mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-09-28 09:11:11 -07:00
Name every machine after its own MAC address, and drop mDNS
One name for every machine was wrong: an operator with two of them on a network had one forgefirm.local, and mDNS does not work on many networks at all. The machine now calls itself forgefirm-<xxxx>, from the last four hex digits of its WiFi MAC address, and sends that name with its DHCP request, so a network with dynamic DNS publishes it and a router lists the machine by name. The name is the same at every boot, two machines take different names, and no serial number leaves the machine. forgefirm-hostname (new): reads the wlan0 MAC address (eth0 on a machine with no WiFi) at S38 in rcS, after udev has probed the network drivers and before poky's hostname.sh reads the file and before the network starts. The rootfs is read-only, so the name is written through a bind-mounted copy under /run/forgefirm. A bounded wait covers a slow probe. hostname:pn-base-files is "forgefirm": the name before S38, and the fallback when no MAC address can be read. avahi is deleted - the bbappend, the daemon configuration, the service file, the image install and the distro block. The address is the way in that works on every network, and the DHCP name covers the rest. forgefirm-banner: the marker lines are gone. "# ForgeFIRM addresses" and "# end" delimited the address block inside /etc/issue, and getty prints every line of that file, so both markers were on the console. The script now keeps the image's own text in a second copy under /run/forgefirm, captured once per boot before the first write, and renders the whole banner from it. The block is the addresses alone: no mDNS name. forgefirm-image.bb: the ForgeFIRM mark, under the OpenGlow one the base image carries, with the version on the mark's own last line, right-justified to the mark's last column. The mark is written once and rendered per reader, because /etc/issue is parsed by busybox getty (a backslash or a percent sign starts an escape, so the art goes in with every backslash doubled) while /etc/motd is written out as it is. Widths are measured in columns, not bytes: the color sequences take no room on the screen. /etc/issue.net stays unused - the machine tells a client that has not logged in nothing. Acceptance: commission.mdns-announce is replaced by commission.machine-name, which checks the name against the MAC address, the bind-mounted /etc/hostname, the DHCP client's hostname option, the banner's addresses, and that no mDNS responder is on the image; it covers nothing by design, like the test it replaces. forgectrl.auth gains the own-name Host check and its refusal with a domain on it. image.health checks the /etc/hostname mount and the version on the mark's last line in both files. commission.ssh-until-reboot asserts there is no pre-authentication banner. commission_dark's lens coverage widens to src/lenshome.* so src/lenshome.h is covered; the lint is clean at 83 tests. Pins: forgectrl 0.1.14 (9e5330f, the hostname certificate and the Host rule), meta-openglow ced2af2 (the DHCP hostname option and the motd mark) in the kas lock. Proven on the bench reference, hot-deployed and rebooted (image 20260910000208 dev): hostname forgefirm-b00a from MAC 2c:6b:7d:0d:b0:0a, live and in the bind-mounted file; the DHCP client running with -x hostname:forgefirm-b00a; the console banner and the motd carrying both marks with the version aligned to the mark's last column, no marker line and no .local name; forgectrl regenerating its certificate for the new name. Host tests: 357 forgetest unit tests, forgectrl clean under -Werror, tls_test and sanitize_test.
This commit is contained in:
ScottW514
@@ -1,24 +1,23 @@
|
||||
#!/bin/sh
|
||||
# Rewrites the address block of /etc/issue, the serial-console login
|
||||
# banner: the control panel by mDNS name, then one https:// URL per
|
||||
# global address of wlan0 (and eth0 when the machine has one). Every
|
||||
# other line of /etc/issue stays as the image build wrote it. The block
|
||||
# sits between the marker lines "# ForgeFIRM addresses" and "# end" and
|
||||
# is appended when absent. Called by the init script at boot and by the
|
||||
# udhcpc hook on every lease event. Idempotent: the file is written only
|
||||
# when the block changes.
|
||||
# Rewrites /etc/issue, the serial-console login banner: the lines the
|
||||
# image build wrote, then one https:// URL per global address of wlan0
|
||||
# (and eth0 when the machine has one). The address is the only way in
|
||||
# that the banner gives, because it is the one that works on every
|
||||
# network. Called by the init script at boot and by the udhcpc hook on
|
||||
# every lease event. Idempotent: the file is written only when the text
|
||||
# changes.
|
||||
#
|
||||
# The rootfs is read-only: at the first change after boot the file is
|
||||
# bind-mounted from a copy under /run/forgefirm (tmpfs) and the block is
|
||||
# written through the mount. Before that the image's own file shows.
|
||||
# bind-mounted from a copy under /run/forgefirm (tmpfs) and the banner
|
||||
# is written through the mount. Before that the image's own file shows.
|
||||
# The image's own text is kept at that moment in a second copy, so the
|
||||
# banner needs no marker line in the file and shows nothing but itself.
|
||||
|
||||
PATH=/sbin:/usr/sbin:/bin:/usr/bin
|
||||
|
||||
ISSUE=/etc/issue
|
||||
STATE=/run/forgefirm/issue
|
||||
MARK_BEGIN='# ForgeFIRM addresses'
|
||||
MARK_END='# end'
|
||||
PANEL='Control panel: https://forgefirm.local/'
|
||||
BASE=/run/forgefirm/issue.base
|
||||
|
||||
# One URL per global address; an IPv6 address gets its URL brackets.
|
||||
# Tentative, deprecated and temporary addresses are left out.
|
||||
@@ -32,45 +31,40 @@ addresses () {
|
||||
a = $2
|
||||
sub(/\/.*/, "", a)
|
||||
if ($1 == "inet6") a = "[" a "]"
|
||||
print "https://" a "/"
|
||||
print " https://" a "/"
|
||||
}'
|
||||
done
|
||||
}
|
||||
|
||||
block () {
|
||||
echo "$MARK_BEGIN"
|
||||
echo "$PANEL"
|
||||
addrs=$(addresses)
|
||||
if [ -n "$addrs" ]; then
|
||||
echo "$addrs"
|
||||
else
|
||||
echo "no network address yet"
|
||||
fi
|
||||
echo "$MARK_END"
|
||||
# A mount at the file, read from /proc/mounts (mountpoint(1) judges a
|
||||
# file by its device numbers alone).
|
||||
is_mounted () {
|
||||
awk -v t="$1" '$2 == t { f = 1 } END { exit !f }' /proc/mounts
|
||||
}
|
||||
|
||||
[ -f "$ISSUE" ] || exit 0
|
||||
|
||||
new=$(block)
|
||||
old=$(awk -v b="$MARK_BEGIN" -v e="$MARK_END" \
|
||||
'$0 == b { p = 1 } p { print } $0 == e { p = 0 }' "$ISSUE")
|
||||
[ "$new" = "$old" ] && exit 0
|
||||
|
||||
# A mount at the file, read from /proc/mounts (mountpoint(1) judges a
|
||||
# file by its device numbers alone).
|
||||
if ! awk -v t="$ISSUE" '$2 == t { f = 1 } END { exit !f }' /proc/mounts; then
|
||||
mkdir -p "${STATE%/*}" \
|
||||
&& cp -p "$ISSUE" "$STATE" \
|
||||
# The image's own text: the file as it is before the first write of the
|
||||
# boot. /run is a tmpfs, so the copy is made once per boot, and the
|
||||
# first caller is the one that finds the file untouched.
|
||||
mkdir -p "${STATE%/*}" || exit 1
|
||||
[ -f "$BASE" ] || cp -p "$ISSUE" "$BASE" || exit 1
|
||||
if ! is_mounted "$ISSUE"; then
|
||||
cp -p "$BASE" "$STATE" \
|
||||
&& mount --bind "$STATE" "$ISSUE" || exit 1
|
||||
fi
|
||||
|
||||
base=$(cat "$BASE")
|
||||
addrs=$(addresses)
|
||||
if [ -n "$addrs" ]; then
|
||||
new=$(printf '%s\n\nControl panel:\n%s\n' "$base" "$addrs")
|
||||
else
|
||||
new=$(printf '%s\n\nControl panel: no network address yet\n' "$base")
|
||||
fi
|
||||
[ "$new" = "$(cat "$ISSUE")" ] && exit 0
|
||||
|
||||
tmp="$STATE.tmp.$$"
|
||||
awk -v b="$MARK_BEGIN" -v e="$MARK_END" -v blk="$new" '
|
||||
$0 == b { print blk; seen = 1; skip = 1; next }
|
||||
$0 == e && skip { skip = 0; next }
|
||||
!skip { print }
|
||||
END { if (!seen) print blk }
|
||||
' "$ISSUE" > "$tmp" || { rm -f "$tmp"; exit 1; }
|
||||
printf '%s\n\n' "$new" > "$tmp" || { rm -f "$tmp"; exit 1; }
|
||||
cat "$tmp" > "$ISSUE"
|
||||
rm -f "$tmp"
|
||||
exit 0
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
SUMMARY = "ForgeFIRM console banner: the control panel addresses in /etc/issue"
|
||||
DESCRIPTION = "Keeps an address block in the serial-console login banner \
|
||||
(/etc/issue): the control panel by mDNS name and by every global address \
|
||||
of wlan0 and eth0. Refreshed at boot and on every DHCP lease event."
|
||||
(/etc/issue): one control panel URL per global address of wlan0 and eth0. \
|
||||
Refreshed at boot and on every DHCP lease event."
|
||||
LICENSE = "MIT"
|
||||
LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user