1. 26 Aug, 2017 1 commit
  2. 14 Nov, 2016 1 commit
    • Mike Hibler's avatar
      Tweaks to the agreement between mkextrafs and the blockstore system. · 939b0ae7
      Mike Hibler authored
      For the case in which mkextrafs is used to create local homedirs/projdirs:
      
      Look for the desired mount point (/local) in /etc/fstab and use that if
      it exists (i.e., that FS was already setup by the blockstore system or a
      previous mkextrafs).
      
      Otherwise, look for /var/emulab/boot/extrafs which should contain info
      left behind by the local blockstore setup code indicating a FS or unused
      device to use. For an unused device, rc.storage will identify the largest
      available device that is at least 10MB.
      939b0ae7
  3. 04 Jun, 2016 1 commit
  4. 25 Apr, 2016 1 commit
  5. 19 Feb, 2016 1 commit
  6. 16 Nov, 2015 1 commit
  7. 31 Mar, 2015 1 commit
    • Mike Hibler's avatar
      Add sitevar to determine whether clients should use UDP or TCP for NFS. · f1ae820e
      Mike Hibler authored
      Yes, out of the blue and off the wall. But I got tired of trying to
      guess what we had Linux and FreeBSD use. I was surprised to discover
      that we were using UDP on Linux (which caused Clemson CloudLab to fail
      because they have jumbo frames enabled on their control net switches
      but ops had the MTU set to 1500).
      
      Anyway, here it is. The default setting is UDP for backward compat.
      We should probably set it to TCP nowadays. There is also an 'osdefault'
      setting which says use the default setting on the client OS.
      f1ae820e
  8. 05 Mar, 2015 1 commit
  9. 09 Oct, 2014 1 commit
    • Mike Hibler's avatar
      Rework client-side storage scripts to semi-coexist with mkextrafs uses. · 9cf8f9c6
      Mike Hibler authored
      Broke rc.storage into two phases, local blockstores and remote blockstores.
      Setup of the former will also pick a best candidate for an old-school
      "extrafs" and put the info in /var/emulab/boot/extrafs. This will be a
      single line with one of DISK=foo, PART=foo, or FS=foo depending on whether
      it found an available full disk, disk partition, or mounted filesystem
      that we can use for mkextrafs (in the first two cases) or where we can
      mooch off of (the last). This is only used in os_mountextrafs() right now;
      i.e., I have NOT changed the mkextrafs script. So explicit invocations
      by the user could still screw things up.
      
      I have tested this with local blockstores and a non-nfs experiment
      on both Linux and FreeBSD to make sure the most common sharing of space
      works. I have not made any new images and I have not yet tested to make
      sure I did not break non-blockstore, non-nfs experiments (i.e., where
      we really should run mkextrafs).
      
      So maybe don't make any new images til I get back, or else be prepared
      to clean up after me.
      9cf8f9c6
  10. 19 Mar, 2014 1 commit
    • Mike Hibler's avatar
      get FreeBSD firewall working with vnodes. · 650adc28
      Mike Hibler authored
      Firewall needed to be taught about the vnode control net (172.16.0.0).
      Basic stuff works now. Haven't tested everything.
      
      Unrelated to this commit, the Linux firewall seems to be broken.
      No traffic flows between the inside and outside even in an "open"
      configuration. Needs investigation.
      650adc28
  11. 14 May, 2013 2 commits
  12. 09 May, 2013 2 commits
  13. 08 May, 2013 1 commit
    • Mike Hibler's avatar
      First round of client-side support for node-local storage "slices". · c1d21b9a
      Mike Hibler authored
      Supports the three coarse-grained placements we decided on:
      
        "SYSVOL" is special. You can declare a single blockstore with this
             placement and it will create a "native" (ufs/ext) filesystem on
             the 4th partition of the boot disk. This is how you create an
             extra storage partition that can be captured in a custom image.
             We don't use a volume manager here because imagezip doesn't
             recognize any of them (lvm, zfs, vinum).
      
        "ANY" coalesces all "available" storage from all disks into a logical
              volume manager pool and dishes out storage from that for
              individual blockstores. Typically this would include, the 4th
          partition of the boot disk (if not in use) and the second hard
          drive. If the machine has more than 2 drives, it will include
          all the extra drives.
      
        "NONSYSVOL" coalesces all "available" storage that is NOT on the
             boot disk into a logical volume manager pool and dishes out
             storage from that for individual blockstores. This case is if
             you want to avoid interfere with the system disk.
      
      Only implemented on FreeBSD 8/9 with "vinum" right now. It only creates
      "concat" (JBOD) volumes right now.
      
      This stuff will probably get split out into its own perl module(s) at
      some point, as it is getting large.
      
      Next up is LVM on Linux and then maybe ZFS on Freebsd.
      c1d21b9a
  14. 04 Feb, 2013 1 commit
  15. 01 Feb, 2013 1 commit
  16. 28 Jan, 2013 1 commit
  17. 25 Jan, 2013 1 commit
  18. 30 Oct, 2012 1 commit
    • Mike Hibler's avatar
      Remaining infrastructure for control network "ARP lockdown". · 4b5e17b0
      Mike Hibler authored
      It works like this. Certain nodes that are on the node control net
      (right now just subbosses, but ops coming soon) can set static ARP entries
      for the nodes they serve. This raises the bar for (but does not eliminate
      the possibility of) nodes spoofing servers. Currently this is only for
      FreeBSD.
      
      When such a server boots, it will early on run /etc/rc.d/arplock.sh
      which will in turn run /usr/local/etc/emulab/fixarpinfo. fixarpinfo
      asks boss via an SSL tmcc call for "arpinfo" (using SSL ensures that the
      info coming back is really from boss). Tmcd on boss returns such arpinfo
      as appropriate for the node (subboss, ops, fs, etc.) along with the type
      of lockdown being done. The script uses this info to update the ARP
      cache on the machine, adding, removing, or making permanent entries
      as appropriate.
      
      fixarpinfo is intended to be called not just at boot, but also whenever
      we might need to update the ARP info on a server. The only other use right
      now is in subboss_dhcpd_makeconf which is called whenever DHCP info may
      need to be changed on a subboss (we hook this because a call to this script
      might also indicate a change in the set of nodes served by the subboss).
      In the future, fixarpinfo might be called from the newnode path (for ops/fs,
      when a node is added to the testbed), the deletenode path, or maybe from
      the watchdog (if we started locking down arp entries on experiment nodes)
      
      The type of the lockdown is controlled by a sitevar on boss,
      general/arplockdown, which can be set to 'none', 'static' or 'staticonly'.
      'none' means do nothing, 'static' means just create static arp entries
      for the given nodes but continue to dynamically arp for others, and
      'staticonly' means use only this set of static arp entries and disable
      dynamic arp on the control net interface. The last implies that the server
      will only be able to talk to the set of nodes for which it got ARP info.
      
      As mentioned, tmcd is responsible for returning the correct set of arp
      info for a given request. The logic currently is:
      
       * Only return ARP info to nodes which are on the CONTROL_NETWORK.
         If the requester is elsewhere (e.g., Utah's boss and ops are currently
         segregated on different IP subnets) then this whole infrastructure
         does not apply and nothing is returned.
      
       * If the requester is a subboss, return info for all other servers that
         are on the node control network as well as for the set of nodes
         which the subboss serves.
      
       * If the requester is an ops or fs node, again return info for all
         other servers and info for all testnodes or virtnodes whose control
         net IP is on the node control net.
      
       * Otherwise, return nothing.
      
      One final note is that the ARP info for servers such as boss/ops/fs or
      the gateway router is not readily available in most Emulab instances
      since those machines are not in the DB nodes or interfaces tables.
      Eventually we will fix that, but for now the info must come from new
      site variables. To help initially populate those variables, I added
      the utils/update_sitevars script which attempts to determine which
      servers are on the node control net and gathers the appropriate IP and
      MAC info from them.
      4b5e17b0
  19. 24 Sep, 2012 1 commit
    • Eric Eide's avatar
      Replace license symbols with {{{ }}}-enclosed license blocks. · 6df609a9
      Eric Eide authored
      This commit is intended to makes the license status of Emulab and
      ProtoGENI source files more clear.  It replaces license symbols like
      "EMULAB-COPYRIGHT" and "GENIPUBLIC-COPYRIGHT" with {{{ }}}-delimited
      blocks that contain actual license statements.
      
      This change was driven by the fact that today, most people acquire and
      track Emulab and ProtoGENI sources via git.
      
      Before the Emulab source code was kept in git, the Flux Research Group
      at the University of Utah would roll distributions by making tar
      files.  As part of that process, the Flux Group would replace the
      license symbols in the source files with actual license statements.
      
      When the Flux Group moved to git, people outside of the group started
      to see the source files with the "unexpanded" symbols.  This meant
      that people acquired source files without actual license statements in
      them.  All the relevant files had Utah *copyright* statements in them,
      but without the expanded *license* statements, the licensing status of
      the source files was unclear.
      
      This commit is intended to clear up that confusion.
      
      Most Utah-copyrighted files in the Emulab source tree are distributed
      under the terms of the Affero GNU General Public License, version 3
      (AGPLv3).
      
      Most Utah-copyrighted files related to ProtoGENI are distributed under
      the terms of the GENI Public License, which is a BSD-like open-source
      license.
      
      Some Utah-copyrighted files in the Emulab source tree are distributed
      under the terms of the GNU Lesser General Public License, version 2.1
      (LGPL).
      6df609a9
  20. 23 Jul, 2012 1 commit
  21. 15 Nov, 2011 1 commit
    • Mike Hibler's avatar
      Further overhaul of firewall code. NOTE: required bump of tmcd version to 34. · 6a26b246
      Mike Hibler authored
      Firewalls now work with nodes which require a subboss. Had to introduce new
      firewall rules which skipped around the checks that no packets to/from
      node control net IPs should pass through the firewall, if the IP in question
      belongs to a subboss (since subboss is on the node control network). It
      actually checks for all Emulab servers (boss, ops, fs or any subboss),
      so the code should work for an Emulab install which has a non-segmented
      control network in which all servers were in the same subnet as the nodes.
      
      In addition to the new rules, we also had to pass in additional information
      via "tmcc firewallinfo" giving the IP/MAC of those server nodes that are on
      the node control network. We use this to establish ARP entries on the
      inside network so that nodes can find the servers. Since the existing
      client-side firewall code in libsetup.pm would blow up if it got a line
      that it didn't recognize, I had to bump the tmcd version number and add
      some conditional code to tmcd.c:dofwinfo() to not return the extra info for
      old versions.
      
      Added a couple of new firewall variables EMULAB_BOSSES and EMULAB_SERVERS
      that are used in the new rules. Fixed the support scripts in firewall/
      to properly initialize these variables.
      
      IMPORTANT: tmcd looks up boss, ops, fs, and subbosses in the interfaces
      table to find their IPs and MAC addresses. By default, we do not create
      such interface table entries for boss/ops/fs. We have them at Utah for
      other reasons. These entries are only needed if you have a non-segmented
      control network (or a subboss) and you want to firewall such nodes.
      The script to initialize the firewall variables (initfwvars.pl) will
      print out a warning for configurations that are affected and don't have
      the entries.
      6a26b246
  22. 21 Jul, 2011 1 commit
  23. 29 Jun, 2011 1 commit
    • Mike Hibler's avatar
      Allow for more flexible setup of pxe_boot_path. · 2abf13da
      Mike Hibler authored
      If nodes.pxe_boot_path is set to '/tftpboot/pxelinux/<something>', then
      dhcpd_makeconf will set the (pxeboot) filename to /tftpboot/pxelinux.0
      and symlink the node's config file (/tftpboot/pxelinux.cfg/<mac>) to
      /tftpboot/pxelinux.cfg/<something>.
      
      In other words, we can customize pxelinux to some small degree, using one
      of some small number of pre-existing configurations. We were using pxelinux
      before for plab-in-elab and we will also need it for loading WinPE for
      configuring Windows7 images. For the latter we will set the pxe_boot_path
      to /tftpboot/pxelinux/winpe.
      
      Anyway, ideally we would allow the user to specify a pxelinux config file
      through the NS file, but need to think about the implications of that some
      more. Small steps...
      2abf13da
  24. 20 Oct, 2010 1 commit
    • Mike Hibler's avatar
      Support for no shared filesystem (unsupport for shared filesystem?) and · c1c1bce2
      Mike Hibler authored
      (eventual) support for NFS servers without race conditions!
      
      This means no NFS between nodes and ops/fs. There are still NFS mounts of
      ops on boss however.
      
      Added new defs-* variable NOSHAREDFS, which when set non-zero will disable
      the export of NFS filesystems to nodes.  Involved lots of little changes:
      
       * /users, /proj, and /share filesystems are not exported to nodes.
      
       * Returned mount info now includes an FSTYPE key which will be set to "LOCAL"
         if NOSHAREDFS is in effect (by default it is set to "NFS-RACY"; more on
         this later).  In the case where it is set to LOCAL, the other mount lines
         no longer contain REMOTE=foo settings.  Because of this change,
         THE TMCD VERSION NUMBER HAS BEEN BUMPED TO 32.
      
       * The client rc.mounts script will now create local versions of /users/*,
         /proj/<pid>, and /share when FSTYPE=LOCAL.  It first runs mkextrafs to
         create a large partition for these, since someday we will likely want
        ...
      c1c1bce2
  25. 15 Jul, 2010 1 commit
    • David Johnson's avatar
      Do not automatically merge updates to passwd/group/shadow files. · ed074826
      David Johnson authored
      Now, if experimenters add users or groups to their nodes, and take
      an image, they must explicitly tell prepare to overwrite the master
      passwd/group/shadow files in /etc/emulab.  For Linux,
      os_account_cleanup tried to update the masters automatically, but
      this is not fullproof and can result in the masters getting passwd
      hashes from shadow.  Now, a diff of the non-shadow files is printed
      from prepare so that at least people can see that the masters need
      to be manually updated.
      ed074826
  26. 28 Jun, 2010 1 commit
  27. 15 Apr, 2010 1 commit
    • Ryan Jackson's avatar
      Various subboss-related bits · 3d95a752
      Ryan Jackson authored
      - Add support for new tmcd dhcpdconf command to watchdog
      - Fix dhcpd.conf template so that ddns-update-style is set to none
      - Pull some utility functions from boss's libtestbed.pm into the client
        libtestbed.pm for use by subboss_dhcpd_makeconf and daemon_wrapper.
      - Add stuff to simplify getting control interface IP address.
      3d95a752
  28. 03 Mar, 2010 1 commit
  29. 24 Feb, 2010 2 commits
    • Mike Hibler's avatar
      Minor tweaks I forgot. · ed1c1252
      Mike Hibler authored
      Implement minsize option, fix some prints.
      ed1c1252
    • Mike Hibler's avatar
      Major mkextrafs whackage for FreeBSD. · f6c71abf
      Mike Hibler authored
      Change mkextrafs so that we can create a filessytem on the second disk.
      The command line option was always there, it just didn't work.
      
      Added -l option to make it print out "available" partitions that you could
      put a filesystem on.  This uses the new os_find_freedisk() function which
      was inspired by Dave's Linux libvnode routine to locate unused space.
      In fact, that latter function should get moved up to linux/liblocsetup.pm
      and the Linux mkextrafs updated to support -l.
      f6c71abf
  30. 15 Dec, 2009 1 commit
  31. 08 Sep, 2009 1 commit
  32. 15 Oct, 2008 1 commit
  33. 19 Sep, 2008 1 commit
  34. 10 Sep, 2008 1 commit
  35. 16 Apr, 2008 1 commit
    • Leigh B. Stoller's avatar
      A set of changes to implement dynamic root passwords on local nodes · bac0172e
      Leigh B. Stoller authored
      (and vnodes). Each time a node is allocated to an experiment it gets a
      new root password (using the node_attributes table). The watchdog has
      a new section that resets the root password (defaults to hourly).  We
      still using a common password in the image to avoid totally bricking
      ourselves, but once a node boots into an experiment it gets a new root
      password.
      
      This prevents hundreds of nodes with the same password, and all of the
      problems associated with that.
      bac0172e
  36. 29 Jan, 2008 1 commit
  37. 14 Jan, 2008 1 commit