() {
 					echo "GREEN_NETMASK=${netmask}"
 					echo "GREEN_NETADDRESS=${netaddress}"
 					echo "GREEN_BROADCAST=${broadcast}"
+					echo "GREEN_MTU=${DEFAULT_MTU}"
 				) >> /var/ipfire/ethernet/settings
 				;;
 
@@ -204,6 +209,7 @@ import_aws_configuration() {
 					echo "ORANGE_NETMASK=${netmask}"
 					echo "ORANGE_NETADDRESS=${netaddress}"
 					echo "ORANGE_BROADCAST=${broadcast}"
+					echo "ORANGE_MTU=${DEFAULT_MTU}"
 				) >> /var/ipfire/ethernet/settings
 				;;
 		esac

src/initscripts/helper/gcp-setup

@@ -0,0 +1,292 @@
+#!/bin/bash
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+# Set PATH to find our own executables
+export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
+
+# GCP only supports an MTU of 1460
+DEFAULT_MTU=1460
+
+get() {
+	local file="${1}"
+
+	wget --header="Metadata-Flavor: Google" -qO - "http://169.254.169.254/computeMetadata/v1/${file}"
+}
+
+to_address() {
+	local n="${1}"
+
+	local o1=$(( (n & 0xff000000) >> 24 ))
+	local o2=$(( (n & 0xff0000) >> 16 ))
+	local o3=$(( (n & 0xff00) >> 8 ))
+	local o4=$(( (n & 0xff) ))
+
+	printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
+}
+
+to_integer() {
+	local address="${1}"
+
+	local integer=0
+
+	local i
+	for i in ${address//\./ }; do
+		integer=$(( (integer << 8) + i ))
+	done
+
+	printf "%d\n" "${integer}"
+}
+
+prefix2netmask() {
+	local prefix=${1}
+
+	local zeros=$(( 32 - prefix ))
+	local netmask=0
+
+	local i
+	for (( i=0; i<${zeros}; i++ )); do
+		netmask=$(( (netmask << 1) ^ 1 ))
+	done
+
+	to_address "$(( netmask ^ 0xffffffff ))"
+}
+
+import_gcp_configuration() {
+	local instance_id="$(get instance/id)"
+
+	boot_mesg "Importing Google Compute Platform configuration for instance ${instance_id}..."
+
+	# Store instance ID
+	echo "${instance_id}" > /var/run/gcp-instance-id
+
+	# Initialise system settings
+	local hostname=$(get instance/hostname)
+
+	# Set hostname
+	if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
+		echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
+	fi
+
+	# Set domainname
+	if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
+		echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
+	fi
+
+	# Create setup user
+	if ! getent passwd setup &>/dev/null; then
+		useradd setup -s /usr/bin/run-setup -g nobody -m
+
+		# Unlock the account
+		usermod -p "x" setup
+	fi
+
+	# Import SSH keys for setup user
+	local line
+	while read -r line; do
+		# Strip the username part from the key
+		local key="${line#*:}"
+
+		if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev/null; then
+			mkdir -p "/home/setup/.ssh"
+			chmod 700 "/home/setup/.ssh"
+			chown setup.nobody "/home/setup/.ssh"
+
+			echo "${key}" >> "/home/setup/.ssh/authorized_keys"
+			chmod 600 "/home/setup/.ssh/authorized_keys"
+			chown setup.nobody "/home/setup/.ssh/authorized_keys"
+		fi
+	done <<<"$(get instance/attributes/ssh-keys)"
+
+	# Download the user-data script only on the first boot
+	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
+		# Download a startup script
+		local script="$(get instance/attributes/startup-script)"
+
+		# Execute the script
+		if [ "${script:0:2}" = "#!" ]; then
+			echo "${script}" > /tmp/gcp-startup.script
+			chmod 700 /tmp/gcp-startup.script
+
+			# Run the script
+			local now="$(date -u +"%s")"
+			/tmp/gcp-startup.script &>/var/log/startup-script.log.${now}
+
+			# Delete the script right away
+			rm /tmp/gcp-startup.script
+		fi
+	fi
+
+	# Import network configuration
+	# After this, no network connectivity will be available from this script due to the
+	# renaming of the network interfaces for which they have to be shut down
+	local config_type=1
+	: > /var/ipfire/ethernet/settings
+
+	local device_number
+	for device_number in $(get instance/network-interfaces/); do
+		# Remove trailing slash
+		device_number="${device_number//\//}"
+
+		local mac="$(get "instance/network-interfaces/${device_number}/mac")"
+
+		# XXX TODO read the MTU because Google seems to only support 1460
+
+		# First IPv4 address
+		local ipv4_address="$(get "instance/network-interfaces/${device_number}/ip")"
+		local ipv4_address_num="$(to_integer "${ipv4_address}")"
+
+		local netmask="$(get "instance/network-interfaces/${device_number}/subnetmask")"
+		local netmask_num="$(to_integer "${netmask}")"
+
+		# Calculate the network and broadcast addresses
+		local netaddress="$(to_address $(( ipv4_address_num & netmask_num )))"
+		local broadcast="$(to_address $(( ipv4_address_num | (0xffffffff ^ netmask_num) )))"
+
+		case "${device_number}" in
+			# RED
+			0)
+				local interface_name="red0"
+				local gateway="$(get instance/network-interfaces/${device_number}/gateway)"
+
+				(
+					echo "RED_TYPE=STATIC"
+					echo "RED_DEV=${interface_name}"
+					echo "RED_MACADDR=${mac}"
+					echo "RED_DESCRIPTION='${interface_id}'"
+					echo "RED_ADDRESS=${ipv4_address}"
+					echo "RED_NETMASK=${netmask}"
+					echo "RED_NETADDRESS=${netaddress}"
+					echo "RED_BROADCAST=${broadcast}"
+					echo "RED_MTU=${DEFAULT_MTU}"
+					echo "DEFAULT_GATEWAY=${gateway}"
+				) >> /var/ipfire/ethernet/settings
+
+				# Import aliases for RED
+				for alias in $(get "instance/network-interfaces/${device_number}/ip-aliases"); do
+					echo "${alias},on,"
+				done > /var/ipfire/ethernet/aliases
+				;;
+
+			# GREEN
+			1)
+				local interface_name="green0"
+
+				(
+					echo "GREEN_DEV=${interface_name}"
+					echo "GREEN_MACADDR=${mac}"
+					echo "GREEN_DESCRIPTION='${interface_id}'"
+					echo "GREEN_ADDRESS=${ipv4_address}"
+					echo "GREEN_NETMASK=${netmask}"
+					echo "GREEN_NETADDRESS=${netaddress}"
+					echo "GREEN_BROADCAST=${broadcast}"
+					echo "GREEN_MTU=${DEFAULT_MTU}"
+				) >> /var/ipfire/ethernet/settings
+				;;
+
+			# ORANGE
+			2)
+				local interface_name="orange0"
+				config_type=2
+
+				(
+					echo "ORANGE_DEV=${interface_name}"
+					echo "ORANGE_MACADDR=${mac}"
+					echo "ORANGE_DESCRIPTION='${interface_id}'"
+					echo "ORANGE_ADDRESS=${ipv4_address}"
+					echo "ORANGE_NETMASK=${netmask}"
+					echo "ORANGE_NETADDRESS=${netaddress}"
+					echo "ORANGE_BROADCAST=${broadcast}"
+					echo "ORANGE_MTU=${DEFAULT_MTU}"
+				) >> /var/ipfire/ethernet/settings
+				;;
+		esac
+	done
+
+	# Save CONFIG_TYPE
+	echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
+
+	# Actions performed only on the very first start
+	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
+		# Disable using ISP nameservers
+		sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings
+
+		# Enable SSH
+		sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
+
+		# Disable SSH password authentication
+		sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
+
+		# Enable SSH key authentication
+		sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
+
+		# Apply SSH settings
+		/usr/local/bin/sshctrl
+
+		# Mark SSH to start immediately (but not right now)
+		touch /var/ipfire/remote/enablessh
+		chown nobody:nobody /var/ipfire/remote/enablessh
+
+		# Firewall rules for SSH and WEBIF
+		(
+			echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
+			echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
+		) >> /var/ipfire/firewall/input
+
+		# This script has now completed the first steps of setup
+		touch /var/ipfire/main/firstsetup_ok
+	fi
+
+	# All done
+	echo_ok
+}
+
+case "${reason}" in
+	PREINIT)
+		# Bring up the interface
+		ip link set "${interface}" up
+		;;
+
+	BOUND|RENEW|REBIND|REBOOT)
+		# Remove any previous IP addresses
+		ip addr flush dev "${interface}"
+
+		# Add (or re-add) the new IP address
+		ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
+
+		# Add the default route
+		ip route add "${new_routers}" dev "${interface}"
+		ip route add default via "${new_routers}"
+
+		# Setup DNS
+		for domain_name_server in ${new_domain_name_servers}; do
+			echo "nameserver ${domain_name_server}"
+		done > /etc/resolv.conf
+
+		# The system is online now
+		touch /var/ipfire/red/active
+
+		# Import GCP configuration
+		import_gcp_configuration
+		;;
+
+	EXPIRE|FAIL|RELEASE|STOP)
+		# The system is no longer online
+		rm -f /var/ipfire/red/active
+
+		# Remove all IP addresses
+		ip addr flush dev "${interface}"
+
+		# Shut down the interface
+		ip link set "${interface}" down
+		;;
+
+	*)
+		echo "Unhandled reason: ${reason}" >&2
+		exit 2
+		;;
+esac
+
+# Terminate
+exit 0

src/initscripts/networking/any

@@ -26,6 +26,7 @@ if [ "$(basename $0)" == "green" ]; then
 	NETADDRESS="${GREEN_NETADDRESS}"
 	NETMASK="${GREEN_NETMASK}"
 	DEVICE="${GREEN_DEV}"
+	MTU="${GREEN_MTU}"
 elif [ "$(basename $0)" == "blue" ]; then
 	DEVICE="${BLUE_DEV}"
 	ADDRESS="${BLUE_ADDRESS}"
@@ -33,6 +34,7 @@ elif [ "$(basename $0)" == "blue" ]; then
 	NETADDRESS="${BLUE_NETADDRESS}"
 	NETMASK="${BLUE_NETMASK}"
 	DEVICE="${BLUE_DEV}"
+	MTU="${GREEN_MTU}"
 elif [ "$(basename $0)" == "orange" ]; then
 	DEVICE="${ORANGE_DEV}"
 	ADDRESS="${ORANGE_ADDRESS}"
@@ -40,6 +42,7 @@ elif [ "$(basename $0)" == "orange" ]; then
 	NETADDRESS="${ORANGE_NETADDRESS}"
 	NETMASK="${ORANGE_NETMASK}"
 	DEVICE="${ORANGE_DEV}"
+	MTU="${ORANGE_MTU}"
 fi
 
 if [ -z "${BROADCAST}" ]; then
@@ -77,6 +80,14 @@ case "${1}" in
 			exit 1
 		fi
 
+		# Set the MTU
+		if [ -n "${MTU}" ]; then
+			if ! ip link set dev "${DEVICE}" mtu "${MTU}" &>/dev/null; then
+				boot_mesg "Could not set MTU of ${MTU} to ${DEVICE}..."
+				echo_warning
+			fi
+		fi
+
 		# Create & Enable vnstat data collection
 		/usr/bin/vnstat -u -i ${DEVICE} -r --enable --force > /dev/null 2>&1
 		

src/initscripts/networking/red

@@ -54,11 +54,13 @@ if [ "${TYPE}" == "STATIC" ]; then
 		BROADCAST="${RED_BROADCAST}"
 		NETADDRESS="${RED_NETADDRESS}"
 		NETMASK="${RED_NETMASK}"
+		MTU="${RED_MTU}"
 	else
 		ADDRESS="${GREEN_ADDRESS}"
 		BROADCAST="${GREEN_BROADCAST}"
 		NETADDRESS="${GREEN_NETADDRESS}"
 		NETMASK="${GREEN_NETMASK}"
+		MTU="${GREEN_MTU}"
 	fi
 	GATEWAY="${DEFAULT_GATEWAY}"
 	# DNS1
@@ -108,7 +110,14 @@ case "${1}" in
 		/usr/bin/vnstat -u -i ${DEVICE} -r --enable --force > /dev/null 2>&1
 		
 		if [ "${TYPE}" == "STATIC" ]; then
-		
+			# Set the MTU
+			if [ -n "${MTU}" ]; then
+				if ! ip link set dev "${DEVICE}" mtu "${MTU}" &>/dev/null; then
+					boot_mesg "Could not set MTU of ${MTU} to ${DEVICE}..."
+					echo_warning
+				fi
+			fi
+
 			if [ "$DEVICE" != "${GREEN_DEV}" ]; then
 				boot_mesg "Adding IPv4 address ${ADDRESS} to the ${DEVICE} interface..."
 				ip addr add ${args} dev ${DEVICE}

src/initscripts/system/cloud-init

@@ -13,6 +13,8 @@ case "${1}" in
 			scriptname="/etc/rc.d/helper/aws-setup"
 		elif running_on_azure; then
 			scriptname="/etc/rc.d/helper/azure-setup"
+		elif running_on_gcp; then
+			scriptname="/etc/rc.d/helper/gcp-setup"
 		else
 			# This system is not running in the cloud
 			exit 0
@@ -63,6 +65,11 @@ case "${1}" in
 			echo "This system is running on Microsoft Azure"
 			exit 0
 
+		# Check Google
+		elif running_on_gcp; then
+			echo "This system is running on Google Cloud"
+			exit 0
+
 		# The rest
 		else
 			echo "This system is NOT running in the cloud"

src/initscripts/system/firewall

@@ -32,6 +32,10 @@ iptables_init() {
 	iptables -P FORWARD DROP
 	iptables -P OUTPUT ACCEPT
 
+	# Enable TRACE logging to syslog
+	modprobe nf_log_ipv4
+	sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
+
 	# Empty LOG_DROP and LOG_REJECT chains
 	iptables -N LOG_DROP
 	iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
@@ -96,6 +100,9 @@ iptables_init() {
 
 	# Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
 
+	# GRE (always enabled)
+	modprobe nf_conntrack_proto_gre
+
 	# SIP
 	if [ "${CONNTRACK_SIP}" = "on" ]; then
 		modprobe nf_nat_sip

src/initscripts/system/functions

@@ -822,4 +822,16 @@ running_on_azure() {
 	return 1
 }
 
+running_on_gcp() {
+	# Check if the BIOS vendor is "Google"
+	if [ -r "/sys/devices/virtual/dmi/id/bios_vendor" ]; then
+		local bios_vendor="$(</sys/devices/virtual/dmi/id/bios_vendor)"
+
+		[ "${bios_vendor}" = "Google" ] && return 0
+	fi
+
+	# We are not running on GCP
+	return 1
+}
+
 # End $rc_base/init.d/functions

src/initscripts/system/partresize

@@ -45,8 +45,8 @@ case "${1}" in
 				esac
 			fi
 
-			# Enable the serial console on all systems on Azure
-			if running_on_azure; then
+			# Enable the serial console on all systems on Azure and Google Compute Platform
+			if running_on_azure || running_on_gcp; then
 				scon="on"
 			fi