ngcpcfg

Commit Graph

Author	SHA1	Message	Date
Guillem Jover	5d1b3dcc1e	MT#58014 Refactor OpenPGP functions into a new functions file We move some of the OpenPGP support into this file, which we will extend once we switch to use the OpenPGP Stateless OpenPGP support. Change-Id: I56acd993cb394dd8bc12a8da3cf4c78088adb61b	1 year ago
Guillem Jover	c4f6293c5e	MT#58014 encrypt, decrypt: Do not use an intermediate unencrypted tarfile We can simply feed the encrypted or unencrypted tarfile both when decrypting and encrypting it, so that we do not have to leave one around with the additional disk space, and danger of it not getting removed. Change-Id: If8c9fba36fd14c58cccacc789a0e4f8e474aac3f	1 year ago
Guillem Jover	6e5628d599	MT#58014 encrypt, decrypt: Clarify cryptographic terms Rename gpg to pgp or OpenPGP and remove crypted from filenames. The standard is called OpenPGP, GnuPG (or GPG, gpg) is one of many implementations (although depending on the context the prevalent one) so we use that when referring to the specification. For the encrypted tarball we remove the «-crypted» term which is an odd wording use for encryted content and it is unnecessary and confusing when using layered containers (as when the tarball is decrypted the name becomes invalid); and make it use «.pgp» instead of «.gpg» as extension, while trying the old filename on decryption for backwards compatibility. Change-Id: If5e0349ff0c3d8e3b47ced361e9e77d7d4d2defc	1 year ago
Guillem Jover	02055b8f6e	MT#58014 encrypt: Avoid remove leading / messages from tar We are prepending an extra / to the pathnames passed to tar, and calling tar from a directory other than the root directory while not telling it to use absolute names so it complains about these two things with the following messages: ,--- tar: Removing leading `/' from member names tar: Removing leading `/' from hard link targets tar: Removing leading `//' from member names tar: Removing leading `//' from hard link targets `--- which is something the user cannot do much about, and it's rather annoying. Change-Id: I9e9c853f26363e451b8883d3c74c5508ba3049dc	1 year ago
Guillem Jover	732bc1705b	TT#161150 Unify and switch to NGCP_NODENAME and NGCP_PAIRNAME The HA_NODE, HA_FILE and HA_CONFIG variables and nomenclature are deprecated in favor of the NGCP_NODENAME, NODE_FILE and NODE_CONFIG. Switch the old uses to the new ones. Unify PAIRNAME to NGCP_PAIRNAME. Leave the old HA_ variables for backwards compatibility Change-Id: I11f09f1620c2e456f10fc17229b61ec5a35a732b	3 years ago
Michael Prokop	3e8814205a	TT#82051 Shellcheck v0.8 fixes shellcheck v0.8 has new check, known as SC2295 ("Warn about "${x#$y}" treating $y as a pattern when not quoted"). Fixes: \| In scripts/build line 117: \| build_file="${build_file%%.${host}}" \| ^-----^ SC2295 (info): Expansions inside ${..} need to be quoted separately, otherwise they match as patterns. \| In scripts/encrypt line 24: \| x=${file##${NGCPCTL_MAIN}/templates/} # drop leading /etc/ngcp-config \| ^-------------^ SC2295 (info): Expansions inside ${..} need to be quoted separately, otherwise they match as patterns. ... as reported by our Github actions at https://github.com/sipwise/ngcpcfg Change-Id: I3371388ecf445905cca0bc4681276151aceb43ae	4 years ago
Alexander Lutay	567318c578	TT#106202 Add tty check for ngcpcfg 'read' calls On a Carrier cluster setup the command 'ngcpcfg clean --all' can be executed on several nodes in parallel (e.g. using ngcp-parallel-ssh). Which can get stuck on the yes/no question if the operator forgot to use '--force'. In practice it causes 100% CPU usage after several days due to logs rotation (reason is not 100% clear). Strace for such case: > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 > select(1, [0], NULL, [0], {tv_sec=0, tv_usec=0}) = 1 (in [0], left {tv_sec=0, tv_usec=0}) > rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 > rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 > ioctl(0, TCGETS, 0x7fff317e39a0) = -1 ENOTTY (Inappropriate ioctl for device) > lseek(0, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) > read(0, "", 1) = 0 The idea here is to check tty invocation and skip questions if no tty found. JFYI, there is no tty when running scripts under ngcp-parallel-ssh. Change-Id: Ia8ded3ada4d48ecb374f36859161645776381c31	4 years ago
Alexander Lutay	eee0a9c18c	TT#106202 Remove shellcheck mute for warning [SC2086] in 'scripts/encrypt' > warning shellcheck:note Double quote to prevent globbing and word splitting. [SC2086] Also tuned Shell Code Style. Change-Id: I3a726938f67b2c7f96b1de97b1eabd5b7043e52a	4 years ago
Alexander Lutay	055ec2f767	TT#106202 Remove unused variable $RC Change-Id: I9865a014cbbc9cb8b7e87ef9a1ce3376cf5504c6	4 years ago
Michael Prokop	0dda93ad97	TT#82051 Shellcheck fixes shellcheck v0.7.1 complains about a bunch of issues: SC1083: This { is literal. Check expression (missing ;/\n?) or quote it. SC1083: This } is literal. Check expression (missing ;/\n?) or quote it. SC1090: Can't follow non-constant source. Use a directive to specify location. SC2034: foo appears unused. Verify it or export it. SC2059: Don't use variables in the printf format string. Use printf '..%s..' "$foo". SC2128: Expanding an array without an index only gives the first element. SC2148: Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive. SC2155: Declare and assign separately to avoid masking return values. SC2162: read without -r will mangle backslashes. SC2164: Use 'cd ... \|\| exit' or 'cd ... \|\| return' in case cd fails. SC2181: Check exit code directly with e.g. 'if mycmd;', not indirectly with $?. SC2207: Prefer mapfile or read -a to split command output (or quote to avoid splitting). SC2237: Use [ -z .. ] instead of ! [ -n .. ]. We're still bound to support shellcheck v0.3.4 and sadly this version fails hard when using the modern "shellcheck source=" directives to address SC1090 and SC1091. It's failing like: \| not ok 1 source/functions/init:8:28: note: The mentioned parser error was in this then clause. [SC1009] \| not ok 2 source/functions/init:10:3: error: Couldn't parse this shellcheck annotation. [SC1073] \| not ok 3 source/functions/init:10:16: error: Unexpected "s". Fix any mentioned problems and try again. [SC1072] So until we can get rid of supporting this ancient shellcheck version, instead of using: \| # shellcheck source=etc/ngcp-config/ngcpcfg.cfg \| # shellcheck source=functions/init \| # shellcheck source=functions/logs \| # shellcheck source=functions/main we need to place disable=SC1090 and disable=SC1091 accordingly. Change-Id: I14da87a00102609bffdb60e932045180c6d13d5e	5 years ago
Guillem Jover	18edbf9718	TT#71950 Fix typos Change-Id: Ia42bc5d06992097ab077bc908837b3f04516ce62	5 years ago
Alexander Lutay	dfb0053b37	TT#37257 encrypt: clean glusterfs data in new data storage '/ngcp-data/glusterfs/' Change-Id: Ib7d8b95da07c5aeb980135dcc2b254a1b64e0bca	7 years ago
Alexander Lutay	a2a8b52f13	TT#24920 Initial commit for 'ngcpcfg patch' The 'ngcpcfg' received support for 'patchtt' files, like > /etc/ngcp-config/templates/etc/foo/bar.patchtt.tt2 Those 'patchtt' are going to be applied on default 'tt2 template' file: > /etc/ngcp-config/templates/etc/foo/bar.tt2 and produce 'customtt' on 'ngcpcfg patch': > /etc/ngcp-config/templates/etc/foo/bar.customtt.tt2 Further 'customtt' will be used to overwrite 'tt2 templates' on 'ngcpcfg build' or 'ngcpcfg apply'. NOTE: 'ngcpcfg patch' is executed automatically on every 'ngcpcfg build'. It should allows to update ngcp-templates easily and support local modifications without the pain (until the patches can be applied). Change-Id: Ice4369386313c5d33e4d498346345eade6f3d0d7	7 years ago
Michael Prokop	f009806409	MT#22567 Create /etc/ngcp-config-crypted.tgz* files with more restrict file permissions The file should be accessible only to user root. Also don't leave the unencrypted file /etc/ngcp-config-crypted.tgz around. Change-Id: I82f7f36d8561d8d5e82435edb70e11170fa6c082	9 years ago
Victor Seva	eac494cb42	MT#14229 clean shellcheck warnings While at it spread support for testsuite Change-Id: I60c4dae5479827b0d28ffa135105d9dbdf603825	10 years ago
Victor Seva	5ed308c1a0	MT#8763 allow multiple config directories on templates not only "/etc" Change-Id: I1c8fc5fd45a0c34ba7542ddc6ce24793bd568cb5	11 years ago
Michael Prokop	928cd68cf2	Simplify default configuration code	12 years ago
Michael Prokop	3436c08361	Initial checkin	12 years ago

18 Commits (master)