1. 19 May, 2016 2 commits
  2. 11 Mar, 2016 1 commit
  3. 01 Mar, 2016 2 commits
  4. 19 Feb, 2016 1 commit
  5. 29 Jan, 2016 2 commits
  6. 28 Jan, 2016 1 commit
  7. 27 Jan, 2016 2 commits
  8. 16 Dec, 2015 1 commit
  9. 08 Dec, 2015 1 commit
  10. 12 Oct, 2015 1 commit
  11. 08 Sep, 2015 1 commit
  12. 09 Jul, 2015 1 commit
  13. 24 Jun, 2015 1 commit
    • Mike Hibler's avatar
      Updates for new FreeBSD 10.1 based servers. · 480fdc70
      Mike Hibler authored
      Big changes a comin' to try to get us back on the supported path.
      
       * perl 5.14 -> 5.20
       * mysql 5.1 -> 5.5
       * php 5.4   -> 5.6
       * tcl 8.4   -> 8.6
       * number of vim patches up to 683.
      
      Not everything tested yet, but getting there.
      
      Specific changes:
      
       * New install/ports directory. New packages for FreeBSD 10.1 are version
         6.1. Cleaned up the ports' Makefiles getting rid of conditionals for
         all older versions. Also got rid of ports we don't use. Old ports tree
         is now install/oports.
      
       * Install script changes. Make sure /usr/bin/perl and /usr/local/bin/python
         links exist. Ports no longer make these but we use them in '#!'. Changes
         to mysql install and startup script--mysql has changed a LOT since we did
         the support in 4.x. Create syslog entry for named.log. Make sure php.conf
         loads the legacy "mysql" module rather than using "mysqli".
      
       * Elabinelab support. reflect new packages, remove all old packages
         (except perl) before installing new versions, install "extras" package,
         make sure sendmail cert get regenerated, make sure /usr/bin/perl link
         exists, make sure /usr/local/bin/python link exists.
      
       * Custom ports. otcl and xerces-c2 have both been removed from the ports
         tree as of Q2 2015. ipmitool-devel is a port for the latest version of
         ipmitool. The FreeBSD port is still a rev behind here. We need the
         newer version as it appears to make our SOL consoles more stable.
      
       * Random. Fixed prerender as neato output has changed again. Tweak to
         sslxmlrpc_server to reflect change in an underlying library. Tweak to
         db/libdb.py.in to turn on autocommit which matters now as mysql 5.5 will
         hang on a metadata lock otherwise. Remade eventsys perl/python stubs
         with SWIG 2.0. SWIG 1.3 did not produce working stubs for perl 5.20.
      
      Specific un-changes:
      
       * Apache is still at 2.2. I lack the guts and skilz to upgrade to 2.4.
      
       * Xerces library is still at (now unsupported) 2.8. Assign will need
         changes before we can move to 3.x.
      
       * Python is still 2.7.
      
      Thanks to Keith Sklower for all the work he did converting ports!
      480fdc70
  14. 07 Apr, 2015 1 commit
  15. 12 Feb, 2015 1 commit
  16. 20 Jan, 2015 1 commit
  17. 14 Jan, 2015 1 commit
  18. 27 Aug, 2014 1 commit
  19. 19 Aug, 2014 1 commit
  20. 20 May, 2014 1 commit
  21. 25 Apr, 2014 1 commit
  22. 14 Apr, 2014 1 commit
  23. 19 Feb, 2014 1 commit
  24. 23 Jan, 2014 1 commit
    • Mike Hibler's avatar
      Fire up the lease daemon. · 3bc4b42e
      Mike Hibler authored
      Currently it is configured (hardwired) to run every 15 minutes, even that
      may be too frequent as things don't happen too fast in lease-world.
      3bc4b42e
  25. 08 Jan, 2014 1 commit
  26. 16 Dec, 2013 1 commit
  27. 28 Aug, 2013 1 commit
  28. 09 Aug, 2013 1 commit
  29. 22 Jul, 2013 1 commit
  30. 14 Jan, 2013 1 commit
  31. 12 Dec, 2012 1 commit
  32. 30 Nov, 2012 2 commits
    • Mike Hibler's avatar
      Forgot a new ARP-related script. · d082afbb
      Mike Hibler authored
      d082afbb
    • Mike Hibler's avatar
      More ARP lockdown related changes. · f4871f4a
      Mike Hibler authored
      Make sure sitevars get initialized on initial installation of an Emulab.
      Fixes to the update_sitevars script, mostly in case we someday want to
      run it on every testbed software install (which we do not do right now).
      
      For ops and fs there is a race with boss that prevents us from locking
      down ARP entries early. For now, we do the lock down later in the boot.
      If someone spoofs boss or the gateway before then, we will detect it
      when we request the ARP info via SSL-enabled tmcc.
      f4871f4a
  33. 09 Nov, 2012 1 commit
  34. 30 Oct, 2012 2 commits
    • Mike Hibler's avatar
      Doh, forgot to add the fixarpinfo script. · c1a7783a
      Mike Hibler authored
      Also, add verbose mode and log to /var/emulab/logs/fixarpinfo.log so we
      can track what changes.
      c1a7783a
    • Mike Hibler's avatar
      Remaining infrastructure for control network "ARP lockdown". · 4b5e17b0
      Mike Hibler authored
      It works like this. Certain nodes that are on the node control net
      (right now just subbosses, but ops coming soon) can set static ARP entries
      for the nodes they serve. This raises the bar for (but does not eliminate
      the possibility of) nodes spoofing servers. Currently this is only for
      FreeBSD.
      
      When such a server boots, it will early on run /etc/rc.d/arplock.sh
      which will in turn run /usr/local/etc/emulab/fixarpinfo. fixarpinfo
      asks boss via an SSL tmcc call for "arpinfo" (using SSL ensures that the
      info coming back is really from boss). Tmcd on boss returns such arpinfo
      as appropriate for the node (subboss, ops, fs, etc.) along with the type
      of lockdown being done. The script uses this info to update the ARP
      cache on the machine, adding, removing, or making permanent entries
      as appropriate.
      
      fixarpinfo is intended to be called not just at boot, but also whenever
      we might need to update the ARP info on a server. The only other use right
      now is in subboss_dhcpd_makeconf which is called whenever DHCP info may
      need to be changed on a subboss (we hook this because a call to this script
      might also indicate a change in the set of nodes served by the subboss).
      In the future, fixarpinfo might be called from the newnode path (for ops/fs,
      when a node is added to the testbed), the deletenode path, or maybe from
      the watchdog (if we started locking down arp entries on experiment nodes)
      
      The type of the lockdown is controlled by a sitevar on boss,
      general/arplockdown, which can be set to 'none', 'static' or 'staticonly'.
      'none' means do nothing, 'static' means just create static arp entries
      for the given nodes but continue to dynamically arp for others, and
      'staticonly' means use only this set of static arp entries and disable
      dynamic arp on the control net interface. The last implies that the server
      will only be able to talk to the set of nodes for which it got ARP info.
      
      As mentioned, tmcd is responsible for returning the correct set of arp
      info for a given request. The logic currently is:
      
       * Only return ARP info to nodes which are on the CONTROL_NETWORK.
         If the requester is elsewhere (e.g., Utah's boss and ops are currently
         segregated on different IP subnets) then this whole infrastructure
         does not apply and nothing is returned.
      
       * If the requester is a subboss, return info for all other servers that
         are on the node control network as well as for the set of nodes
         which the subboss serves.
      
       * If the requester is an ops or fs node, again return info for all
         other servers and info for all testnodes or virtnodes whose control
         net IP is on the node control net.
      
       * Otherwise, return nothing.
      
      One final note is that the ARP info for servers such as boss/ops/fs or
      the gateway router is not readily available in most Emulab instances
      since those machines are not in the DB nodes or interfaces tables.
      Eventually we will fix that, but for now the info must come from new
      site variables. To help initially populate those variables, I added
      the utils/update_sitevars script which attempts to determine which
      servers are on the node control net and gathers the appropriate IP and
      MAC info from them.
      4b5e17b0