diff options
Diffstat (limited to 'meta-google/recipes-google')
26 files changed, 490 insertions, 34 deletions
diff --git a/meta-google/recipes-google/console/glome_git.bb b/meta-google/recipes-google/console/glome_git.bb new file mode 100644 index 000000000..b302e72ef --- /dev/null +++ b/meta-google/recipes-google/console/glome_git.bb @@ -0,0 +1,26 @@ +SUMMARY = "GLOME Login Client" +DESCRIPTION = "GLOME login is first application of the GLOME protocol. It is used to authorize serial console access to Linux machines" +PR = "r1" +PV = "0.1+git${SRCPV}" + +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" + +inherit meson pkgconfig + +DEPENDS += " \ + openssl \ + glib-2.0 \ + " + +S = "${WORKDIR}/git" +SRC_URI = "git://github.com/google/glome.git" +SRCREV = "02f7d2722a2eb303f1f02d0c2ce97a65f8273662" + +FILES_${PN} += "${libdir}/security" + +PACKAGECONFIG ??= "" +PACKAGECONFIG[glome-cli] = "-Dglome-cli=true,-Dglome-cli=false" +PACKAGECONFIG[pam-glome] = "-Dpam-glome=true,-Dpam-glome=false,libpam" + +EXTRA_OEMESON = "-Dtests=disabled" diff --git a/meta-google/recipes-google/google-bios-key/google-bios-key.bb b/meta-google/recipes-google/google-bios-key/google-bios-key.bb new file mode 100644 index 000000000..5e41a7977 --- /dev/null +++ b/meta-google/recipes-google/google-bios-key/google-bios-key.bb @@ -0,0 +1,26 @@ +SUMMARY = "Google BIOS Public Keys" +DESCRIPTION = "Google BIOS Public Keys" +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10" + +FILESEXTRAPATHS:prepend:gbmc := "${THISDIR}/${PN}:" + +SRC_URI:append:gbmc = " \ + file://platforms_secure.pem \ + file://platforms_bringup.pem \ +" + + +FILES:${PN} += "${datadir}/google-bios-key/platforms_secure.pem" +FILES:${PN} += "${datadir}/google-bios-key/platforms_bringup.pem" +FILES:${PN} += "${datadir}/platforms_secure.pem" +FILES:${PN} += "${datadir}/platforms_bringup.pem" + +do_install() { + install -d ${D}${datadir}/google-bios-key + install -m 0644 ${WORKDIR}/platforms_secure.pem ${D}${datadir}/google-bios-key + install -m 0644 ${WORKDIR}/platforms_bringup.pem ${D}${datadir}/google-bios-key + + ln -s -r ${D}${datadir}/google-bios-key/platforms_secure.pem ${D}${datadir}/platforms_secure.pem + ln -s -r ${D}${datadir}/google-bios-key/platforms_bringup.pem ${D}${datadir}/platforms_bringup.pem +} diff --git a/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_bringup.pem b/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_bringup.pem new file mode 100644 index 000000000..85fbd5b54 --- /dev/null +++ b/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_bringup.pem @@ -0,0 +1,14 @@ +-----BEGIN PUBLIC KEY----- +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq1licj5L+p5orm2eQsjW +7z1L5As2q0ZbyFtE/xeH/8NAbKfTA1LSKiqElcPTM47oFDixGtCm7bubcClWT8Uq +Ol6t4CITlgRLFPP06z63mnE83EKj1ZBTATgtO+PN1P/RrQXp0pCPy0AFYtWZPT4J +GzxACBwVI/XEuUnCOG4ErXLfgfPZadOMUmP9X5pXeyBgN/al0vThIVpQ7DUix6jd +awYd2AwM1TG9qRX1Fmlsut9zUGDoqEOCAdIgx5z9GOTfwzbIg1NWk12iLQyufJ4P +FAa4a5QVZYTKcDUNYadx7Qwg/gNspiAIdtB/1ORz1ew1d1csCHqUZcgkCwtaqMYg +ZiQ6+7tpJY0vnWyaNXcylOvmZjOlovV3i5NUJ/r74bDC8U+5XKH3ZSmhA6AsnA54 +QnNHLgsnG89JvfBP2c9UJqb49sw6VkEE3Y8lc134QBaLU3N3LmRVmM4zzPRGbbEK ++nmZtBztbKiSHTqMoYGCY5aN1peQdzgNYk5P8mnVWzAIh5y1MzxkEVeu82/zCj+/ +T54D3jS+a/jxAGnUUmTMYsOYXNqJsPKz36qvrFLstSjrjHVEZjniaetjAuWtVGsO +DziPDyywN14iIeR5HdNpqeJ6mCZnY2rLtBzIZRK/JK0LpCvqdEmqg2u/J2Vx2ClE +DnNnPSr8XSpsFkaxGYyFjEUCAwEAAQ== +-----END PUBLIC KEY----- diff --git a/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_secure.pem b/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_secure.pem new file mode 100644 index 000000000..6519411e9 --- /dev/null +++ b/meta-google/recipes-google/google-bios-key/google-bios-key/platforms_secure.pem @@ -0,0 +1,14 @@ +-----BEGIN PUBLIC KEY----- +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzCYi0R3IiNenOlVNlpOC +mIZ/0nq6OGS5Dt1Yex5nr7/bIr+Phk7mct+V7gMJzfdyCOI3n2S2sGDWADUNfvDJ +LQgV4xOfoUwhzQ292cp2UFUrPblfZaz0C5x7BRVtj7yfBp8FRFVSpZTNI6QjEQ6m +JxVh5C8CYjdQQJLz+wayVZTk72z0iaSBdua+eZYrAc3+ckTvTWJ9V7yO40iyJOXQ +ixxHo/p49oHoNp4+q0a6DYYmjka6MESeFbbkND5PkyNV4+vAbgtzkoGnnutk+zQ3 +K374d9+aOqXlbLBXAUaNkfnF1XjUYQFLrNkFbvOqYura1mBxWuz/OIAfbWxQltzo +6cYl0YNw7zbHzSwiTPvt31wxg9EqqIV7QD4hXLAgoclJIK5vhUqIbn3kjSwOv2Rv +MQ17wLeCkYaxL4Ovscx6lDnOw+Y76KGia5zky0GvidjaDgzUZTt46/uOtjxxXy5k +KhDwqs1QoU0LKBvJL8O7bYj6t0LLQTsI2UW9szVGGsiKB3l0SfIzfvz6eNNng7Uf +T9zLPW9jq0BGG61KiYK+Dy/0JwauPub3WzcZwSXnl1OCMLD90HIA2/YsFtfE+mm/ +Wlta+cR3REHd//DiRlkT59K0H5H8JBrJKhkAVi/gzqoAYhLAOj9irWzsZ2Assm74 +oa3/lWlmVsKQTAGOCQFeAHsCAwEAAQ== +-----END PUBLIC KEY----- diff --git a/meta-google/recipes-google/google-misc/google-misc.inc b/meta-google/recipes-google/google-misc/google-misc.inc index 36ad141de..49535873b 100644 --- a/meta-google/recipes-google/google-misc/google-misc.inc +++ b/meta-google/recipes-google/google-misc/google-misc.inc @@ -6,7 +6,7 @@ LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://../../LICENSE;md5=34400b68072d710fecd0a2940a0d1658" SRC_URI += "git://github.com/openbmc/google-misc" -SRCREV = "d237c6cc59e731c2a8a3a1bdcd91ad39bd67e182" +SRCREV = "379b061ffdd797d00c07acf0b5cb81e1f6513bca" S = "${WORKDIR}/git/subprojects/${GOOGLE_MISC_PROJ}" inherit meson diff --git a/meta-google/recipes-google/ipmi/google-ipmi-i2c_git.bb b/meta-google/recipes-google/ipmi/google-ipmi-i2c_git.bb index 3d5504ea1..c58382ab6 100644 --- a/meta-google/recipes-google/ipmi/google-ipmi-i2c_git.bb +++ b/meta-google/recipes-google/ipmi/google-ipmi-i2c_git.bb @@ -14,7 +14,7 @@ DEPENDS += "phosphor-ipmi-host" S = "${WORKDIR}/git" SRC_URI = "git://github.com/openbmc/google-ipmi-i2c" -SRCREV = "b7d431199ac519e7c3cd5f3341d67f2ff0e09e10" +SRCREV = "d78cbec9efb29526d913cc02d61e0b9bf5cff5ae" FILES:${PN}:append = " ${libdir}/ipmid-providers/lib*${SOLIBS}" FILES:${PN}:append = " ${libdir}/host-ipmid/lib*${SOLIBS}" diff --git a/meta-google/recipes-google/ipmi/google-ipmi-sys_git.bb b/meta-google/recipes-google/ipmi/google-ipmi-sys_git.bb index 1310f7e00..d136eb245 100644 --- a/meta-google/recipes-google/ipmi/google-ipmi-sys_git.bb +++ b/meta-google/recipes-google/ipmi/google-ipmi-sys_git.bb @@ -19,7 +19,7 @@ DEPENDS += " \ S = "${WORKDIR}/git" SRC_URI = "git://github.com/openbmc/google-ipmi-sys" -SRCREV = "b69209b498bf9b1c009c528e40280d13e68f8dbd" +SRCREV = "40fe52225515f6ec82858795638add0b4c8e94af" FILES:${PN} += "${libdir}/ipmid-providers" diff --git a/meta-google/recipes-google/ipmi/ipmi-fru-sh/lib.sh b/meta-google/recipes-google/ipmi/ipmi-fru-sh/lib.sh index 335e0b21c..d02eeab47 100644 --- a/meta-google/recipes-google/ipmi/ipmi-fru-sh/lib.sh +++ b/meta-google/recipes-google/ipmi/ipmi-fru-sh/lib.sh @@ -23,6 +23,20 @@ IPMI_FRU_COMMON_HEADER_MULTI_RECORD_OFFSET_IDX=5 IPMI_FRU_AREA_HEADER_SIZE_IDX=1 IPMI_FRU_CHECKSUM_IDX=-1 +offset_1bw() { + local addr="$1" + local off="$2" + local extra="${3-0}" + echo w$((1+extra))@$addr $(( off & 0xff )) +} + +offset_2bw() { + local addr="$1" + local off="$2" + local extra="${3-0}" + echo w$((2+extra))@$addr $(( (off >> 8) & 0xff )) $(( off & 0xff )) +} + of_name_to_eeproms() { local names if ! names="$(grep -xl "$1" /sys/bus/i2c/devices/*/of_node/name)"; then @@ -42,6 +56,78 @@ of_name_to_eeprom() { echo "$eeproms" } +# Each element is a `filename` +declare -A IPMI_FRU_EEPROM_FILE=() +# Each element is a `bus` + `addr` + `offset_bytes_func` +declare -A IPMI_FRU_EEPROM_BUSADDR=() + +ipmi_fru_device_alloc() { + local fdn="$1" + local idx="$2" + + local json + json="$(busctl -j call xyz.openbmc_project.FruDevice \ + /xyz/openbmc_project/FruDevice/"$fdn" org.freedesktop.DBus.Properties \ + GetAll s xyz.openbmc_project.FruDevice)" || return 80 + + local jqq='.data[0] | (.BUS.data | tostring) + " " + (.ADDRESS.data | tostring)' + local busaddr + busaddr=($(echo "$json" | jq -r "$jqq")) || return + + # FRU 0 is hardcoded and FruDevice does not report the correct bus for it + # Hardcode a workaround for this specifically known bus + if (( busaddr[0] == 0 && busaddr[1] == 0 )); then + IPMI_FRU_EEPROM_FILE["$idx"]=/etc/fru/baseboard.fru.bin + else + local offset_bw=offset_2bw + local rsp + rsp=$(i2ctransfer -f -y ${busaddr[0]} $(offset_1bw ${busaddr[1]} 0) r1) || return + # FRUs never start with 0xff bytes, so we can figure out addressing mode + if (( rsp != 0xff )); then + offset_bw=offset_1bw + fi + IPMI_FRU_EEPROM_BUSADDR["$idx"]="${busaddr[*]} $offset_bw" + fi +} + +ipmi_fru_alloc() { + local name="$1" + local -n ret="$2" + + # Pick the first free index to return as the allocated entry + for (( ret = 0; ret < "${#IPMI_FRU_EEPROM_FILE[@]}"; ++ret )); do + [ -n "${IPMI_FRU_EEPROM_FILE[@]+1}" ] || \ + [ -n "${IPMI_FRU_EEPROM_BUSADDR[@]+1}" ]|| break + done + + if [[ "$name" =~ ^of-name:(.*)$ || "$name" =~ ^([^:]*)$ ]]; then + local ofn="${BASH_REMATCH[1]}" + local file + file="$(of_name_to_eeprom "$ofn")" || return + IPMI_FRU_EEPROM_FILE["$ret"]="$file" + elif [[ "$name" =~ ^frudev-name:(.*)$ ]]; then + local fdn="${BASH_REMATCH[1]}" + local start=$SECONDS + local file + while (( SECONDS - start < 60 )); do + local rc=0 + ipmi_fru_device_alloc "$fdn" "$ret" || rc=$? + (( rc == 0 )) && break + # Immediately return any errors, 80 is special to signify retry + (( rc != 80 )) && return $rc + sleep 1 + done + else + echo "Invalid IPMI FRU eeprom specification: $name" >&2 + return 1 + fi +} + +ipmi_fru_free() { + unset 'IPMI_FRU_EEPROM_FILE[$1]' + unset 'IPMI_FRU_EEPROM_BUSADDR[$1]' +} + checksum() { local -n checksum_arr="$1" local checksum=0 @@ -61,24 +147,36 @@ fix_checksum() { } read_bytes() { - local file="$1" + local busaddr=(${IPMI_FRU_EEPROM_BUSADDR["$1"]-}) + local file="${IPMI_FRU_EEPROM_FILE["$1"]-$1}" local offset="$2" local size="$3" - echo "Reading $file at $offset for $size" >&2 - dd if="$file" bs=1 count="$size" skip="$offset" 2>/dev/null | \ - hexdump -v -e '1/1 "%d "' + if (( "${#busaddr[@]}" > 0)); then + echo "Reading ${busaddr[*]} at $offset for $size" >&2 + i2ctransfer -f -y ${busaddr[0]} $(${busaddr[2]} ${busaddr[1]} $offset) r$size + else + echo "Reading $file at $offset for $size" >&2 + dd if="$file" bs=1 count="$size" skip="$offset" 2>/dev/null | \ + hexdump -v -e '1/1 "%d "' + fi } write_bytes() { - local file="$1" + local busaddr=(${IPMI_FRU_EEPROM_BUSADDR["$1"]-}) + local file="${IPMI_FRU_EEPROM_FILE["$1"]-$1}" local offset="$2" local -n bytes_arr="$3" - local hexstr - hexstr="$(printf '\\x%x' "${bytes_arr[@]}")" || return - echo "Writing $file at $offset for ${#bytes_arr[@]}" >&2 - printf "$hexstr" | dd of="$file" bs=1 seek=$offset 2>/dev/null + if (( "${#busaddr[@]}" > 0)); then + echo "Writing ${busaddr[*]} at $offset for ${#bytes_arr[@]}" >&2 + i2ctransfer -f -y ${busaddr[0]} $(${busaddr[2]} ${busaddr[1]} $offset ${#bytes_arr[@]}) ${bytes_arr[@]} + else + local hexstr + hexstr="$(printf '\\x%x' "${bytes_arr[@]}")" || return + echo "Writing $file at $offset for ${#bytes_arr[@]}" >&2 + printf "$hexstr" | dd of="$file" bs=1 seek=$offset 2>/dev/null + fi } read_header() { diff --git a/meta-google/recipes-google/libcr51sign/libcr51sign_git.bb b/meta-google/recipes-google/libcr51sign/libcr51sign_git.bb new file mode 100644 index 000000000..c4fd78ca0 --- /dev/null +++ b/meta-google/recipes-google/libcr51sign/libcr51sign_git.bb @@ -0,0 +1,11 @@ +SUMMARY = "Google libcr51sign" +DESCRIPTION = "Google libcr51sign" +GOOGLE_MISC_PROJ = "libcr51sign" + +require ../google-misc/google-misc.inc + +inherit pkgconfig + +DEPENDS += " \ + openssl \ +" diff --git a/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.netdev b/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.netdev new file mode 100644 index 000000000..58f13bd46 --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.netdev @@ -0,0 +1,5 @@ +[NetDev] +Name=gbmcbrncsidhcp +Kind=veth +[Peer] +Name=gbmcncsidhcp diff --git a/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.network b/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.network new file mode 100644 index 000000000..5474bffab --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/-bmc-gbmcbrncsidhcp.network @@ -0,0 +1,4 @@ +[Match] +Name=gbmcbrncsidhcp +[Network] +Bridge=gbmcbr diff --git a/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.netdev b/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.netdev new file mode 100644 index 000000000..08235aac0 --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.netdev @@ -0,0 +1,5 @@ +[NetDev] +Name=gbmcncsidhcp +Kind=veth +[Peer] +Name=gbmcbrncsidhcp diff --git a/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.network b/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.network new file mode 100644 index 000000000..868d24b7e --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/-bmc-gbmcncsidhcp.network @@ -0,0 +1,9 @@ +[Match] +Name=gbmcncsidhcp +[Network] +DHCP=false +IPv6AcceptRA=false +LLMNR=false +MulticastDNS=false +LinkLocalAddressing=ipv6 +Address=fdb5:0481:10ce::1/64 diff --git a/meta-google/recipes-google/ncsi/files/50-gbmc-ncsi.rules.in b/meta-google/recipes-google/ncsi/files/50-gbmc-ncsi.rules.in index 938dca34b..e2ade6e5b 100644 --- a/meta-google/recipes-google/ncsi/files/50-gbmc-ncsi.rules.in +++ b/meta-google/recipes-google/ncsi/files/50-gbmc-ncsi.rules.in @@ -8,6 +8,7 @@ table inet filter { } chain ncsi_gbmc_br_pub_input { jump gbmc_br_pub_input + jump ncsi_legacy_input reject } chain gbmc_br_pub_input { @@ -31,4 +32,10 @@ table inet filter { ip6 daddr fdb5:0481:10ce::/64 drop ip6 saddr fdb5:0481:10ce::/64 drop } + chain ncsi_dhcp_input { + type filter hook input priority 0; policy drop; + iifname != ncsigbmc accept + ip6 nexthdr icmpv6 accept + udp dport 547 accept + } } diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in index 961da5095..5adc41328 100644 --- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in +++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in @@ -16,9 +16,12 @@ gbmc_ncsi_br_pub_addr_init= gbmc_ncsi_br_pub_addr_lastip= +gbmc_ncsi_br_pub_addr_confip= gbmc_ncsi_br_pub_addr_update() { [ -n "$gbmc_ncsi_br_pub_addr_init" ] || return + [ "$gbmc_ncsi_br_pub_addr_confip" != "$gbmc_ncsi_br_pub_addr_lastip" ] || return + gbmc_ncsi_br_pub_addr_confip="$gbmc_ncsi_br_pub_addr_lastip" printf 'gBMC Bridge Pub Addr from NCSI: %s\n' \ "${gbmc_ncsi_br_pub_addr_lastip:-(deleted)}" >&2 @@ -36,14 +39,14 @@ gbmc_ncsi_br_pub_addr_update() { done fi - local contents='[Network]'$'\n' + local contents= if (( ${#pfx_bytes[@]} != 0 )); then pfx_bytes[8]=0xfd local stateless_pfx="$(ip_bytes_to_str pfx_bytes)" pfx_bytes[9]=0x01 local ncsi_pfx="$(ip_bytes_to_str pfx_bytes)" - local here= - read -r -d '' here <<EOF + read -r -d '' contents <<EOF +[Network] Address=$ncsi_pfx/128 IPv6PrefixDelegation=yes [IPv6PrefixDelegation] @@ -56,17 +59,20 @@ ValidLifetimeSec=60 Route=$ncsi_pfx/80 LifetimeSec=60 [Route] -Destination=$stateless_pfx/72 +Destination=$stateless_pfx/76 Type=unreachable Metric=1024 EOF - contents+="$here"$'\n' fi local file for file in /run/systemd/network/{00,}-bmc-gbmcbr.network.d/50-public.conf; do mkdir -p -m 755 "$(dirname "$file")" - printf '%s' "$contents" >"$file" + if [ -z "$contents" ]; then + rm -f "$file" + else + printf '%s' "$contents" >"$file" + fi done # Ensure that systemd-networkd performs a reconfiguration as it doesn't @@ -82,16 +88,19 @@ EOF gbmc_ncsi_br_pub_addr_hook() { if [ "$change" = 'init' ]; then gbmc_ncsi_br_pub_addr_init=1 + gbmc_ip_monitor_defer + elif [ "$change" = 'defer' ]; then gbmc_ncsi_br_pub_addr_update elif [ "$change" = 'addr' -a "$intf" = '@NCSI_IF@' ] && - [ "$scope" = 'global' -a "$fam" = 'inet6' ]; then + [ "$scope" = 'global' -a "$fam" = 'inet6' ] && + [[ "$flags" != *deprecated* ]]; then if [ "$action" = 'add' -a "$ip" != "$gbmc_ncsi_br_pub_addr_lastip" ]; then gbmc_ncsi_br_pub_addr_lastip="$ip" - gbmc_ncsi_br_pub_addr_update + gbmc_ip_monitor_defer fi if [ "$action" = 'del' -a "$ip" = "$gbmc_ncsi_br_pub_addr_lastip" ]; then gbmc_ncsi_br_pub_addr_lastip= - gbmc_ncsi_br_pub_addr_update + gbmc_ip_monitor_defer fi fi } diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-dhcrelay.service.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-dhcrelay.service.in new file mode 100644 index 000000000..5e0345542 --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-dhcrelay.service.in @@ -0,0 +1,13 @@ +[Unit] +Description=gBMC DHCP Relay Agent Daemon +After=network.target +StartLimitIntervalSec=10 +StartLimitBurst=3 + +[Service] +Restart=always +RestartSec=5 +ExecStart=/usr/sbin/dhcrelay -d --no-pid -rp 3967 -l gbmcncsidhcp -u @NCSI_IF@ + +[Install] +WantedBy=multi-user.target diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.service.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.service.in new file mode 100644 index 000000000..82972fffc --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.service.in @@ -0,0 +1,15 @@ +[Unit] +Description=gBMC NCSI RA Discovery +After=network.target +StartLimitIntervalSec=10 +StartLimitBurst=3 +Conflicts=nic-hostless@@NCSI_IF@.target +Conflicts=nic-hostful@@NCSI_IF@.target + +[Service] +Restart=always +RestartSec=5 +ExecStart=/usr/libexec/gbmc-ncsi-ip-from-ra.sh + +[Install] +WantedBy=multi-user.target diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in new file mode 100755 index 000000000..80bd34f04 --- /dev/null +++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-ip-from-ra.sh.in @@ -0,0 +1,133 @@ +#!/bin/bash +# Copyright 2021 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +source /usr/share/network/lib.sh || exit +source /usr/libexec/ncsid_lib.sh || exit + +NCSI_IF='@NCSI_IF@' + +old_pfx= +old_fqdn= +old_rtr= + +set_host() { + [ -n "$host" -a -n "$domain" -a -n "$hextet" ] || return + + local fqdn="$host-n$hextet.$domain" + [ "$fqdn" != "$old_fqdn" ] || return + old_fqdn="$fqdn" + + echo "Found hostname $fqdn" >&2 + hostnamectl set-hostname "$fqdn" || true +} + +set_net() { + [ -n "$pfx" -a -n "$rtr" ] || return + [[ "$pfx" != "$old_pfx" || "$rtr" != "$old_rtr" ]] || return + old_pfx="$pfx" + old_rtr="$rtr" + + echo "Found prefix $pfx from $rtr" >&2 + + # Delete any stale IP Addresses from the primary interface as we won't use them + UpdateIP xyz.openbmc_project.Network "$NCSI_IF" '0.0.0.0' '0' || true + UpdateIP xyz.openbmc_project.Network "$NCSI_IF" '::' '0' || true + + read -r -d '' contents <<EOF +[Network] +Address=$pfx/128 +IPv6PrefixDelegation=yes +[IPv6PrefixDelegation] +RouterLifetimeSec=60 +[IPv6Prefix] +Prefix=$stateless_pfx/80 +PreferredLifetimeSec=60 +ValidLifetimeSec=60 +[IPv6RoutePrefix] +Route=$pfx/80 +LifetimeSec=60 +[Route] +Destination=$stateless_pfx/76 +Type=unreachable +Metric=1024 +EOF + for file in /run/systemd/network/{00,}-bmc-gbmcbr.network.d/49-public-ra.conf; do + mkdir -p -m 755 "$(dirname "$file")" + printf '%s' "$contents" >"$file" + done + touch -c /lib/systemd/network/*-bmc-gbmcbr.network || true + + contents='[Network]'$'\n' + contents+="Address=$pfx/128"$'\n' + contents+="Gateway=$rtr"$'\n' + for file in /run/systemd/network/{00,}-bmc-"$NCSI_IF".network.d/49-public-ra.conf; do + mkdir -p -m 755 "$(dirname "$file")" + printf '%s' "$contents" >"$file" + done + touch -c /etc/systemd/network/*-bmc-"$NCSI_IF".network || true + + if [ "$(systemctl is-active systemd-networkd)" != 'inactive' ]; then + networkctl reload && networkctl reconfigure gbmcbr "$NCSI_IF" || true + fi + + read -r -d '' contents <<EOF +table inet filter { + chain ncsi_input { + ip6 saddr != $pfx/76 ip6 daddr $pfx/76 goto ncsi_gbmc_br_pub_input + } + chain ncsi_forward { + ip6 saddr != $pfx/76 ip6 daddr $pfx/76 accept + } +} +EOF + rfile=/run/nftables/40-gbmc-ncsi-ra.rules + mkdir -p -m 755 "$(dirname "$rfile")" + printf '%s' "$contents" >"$rfile" + systemctl reset-failed nftables && systemctl --no-block restart nftables || true +} + +w=60 +while true; do + start=$SECONDS + while read line; do + if [ -z "$line" ]; then + hextet= + pfx= + host= + domain= + elif [[ "$line" =~ ^Prefix' '*:' '*(.*)/([0-9]+)$ ]]; then + t_pfx="${BASH_REMATCH[1]}" + t_pfx_len="${BASH_REMATCH[2]}" + ip_to_bytes t_pfx_b "$t_pfx" || continue + (( t_pfx_len == 76 && t_pfx_b[8] & 0xfd == 0xfd )) || continue + (( t_pfx_b[9] |= 1 )) + hextet="fd$(printf '%02x' ${t_pfx_b[9]})" + pfx="$(ip_bytes_to_str t_pfx_b)" + (( t_pfx_b[9] &= 0xf0 )) + stateless_pfx="$(ip_bytes_to_str t_pfx_b)" + elif [[ "$line" =~ ^'DNS search list'' '*:' '*([^.-]*)[^.]*[.](.*.google.com)$ ]]; then + host="${BASH_REMATCH[1]}" + domain="${BASH_REMATCH[2]}" + elif [[ "$line" =~ ^from' '(.*)$ ]]; then + rtr="${BASH_REMATCH[1]}" + set_net || true + set_host || true + fi + done < <(rdisc6 -d -m "$NCSI_IF" -w $(( w * 1000 )) 2>/dev/null) + # If rdisc6 exits early we still want to wait the full `w` time before + # starting again. + (( timeout = start + w - SECONDS )) + sleep $(( timeout < 0 ? 0 : timeout )) +done diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in index d07b9e2f0..7a630f5fe 100644 --- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in +++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in @@ -54,15 +54,15 @@ gbmc_ncsi_nft_update() { if (( ${#ip_bytes[@]} != 0 )); then ip_bytes[8]=0xfd pfx="$(ip_bytes_to_str ip_bytes)" - contents+=" ip6 saddr != $pfx/72 ip6 daddr" - contents+=" $pfx/72 goto ncsi_gbmc_br_pub_input"$'\n' + contents+=" ip6 saddr != $pfx/76 ip6 daddr" + contents+=" $pfx/76 goto ncsi_gbmc_br_pub_input"$'\n' fi fi contents+=' }'$'\n' contents+=' chain ncsi_forward {'$'\n' if [ -n "$pfx" ]; then - contents+=" ip6 saddr != $pfx/72 ip6 daddr $pfx/72 accept"$'\n' + contents+=" ip6 saddr != $pfx/76 ip6 daddr $pfx/76 accept"$'\n' fi contents+=' }'$'\n' contents+='}'$'\n' @@ -80,7 +80,8 @@ gbmc_ncsi_nft_hook() { if [ "$change" = 'init' ]; then gbmc_ncsi_nft_init=1 gbmc_ncsi_nft_update - elif [ "$change" = 'addr' -a "$intf" = '@NCSI_IF@' -a "$scope" = 'global' ]; then + elif [ "$change" = 'addr' -a "$intf" = '@NCSI_IF@' -a "$scope" = 'global' ] && + [[ "$flags" != *deprecated* ]]; then if [ "$fam" = 'inet6' ]; then local -n lastip='gbmc_ncsi_nft_lastip6' else diff --git a/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb b/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb index 6480be1da..10ef56a76 100644 --- a/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb +++ b/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb @@ -6,7 +6,14 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5 inherit systemd SRC_URI += " \ + file://-bmc-gbmcbrncsidhcp.netdev \ + file://-bmc-gbmcbrncsidhcp.network \ + file://-bmc-gbmcncsidhcp.netdev \ + file://-bmc-gbmcncsidhcp.network \ file://50-gbmc-ncsi.rules.in \ + file://gbmc-ncsi-dhcrelay.service.in \ + file://gbmc-ncsi-ip-from-ra.service.in \ + file://gbmc-ncsi-ip-from-ra.sh.in \ file://gbmc-ncsi-sslh.socket.in \ file://gbmc-ncsi-sslh.service \ file://gbmc-ncsi-nft.sh.in \ @@ -17,10 +24,14 @@ SRC_URI += " \ S = "${WORKDIR}" RDEPENDS:${PN} += " \ + bash \ + dhcp-relay \ gbmc-ip-monitor \ ncsid \ + network-sh \ nftables-systemd \ sslh \ + ndisc6-rdisc6 \ " FILES:${PN} += " \ @@ -29,9 +40,11 @@ FILES:${PN} += " \ " SYSTEMD_SERVICE:${PN} += " \ + gbmc-ncsi-dhcrelay.service \ gbmc-ncsi-sslh.service \ gbmc-ncsi-sslh.socket \ gbmc-ncsi-set-nicenabled.service \ + gbmc-ncsi-ip-from-ra.service \ " do_install:append() { @@ -47,6 +60,16 @@ do_install:append() { echo "net.ipv6.conf.$if_name.dad_transmits=0" \ >>${D}${sysconfdir}/sysctl.d/25-gbmc-ncsi.conf + install -d -m0755 ${D}${systemd_unitdir}/network + install -m0644 ${WORKDIR}/-bmc-gbmcbrncsidhcp.netdev \ + ${D}${systemd_unitdir}/network/ + install -m0644 ${WORKDIR}/-bmc-gbmcbrncsidhcp.network \ + ${D}${systemd_unitdir}/network/ + install -m0644 ${WORKDIR}/-bmc-gbmcncsidhcp.netdev \ + ${D}${systemd_unitdir}/network/ + install -m0644 ${WORKDIR}/-bmc-gbmcncsidhcp.network \ + ${D}${systemd_unitdir}/network/ + netdir=${D}${systemd_unitdir}/network/00-bmc-$if_name.network.d install -d -m0755 "$netdir" echo '[Network]' >>"$netdir"/gbmc-ncsi.conf @@ -80,4 +103,21 @@ do_install:append() { sed "s,@NCSI_IF@,$if_name,g" ${WORKDIR}/gbmc-ncsi-set-nicenabled.service.in \ >${D}${systemd_system_unitdir}/gbmc-ncsi-set-nicenabled.service + + sed "s,@NCSI_IF@,$if_name,g" ${WORKDIR}/gbmc-ncsi-dhcrelay.service.in \ + >${D}${systemd_system_unitdir}/gbmc-ncsi-dhcrelay.service + + sed "s,@NCSI_IF@,$if_name,g" ${WORKDIR}/gbmc-ncsi-ip-from-ra.service.in \ + >${WORKDIR}/gbmc-ncsi-ip-from-ra.service + install -m0644 ${WORKDIR}/gbmc-ncsi-ip-from-ra.service ${D}${systemd_system_unitdir} + sed "s,@NCSI_IF@,$if_name,g" ${WORKDIR}/gbmc-ncsi-ip-from-ra.sh.in \ + >${WORKDIR}/gbmc-ncsi-ip-from-ra.sh + install -d -m0755 ${D}${libexecdir} + install -m0755 ${WORKDIR}/gbmc-ncsi-ip-from-ra.sh ${D}${libexecdir}/ +} + +do_rm_work:prepend() { + # HACK: Work around broken do_rm_work not properly calling rm with `--` + # It doesn't like filenames that start with `-` + rm -rf -- ${WORKDIR}/-* } diff --git a/meta-google/recipes-google/ncsi/ncsid_git.bb b/meta-google/recipes-google/ncsi/ncsid_git.bb index a67a3104b..967f45f79 100644 --- a/meta-google/recipes-google/ncsi/ncsid_git.bb +++ b/meta-google/recipes-google/ncsi/ncsid_git.bb @@ -16,6 +16,9 @@ SYSTEMD_SERVICE:${PN} += " \ ncsid@.service \ nic-hostful@.target \ nic-hostless@.target \ + update-ra-gw@.service \ + update-ra-neighbor@.service \ + update-ra-neighbor@.timer \ update-static-neighbors@.service \ update-static-neighbors@.timer \ " diff --git a/meta-google/recipes-google/networking/files/gbmc-ip-monitor.sh b/meta-google/recipes-google/networking/files/gbmc-ip-monitor.sh index e64c8675e..9da090f47 100755 --- a/meta-google/recipes-google/networking/files/gbmc-ip-monitor.sh +++ b/meta-google/recipes-google/networking/files/gbmc-ip-monitor.sh @@ -44,6 +44,17 @@ gbmc_ip_monitor_generate_init() { echo '[INIT]' } +GBMC_IP_MONITOR_DEFER_OUTSTANDING= +gbmc_ip_monitor_defer_() { + sleep 1 + printf '[DEFER]\n' >&$GBMC_IP_MONITOR_DEFER +} +gbmc_ip_monitor_defer() { + [ -z "$GBMC_IP_MONITOR_DEFER_OUTSTANDING" ] || return 0 + gbmc_ip_monitor_defer_ & + GBMC_IP_MONITOR_DEFER_OUTSTANDING=1 +} + gbmc_ip_monitor_parse_line() { local line="$1" if [[ "$line" == '[INIT]'* ]]; then @@ -98,11 +109,16 @@ gbmc_ip_monitor_parse_line() { read line || break data=($line) mac="${data[1]}" + elif [[ "$line" == '[DEFER]'* ]]; then + GBMC_IP_MONITOR_DEFER_OUTSTANDING= + change=defer else return 2 fi } +return 0 2>/dev/null + cleanup() { local st="$?" trap - HUP INT QUIT ABRT TERM EXIT @@ -111,7 +127,10 @@ cleanup() { } trap cleanup HUP INT QUIT ABRT TERM EXIT -return 0 2>/dev/null +FIFODIR="$(mktemp -d)" +mkfifo "$FIFODIR"/fifo +exec {GBMC_IP_MONITOR_DEFER}<>"$FIFODIR"/fifo +rm -rf "$FIFODIR" while read line; do gbmc_ip_monitor_parse_line "$line" || continue @@ -119,4 +138,4 @@ while read line; do if [ "$change" = 'init' ]; then systemd-notify --ready fi -done < <(gbmc_ip_monitor_generate_init; exec ip monitor link addr route label) +done < <(gbmc_ip_monitor_generate_init; ip monitor link addr route label & cat <&$GBMC_IP_MONITOR_DEFER) diff --git a/meta-google/recipes-google/networking/files/gbmc-mac-config.sh.in b/meta-google/recipes-google/networking/files/gbmc-mac-config.sh.in index a3430a65e..fa2f4bffe 100644 --- a/meta-google/recipes-google/networking/files/gbmc-mac-config.sh.in +++ b/meta-google/recipes-google/networking/files/gbmc-mac-config.sh.in @@ -15,7 +15,7 @@ source /usr/share/ipmi-fru/lib.sh || exit -eeprom="$(of_name_to_eeprom '@EEPROM@')" || exit +ipmi_fru_alloc '@EEPROM@' eeprom || exit header=() read_header "$eeprom" header || exit diff --git a/meta-google/recipes-google/networking/gbmc-bridge/-bmc-gbmcbr.network.in b/meta-google/recipes-google/networking/gbmc-bridge/-bmc-gbmcbr.network.in index c6097bbdb..afea5cca7 100644 --- a/meta-google/recipes-google/networking/gbmc-bridge/-bmc-gbmcbr.network.in +++ b/meta-google/recipes-google/networking/gbmc-bridge/-bmc-gbmcbr.network.in @@ -7,3 +7,5 @@ IPv6AcceptRA=true LLMNR=true MulticastDNS=true LinkLocalAddressing=ipv6 +[IPv6AcceptRA] +DHCPv6Client=false diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh index 18341fefb..a9bfd74af 100644 --- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh +++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-from-ra.sh @@ -67,26 +67,28 @@ gbmc_br_from_ra_update() { gbmc_br_from_ra_hook() { if [ "$change" = 'init' ]; then gbmc_br_from_ra_init=1 + gbmc_ip_monitor_defer + elif [ "$change" = 'defer' ]; then gbmc_br_from_ra_update elif [[ "$change" == 'route' && "$route" != *' via '* ]] && [[ "$route" =~ ^(.* dev gbmcbr proto ra .*)( +expires +([^ ]+)sec).*$ ]]; then pfx="${route%% *}" if [ "$action" = 'add' ]; then gbmc_br_from_ra_pfxs["$pfx"]="${BASH_REMATCH[3]}" - gbmc_br_from_ra_update + gbmc_ip_monitor_defer elif [ "$action" = 'del' ]; then gbmc_br_from_ra_pfxs["$pfx"]=0 - gbmc_br_from_ra_update + gbmc_ip_monitor_defer fi elif [ "$change" = 'link' -a "$intf" = 'gbmcbr' ]; then rdisc6 -m gbmcbr -r 1 -w 100 >/dev/null 2>&1 if [ "$action" = 'add' -a "$mac" != "$gbmc_br_from_ra_mac" ]; then gbmc_br_from_ra_mac="$mac" - gbmc_br_from_ra_update + gbmc_ip_monitor_defer fi if [ "$action" = 'del' -a "$mac" = "$gbmc_br_from_ra_mac" ]; then gbmc_br_from_ra_mac= - gbmc_br_from_ra_update + gbmc_ip_monitor_defer fi fi } diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh index 19b8f64a1..980f7b6d6 100644 --- a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh +++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-nft.sh @@ -48,7 +48,7 @@ gbmc_br_nft_hook() { gbmc_br_nft_update # Match only global IP addresses on the bridge that match the BMC prefix # (<mpfx>:fdxx:). So 2002:af4:3480:2248:fd02:6345:3069:9186 would become - # a 2002:af4:3480:2248:fd00/72 rule. + # a 2002:af4:3480:2248:fd00/76 rule. elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] && [[ "$fam" == 'inet6' && "$flags" != *tentative* ]]; then local ip_bytes=() @@ -63,7 +63,7 @@ gbmc_br_nft_hook() { for (( i=9; i<16; i++ )); do ip_bytes[$i]=0 done - pfx="$(ip_bytes_to_str ip_bytes)/72" + pfx="$(ip_bytes_to_str ip_bytes)/76" if [ "$action" = "add" -a "$pfx" != "$gbmc_br_nft_pfx" ]; then gbmc_br_nft_pfx="$pfx" gbmc_br_nft_update |