Compare commits

...

104 commits

Author SHA1 Message Date
Alexander Sieg
92432c5d9a cconn a transparent connection wrapper
cconn used the inventory system to dynamically connect to FreeBSD jail via
the host system and/or using sudo to get root access

This is more of a prove of concept then a finish idea.
2021-01-20 20:18:38 +01:00
Darko Poljak
92a50da487 Fix pycodestyle issues 2021-01-18 06:28:09 +01:00
Darko Poljak
6e9b13d949 ++changelog 2021-01-18 06:22:32 +01:00
878a65a8b7 Merge branch 'fix/type/__sshd_config/error-on-invalid' into 'master'
sshd config: Produce error if invalid config is generated, fix processing of AuthenticationMethods and AuthorizedKeysFile, document explorer bug

See merge request ungleich-public/cdist!968
2021-01-18 06:22:02 +01:00
cce470b556 Merge branch 'bugfix/preos-debug' into 'master'
Fix debug parameter

Closes #849

See merge request ungleich-public/cdist!970
2021-01-18 06:17:36 +01:00
Nico Schottelius
f0e1b3b849 Merge branch 'master' of code.ungleich.ch:ungleich-public/cdist 2021-01-11 22:20:50 +01:00
Darko Poljak
c819548343 Fix debug parameter
-d was removed from cdist in favor of mulitple -v and -l parameters, but
-d was not removed from preos.

Resolve #849.
2021-01-11 09:51:52 +01:00
Dennis Camera
bd8ab8f26f [type/__sshd_config] Document "bug" in state explorer 2021-01-05 17:02:42 +01:00
Dennis Camera
8753b7eedf [type/__sshd_config] Make AuthenticationMethods and AuthorizedKeysFile singleton options
They were incorrectly treated as non-singleton options before.

cf. https://github.com/openssh/openssh-portable/blob/V_8_4/servconf.c#L2273
and https://github.com/openssh/openssh-portable/blob/V_8_4/servconf.c#L1899 resp.
2021-01-05 16:59:04 +01:00
Dennis Camera
766198912d [type/__sshd_config] Produce error if invalid config file is generated
Previously, cdist would silently swallow the error (no invalid config file was
generated).

Reason: `set -e` does not exit if a command in a sub-command group fails,
it merely returns with a non-zero exit status.

e.g. the following snippet does not abort the script if sshd -t returns with a
non-zero exit status:

    set -e
    cmp -s old new || {
        # check config file and update it
        sshd -t -f new \
        && cat new >old
    }

or compressed:

    set -e
    false || { false && true; }
    echo $?
    # prints 1
2021-01-05 15:50:21 +01:00
Darko Poljak
7cf85c4659 Release 6.9.4 2020-12-21 19:21:51 +01:00
Nico Schottelius
a10d43bc69 Merge branch 'master' of code.ungleich.ch:ungleich-public/cdist 2020-12-20 11:42:44 +01:00
Darko Poljak
4bae2863db ++changelog 2020-12-18 12:54:33 +01:00
3566901e1c Merge branch '__dot_file-dirmode' into 'master'
Added optional dirmode parameter to set the mode of (optional) the directory.

See merge request ungleich-public/cdist!966
2020-12-18 12:50:30 +01:00
Mark Verboom
8dc2c4207c Added optional dirmode parameter to set the mode of (optional) the directory. 2020-12-18 11:16:28 +01:00
Darko Poljak
71f2283117 ++changelog 2020-12-13 16:03:39 +01:00
f87da8150c Merge branch 'type/__debian_backports' into 'master'
__apt_backports type

See merge request ungleich-public/cdist!964
2020-12-13 16:03:31 +01:00
ae747ac021 Merge branch 'os_version-freebsd' into 'master'
[explorer/os_version] Improve FreeBSD support.

See merge request ungleich-public/cdist!965
2020-12-13 16:00:45 +01:00
27aca06fb8 __apt_backports: undo __apt_update_index call
Becuase it is already done by __apt_source.
2020-12-12 17:34:51 +01:00
fca35fc858 __apt_backports: fix explorer call
s/-/_/ because the explorers are following an other convention :-)
2020-12-12 17:29:58 +01:00
645734c629 [explorer/os_version] Improve FreeBSD support.
It looks like uname -r is not the most reliable way to get the target patch
level for the target system.

For more information see:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251743
2020-12-12 12:15:17 +01:00
fafa3d9ea5 __apt_backports: update index if required
This type now automatically calls the type __apt_update_index to update
the package index if something changed.
2020-12-12 10:00:23 +01:00
49aec0b5e4 __apt_backports: list supported OSes
The manpage now lists all OSes where this type supports backports.
2020-12-12 09:40:47 +01:00
c4d19a2319 __debian_backports -> __apt_backports; add wider os support
As discussed in the chat, this type now supports a broader list of OSes
which it supports backports for. Because of this, it was renamed to
something more generic. "apt" should fit in.
2020-12-12 09:36:17 +01:00
Nico Schottelius
69b8bc9af0 Merge branch 'master' of code.ungleich.ch:ungleich-public/cdist 2020-12-11 19:38:03 +01:00
Nico Schottelius
bc2948a8a5 ++scan stuff 2020-12-11 19:37:53 +01:00
0d96b31b56 __debian_backports: pass shellcheck for sourced file
Because the sourced explorer can't be detected by shellcheck, it will be
completely disabled. Changing the path to /etc/os-release isn't
deterministic either.

The shellcheck wiki page suggests to use `source=/dev/null` instead of
`disable=SC1090`, but it was choosen to completely avoid that check ..
2020-12-11 18:13:44 +01:00
a5169ad858 new type __debian_backports
This new type will setup the backports distribution for the current
Debian release.
2020-12-10 21:24:26 +01:00
Darko Poljak
a58f5ffa7f ++changelog 2020-12-08 19:36:44 +01:00
0546d6e476 Merge branch 'fix/__block/escape' into 'master'
__block: fix escaping in here-doc

Closes #838

See merge request ungleich-public/cdist!962
2020-12-08 19:36:45 +01:00
Darko Poljak
14c81d6c7e ++changelog 2020-12-08 07:16:26 +01:00
a1987fe410 Merge branch 'feature/__iptables_rule/ipv6' into 'master'
__iptables*: add IPv6 support

See merge request ungleich-public/cdist!959
2020-12-08 07:10:29 +01:00
c5ca4cd2e1 __block: securly quote via the quote function
Because the function already exists, it will be used for the file to be
changed, too. Therefor, no quotes are required for that value.

The prefix and suffix match was also improved: There is no regex check
any more (the regex did checked the whole line); instead it will do it
simple.
2020-12-07 19:59:05 +01:00
Darko Poljak
2966296173 ++changelog 2020-12-07 19:47:52 +01:00
226f665fb5 Merge branch 'imp-deprecation' into 'master'
Deal with deprecation of imp module.

See merge request ungleich-public/cdist!963
2020-12-07 19:48:08 +01:00
1c61989c03 Merge branch 'fix/type/__package_pkgng_freebsd/bootstrap' into 'master'
__package_pkgng_freebsd: Fix bootstrapping pkg(7)

See merge request ungleich-public/cdist!961
2020-12-07 19:42:21 +01:00
bed08c2c5c Deal with deprecation of imp module.
importlib has been a thing since Python 3.1, and imp has been deprecated since
3.4.

Insert random complaint here about not being able to use f-strings because they
were introduced in Python 3.6 and apparently we support Python 3.5 >,<.

Output diff before to after for ./bin/cdist-build-helper test (on heavy load):
```
1,2d0
< /usr/home/evilham/s/cdist/cdist/cdist/test/__main__.py:23: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
<   import imp
72c70
< ERROR: cdisttesthost: __file/tmp/foobar requires object __file without object id. Defined at /tmp/tmp.cdist.test.g87lx7c8/tmp.cdist.test.6ramsakx
---
> ERROR: cdisttesthost: __file/tmp/foobar requires object __file without object id. Defined at /tmp/tmp.cdist.test.aqdf6vjz/tmp.cdist.test.jgv3udel
76c74
< test_nonexistent_type_requirement (cdist.test.emulator.EmulatorTestCase) ... ERROR: cdisttesthost: __file/tmp/foobar requires object __does-not-exist/some-id, but type __does-not-exist does not exist. Defined at /tmp/tmp.cdist.test.mma5j8ln/tmp.cdist.test.3zg4by4d
---
> test_nonexistent_type_requirement (cdist.test.emulator.EmulatorTestCase) ... ERROR: cdisttesthost: __file/tmp/foobar requires object __does-not-exist/some-id, but type __does-not-exist does not exist. Defined at /tmp/tmp.cdist.test.t8d6ockr/tmp.cdist.test.uimxurg9
86c84
< test_initial_manifest_environment (cdist.test.manifest.ManifestTestCase) ... VERBOSE: cdisttesthost: Running initial manifest /tmp/tmp.cdist.test.uvid60ij/759547ff4356de6e3d9e08522b0d0807/data/conf/manifest/dump_environment
---
> test_initial_manifest_environment (cdist.test.manifest.ManifestTestCase) ... VERBOSE: cdisttesthost: Running initial manifest /tmp/tmp.cdist.test._cttcnrj/759547ff4356de6e3d9e08522b0d0807/data/conf/manifest/dump_environment
89c87
< test_type_manifest_environment (cdist.test.manifest.ManifestTestCase) ... VERBOSE: cdisttesthost: Running type manifest /tmp/tmp.cdist.test.k1i2onpb/759547ff4356de6e3d9e08522b0d0807/data/conf/type/__dump_environment/manifest for object __dump_environment/whatever
---
> test_type_manifest_environment (cdist.test.manifest.ManifestTestCase) ... VERBOSE: cdisttesthost: Running type manifest /tmp/tmp.cdist.test.ukr7lrzd/759547ff4356de6e3d9e08522b0d0807/data/conf/type/__dump_environment/manifest for object __dump_environment/whatever
272c270
< Ran 225 tests in 44.457s
---
> Ran 225 tests in 43.750s
```
2020-12-06 20:24:00 +01:00
3930f69456 __block: fix escaping in here-doc
This changes the here-document to do not interpret any shell-things. It
also single-quotes some more strings that are printed to code-remote.

Fixes #838
2020-12-06 16:45:58 +01:00
087be130fa __iptables_apply: shorten copyright header
Do we need all the copyright header or is this sufficient? The licence
is given for cdist, but not on the target host. But it should be clear
anyway.
2020-12-04 19:23:49 +01:00
Dennis Camera
2d19856840 [type/__package_pkgng_freebsd] Set ASSUME_ALWAYS_YES instead of -y 2020-12-04 18:26:03 +01:00
ba7d16a155 __iptables_*: correct manpage spelling 2020-12-04 17:57:55 +01:00
Darko Poljak
d44b5cfdc9 Release 6.9.3 2020-12-04 15:31:35 +01:00
Darko Poljak
c7fa2efe6b ++changelog 2020-12-04 15:30:08 +01:00
74426a7827 Merge branch 'fix/pip-install' into 'master'
Hotfix: Add cdist.scan to packages

See merge request ungleich-public/cdist!960
2020-12-04 15:30:12 +01:00
Dennis Camera
1055e92545 [setup.py] Add cdist.scan to packages 2020-12-02 19:54:41 +01:00
a1db5c3d0e __iptables*: Update manpages for execution order
To make some thinks clear if someone needs it ..
2020-12-02 18:22:31 +01:00
bee255c1ae __iptables_apply: man updates 2020-12-02 18:04:50 +01:00
f568462e49 __iptables_rule: fix shellcheck SC2235 2020-12-02 17:48:41 +01:00
84172550df __iptables*: add IPv6 support
Because it currently only support IPv4. To implement this, it falls back
to IPv4 for backward compatibilty, but now supports rules for IPv6 and
both protocols at the same time.
2020-11-30 20:35:19 +01:00
Darko Poljak
23e0da521c Release 6.9.2 2020-11-20 19:46:55 +01:00
Darko Poljak
803a9d62a7 ++changelog 2020-11-20 19:46:03 +01:00
a234445e85 Merge branch 'feature/type/__localedef' into 'master'
__localedef: Add new type to replace __locale

See merge request ungleich-public/cdist!951
2020-11-20 19:42:52 +01:00
Darko Poljak
82eadb6994 ++changelog 2020-11-19 19:34:43 +01:00
58b28d2d75 Merge branch 'feature/type/__sshd_config' into 'master'
__sshd config: New type

See merge request ungleich-public/cdist!958
2020-11-19 19:33:49 +01:00
9d4f69250e __sshd config: New type 2020-11-19 19:33:47 +01:00
6c539d67af Merge branch 'fix/type/__hostname/fix-os-version-detection' into 'master'
__hostname: fix guessing of SuSE OS version

See merge request ungleich-public/cdist!953
2020-11-19 19:31:53 +01:00
d30cd5c2b2 Merge branch 'bugfix/in-script-import' into 'master'
Fix importing cdist module

Closes #845

See merge request ungleich-public/cdist!957
2020-11-14 15:09:42 +01:00
Dennis Camera
87faffd875 [type/__localdef] Also check for aliases in state explorer 2020-11-14 11:45:31 +01:00
Dennis Camera
eeb9871919 [type/__localedef] glibc: Also delete aliases when removing a locale 2020-11-14 11:45:31 +01:00
Dennis Camera
575bb62dc5 [type/__localedef] Externalise functions to separate files 2020-11-14 11:45:31 +01:00
Dennis Camera
c1c60e3374 [type/__localedef] Blacklist OpenBSD and NetBSD 2020-11-14 11:45:31 +01:00
Dennis Camera
dcef2c19f5 [type/__localedef] Add support for FreeBSD 2020-11-14 11:45:31 +01:00
Dennis Camera
f44888f192 [type/__localedef] Only install dependencies in manifest. OS checking moved to gencode-remote 2020-11-14 11:45:31 +01:00
Dennis Camera
cc29e54b85 [type/__localedef] Differentiate between OSes and better handling of normalized locale names 2020-11-14 11:45:31 +01:00
Dennis Camera
54e689f7c2 [type/__localedef] Add state explorer 2020-11-14 10:48:18 +01:00
Dennis Camera
f75d477209 Deprecate __locale and replace with __localedef 2020-11-14 10:48:18 +01:00
Darko Poljak
76aa00b12e Fix importing cdist module
Resolve #845.
2020-11-14 10:23:43 +01:00
Darko Poljak
5092752786 Update build helper script in .gitattributes 2020-11-14 09:59:30 +01:00
Darko Poljak
a07a458871 ++changelog 2020-11-13 06:43:01 +01:00
105797ccb4 Merge branch 'feature/type/__hwclock' into 'master'
__hwclock: New type

See merge request ungleich-public/cdist!956
2020-11-13 06:35:58 +01:00
17fb8bb5d5 Merge branch 'feature/tests/keep-going' into 'master'
cdist-build-helper shellcheck* keep going

See merge request ungleich-public/cdist!955
2020-11-13 06:32:31 +01:00
ac31e95ec0 Merge branch 'fix/ci' into 'master'
Make the pipeline green again

See merge request ungleich-public/cdist!954
2020-11-13 06:30:37 +01:00
Dennis Camera
ebf471e8d0 [type/__hwclock] Add new type 2020-11-13 02:32:45 +01:00
Dennis Camera
2f70a8b540 [bin/cdist-build-helper] Keep going in shellcheck targets 2020-11-11 15:25:46 +01:00
Dennis Camera
c39eb1dbce [cdist.emulator] Fix setting of log level (tests OK) 2020-11-11 15:16:33 +01:00
Dennis Camera
0ee3fda94d Fix paths to cdist executable 2020-11-11 15:05:04 +01:00
Dennis Camera
f82e0167aa [.gitlab-ci.yml] Make version before other targets 2020-11-11 14:49:04 +01:00
Dennis Camera
e2d4f8037a [bin/cdist-build-helper] Fix paths to ex scripts/ scripts 2020-11-11 14:45:05 +01:00
Dennis Camera
21dd500c05 Make pycodestyle pipeline happy 2020-11-11 14:44:44 +01:00
Dennis Camera
87a0d91587 [type/__hostname] Fix OS version detection for SuSE
everything should be suse now…
2020-11-11 14:21:35 +01:00
Dennis Camera
702f3eba4f [type/__hostname] Remove opensuse-leap OS string
everything should be suse now…
2020-11-11 14:21:35 +01:00
Dennis Camera
3e48ef9e11 [type/__hostname] Lint
- Error if expected environment variables are unset
- Always wrap variable expansions in {}
2020-11-11 14:21:35 +01:00
Darko Poljak
ba90651052 ++changelog 2020-11-11 07:49:32 +01:00
bf9d70bb8c Merge branch 'reorg' into 'master'
small reorganization

See merge request ungleich-public/cdist!942
2020-11-11 07:49:08 +01:00
461c287323 Merge branch 'feature/__locale/explorer' into 'master'
__locale: add state explorer

See merge request ungleich-public/cdist!950
2020-11-11 07:42:41 +01:00
304f420072 Merge branch 'docs/cdist-best-practice/24-9' into 'master'
docs: Add missing 'config' command in 24.9. Testing a new type

See merge request ungleich-public/cdist!952
2020-11-11 07:41:53 +01:00
792b4b1076 Add missing 'config' command 2020-11-09 12:08:54 +01:00
a95eab77a5 __locale: add state explorer
.. so it doesn't execute code all the time.
2020-11-08 15:28:14 +01:00
aa5e882fce Merge branch 'master' into reorg 2020-10-21 20:26:51 +03:00
6964070282 s/build-helper/cdist-build-helper/ 2020-10-18 17:13:22 +03:00
d20fb74324 use os.path.realpath instead, because it eliminates any symbolic links encountered in the path 2020-10-17 23:16:42 +03:00
54d83a6211 there is no single author anymore, also remove www. 2020-10-16 15:50:50 +03:00
e55db1b427 use check_output for git describe execution and define fallback VERSION earlier 2020-10-16 15:41:38 +03:00
b41d80075a update paths in setup.py 2020-10-16 14:16:04 +03:00
42d5d6c3e2 redundant str() 2020-10-16 14:12:39 +03:00
65c8af4ba3 overengineered version discovery 2020-10-16 14:11:12 +03:00
174aa77280 __file__ already is absolute 2020-10-16 14:11:00 +03:00
1614b62f70 fallback VERSION to "unknown version" 2020-10-16 13:48:28 +03:00
fd04c03613 add parent dir to module search path only when importing fails 2020-10-16 13:42:16 +03:00
86057cef19 don't die if there is no version.py 2020-10-14 02:20:58 +03:00
fdc1ab93e9 move scripts/* to bin/ 2020-10-14 02:20:58 +03:00
3f1939716f enable running scripts/cdist directly and symlinked 2020-10-14 02:20:30 +03:00
45d51c0e15 rename build-helper -> cdist-build-helper 2020-10-14 02:18:25 +03:00
8ecae42199 remove bin/cdist script 2020-10-14 02:18:25 +03:00
68 changed files with 2373 additions and 325 deletions

2
.gitattributes vendored
View file

@ -4,5 +4,5 @@
docs/speeches export-ignore
docs/video export-ignore
docs/src/man7 export-ignore
bin/build-helper export-ignore
bin/cdist-build-helper export-ignore
README-maintainers export-ignore

View file

@ -1,20 +1,23 @@
---
image: code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest
stages:
- test
image: code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest
unit_tests:
stage: test
script:
- ./bin/build-helper version
- ./bin/build-helper test
pycodestyle:
stage: test
script:
- ./bin/build-helper pycodestyle
before_script:
- ./bin/cdist-build-helper version
shellcheck:
stage: test
script:
- ./bin/build-helper shellcheck
- ./bin/cdist-build-helper shellcheck
pycodestyle:
stage: test
script:
- ./bin/cdist-build-helper pycodestyle
unit_tests:
stage: test
script:
- ./bin/cdist-build-helper test

View file

@ -1,4 +1,4 @@
Maintainers should use ./bin/build-helper script.
Maintainers should use ./bin/cdist-build-helper script.
Makefile is intended for end users. It can be used for non-maintaining
targets that can be run from pure source (without git repository).

View file

@ -1,7 +1,8 @@
#!/bin/sh
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
# 2012 Nico Schottelius (nico-cdist at schottelius.org)
# 2010-2016 Nico Schottelius (nico-cdist at schottelius.org)
# 2016 Darko Poljak (darko.poljak at gmail.com)
#
# This file is part of cdist.
#
@ -20,14 +21,81 @@
#
#
# Wrapper for real script to allow execution from checkout
dir=${0%/*}
import logging
import os
import sys
# Ensure version is present - the bundled/shipped version contains a static version,
# the git version contains a dynamic version
"$dir/build-helper" version
# See if this file's parent is cdist module
# and if so add it to module search path.
cdist_dir = os.path.realpath(
os.path.join(
os.path.dirname(os.path.realpath(__file__)),
os.pardir))
cdist_init_dir = os.path.join(cdist_dir, 'cdist', '__init__.py')
if os.path.exists(cdist_init_dir):
sys.path.insert(0, cdist_dir)
libdir=$(cd "${dir}/../" && pwd -P)
export PYTHONPATH="${libdir}"
import cdist # noqa 402
import cdist.argparse # noqa 402
import cdist.banner # noqa 402
import cdist.config # noqa 402
import cdist.install # noqa 402
import cdist.shell # noqa 402
import cdist.inventory # noqa 402
"$dir/../scripts/cdist" "$@"
def commandline():
"""Parse command line"""
# preos subcommand hack
if len(sys.argv) > 1 and sys.argv[1] == 'preos':
return cdist.preos.PreOS.commandline(sys.argv[1:])
parser, cfg = cdist.argparse.parse_and_configure(sys.argv[1:])
args = cfg.get_args()
# Work around python 3.3 bug:
# http://bugs.python.org/issue16308
# http://bugs.python.org/issue9253
# FIXME: catching AttributeError also hides
# real problems.. try a different way
# FIXME: we always print main help, not
# the help of the actual parser being used!
try:
getattr(args, "func")
except AttributeError:
parser['main'].print_help()
sys.exit(0)
args.func(args)
if __name__ == "__main__":
if sys.version < cdist.MIN_SUPPORTED_PYTHON_VERSION:
print('Python >= {} is required on the source host.'.format(
cdist.MIN_SUPPORTED_PYTHON_VERSIO), file=sys.stderr)
sys.exit(1)
exit_code = 0
try:
import re
import os
if re.match("__", os.path.basename(sys.argv[0])):
import cdist.emulator
emulator = cdist.emulator.Emulator(sys.argv)
emulator.run()
else:
commandline()
except KeyboardInterrupt:
exit_code = 2
except cdist.Error as e:
log = logging.getLogger("cdist")
log.error(e)
exit_code = 1
sys.exit(exit_code)

View file

@ -45,7 +45,7 @@ usage() {
shellcheck-manifests
shellcheck-local-gencodes
shellcheck-remote-gencodes
shellcheck-scripts
shellcheck-bin
shellcheck-gencodes
shellcheck-types
shellcheck
@ -405,7 +405,7 @@ eof
;;
pycodestyle|pep8)
pycodestyle "${basedir}" "${basedir}/scripts/cdist"
pycodestyle "${basedir}" "${basedir}/bin/cdist"
;;
check-pycodestyle)
@ -460,27 +460,34 @@ eof
test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
;;
shellcheck-scripts)
# NOTE: shellcheck-scripts is kept for compatibility
shellcheck-bin|shellcheck-scripts)
# shellcheck disable=SC2086
${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type > "${SHELLCHECKTMP}"
${SHELLCHECKCMD} bin/cdist-dump bin/cdist-new-type > "${SHELLCHECKTMP}"
test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
;;
shellcheck-gencodes)
"$0" shellcheck-local-gencodes || exit 1
"$0" shellcheck-remote-gencodes || exit 1
errors=false
"$0" shellcheck-local-gencodes || errors=true
"$0" shellcheck-remote-gencodes || errors=true
! $errors || exit 1
;;
shellcheck-types)
"$0" shellcheck-type-explorers || exit 1
"$0" shellcheck-manifests || exit 1
"$0" shellcheck-gencodes || exit 1
errors=false
"$0" shellcheck-type-explorers || errors=true
"$0" shellcheck-manifests || errors=true
"$0" shellcheck-gencodes || errors=true
! $errors || exit 1
;;
shellcheck)
"$0" shellcheck-global-explorers || exit 1
"$0" shellcheck-types || exit 1
"$0" shellcheck-scripts || exit 1
errors=false
"$0" shellcheck-global-explorers || errors=true
"$0" shellcheck-types || errors=true
"$0" shellcheck-bin || errors=true
! $errors || exit 1
;;
shellcheck-type-files)
@ -490,12 +497,14 @@ eof
;;
shellcheck-with-files)
"$0" shellcheck || exit 1
"$0" shellcheck-type-files || exit 1
errors=false
"$0" shellcheck || errors=true
"$0" shellcheck-type-files || errors=true
! $errors || exit 1
;;
shellcheck-build-helper)
${SHELLCHECKCMD} ./bin/build-helper
${SHELLCHECKCMD} ./bin/cdist-build-helper
;;
check-shellcheck)

View file

@ -22,12 +22,27 @@
import os
import hashlib
import subprocess
import cdist.log
VERSION = 'unknown version'
try:
import cdist.version
VERSION = cdist.version.VERSION
except ModuleNotFoundError:
cdist_dir = os.path.abspath(
os.path.join(os.path.dirname(__file__), os.pardir))
if os.path.isdir(os.path.join(cdist_dir, '.git')):
try:
VERSION = subprocess.check_output(
['git', 'describe', '--always'],
cwd=cdist_dir,
universal_newlines=True)
except Exception:
pass
BANNER = """
.. . .x+=:. s

View file

@ -70,6 +70,11 @@ case "$("$__explorer/os")" in
macosx)
sw_vers -productVersion
;;
freebsd)
# Apparently uname -r is not a reliable way to get the patch level.
# See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251743
freebsd-version
;;
*bsd|solaris)
uname -r
;;

View file

@ -0,0 +1,104 @@
cdist-type__debian_backports(7)
===============================
NAME
----
cdist-type__apt_backports - Install backports
DESCRIPTION
-----------
This singleton type installs backports for the current OS release.
It aborts if backports are not supported for the specified OS or
no version codename could be fetched (like Debian unstable).
The package index will be automatically updated if required.
It supports backports from following OSes:
- Debian
- Devuan
- Ubuntu
REQUIRED PARAMETERS
-------------------
None.
OPTIONAL PARAMETERS
-------------------
state
Represents the state of the backports repository. ``present`` or
``absent``, defaults to ``present``.
Will be directly passed to :strong:`cdist-type__apt_source`\ (7).
mirror
The mirror to fetch the backports from. Will defaults to the generic
mirror of the current OS.
Will be directly passed to :strong:`cdist-type__apt_source`\ (7).
BOOLEAN PARAMETERS
------------------
None.
MESSAGES
--------
None.
EXAMPLES
--------
.. code-block:: sh
# setup the backports
__apt_backports
__apt_backports --state absent
__apt_backports --state present --mirror "http://ftp.de.debian.org/debian/"
# install a backports package
# currently for the buster release backports
require="__apt_backports" __package_apt wireguard \
--target-release buster-backports
ABORTS
------
Aborts if the detected os is not Debian.
Aborts if no distribuition codename could be detected. This is common for the
unstable distribution, but there is no backports repository for it already.
CAVEATS
-------
For Ubuntu, it setup all componenents for the backports repository: ``main``,
``restricted``, ``universe`` and ``multiverse``. The user may not want to
install proprietary packages, which will only be installed if the user
explicitly uses the backports target-release. The user may change this behavior
to install backports packages without the need of explicitly select it.
SEE ALSO
--------
`Official Debian Backports site <https://backports.debian.org/>`_
:strong:`cdist-type__apt_source`\ (7)
AUTHORS
-------
Matthias Stecher <matthiasstecher at gmx.de>
COPYING
-------
Copyright \(C) 2020 Matthias Stecher. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

View file

@ -0,0 +1,81 @@
#!/bin/sh -e
# __apt_backports/manifest
#
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
#
# Enables/disables backports repository. Utilises __apt_source for it.
#
# Get the distribution codename by /etc/os-release.
# is already executed in a subshell by string substitution
# lsb_release may not be given in all installations
codename_os_release() {
# shellcheck disable=SC1090
. "$__global/explorer/os_release"
printf "%s" "$VERSION_CODENAME"
}
# detect backport distribution
os="$(cat "$__global/explorer/os")"
case "$os" in
debian)
dist="$( codename_os_release )"
components="main"
mirror="http://deb.debian.org/debian/"
;;
devuan)
dist="$( codename_os_release )"
components="main"
mirror="http://deb.devuan.org/merged"
;;
ubuntu)
dist="$( codename_os_release )"
components="main restricted universe multiverse"
mirror="http://archive.ubuntu.com/ubuntu"
;;
*)
printf "Backports for %s are not supported!\n" "$os" >&2
exit 1
;;
esac
# error if no codename given (e.g. on Debian unstable)
if [ -z "$dist" ]; then
printf "No backports for unkown version of distribution %s!\n" "$os" >&2
exit 1
fi
# parameters
state="$(cat "$__object/parameter/state")"
# mirror already set for the os, only override user-values
if [ -f "$__object/parameter/mirror" ]; then
mirror="$(cat "$__object/parameter/mirror")"
fi
# install the given backports repository
__apt_source "${dist}-backports" \
--state "$state" \
--distribution "${dist}-backports" \
--component "$components" \
--uri "$mirror"

View file

@ -0,0 +1 @@
present

View file

@ -0,0 +1,2 @@
state
mirror

View file

@ -46,28 +46,29 @@ fi
remove_block() {
cat << DONE
tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX)
tmpfile=\$(mktemp ${quoted_file}.cdist.XXXXXXXXXX)
# preserve ownership and permissions of existing file
if [ -f "$file" ]; then
cp -p "$file" "\$tmpfile"
if [ -f $quoted_file ]; then
cp -p $quoted_file "\$tmpfile"
fi
awk -v prefix=^$(quote "$prefix")\$ -v suffix=^$(quote "$suffix")\$ '
awk -v prefix=$(quote "$prefix") -v suffix=$(quote "$suffix") '
{
if (match(\$0,prefix)) {
if (\$0 == prefix) {
triggered=1
}
if (triggered) {
if (match(\$0,suffix)) {
if (\$0 == suffix) {
triggered=0
}
} else {
print
}
}' "$file" > "\$tmpfile"
mv -f "\$tmpfile" "$file"
}' $quoted_file > "\$tmpfile"
mv -f "\$tmpfile" $quoted_file
DONE
}
quoted_file="$(quote "$file")"
case "$state_should" in
present)
if [ "$state_is" = "changed" ]; then
@ -77,7 +78,7 @@ case "$state_should" in
echo add >> "$__messages_out"
fi
cat << DONE
cat >> "$file" << ${__type##*/}_DONE
cat >> $quoted_file << '${__type##*/}_DONE'
$(cat "$block")
${__type##*/}_DONE
DONE

View file

@ -25,6 +25,9 @@ user
OPTIONAL PARAMETERS
-------------------
dirmode
forwarded to :strong:`__directory` type as mode
mode
forwarded to :strong:`__file` type

View file

@ -19,6 +19,7 @@ set -eu
user="$(cat "${__object}/parameter/user")"
home="$(cat "${__object}/explorer/home")"
primary_group="$(cat "${__object}/explorer/primary_group")"
dirmode="$(cat "${__object}/parameter/dirmode")"
# Create parent directory. Type __directory has flag 'parents', but it
# will leave us with root-owned directory in user home, which is not
@ -36,6 +37,7 @@ export CDIST_ORDER_DEPENDENCY
for dir ; do
__directory "${home}/${dir}" \
--group "${primary_group}" \
--mode "${dirmode}" \
--owner "${user}"
done

View file

@ -0,0 +1 @@
0700

View file

@ -1,3 +1,4 @@
state
mode
source
dirmode

View file

@ -20,25 +20,26 @@
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
os=$(cat "$__global/explorer/os")
name_running=$(cat "$__global/explorer/hostname")
has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
os=$(cat "${__global:?}/explorer/os")
name_running=$(cat "${__global:?}/explorer/hostname")
has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl")
if test -s "$__object/parameter/name"
if test -s "${__object:?}/parameter/name"
then
name_should=$(cat "$__object/parameter/name")
name_should=$(cat "${__object:?}/parameter/name")
else
case $os
case ${os}
in
# RedHat-derivatives and BSDs
centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd)
(centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd)
# Hostname is FQDN
name_should="${__target_host}"
name_should=${__target_host:?}
;;
*)
(*)
# Hostname is only first component of FQDN
name_should="${__target_host%%.*}"
name_should=${__target_host:?}
name_should=${name_should%%.*}
;;
esac
fi
@ -47,46 +48,46 @@ fi
################################################################################
# Check if the (running) hostname is already correct
#
test "$name_running" != "$name_should" || exit 0
test "${name_running}" != "${name_should}" || exit 0
################################################################################
# Setup hostname
#
echo 'changed' >>"$__messages_out"
echo 'changed' >>"${__messages_out:?}"
# Use the good old way to set the hostname.
case $os
case ${os}
in
alpine|debian|devuan|ubuntu)
(alpine|debian|devuan|ubuntu)
echo 'hostname -F /etc/hostname'
;;
archlinux)
(archlinux)
echo 'command -v hostnamectl >/dev/null 2>&1' \
"&& hostnamectl set-hostname '$name_should'" \
"|| hostname '$name_should'"
"&& hostnamectl set-hostname '${name_should}'" \
"|| hostname '${name_should}'"
;;
centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void)
echo "hostname '$name_should'"
(centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void)
echo "hostname '${name_should}'"
;;
openwrt)
echo "echo '$name_should' >/proc/sys/kernel/hostname"
(openwrt)
echo "echo '${name_should}' >/proc/sys/kernel/hostname"
;;
macosx)
echo "scutil --set HostName '$name_should'"
(macosx)
echo "scutil --set HostName '${name_should}'"
;;
solaris)
echo "uname -S '$name_should'"
(solaris)
echo "uname -S '${name_should}'"
;;
slackware|suse|opensuse-leap)
(slackware|suse)
# We do not read from /etc/HOSTNAME, because the running
# hostname is the first component only while the file contains
# the FQDN.
echo "hostname '$name_should'"
echo "hostname '${name_should}'"
;;
*)
(*)
# Fall back to set the hostname using hostnamectl, if available.
if test -n "$has_hostnamectl"
if test -n "${has_hostnamectl}"
then
# Don't use hostnamectl as the primary means to set the hostname for
# systemd systems, because it cannot be trusted to work reliably and
@ -97,7 +98,8 @@ in
echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\"" \
" || hostname -F /etc/hostname"
else
printf "echo 'Unsupported OS: %s' >&2\nexit 1\n" "$os"
printf "echo 'Unsupported OS: %s' >&2\n" "${os}"
printf 'exit 1\n'
fi
;;
esac

View file

@ -20,69 +20,49 @@
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
not_supported() {
echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
echo "Please contribute an implementation for it if you can." >&2
exit 1
}
set_hostname_systemd() {
echo "$1" | __file /etc/hostname --source -
}
os=$(cat "$__global/explorer/os")
os_version=$(cat "$__global/explorer/os_version")
os_major=$(echo "$os_version" | grep -o '^[0-9][0-9]*' || true)
os=$(cat "${__global:?}/explorer/os")
max_len=$(cat "$__object/explorer/max_len")
has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
max_len=$(cat "${__object:?}/explorer/max_len")
has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl")
if test -s "$__object/parameter/name"
if test -s "${__object:?}/parameter/name"
then
name_should=$(cat "$__object/parameter/name")
name_should=$(cat "${__object:?}/parameter/name")
else
case $os
case ${os}
in
# RedHat-derivatives and BSDs
centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware)
(centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware|suse)
# Hostname is FQDN
name_should="${__target_host}"
;;
suse|opensuse-leap)
# Classic SuSE stores the FQDN in /etc/HOSTNAME, while
# systemd does not. The running hostname is the first
# component in both cases.
# In versions before 15.x, the FQDN is stored in /etc/hostname.
if test -n "$has_hostnamectl" && test "$os_major" -ge 15 \
&& test "$os_major" -ne 42
then
name_should="${__target_host%%.*}"
else
name_should="${__target_host}"
fi
name_should=${__target_host:?}
;;
*)
# Hostname is only first component of FQDN on all other systems.
name_should="${__target_host%%.*}"
name_should=${__target_host:?}
name_should=${name_should%%.*}
;;
esac
fi
if test -n "$max_len" && test "$(printf '%s' "$name_should" | wc -c)" -gt "$max_len"
if test -n "${max_len}" && test "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
then
printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
exit 1
fi
case $os
case ${os}
in
alpine|debian|devuan|ubuntu|void)
echo "$name_should" | __file /etc/hostname --source -
(alpine|debian|devuan|ubuntu|void)
echo "${name_should}" | __file /etc/hostname --source -
;;
archlinux)
if test -n "$has_hostnamectl"
(archlinux)
if test -n "${has_hostnamectl}"
then
set_hostname_systemd "$name_should"
set_hostname_systemd "${name_should}"
else
echo 'Ancient ArchLinux variants without hostnamectl are not supported.' >&2
exit 1
@ -97,8 +77,8 @@ in
# --value "\"$name_should\""
fi
;;
centos|fedora|redhat|scientific)
if test -z "$has_hostnamectl"
(centos|fedora|redhat|scientific)
if test -z "${has_hostnamectl}"
then
# Only write to /etc/sysconfig/network on non-systemd versions.
# On systemd-based versions this entry is ignored.
@ -106,63 +86,83 @@ in
--file /etc/sysconfig/network \
--delimiter '=' --exact_delimiter \
--key HOSTNAME \
--value "\"$name_should\""
--value "\"${name_should}\""
else
set_hostname_systemd "$name_should"
set_hostname_systemd "${name_should}"
fi
;;
gentoo)
(gentoo)
# Only write to /etc/conf.d/hostname on OpenRC-based installations.
# On systemd use hostnamectl(1) in gencode-remote.
if test -z "$has_hostnamectl"
if test -z "${has_hostnamectl}"
then
__key_value '/etc/conf.d/hostname:hostname' \
--file /etc/conf.d/hostname \
--delimiter '=' --exact_delimiter \
--key 'hostname' \
--value "\"$name_should\""
--value "\"${name_should}\""
else
set_hostname_systemd "$name_should"
fi
;;
freebsd)
(freebsd)
__key_value '/etc/rc.conf:hostname' \
--file /etc/rc.conf \
--delimiter '=' --exact_delimiter \
--key 'hostname' \
--value "\"$name_should\""
--value "\"${name_should}\""
;;
macosx)
(macosx)
# handled in gencode-remote
:
;;
netbsd)
(netbsd)
__key_value '/etc/rc.conf:hostname' \
--file /etc/rc.conf \
--delimiter '=' --exact_delimiter \
--key 'hostname' \
--value "\"$name_should\""
--value "\"${name_should}\""
# To avoid confusion, ensure that the hostname is only stored once.
__file /etc/myname --state absent
;;
openbsd)
echo "$name_should" | __file /etc/myname --source -
(openbsd)
echo "${name_should}" | __file /etc/myname --source -
;;
openwrt)
__uci system.@system[0].hostname --value "$name_should"
(openwrt)
__uci system.@system[0].hostname --value "${name_should}"
# --transaction hostname
;;
slackware)
(slackware)
# We write the FQDN into /etc/HOSTNAME. But /etc/rc.d/rc.M will only
# read the first component from this file and set it as the running
# hostname on boot.
echo "$name_should" | __file /etc/HOSTNAME --source -
echo "${name_should}" | __file /etc/HOSTNAME --source -
;;
solaris)
echo "$name_should" | __file /etc/nodename --source -
(solaris)
echo "${name_should}" | __file /etc/nodename --source -
;;
suse|opensuse-leap)
(suse)
if test -s "${__global:?}/explorer/os_release"
then
# shellcheck source=/dev/null
os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}")
else
os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version")
fi
os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)')
# Classic SuSE stores the FQDN in /etc/HOSTNAME, while
# systemd does not. The running hostname is the first
# component in both cases.
# In versions before 15.x, the FQDN is stored in /etc/hostname.
if test -n "${has_hostnamectl}" \
&& test "${os_major}" -ge 15 \
&& test "${os_major}" -ne 42
then
# strip away everything but the first part from $name_should
name_should=${name_should%%.*}
fi
# Modern SuSE provides /etc/HOSTNAME as a symlink for
# backwards-compatibility. Unfortunately it cannot be used
# here as __file does not follow the symlink.
@ -171,23 +171,25 @@ in
# not work correctly on openSUSE 12.x which provides
# hostnamectl but not /etc/hostname.
if test -n "$has_hostnamectl" -a "$os_major" -gt 12
if test -n "${has_hostnamectl}" -a "${os_major}" -gt 12
then
hostname_file='/etc/hostname'
hostname_file=/etc/hostname
else
hostname_file='/etc/HOSTNAME'
hostname_file=/etc/HOSTNAME
fi
echo "$name_should" | __file "$hostname_file" --source -
echo "${name_should}" | __file "${hostname_file}" --source -
;;
*)
(*)
# On other operating systems we fall back to systemd's
# hostnamectl if available…
if test -n "$has_hostnamectl"
if test -n "${has_hostnamectl}"
then
set_hostname_systemd "$name_should"
set_hostname_systemd "${name_should}"
else
not_supported
echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2
echo "Please contribute an implementation for it if you can." >&2
exit 1
fi
;;
esac

View file

@ -0,0 +1,28 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Prints the clock mode read from the /etc/adjtime file, if present.
#
# not all operating systems use an adjfile
test -f /etc/adjtime || exit 0
# 3rd line is clock mode
# adjtime(5) https://man7.org/linux/man-pages/man5/adjtime.5.html
sed -n 3p /etc/adjtime

View file

@ -0,0 +1,27 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Prints the LocalRTC property using timedatectl on systemd-based systems.
#
command -v timedatectl >/dev/null 2>&1 || exit 0
# NOTE: Older versions of timedatectl do not support `timedatectl show'
timedatectl --no-pager status \
| awk -F': ' '$1 ~ "RTC in local TZ$" { sub(/[ \t]*$/, "", $2); print $2 }'

View file

@ -0,0 +1,62 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
mode=$(cat "${__object:?}/parameter/mode")
timedatectl_localrtc=$(cat "${__object:?}/explorer/timedatectl_localrtc")
adjtime_mode=$(cat "${__object:?}/explorer/adjtime_mode")
case ${mode}
in
(localtime)
adjtime_str=LOCAL
local_rtc_str=yes
;;
(UTC|utc)
adjtime_str=UTC
local_rtc_str=no
;;
(*)
printf 'Invalid value for --mode: %s\n' "${mode}" >&2
printf 'Acceptable values are: localtime, utc.\n' >&2
exit 1
esac
if test -n "${timedatectl_localrtc}"
then
# systemd
timedatectl_should=${local_rtc_str}
if test "${timedatectl_localrtc}" != "${timedatectl_should}"
then
printf 'timedatectl set-local-rtc %s\n' "${timedatectl_should}"
fi
elif test -n "${adjtime_mode}"
then
# others (update /etc/adjtime if present)
if test "${adjtime_mode}" != "${adjtime_str}"
then
# Update /etc/adjtime (3rd line is clock mode)
# adjtime(5) https://man7.org/linux/man-pages/man5/adjtime.5.html
# FIXME: Should maybe add third line if adjfile only contains two lines
printf "sed -i '3c\\\\\\n%s\\n' /etc/adjtime\\n" "${adjtime_str}"
fi
fi

View file

@ -0,0 +1,63 @@
cdist-type__hwclock(7)
======================
NAME
----
cdist-type__hwclock - Manage the hardware real time clock.
DESCRIPTION
-----------
This type can be used to control how the hardware clock is used by the operating
system.
REQUIRED PARAMETERS
-------------------
mode
What mode the hardware clock is in.
Acceptable values:
localtime
The hardware clock is set to local time (common for systems also running
Windows.)
UTC
The hardware clock is set to UTC (common on UNIX systems.)
OPTIONAL PARAMETERS
-------------------
None.
BOOLEAN PARAMETERS
------------------
None.
EXAMPLES
--------
.. code-block:: sh
# Make the operating system treat the time read from the hwclock as UTC.
__hwclock --mode UTC
SEE ALSO
--------
:strong:`hwclock`\ (8)
AUTHORS
-------
Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
COPYING
-------
Copyright \(C) 2020 Dennis Camera. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

View file

@ -0,0 +1,222 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# TODO: Consider supporting BADYEAR
os=$(cat "${__global:?}/explorer/os")
mode=$(cat "${__object:?}/parameter/mode")
has_systemd_timedatectl=$(test -s "${__object:?}/explorer/timedatectl_localrtc" && echo true || echo false)
case ${mode}
in
(localtime)
local_clock=true
;;
(UTC|utc)
local_clock=false
;;
(*)
printf 'Invalid value for --mode: %s\n' "${mode}" >&2
printf 'Acceptable values are: UTC, localtime.\n' >&2
exit 1
esac
case ${os}
in
(alpine|gentoo)
if ! $has_systemd_timedatectl
then
# NOTE: Gentoo also supports systemd, in which case /etc/conf.d is
# not used. So we check for systemd presence here and only
# update /etc/conf.d if systemd is not installed.
# https://wiki.gentoo.org/wiki/System_time#Hardware_clock
export CDIST_ORDER_DEPENDENCY=true
__file /etc/conf.d/hwclock --state present \
--owner root --group root --mode 0644
__key_value /etc/conf.d/hwclock:clock \
--file /etc/conf.d/hwclock \
--key clock \
--delimiter '=' --exact_delimiter \
--value "\"$($local_clock && echo local || echo UTC)\""
unset CDIST_ORDER_DEPENDENCY
fi
;;
(centos|fedora|redhat|scientific)
os_version=$(cat "${__global:?}/explorer/os_version")
os_major=$(expr "${os_version}" : '.* release \([0-9]*\)')
case ${os}
in
(centos|scientific)
update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false)
;;
(fedora)
update_sysconfig=$(test "${os_major}" -lt 10 && echo true || echo false)
;;
(redhat|*)
case ${os_version}
in
('Red Hat Enterprise Linux'*)
update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false)
;;
('Red Hat Linux'*)
update_sysconfig=true
;;
(*)
printf 'Could not determine Red Hat distribution.\n' >&2
printf "Please contribute an implementation for it if you can.\n" >&2
exit 1
;;
esac
;;
esac
if ${update_sysconfig:?}
then
export CDIST_ORDER_DEPENDENCY=true
__file /etc/sysconfig/clock --state present \
--owner root --group root --mode 0644
__key_value /etc/sysconfig/clock:UTC \
--file /etc/sysconfig/clock \
--key UTC \
--delimiter '=' --exact_delimiter \
--value "$($local_clock && echo false || echo true)"
unset CDIST_ORDER_DEPENDENCY
fi
;;
(debian|devuan|ubuntu)
os_major=$(sed 's/[^0-9].*$//' "${__global:?}/explorer/os_version")
case ${os}
in
(debian)
if test "${os_major}" -ge 7
then
update_rcS=false
elif test "${os_major}" -ge 3
then
update_rcS=true
else
# Debian 2.2 should be supportable using rcS.
# Debian 2.1 uses the ancient GMT key.
# Debian 1.3 does not have rcS.
printf "Your operating system (Debian %s) is currently not supported by this type (%s)\n" \
"$(cat "${__global:?}/explorer/os_version")" "${__type##*/}" >&2
printf "Please contribute an implementation for it if you can.\n" >&2
exit 1
fi
;;
(devuan)
update_rcS=false
;;
(ubuntu)
update_rcS=$(test "${os_major}" -lt 16 && echo true || echo false)
;;
esac
if ${update_rcS}
then
export CDIST_ORDER_DEPENDENCY=true
__file /etc/default/rcS --state present \
--owner root --group root --mode 0644
__key_value /etc/default/rcS:UTC \
--file /etc/default/rcS \
--key UTC \
--delimiter '=' --exact_delimiter \
--value "$($local_clock && echo no || echo yes)"
unset CDIST_ORDER_DEPENDENCY
fi
;;
(freebsd)
# cf. adjkerntz(8)
__file /etc/wall_cmos_clock \
--state "$($local_clock && echo present || echo absent)" \
--owner root --group wheel --mode 0444
;;
(netbsd)
# https://wiki.netbsd.org/guide/boot/#index9h2
__key_value /etc/rc.conf:rtclocaltime \
--file /etc/rc.conf \
--key rtclocaltime \
--delimiter '=' --exact_delimiter \
--value "$($local_clock && echo YES || echo NO)"
;;
(slackware)
__file /etc/hardwareclock --owner root --group root --mode 0644 \
--source - <<-EOF
# /etc/hardwareclock
#
# Tells how the hardware clock time is stored.
# This file is managed by cdist.
$($local_clock && echo localtime || echo UTC)
EOF
;;
(suse)
if test -s "${__global:?}/explorer/os_release"
then
# shellcheck source=/dev/null
os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}")
else
os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version")
fi
os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)')
# TODO: Consider using `yast2 timezone set hwclock' instead
if expr "${os_major}" \< 12
then
# Starting with SuSE 12 (first systemd-based version)
# /etc/sysconfig/clock does not contain the HWCLOCK line
# anymore.
# With SuSE 13, it has been reduced to TIMEZONE configuration.
__key_value /etc/sysconfig/clock:HWCLOCK \
--file /etc/sysconfig/clock \
--delimiter '=' --exact_delimiter \
--key HWCLOCK \
--value "$($local_clock && echo '"--localtime"' || echo '"-u"')"
fi
;;
(void)
export CDIST_ORDER_DEPENDENCY=true
__file /etc/rc.conf \
--owner root --group root --mode 0644 \
--state present
__key_value /etc/rc.conf:HARDWARECLOCK \
--file /etc/rc.conf \
--delimiter '=' --exact_delimiter \
--key HARDWARECLOCK \
--value "\"$($local_clock && echo localtime || echo UTC)\""
unset CDIST_ORDER_DEPENDENCY
;;
(*)
if ! $has_systemd_timedatectl
then
printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2
printf "Please contribute an implementation for it if you can.\n" >&2
exit 1
fi
;;
esac
# NOTE: timedatectl set-local-rtc for systemd is in gencode-remote
# NOTE: /etc/adjtime is also updated in gencode-remote

View file

@ -0,0 +1 @@
mode

View file

View file

@ -1,7 +1,4 @@
#!/bin/sh
# Nico Schottelius
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
#
### BEGIN INIT INFO
# Provides: iptables
# Required-Start: $local_fs $remote_fs
@ -14,34 +11,72 @@
# and saves/restores previous status
### END INIT INFO
# Originally written by:
# Nico Schottelius
# Zürisee, Mon Sep 2 18:38:27 CEST 2013
#
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
#
# This file is distributed with cdist and licenced under the
# GNU GPLv3+ WITHOUT ANY WARRANTY.
# Read files and execute the content with the given commands
#
# Arguments:
# 1: Directory
# 2..n: Commands which should be used to execute the file content
gothrough() {
cd "$1" || return
shift
# iterate through all rules and continue if it's not a file
for rule in *; do
[ -f "$rule" ] || continue
echo "Appling iptables rule $rule ..."
# execute it with all commands specificed
ruleparam="$(cat "$rule")"
for cmd in "$@"; do
# Command and Rule should be split.
# shellcheck disable=SC2046
command $cmd $ruleparam
done
done
}
# Shortcut for iptables command to do IPv4 and v6
# only applies to the "reset" target
iptables() {
command iptables "$@"
command ip6tables "$@"
}
basedir=/etc/iptables.d
status="${basedir}/.pre-start"
status4="${basedir}/.pre-start"
status6="${basedir}/.pre-start6"
case $1 in
start)
# Save status
iptables-save > "$status"
iptables-save > "$status4"
ip6tables-save > "$status6"
# Apply our ruleset
cd "$basedir" || exit
count="$(find . ! -name . -prune | wc -l)"
# Only do something if there are rules
if [ "$count" -ge 1 ]; then
for rule in *; do
echo "Applying iptables rule $rule ..."
# Rule should be split.
# shellcheck disable=SC2046
iptables $(cat "$rule")
done
fi
gothrough "$basedir" iptables
#gothrough "$basedir/v4" iptables # conflicts with $basedir
gothrough "$basedir/v6" ip6tables
gothrough "$basedir/all" iptables ip6tables
;;
stop)
# Restore from status before, if there is something to restore
if [ -f "$status" ]; then
iptables-restore < "$status"
if [ -f "$status4" ]; then
iptables-restore < "$status4"
fi
if [ -f "$status6" ]; then
ip6tables-restore < "$status6"
fi
;;
restart)

View file

@ -10,7 +10,24 @@ DESCRIPTION
-----------
This cdist type deploys an init script that triggers
the configured rules and also re-applies them on
configuration.
configuration. Rules are written from __iptables_rule
into the folder ``/etc/iptables.d/``.
It reads all rules from the base folder as rules for IPv4.
Rules in the subfolder ``v6/`` are IPv6 rules. Rules in
the subfolder ``all/`` are applied to both rule tables. All
files contain the arguments for a single ``iptables`` and/or
``ip6tables`` command.
Rules are applied in the following order:
1. All IPv4 rules
2. All IPv6 rules
2. All rules that should be applied to both tables
The order of the rules that will be applied are definite
from the result the shell glob returns, which should be
alphabetical. If rules must be applied in a special order,
prefix them with a number like ``02-some-rule``.
REQUIRED PARAMETERS
@ -24,7 +41,7 @@ None
EXAMPLES
--------
None (__iptables_apply is used by __iptables_rule)
None (__iptables_apply is used by __iptables_rule automatically)
SEE ALSO
@ -35,11 +52,13 @@ SEE ALSO
AUTHORS
-------
Nico Schottelius <nico-cdist--@--schottelius.org>
Matthias Stecher <matthiasstecher--@--gmx.de>
COPYING
-------
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
Copyright \(C) 2013 Nico Schottelius.
Copyright \(C) 2020 Matthias Stecher.
You can redistribute it and/or modify it under the terms of the GNU
General Public License as published by the Free Software Foundation,
either version 3 of the License, or (at your option) any later version.

View file

@ -11,6 +11,10 @@ DESCRIPTION
This cdist type allows you to manage iptable rules
in a distribution independent manner.
See :strong:`cdist-type__iptables_apply`\ (7) for the
execution order of these rules. It will be executed
automaticly to apply all rules non-volaite.
REQUIRED PARAMETERS
-------------------
@ -25,6 +29,24 @@ state
'present' or 'absent', defaults to 'present'
BOOLEAN PARAMETERS
------------------
All rules without any of these parameters will be treated like ``--v4`` because
of backward compatibility.
v4
Explicitly set it as rule for IPv4. If IPv6 is set, too, it will be
threaten like ``--all``. Will be the default if nothing else is set.
v6
Explicitly set it as rule for IPv6. If IPv4 is set, too, it will be
threaten like ``--all``.
all
Set the rule for both IPv4 and IPv6. It will be saved separately from the
other rules.
EXAMPLES
--------
@ -48,6 +70,16 @@ EXAMPLES
--state absent
# IPv4-only rule for ICMPv4
__iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT"
# IPv6-only rule for ICMPv6
__iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT"
# doing something for the dual stack
__iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT"
__iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT"
SEE ALSO
--------
:strong:`cdist-type__iptables_apply`\ (7), :strong:`iptables`\ (8)
@ -56,11 +88,13 @@ SEE ALSO
AUTHORS
-------
Nico Schottelius <nico-cdist--@--schottelius.org>
Matthias Stecher <matthiasstecher--@--gmx.de>
COPYING
-------
Copyright \(C) 2013 Nico Schottelius. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
Copyright \(C) 2013 Nico Schottelius.
Copyright \(C) 2020 Matthias Stecher.
You can redistribute it and/or modify it under the terms of the GNU
General Public License as published by the Free Software Foundation,
either version 3 of the License, or (at your option) any later version.

View file

@ -1,6 +1,7 @@
#!/bin/sh -e
#
# 2013 Nico Schottelius (nico-cdist at schottelius.org)
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
#
# This file is part of cdist.
#
@ -24,12 +25,36 @@ base_dir=/etc/iptables.d
name="$__object_id"
state="$(cat "$__object/parameter/state")"
if [ -f "$__object/parameter/v4" ]; then
only_v4="yes"
# $specific_dir is $base_dir
fi
if [ -f "$__object/parameter/v6" ]; then
only_v6="yes"
specific_dir="$base_dir/v6"
fi
# If rules should be set for both protocols
if { [ "$only_v4" = "yes" ] && [ "$only_v6" = "yes" ]; } ||
[ -f "$__object/parameter/all" ]; then
# all to a specific directory
specific_dir="$base_dir/all"
fi
# set rule directory based on if it's the base or subdirectory
rule_dir="${specific_dir:-$base_dir}"
################################################################################
# Basic setup
#
__directory "$base_dir" --state present
# sub-directory if required
if [ "$specific_dir" ]; then
require="__directory/$base_dir" __directory "$specific_dir" --state present
fi
# Have apply do the real job
require="$__object_name" __iptables_apply
@ -37,6 +62,15 @@ require="$__object_name" __iptables_apply
# The rule
#
require="__directory/$base_dir" __file "$base_dir/${name}" \
for dir in "$base_dir" "$base_dir/v6" "$base_dir/all"; do
# defaults to absent except the directory that should contain the file
if [ "$rule_dir" = "$dir" ]; then
curr_state="$state"
else
curr_state="absent"
fi
require="__directory/$rule_dir" __file "$dir/$name" \
--source "$__object/parameter/rule" \
--state "$state"
--state "$curr_state"
done

View file

@ -0,0 +1,3 @@
all
v4
v6

View file

@ -0,0 +1 @@
This type is deprecated. Please use __localedef instead.

View file

@ -0,0 +1,36 @@
#!/bin/sh -e
# __locale/explorer/state
#
# 2020 Matthias Stecher (matthiasstecher at gmx.de)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
#
# Check if the locale is already installed on the system.
# Outputs 'present' or 'absent' depending if the locale exists.
#
# Get user-defined locale
# locale name is echoed differently than the user propably set it (for UTF-8)
locale="$(echo "$__object_id" | sed 's/UTF-8/utf8/')"
# Check if the given locale exists on the system
if localedef --list-archive | grep -qFx "$locale"; then
echo present
else
echo absent
fi

View file

@ -23,6 +23,15 @@
locale="$__object_id"
state_is=$(cat "$__object/explorer/state")
state_should=$(cat "$__object/parameter/state")
# short circuit if there is nothing to do
if [ "$state_is" = "$state_should" ]; then
exit 0
fi
# Hardcoded, create a pull request with
# branching on $os in case it is at another location
alias=/usr/share/locale/locale.alias
@ -35,8 +44,6 @@ charmap=$(echo "$locale" | cut -d . -f 2)
# W-T-F!
locale_remove=$(echo "$locale" | sed 's/UTF-8/utf8/')
state=$(cat "$__object/parameter/state")
os=$(cat "$__global/explorer/os")
# Nothing to be done on alpine
@ -46,7 +53,7 @@ case "$os" in
;;
esac
case "$state" in
case "$state_should" in
present)
echo localedef -A "$alias" -f "$charmap" -i "$input" "$locale"
;;
@ -54,7 +61,7 @@ case "$state" in
echo localedef --delete-from-archive "$locale_remove"
;;
*)
echo "Unsupported state: $state" >&2
echo "Unsupported state: $state_should" >&2
exit 1
;;
esac

View file

@ -0,0 +1,100 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# This explorer determines if the locale is defined on the target system.
# Will print nothing on error.
#
# Possible output:
# present:
# the main locale (and possibly aliases) is present
# absent:
# neither the main locale nor any aliases are present
# alias-present:
# the main locale is absent, but at least one of its aliases is present
#
# Hardcoded, create a pull request in case it is at another location for
# some other distro. (cf. gencode-remote)
aliasfile='/usr/share/locale/locale.alias'
command -v locale >/dev/null 2>&1 || exit 0
locales=$(locale -a)
parse_locale() {
# This function will split locales into their parts. Locale strings are
# usually of the form: [language[_territory][.codeset][@modifier]]
# For simplicity, language and territory are not separated by this function.
# Old Linux systems were also using "english" or "german" as locale strings.
# Usage: parse_locale locale_str lang_var codeset_var modifier_var
eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')"
eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')"
eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')"
}
format_locale() {
# Usage: format_locale language codeset modifier
printf '%s' "$1"
test -z "$2" || printf '.%s' "$2"
test -z "$3" || printf '@%s' "$3"
printf '\n'
}
gnu_normalize_codeset() {
# reimplementation of glibc/locale/programs/localedef.c normalize_codeset()
echo "$*" | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]'
}
locale_available() (
echo "${locales}" | grep -qxF "$1" || {
# glibc uses "normalized" locale names in archives.
# If a locale is stored in an archive, the normalized name will be
# printed by locale, so that needs to be checked, too.
localename=$(
parse_locale "$1" _lang _codeset _modifier \
&& format_locale "${_lang:?}" "$(gnu_normalize_codeset "${_codeset?}")" \
"${_modifier?}")
echo "${locales}" | grep -qxF "${localename}"
}
)
if locale_available "${__object_id:?}"
then
echo present
else
# NOTE: locale.alias can be symlinked.
if test -e "${aliasfile}"
then
# Check if one of the aliases of the locale is defined
baselocale=$(
parse_locale "${__object_id:?}" _lang _codeset _modifiers \
&& format_locale "${_lang}" "${_codeset}")
while read -r _alias _localename
do
if test "${_localename}" = "${baselocale}" \
&& echo "${locales}" | grep -qxF "${_alias}"
then
echo alias-present
exit 0
fi
done <"${aliasfile}"
fi
echo absent
fi

View file

@ -0,0 +1,5 @@
# -*- mode: sh; indent-tabs-mode: t -*-
gnu_normalize_codeset() {
echo "$*" | tr -cd '[:alnum:]' | tr '[:upper:]' '[:lower:]'
}

View file

@ -0,0 +1,20 @@
# -*- mode: sh; indent-tabs-mode:t -*-
parse_locale() {
# This function will split locales into their parts. Locale strings are
# usually of the form: [language[_territory][.codeset][@modifier]]
# For simplicity, language and territory are not separated by this function.
# Old Linux systems were also using "english" or "german" as locale strings.
# Usage: parse_locale locale_str lang_var codeset_var modifier_var
eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')"
eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')"
eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')"
}
format_locale() {
# Usage: format_locale language codeset modifier
printf '%s' "$1"
test -z "$2" || printf '.%s' "$2"
test -z "$3" || printf '@%s' "$3"
printf '\n'
}

View file

@ -0,0 +1,136 @@
#!/bin/sh -e
#
# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org)
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Manage system locales using localedef(1).
#
# shellcheck source=cdist/conf/type/__localedef/files/lib/locale.sh
. "${__type:?}/files/lib/locale.sh"
# shellcheck source=cdist/conf/type/__localedef/files/lib/glibc.sh
. "${__type:?}/files/lib/glibc.sh"
state_is=$(cat "${__object:?}/explorer/state")
state_should=$(cat "${__object:?}/parameter/state")
test "${state_should}" = 'present' -o "${state_should}" = 'absent' || {
printf 'Invalid state: %s\n' "${state_should}" >&2
exit 1
}
# NOTE: If state explorer fails (e.g. locale(1) missing), the following check
# will always fail and let definition/removal run.
if test "${state_is}" = "${state_should}"
then
exit 0
fi
locale=${__object_id:?}
os=$(cat "${__global:?}/explorer/os")
if expr "${locale}" : '.*/' >/dev/null
then
printf 'Paths as locales are not supported.\n' >&2
printf '__object_id is: %s\n' "${locale}" >&2
exit 1
fi
: "${lang=}" "${codeset=}" "${modifier=}" # declare variables for shellcheck
parse_locale "${locale}" lang codeset modifier
case ${os}
in
(alpine|openwrt)
printf '%s does not support locales.\n' "${os}" >&2
exit 1
;;
(archlinux|debian|devuan|ubuntu|suse|centos|fedora|redhat|scientific)
# FIXME: The code below only works for glibc-based installations.
# NOTE: Hardcoded, create a pull request in case it is at another
# location for some opther distro.
# NOTE: locale.alias can be symlinked (e.g. Debian)
aliasfile='/usr/share/locale/locale.alias'
case ${state_should}
in
(present)
input=$(format_locale "${lang}" '' "${modifier}")
cat <<-EOF
set --
if test -e '${aliasfile}'
then
set -- -A '${aliasfile}'
fi
localedef -i '${input}' -f '${codeset}' "\$@" '${locale}'
EOF
;;
(absent)
main_localename=$(format_locale "${lang}" "$(gnu_normalize_codeset "${codeset}")" "${modifier}")
cat <<-EOF
while read -r _alias _localename
do
if test "\${_localename}" = '$(format_locale "${lang}" "${codeset}")'
then
localedef --delete-from-archive "\${_alias}"
fi
done <'${aliasfile}'
EOF
if test "${state_is}" = present
then
printf "localedef --delete-from-archive '%s'\n" "${main_localename}"
fi
;;
esac
;;
(freebsd)
case ${state_should}
in
(present)
if expr "$(grep -oe '^[0-9]*' "${__global:?}/explorer/os_version")" '>=' 11 >/dev/null
then
# localedef(1) is available with FreeBSD >= 11
printf "localedef -i '%s' -f '%s' '%s'\n" "${input}" "${codeset}" "${locale}"
else
printf 'localedef(1) was added to FreeBSD starting with version 11.\n' >&2
printf 'Please upgrade your FreeBSD installation to use %s.\n' "${__type##*/}" >&2
exit 1
fi
;;
(absent)
printf "rm -R '/usr/share/locale/%s'\n" "${locale}"
;;
esac
;;
(netbsd|openbsd)
# NetBSD/OpenBSD are missing localedef(1).
# We also do not delete defined locales because they can't be recreated.
echo "${os} is lacking localedef(1). Locale management unavailable." >&2
exit 1
;;
(*)
echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2
echo "Please contribute an implementation for it if you can." >&2
exit 1
;;
esac

View file

@ -0,0 +1,60 @@
cdist-type__localedef(7)
========================
NAME
----
cdist-type__localedef - Define and remove system locales
DESCRIPTION
-----------
This cdist type allows you to define locales on the system using
:strong:`localedef`\ (1) or remove them.
On systems that don't support definition of new locales, the type will raise an
error.
**NB:** This type respects the glibc ``locale.alias`` file,
i.e. it defines alias locales or deletes aliases of a locale when it is removed.
It is not possible, however, to use alias names to define locales or only remove
certain aliases of a locale.
OPTIONAL PARAMETERS
-------------------
state
``present`` or ``absent``. Defaults to ``present``.
EXAMPLES
--------
.. code-block:: sh
# Add locale de_CH.UTF-8
__localedef de_CH.UTF-8
# Same as above, but more explicit
__localedef de_CH.UTF-8 --state present
# Remove colourful British English
__localedef en_GB.UTF-8 --state absent
SEE ALSO
--------
:strong:`locale`\ (1),
:strong:`localedef`\ (1),
:strong:`cdist-type__locale_system`\ (7)
AUTHORS
-------
| Dennis Camera <dennis.camera--@--ssrq-sds-fds.ch>
| Nico Schottelius <nico-cdist--@--schottelius.org>
COPYING
-------
Copyright \(C) 2013-2019 Nico Schottelius, 2020 Dennis Camera. Free use of this
software is granted under the terms of the GNU General Public License version 3
or later (GPLv3+).

View file

@ -0,0 +1,30 @@
#!/bin/sh -e
#
# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org)
# 2015 David Hürlimann (david at ungleich.ch)
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Install required packages.
#
case $(cat "${__global:?}/explorer/os")
in
(debian|devuan)
__package_apt locales --state present
;;
esac

View file

@ -0,0 +1 @@
present

View file

@ -0,0 +1 @@
state

View file

@ -75,7 +75,7 @@ execcmd(){
esac
if [ -z "${pkg_bootstrapped}" ]; then
echo "pkg bootstrap -y >/dev/null 2>&1"
echo "ASSUME_ALWAYS_YES=yes pkg bootstrap >/dev/null 2>&1"
fi
echo "$_cmd >/dev/null 2>&1" # Silence the output of the command

View file

@ -0,0 +1,121 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Determines the current state of the config option.
# Possible output:
# - present: "should" option present in config file
# - default: the "should" option is the default -> dont know if present
# - absent: no such option present in config file
#
joinlines() { sed -n -e H -e "\${x;s/^\\n//;s/\\n/${1:?}/g;p;}"; }
trlower() { tr '[:upper:]' '[:lower:]'; }
tolower() { printf '%s' "$*" | trlower; }
default_value() {
sshd -T -f /dev/null -C "$(make_conn_spec)" \
| sed -n -e 's/^'"$(tolower "${1:?}")"'[[:blank:]]\{1,\}//p'
}
make_conn_spec() {
if test -s "${__object:?}/parameter/match"
then
_match_file="${__object:?}/parameter/match"
else
_match_file='/dev/null'
fi
for _kw in \
addr=Address \
user=User \
host=Host \
laddr=LocalAddress \
lport=LocalPort \
rdomain=RDomain
do
_specname=${_kw%%=*}
_confname=$(tolower "${_kw#*=}")
while read -r _k _v
do
if test "$(tolower "${_k}")" = "${_confname}"
then
printf '%s=%s\n' "${_specname}" "${_v}"
continue 2
fi
done <"${_match_file}"
# NOTE: Print test spec even for empty keys to suppress errors like:
# 'Match User' in configuration but 'user' not in connection test specification.
# except lport:
# Invalid port '' in test mode specification lport=
test "${_specname}" = 'lport' || printf '%s=\n' "${_specname}"
done \
| joinlines ','
unset _match_file
}
sshd_config_file=$(cat "${__object:?}/parameter/file")
state_should=$(cat "${__object:?}/parameter/state")
if test -s "${__object:?}/parameter/option"
then
option_name=$(cat "${__object:?}/parameter/option")
else
option_name=${__object_id:?}
fi
value_should=$(cat "${__object:?}/parameter/value" 2>/dev/null) \
|| test "${state_should}" = absent || exit 0 # param optional if --state absent
command -v sshd >/dev/null 2>&1 || {
echo 'Cannot find sshd.' >&2
exit 1
}
test -e "${sshd_config_file}" || {
echo 'absent'
exit 0
}
value_is=$(
sshd -T -f "${sshd_config_file}" -C "$(make_conn_spec)" \
| sed -n -e 's/^'"$(tolower "${option_name}")"'[[:blank:]]\{1,\}//p')
if printf '%s\n' "${value_is}" | {
if test -n "${value_should}"
then
grep -q -x -F "${value_should}"
else
# if no value provided, assume "any" value
grep -q -e .
fi
}
then
if default_value "${option_name}" | grep -q -x -F "${value_is}"
then
# Might produce false positives for default values.
# TODO: Manual checking should be done, but for simplicity, this case is
# currently ignored here.
echo default
else
echo present
fi
else
echo absent
fi

View file

@ -0,0 +1,293 @@
# -*- mode: awk; indent-tabs-mode: t -*-
function usage() {
print_err("Usage: awk -f update_sshd_config.awk -- -o set|unset [-m 'User git'] -l 'X11Forwarding no' /etc/ssh/sshd_config")
}
function print_err(s) { print s | "cat >&2" }
function alength(a, i) {
for (i = 0; (i + 1) in a; ++i);
return i
}
function join(sep, a, i, s) {
for (i = i ? i : 1; i in a; i++)
s = s sep a[i]
return substr(s, 2)
}
function getopt(opts, argv, target, files, i, c, lv, idx, nf) {
# trivial getopt(3) implementation; only basic functionality
if (argv[1] == "--") i++
for (i += 1; i in argv; i++) {
if (lv) { target[c] = argv[i]; lv = 0; continue }
if (argv[i] ~ /^-/) {
c = substr(argv[i], 2, 1)
idx = index(opts, c)
if (!idx) {
print_err(sprintf("invalid option -%c\n", c))
continue
}
if (substr(opts, idx + 1, 1) == ":") {
# option takes argument
if (length(argv[i]) > 2)
target[c] = substr(argv[i], 3)
else
lv = 1
} else {
target[c] = 1
}
} else
files[++nf] = argv[i]
}
}
# tokenise configuration line
# this function mimics the counterpart in OpenSSH (misc.c)
# but it returns two (next token SUBSEP rest) because I didnt want to have to
# simulate any pointer magic.
function strdelim_internal(s, split_equals, old) {
if (!s)
return ""
old = s
if (!match(s, WHITESPACE "|" QUOTE "" (split_equals ? "|" EQUALS : "")))
return s
s = substr(s, RSTART)
old = substr(old, 1, RSTART - 1)
if (s ~ "^" QUOTE) {
old = substr(old, 2)
# Find matching quote
if (match(s, QUOTE)) {
old = substr(old, 1, RSTART)
# s = substr()
if (match(s, "^" WHITESPACE "*"))
s = substr(s, RLENGTH)
return old
} else {
# no matching quote
return ""
}
}
if (match(s, "^" WHITESPACE "+")) {
sub("^" WHITESPACE "+", "", s)
if (split_equals)
sub(EQUALS WHITESPACE "*", "", s)
} else if (s ~ "^" EQUALS) {
s = substr(s, 2)
}
return old SUBSEP s
}
function strdelim(s) { return strdelim_internal(s, 1) }
function strdelimw(s) { return strdelim_internal(s, 0) }
function singleton_option(opt) {
return tolower(opt) !~ /^(acceptenv|allowgroups|allowusers|denygroups|denyusers|hostcertificate|hostkey|listenaddress|logverbose|permitlisten|permitopen|port|setenv|subsystem)$/
}
function print_update() {
if (mode) {
if (match_only) printf "\t"
printf "%s\n", line_should
updated = 1
}
}
BEGIN {
FS = "\n" # disable field splitting
WHITESPACE = "[ \t]" # servconf.c, misc.c:strdelim_internal (without line breaks, cf. bugs)
QUOTE = "[\"]" # misc.c:strdelim_internal
EQUALS = "[=]"
split("", opts)
split("", files)
getopt("ho:l:m:", ARGV, opts, files)
if (opts["h"]) { usage(); exit (e="0") }
line_should = opts["l"]
match_only = opts["m"]
num_files = alength(files)
if (num_files != 1 || !opts["o"] || !line_should) {
usage()
exit (e=126)
}
if (opts["o"] == "set") {
mode = 1
} else if (opts["o"] == "unset") {
mode = 0
} else {
print_err(sprintf("invalid mode %s\n", mode))
exit (e=1)
}
if (mode) {
# loop over sshd_config twice!
ARGV[2] = ARGV[1] = files[1]
ARGC = 3
} else {
# only loop once
ARGV[1] = files[1]
ARGC = 2
}
split(strdelim(line_should), should, SUBSEP)
option_should = tolower(should[1])
value_should = should[2]
}
{
line = $0
# Strip trailing whitespace. Allow \f (form feed) at EOL only
sub("(" WHITESPACE "|\f)*$", "", line)
# Strip leading whitespace
sub("^" WHITESPACE "*", "", line)
if (match(line, "^#" WHITESPACE "*")) {
prefix = substr(line, RSTART, RLENGTH)
line = substr(line, RSTART + RLENGTH)
} else {
prefix = ""
}
line_type = "invalid"
option_is = value_is = ""
if (line) {
split(strdelim(line), toks, SUBSEP)
if (tolower(toks[1]) == "match") {
MATCH = (prefix ~ /^#/ ? "#" : "") join(" ", toks, 2)
line_type = "match"
} else if (toks[1] ~ /^[A-Za-z][A-Za-z0-9]+$/) {
# This could be an option line
line_type = "option"
option_is = tolower(toks[1])
value_is = toks[2]
}
} else {
line_type = "empty"
}
}
# mode: unset
!mode {
# delete matching config
if (prefix !~ /^#/)
if (MATCH == match_only && option_is == option_should)
if (!value_should || value_should == value_is)
next
print
next
}
# mode: set
mode && NR == FNR {
if (line_type == "option") {
if (MATCH !~ /^#/) {
if (prefix ~ /^#/) {
# comment line
last_occ[MATCH, "#" option_is] = FNR
} else {
# option line
last_occ[MATCH, option_is] = FNR
}
last_occ[MATCH] = FNR
}
} else if (line_type == "invalid" && !prefix) {
# INVALID LINE
print_err(sprintf("%s: syntax error on line %u\n", ARGV[0], FNR))
}
next
}
# before second pass prepare hashes containing location information to be used
# in the second pass.
mode && NR > FNR && FNR == 1 {
# First we drop the locations of commented-out options if a non-commented
# option is available. If a non-commented option is available, we will
# append new config options there to have them all at one place.
for (k in last_occ) {
if (k ~ /^#/) {
# delete entries of commented out match blocks
delete last_occ[k]
continue
}
split(k, parts, SUBSEP)
if (parts[2] ~ /^#/ && ((parts[1], substr(parts[2], 2)) in last_occ))
delete last_occ[k]
}
# Reverse the option => line mapping. The line_map allows for easier lookups
# in the second pass.
# We only keep options, not top-level keywords, because we can only have
# one entry per line and there are conflicts with last lines of "sections".
for (k in last_occ) {
if (!index(k, SUBSEP)) continue
line_map[last_occ[k]] = k
}
}
# Second pass
mode && line_map[FNR] == match_only SUBSEP option_should && !updated {
split(line_map[FNR], parts, SUBSEP)
# If option allows multiple values, print current value
if (!singleton_option(parts[2])) {
if (value_should != value_is)
print
}
print_update()
next
}
mode { print }
# Is a comment option
mode && line_map[FNR] == match_only SUBSEP "#" option_should && !updated {
print_update()
}
# Last line of the should match section
mode && last_occ[match_only] == FNR && !updated {
# NOTE: Inserting empty lines is only cosmetic. It is only done if
# different options are next to each other and not in a match block
# (match blocks are usually not in the default config and thus dont
# contain commented blocks.)
if (line && option_is != option_should && !MATCH)
print ""
print_update()
}
END {
if (e) exit e
if (mode && !updated) {
if (match_only && MATCH != match_only) {
printf "\nMatch %s\n", match_only
}
print_update()
}
}

View file

@ -0,0 +1,98 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
joinlines() { sed -n -e H -e "\${x;s/^\\n//;s/\\n/${1:?}/g;p;}"; }
state_is=$(cat "${__object:?}/explorer/state")
state_should=$(cat "${__object:?}/parameter/state")
if test "${state_is}" = "${state_should}" -o "${state_is}" = 'default'
then
# nothing to do (if the value is the default, ignore its state)
exit 0
fi
case ${state_should}
in
(present)
mode='set'
;;
(absent)
mode='unset'
;;
(*)
printf 'Invalid --state: %s\n' "${state_should}" >&2
exit 1
;;
esac
sshd_config_file=$(cat "${__object:?}/parameter/file")
quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
drop_awk_comments() { quote "$(sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@")"; }
# Ensure the sshd_config file is there
cat <<EOF
test -e $(quote "${sshd_config_file}") || {
: >$(quote "${sshd_config_file}")
chown 0:0 $(quote "${sshd_config_file}")
chmod 0644 $(quote "${sshd_config_file}")
}
EOF
match_only=
if test -s "${__object:?}/parameter/match"
then
match_only=$(joinlines ' ' <"${__object:?}/parameter/match")
fi
if test -s "${__object:?}/parameter/option"
then
option_line=$(cat "${__object:?}/parameter/option")
else
option_line=${__object_id:?}
fi
if test -s "${__object:?}/parameter/value"
then
option_line="${option_line} $(cat "${__object:?}/parameter/value")"
fi
# Send message on config update
printf '%s%s %s\n' "${mode}" "${match_only:+ [${match_only}]}" \
"${option_line}" >>"${__messages_out:?}"
# Update sshd_config (remote code)
cat <<EOF
awk $(drop_awk_comments "${__type:?}/files/update_sshd_config.awk") \\
-o ${mode} \\
-m $(quote "${match_only}") \\
-l $(quote "${option_line}") \\
$(quote "${sshd_config_file}") >$(quote "${sshd_config_file}.tmp") \\
|| exit
cmp -s $(quote "${sshd_config_file}") $(quote "${sshd_config_file}.tmp") || {
sshd -t -f $(quote "${sshd_config_file}.tmp") \\
&& cat $(quote "${sshd_config_file}.tmp") >$(quote "${sshd_config_file}") \\
|| exit # stop if sshd_config file check fails
}
rm -f $(quote "${sshd_config_file}.tmp")
EOF

View file

@ -0,0 +1,98 @@
cdist-type__sshd_config(7)
==========================
NAME
----
cdist-type__sshd_config - Manage options in sshd_config
DESCRIPTION
-----------
This space intentionally left blank.
REQUIRED PARAMETERS
-------------------
None.
OPTIONAL PARAMETERS
-------------------
file
The path to the sshd_config file to edit.
Defaults to ``/etc/ssh/sshd_config``.
match
Restrict this option to apply only for certain connections.
Allowed values are what would be allowed to be written after a ``Match``
keyword in ``sshd_config``, e.g. ``--match 'User anoncvs'``.
Can be used multiple times. All of the values are ANDed together.
option
The name of the option to manipulate. Defaults to ``__object_id``.
state
Can be:
- ``present``: ensure a matching config line is present (or the default
value).
- ``absent``: ensure no matching config line is present.
value
The option's value to be assigned to the option (if ``--state present``) or
removed (if ``--state absent``).
This option is required if ``--state present``. If not specified and
``--state absent``, all values for the given option are removed.
BOOLEAN PARAMETERS
------------------
None.
EXAMPLES
--------
.. code-block:: sh
# Disallow root logins with password
__sshd_config PermitRootLogin --value without-password
# Disallow password-based authentication
__sshd_config PasswordAuthentication --value no
# Accept the EDITOR environment variable
__sshd_config AcceptEnv:EDITOR --option AcceptEnv --value EDITOR
# Force command for connections as git user
__sshd_config git@ForceCommand --match 'User git' --option ForceCommand \
--value 'cd ~git && exec git-shell ${SSH_ORIGINAL_COMMAND:+-c "${SSH_ORIGINAL_COMMAND}"}'
SEE ALSO
--------
:strong:`sshd_config`\ (5)
BUGS
----
- This type assumes a nicely formatted config file,
i.e. no config options spanning multiple lines.
- ``Include`` directives are ignored.
- Config options are not added/removed to/from the config file if their value is
the default value.
- | The explorer will incorrectly report ``absent`` if OpenSSH internally
transforms one value to another (e.g. ``permitrootlogin prohibit-password``
is transformed to ``permitrootlogin without-password``).
| Workaround: Use the value that OpenSSH uses internally.
AUTHORS
-------
Dennis Camera <dennis.camera--@--ssrq-sds-fds.ch>
COPYING
-------
Copyright \(C) 2020 Dennis Camera. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

View file

@ -0,0 +1,48 @@
#!/bin/sh -e
#
# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
os=$(cat "${__global:?}/explorer/os")
state_should=$(cat "${__object:?}/parameter/state")
case ${os}
in
(alpine|centos|fedora|redhat|scientific|debian|devuan|ubuntu)
if test "${state_should}" != 'absent'
then
__package openssh-server --state present
fi
;;
(archlinux|gentoo|slackware|suse)
if test "${state_should}" != 'absent'
then
__package openssh --state present
fi
;;
(freebsd|netbsd|openbsd)
# whitelist
;;
(*)
printf 'Your operating system (%s) is currently not supported by this type (%s)\n' \
"${os}" "${__type##*/}" >&2
printf 'Please contribute an implementation for it if you can.\n' >&2
exit 1
;;
esac

View file

@ -0,0 +1 @@
/etc/ssh/sshd_config

View file

@ -0,0 +1 @@
present

View file

@ -0,0 +1,4 @@
file
option
state
value

View file

@ -0,0 +1 @@
match

View file

@ -120,17 +120,18 @@ class Emulator:
level = logging.WARNING
else:
level = logging.WARNING
self.log = logging.getLogger(self.target_host[0])
try:
logging.root.setLevel(level)
self.log.setLevel(level)
except (ValueError, TypeError):
# if invalid __cdist_log_level value
logging.root.setLevel(logging.WARNING)
self.log.setLevel(logging.WARNING)
colored_log = self.env.get('__cdist_colored_log', 'false')
cdist.log.CdistFormatter.USE_COLORS = colored_log == 'true'
self.log = logging.getLogger(self.target_host[0])
def commandline(self):
"""Parse command line"""

View file

@ -54,13 +54,12 @@ _mydir = os.path.dirname(__file__)
def find_cdist_exec():
"""Search cdist executable starting from local lib directory.
Detect if ../scripts/cdist (from local lib direcotry) exists and
Detect if ../bin/cdist (from local lib directory) exists and
if it is executable. If not then try to find cdist exec path in
os.get_exec_path() entries. If no cdist path is found rasie
cdist.Error.
"""
cdist_path = os.path.abspath(os.path.join(_mydir, '..', 'scripts',
'cdist'))
cdist_path = os.path.abspath(os.path.join(_mydir, '..', 'bin', 'cdist'))
if os.access(cdist_path, os.X_OK):
return cdist_path
cdist_path = find_cdist_exec_in_path()

View file

@ -22,7 +22,7 @@ set -e
if [ "${debug}" ]
then
set -x
cdist_params="${cdist_params} -d"
cdist_params="${cdist_params} -l 3"
fi
bootstrap_dir="${target_dir}"

View file

@ -59,6 +59,8 @@ from scapy.all import *
# Datetime overwrites scapy.all.datetime - needs to be imported AFTER
import datetime
import cdist.config
log = logging.getLogger("scan")
@ -125,6 +127,18 @@ class Scanner(object):
with open(fname, "w") as fd:
fd.write(f"{now}\n")
def config(self):
"""
Configure a host
- Assume we are only called if necessary
- However we need to ensure to not run in parallel
- Maybe keep dict storing per host processes
- Save the result
- Save the output -> probably aligned to config mode
"""
def start(self):
self.process = Process(target=self.scan)
self.process.start()

View file

@ -26,7 +26,7 @@ import tempfile
cdist_base_path = os.path.abspath(
os.path.join(os.path.dirname(os.path.realpath(__file__)), "../../"))
cdist_exec_path = os.path.join(cdist_base_path, "scripts/cdist")
cdist_exec_path = os.path.join(cdist_base_path, "bin/cdist")
global_fixtures_dir = os.path.abspath(os.path.join(os.path.dirname(__file__),
"fixtures"))

View file

@ -20,7 +20,7 @@
#
#
import imp
import importlib
import os
import sys
import unittest
@ -37,8 +37,9 @@ for possible_test in os.listdir(base_dir):
suites = []
for test_module in test_modules:
module_parameters = imp.find_module(test_module, [base_dir])
module = imp.load_module("cdist.test." + test_module, *module_parameters)
module_spec = importlib.util.find_spec("cdist.test.{}".format(test_module))
module = importlib.util.module_from_spec(module_spec)
module_spec.loader.exec_module(module)
suite = unittest.defaultTestLoader.loadTestsFromModule(module)
# print("Got suite: " + suite.__str__())

View file

@ -202,7 +202,7 @@ class ConfigRunTestCase(test.CdistTestCase):
host_dir_name=self.hostdir,
# exec_path can not derivated from sys.argv in case of unittest
exec_path=os.path.abspath(os.path.join(
my_dir, '../../../scripts/cdist')),
my_dir, '../../../bin/cdist')),
initial_manifest=os.path.join(fixtures,
'manifest/dryrun_manifest'),
add_conf_dirs=[fixtures])
@ -219,7 +219,7 @@ class ConfigRunTestCase(test.CdistTestCase):
base_root_path=self.host_base_path,
host_dir_name=self.hostdir,
exec_path=os.path.abspath(os.path.join(
my_dir, '../../../scripts/cdist')),
my_dir, '../../../bin/cdist')),
initial_manifest=os.path.join(
fixtures, 'manifest/init-deps-resolver'),
add_conf_dirs=[fixtures])

View file

@ -1,6 +1,32 @@
Changelog
---------
next:
* Core: preos: Fix passing cdist debug parameter (Darko Poljak)
* Type __sshd_config: Produce error if invalid config is generated, fix processing of AuthenticationMethods and AuthorizedKeysFile, document explorer bug (Dennis Camera)
6.9.4: 2020-12-21
* Type __package_pkgng_freebsd: Fix bootstrapping pkg (Dennis Camera)
* Core: Deal with deprecated imp in unit tests (Evil Ham)
* Type __iptables: Add IPv6 support (Matthias Stecher)
* Type __block: Fix escaping in here-doc (Matthias Stecher)
* Explorer os_version: Improve FreeBSD support (Evil Ham)
* New type: __apt_backports (Matthias Stecher)
* Type __dot_file: Add dirmode parameter (Mark Verboom)
6.9.3: 2020-12-04
* pip install: Add cdist.scan to packages in setup.py (Dennis Camera)
6.9.2: 2020-11-20
* Documentation: Fix examples in best practice (Dennis Camera)
* Type __locale: Add state explorer (Matthias Stecher)
* Core: Reorganize scripts, version generation (Ander Punnar, Dennis Camera)
* New type: __hwclock (Dennis Camera)
* Type __hostname: Fix guessing SuSE OS version (Dennis Camera)
* New type: __sshd_config (Dennis Camera)
* New type: __localedef (Dennis Camera)
* Type __locale: Deprecate in favor of __localedef (Dennis Camera)
6.9.1: 2020-11-08
* Type __file: Fix state pre-exists (Dennis Camera)
* Type __hostname: Add support for OpenWrt (Dennis Camera)

View file

@ -54,4 +54,12 @@ VERBOSE: scan: Host fe80::f29f:c2ff:fe7c:275e is alive
VERBOSE: scan: Host fe80::ba69:f4ff:fec5:8db7 is alive
VERBOSE: scan: Host fe80::42b0:34ff:fe6f:f863 is alive
VERBOSE: scan: Host fe80::21b:fcff:feee:f4bc is alive
...
** Better usage -> saving the env
sudo -E cdist scan -b -I wlan0 -vv
** TODO Implement actual configuration step
- Also serves as a nice PoC
- Might need to escape literal IPv6 addresses for scp
** TODO Define how to map link local address to something useful
- via reverse DNS?
- via link local in manifest?
** TODO define ignorehosts?

View file

@ -200,15 +200,15 @@ of cdist:
.. code-block:: sh
# Singleton type without parameter
echo __ungleich_munin_server | cdist --initial-manifest - munin.panter.ch
echo __ungleich_munin_server | cdist config --initial-manifest - munin.panter.ch
# Singleton type with parameter
echo __ungleich_munin_node --allow 1.2.3.4 | \
cdist --initial-manifest - rails-19.panter.ch
cdist config --initial-manifest - rails-19.panter.ch
# Normal type
echo __file /tmp/stdintest --mode 0644 | \
cdist --initial-manifest - cdist-dev-01.ungleich.ch
cdist config --initial-manifest - cdist-dev-01.ungleich.ch
Other content in cdist repository

View file

@ -49,7 +49,7 @@ create version.py:
.. code-block:: sh
./bin/build-helper version
./bin/cdist-build-helper version
Then you install it with:
@ -70,7 +70,7 @@ Or directly with distutils:
python setup.py install
Note that `bin/build-helper` script is intended for cdist maintainers.
Note that `bin/cdist-build-helper` script is intended for cdist maintainers.
Available versions in git

199
other/examples/remote/cconn/cconn Executable file
View file

@ -0,0 +1,199 @@
#!/bin/sh -ex
# Copyright (c) 2021 Alexander Sieg
# cconn is a transparent wrapper that allows seamless usage of sudo/rsync and
# FreeBSD jails, this makes it possible to configure a FreeBSD by just using
# the host system sshd.
# Configuration is done by throw the cdist invertory system.
#
#
# Installation:
#
# Simply set this script as remote_exec and remote_copy implementation in your
# cdist.cfg. You MUST always pass either copy or exec as the first parameter
# to this script
#
# remote_exec = path/to/cconn exec
# remote_copy = path/to/cconn copy
#
# As cconn uses the cdist inventory system for host specific configuration, it
# ether need to be executed from the directory the contains the inventory
# directory or be setting the INVENTORY environment variable to path were the
# inventory entries are kept.
#
# Usage:
#
# To setup a host to use some form of connection "bending" (e.g. sudo) you need
# to add a single __cconn_options tag to the host inventory file. Options are always a
# key value pair separated by a '='. All options are passed in a single tag and
# a separated by a space.
#
# __cconn_options options:
#
# NOTE: jail_host and iocage_jail can not be used at the same time and will
# lead to a error
#
# jail_host:
# hostname on which the FreeBSD jail resides on.
#
# iocage_host:
# Same as jail_host, but for jails managed by iocage(8)
#
# jail_name:
# By default cconn will use the __target_host as the FreeBSD jail name, set
# this option to override this name
#
# sudo_user:
# Username used to connect to the __target_host, all commands are then
# prefixed with sudo and copy operations are done with rsync
#
# For this work you need to be able to execute all command without password entry.
# sudoers(5)
# %wheel ALL=(ALL) NOPASSWD: ALL
#
#Examples:
#
# inventory/jail.example.com:
# some_other_tag
# __cconn_options jail_host=example.com sudo_user=ada
#
#TODO: add sudo_pass and sudo_passfile option to support use without NOPASSWD
#TODO: support SSH connection multiplexing. This requieres a patch to cdist, as
# we need path to the tmp dir.
log() {
# Uncomment this for debugging
echo "$@" | logger -t "cdist-cconn-$COMMAND"
:
}
COMMAND="$1"; shift
if [ -z "$INVENTORY" ]; then
INVENTORY="inventory"
fi
# shellcheck disable=SC2154
options="$(sed -n 's/^__cconn_options\(.*\)$/\1/p' "$INVENTORY/$__target_host" | cut -d' ' -f2-)"
tmpcmd=$*
for option in $options; do
# shellcheck disable=SC2046
set -- $(echo "$option" | tr '=' ' ')
key="$1"
value="$2"
case "$1" in
"jail_host")
JAIL_HOST="$value"
;;
"iocage_host")
IOCAGE_HOST="$value"
;;
"jail_name")
JAIL_NAME="$value"
;;
"sudo_user")
SUDO_USER="$value"
;;
*)
log "unknown option $key=$value found"
;;
esac
done
# shellcheck disable=SC2086
set -- $tmpcmd
if [ -n "$IOCAGE_HOST" ] && [ -n "$JAIL_HOST" ]; then
echo "WARING: jail_host and iocage_host can't be used at the same time"
log "WARING: jail_host and iocage_host can't be used at the same time"
exit 1
fi
TARGET_HOST="$__target_host"
SSH_USER="root"
if [ -n "$IOCAGE_HOST" ]; then
JAIL_HOST="$IOCAGE_HOST"
if [ -z "$JAIL_NAME" ]; then
JAIL_NAME="ioc-$(echo "$__target_host" | tr '.' '_')"
else
JAIL_NAME="ioc-$(echo "$JAIL_NAME" | tr '.' '_')"
fi
else
if [ -z "$JAIL_NAME" ]; then
JAIL_NAME="$TARGET_HOST"
fi
fi
if [ -n "$JAIL_HOST" ]; then
log "INSIDE_JAIL: TRUE"
TARGET_HOST="$JAIL_HOST"
WRAPPER="jexec $JAIL_NAME"
fi
if [ -n "$SUDO_USER" ]; then
log "SUDO_USER: $SUDO_USER"
WRAPPER="sudo -- $WRAPPER"
SSH_USER="$SUDO_USER"
fi
log "TARGET_HOST: $TARGET_HOST"
log "@:" "$@"
if [ -n "$JAIL_HOST" ]; then
log "IOCAGE_HOST: $IOCAGE_HOST"
log "JAIL_HOST: $JAIL_HOST"
log "JAIL_NAME: $JAIL_NAME"
log "WRAPPER: $WRAPPER"
fi
case "$COMMAND" in
"exec")
shift; # remove the jail host name from $@
ssh -o User="$SSH_USER" -q "$TARGET_HOST" "$WRAPPER $*"
;;
"copy")
if [ -n "$JAIL_HOST" ]; then
# jls(8) dosen't need root to print this information
jail_root=$(ssh -q "$TARGET_HOST" -- jls -j "$JAIL_NAME" path)
log "JAIL_ROOT: $jail_root"
fi
if [ -n "$JAIL_HOST" ]; then
set -- "$(echo "$@" | sed "s|$__target_host:|$JAIL_HOST:$jail_root|g")"
fi
if [ -n "$SUDO_USER" ]; then
# For rsync to do the right thing, the source has to end with "/" if it is
# a directory. The below preprocessor loop takes care of that.
# second last argument is the source
source_index=$(($#-1))
index=0
for arg in "$@"; do
if [ $index -eq 0 ]; then
# reset $@
set --
fi
index=$((index+=1))
if [ $index -eq $source_index ] && [ -d "$arg" ]; then
arg="${arg%/}/"
fi
set -- "$@" "$arg"
done
rsync --copy-links -e "ssh -o User=$SSH_USER" --rsync-path='sudo rsync' "$@"
else
#shellcheck disable=SC2068
scp -o "User=$SSH_USER" -q $@
fi
;;
*)
echo "unkown command - $COMMAND"
exit 1
;;
esac
log "----"

View file

@ -1,89 +0,0 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
# 2010-2016 Nico Schottelius (nico-cdist at schottelius.org)
# 2016 Darko Poljak (darko.poljak at gmail.com)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
#
import logging
import sys
import cdist
import cdist.argparse
import cdist.banner
import cdist.config
import cdist.install
import cdist.shell
import cdist.inventory
def commandline():
"""Parse command line"""
# preos subcommand hack
if len(sys.argv) > 1 and sys.argv[1] == 'preos':
return cdist.preos.PreOS.commandline(sys.argv[1:])
parser, cfg = cdist.argparse.parse_and_configure(sys.argv[1:])
args = cfg.get_args()
# Work around python 3.3 bug:
# http://bugs.python.org/issue16308
# http://bugs.python.org/issue9253
# FIXME: catching AttributeError also hides
# real problems.. try a different way
# FIXME: we always print main help, not
# the help of the actual parser being used!
try:
getattr(args, "func")
except AttributeError:
parser['main'].print_help()
sys.exit(0)
args.func(args)
if __name__ == "__main__":
if sys.version < cdist.MIN_SUPPORTED_PYTHON_VERSION:
print('Python >= {} is required on the source host.'.format(
cdist.MIN_SUPPORTED_PYTHON_VERSIO), file=sys.stderr)
sys.exit(1)
exit_code = 0
try:
import re
import os
if re.match("__", os.path.basename(sys.argv[0])):
import cdist.emulator
emulator = cdist.emulator.Emulator(sys.argv)
emulator.run()
else:
commandline()
except KeyboardInterrupt:
exit_code = 2
except cdist.Error as e:
log = logging.getLogger("cdist")
log.error(e)
exit_code = 1
sys.exit(exit_code)

View file

@ -6,7 +6,7 @@ import subprocess
# We have it only if it is a git cloned repo.
build_helper = os.path.join('bin', 'build-helper')
build_helper = os.path.join('bin', 'cdist-build-helper')
# Version file path.
version_file = os.path.join('cdist', 'version.py')
# If we have build-helper we could be a git repo.
@ -54,14 +54,13 @@ os.chdir(cur)
setup(
name="cdist",
packages=["cdist", "cdist.core", "cdist.exec", "cdist.util", ],
packages=["cdist", "cdist.core", "cdist.exec", "cdist.scan", "cdist.util"],
package_data={'cdist': package_data},
scripts=["scripts/cdist", "scripts/cdist-dump", "scripts/cdist-new-type"],
scripts=["bin/cdist", "bin/cdist-dump", "bin/cdist-new-type"],
version=cdist.version.VERSION,
description="A Usable Configuration Management System",
author="Nico Schottelius",
author_email="nico-cdist-pypi@schottelius.org",
url="https://www.cdi.st/",
author="cdist contributors",
url="https://cdi.st",
classifiers=[
"Development Status :: 6 - Mature",
"Environment :: Console",