3 # Run gpg once to create default options
6 /usr/bin/gpg --yes 2>/dev/null </dev/null
8 # if this file is present, cancel the boot (exit this script)
9 CANCEL_BOOT_FLAG=/tmp/CANCEL_BOOT
11 # how many times to fail in attempting to contact primary server
12 # before falling back to original. if the backup fails this many times
13 # too, then the process is repeated started with the primary server
14 ATTEMPTS_BEFORE_BACKUP=3
16 # where all the configuration files for contacting
17 # the boot server are stored
20 # get the server we are going to be contacting
21 BOOT_SERVER=`cat $BOOT_DIR/boot_server`
22 BOOT_SERVER_PORT=`cat $BOOT_DIR/boot_server_port`
24 # the file to request from the boot server
25 BOOT_SERVER_PATH=`cat $BOOT_DIR/boot_server_path`
27 # location of the cacert for this boot server
28 BOOT_SERVER_CACERT=$BOOT_DIR/cacert.pem
30 # location of the gpg key ring to verify scripts
31 BOOT_SERVER_GPG_KEYRING=$BOOT_DIR/pubring.gpg
33 # get the backup server we are going to be contacting
34 BACKUP_BOOT_SERVER=`cat $BOOT_DIR/backup/boot_server`
35 BACKUP_BOOT_SERVER_PORT=`cat $BOOT_DIR/backup/boot_server_port`
37 # the file to request from the backup boot server
38 BACKUP_BOOT_SERVER_PATH=`cat $BOOT_DIR/backup/boot_server_path`
40 # location of the cacert for the backup boot server
41 BACKUP_BOOT_SERVER_CACERT=$BOOT_DIR/backup/cacert.pem
43 # location of the gpg key ring for backup server to verify scripts
44 BACKUP_BOOT_SERVER_GPG_KEYRING=$BOOT_DIR/backup/pubring.gpg
46 # location of a file containing this boot cd version
47 BOOT_VERSION_FILE=/pl_version
49 # the locations of the downloaded scripts
50 UNVERIFIED_SCRIPT=/tmp/bootscript.gpg
51 VERIFIED_SCRIPT=/tmp/bootscript
54 # --------------------------
57 # now, contact the boot server, run the script, and do it over again.
60 # set to one when we are trying to contact backup server
63 # start out contacting the primary servers
64 CONNECT_BOOT_SERVER=$BOOT_SERVER
65 CONNECT_BOOT_SERVER_PORT=$BOOT_SERVER_PORT
66 CONNECT_BOOT_SERVER_PATH=$BOOT_SERVER_PATH
67 CONNECT_BOOT_SERVER_GPG_KEYRING=$BOOT_SERVER_GPG_KEYRING
68 CONNECT_BOOT_SERVER_CACERT=$BOOT_SERVER_CACERT
72 if [[ -f $CANCEL_BOOT_FLAG ]]; then
73 echo "pl_boot: got request to cancel boot, exiting"
77 if [[ $contact_count -ge $ATTEMPTS_BEFORE_BACKUP ]]; then
81 if [[ $on_backup_server == 1 ]]; then
82 echo "pl_boot: failed to contact backup server, trying primary."
86 CONNECT_BOOT_SERVER=$BOOT_SERVER
87 CONNECT_BOOT_SERVER_PORT=$BOOT_SERVER_PORT
88 CONNECT_BOOT_SERVER_PATH=$BOOT_SERVER_PATH
89 CONNECT_BOOT_SERVER_GPG_KEYRING=$BOOT_SERVER_GPG_KEYRING
90 CONNECT_BOOT_SERVER_CACERT=$BOOT_SERVER_CACERT
92 echo "pl_boot: failed to contact primary server, trying backup."
96 CONNECT_BOOT_SERVER=$BACKUP_BOOT_SERVER
97 CONNECT_BOOT_SERVER_PORT=$BACKUP_BOOT_SERVER_PORT
98 CONNECT_BOOT_SERVER_PATH=$BACKUP_BOOT_SERVER_PATH
99 CONNECT_BOOT_SERVER_GPG_KEYRING=$BACKUP_BOOT_SERVER_GPG_KEYRING
100 CONNECT_BOOT_SERVER_CACERT=$BACKUP_BOOT_SERVER_CACERT
104 if [[ $contact_count != 0 ]]; then
106 if [[ $on_backup_server == 1 ]]; then
107 echo "pl_boot: attempting to fetch script from backup server in 30s"
109 echo "pl_boot: attempting to fetch script from primary server in 30s"
114 # assemble the curl transaction
115 CURL_CMD="/usr/bin/curl \
116 --connect-timeout 60 \
118 --form version=<$BOOT_VERSION_FILE \
119 --form cmdline=</proc/cmdline \
120 --form uptime=</proc/uptime \
121 --form ifconfig=</tmp/ifconfig \
122 --form nonce=</tmp/nonce \
124 --output $UNVERIFIED_SCRIPT \
129 --stderr /tmp/curl_errors \
130 --cacert $CONNECT_BOOT_SERVER_CACERT \
131 https://$CONNECT_BOOT_SERVER:$CONNECT_BOOT_SERVER_PORT/$CONNECT_BOOT_SERVER_PATH"
133 # assemble the gpg command line
134 GPG_CMD="/usr/bin/gpg \
135 --no-default-keyring \
136 --keyring $CONNECT_BOOT_SERVER_GPG_KEYRING \
137 --output $VERIFIED_SCRIPT \
139 --decrypt $UNVERIFIED_SCRIPT"
141 echo "pl_boot: generating new nonce"
142 /usr/bin/head --bytes=32 /dev/urandom | \
143 /usr/bin/od -tx1 -An --width=32 | \
144 /bin/sed 's/ //g' > /tmp/nonce
146 echo "pl_boot: fetching script from boot server $CONNECT_BOOT_SERVER"
148 rm -f $UNVERIFIED_SCRIPT
151 if [ $curl_err -ne 0 ]; then
152 echo "pl_boot: curl request failed with error $curl_err:"
158 echo "pl_boot: verifying downloaded script"
159 rm -f $VERIFIED_SCRIPT
160 $GPG_CMD 2> /tmp/gpg_errors
161 if [ $? -ne 0 ]; then
162 echo "pl_boot: failed to verify file:"
167 echo "pl_boot: decrypted and verified script succesfully"
169 echo "pl_boot: handing control to download script"
170 rm -f $UNVERIFIED_SCRIPT
171 chmod +x $VERIFIED_SCRIPT
174 echo "pl_boot: downloaded script has returned"
177 echo "pl_boot: automatic boot process canceled by user"