ripe-atlas: migrate from atlas-sw-probe

ripe-atlas-probe provides atlas-sw-probe, but carries nothing over, so
an upgraded probe would come up with a new key, which RIPE rejects
until its host enters it on atlas.ripe.net.

Take over the key and the settings of atlas-sw-probe in a uci-defaults
script of ripe-atlas-probe, and stop and disable atlas once the key is
in place. A failed run is retried on the next boot. Until it succeeds,
the init does not start the probe, so the key is never used twice and
no new key is created. Until the key is in place, the init logs that it
waits.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 5f90972a66)

net/ripe-atlas/Makefile

@@ -168,6 +168,10 @@ define Package/ripe-atlas-probe/description
 endef
 
 define Package/ripe-atlas-probe/install
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/ripe-atlas.defaults \
+		       $(1)/etc/uci-defaults/80-ripe-atlas
+
 	$(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/scripts
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/config/probe/reg_servers.sh.prod \
 		$(1)/usr/lib/ripe-atlas/scripts

net/ripe-atlas/files/ripe-atlas.defaults

@@ -0,0 +1,83 @@
+#!/bin/sh
+
+# Take over a probe left behind by atlas-sw-probe: RIPE knows a probe by
+# its ssh key. Once /etc/ripe-atlas/probe_key holds a key, ripe-atlas owns
+# the identity. A failed run is retried on the next boot, and until it
+# succeeds the init does not start the probe.
+
+. /lib/functions.sh
+
+NEW_KEY=/etc/ripe-atlas/probe_key
+OLD_INIT=/etc/init.d/atlas
+SEC='ripe-atlas.@ripe-atlas[0]'
+
+fail()
+{
+	rm -f "$NEW_KEY.new" "$NEW_KEY.pub.new"
+	logger -t ripe-atlas -p daemon.err "taking over atlas-sw-probe failed: $*"
+	exit 1
+}
+
+# Only one probe may present the key.
+finish()
+{
+	if [ -x "$OLD_INIT" ]; then
+		"$OLD_INIT" stop
+		"$OLD_INIT" disable
+		! "$OLD_INIT" enabled || fail "cannot disable $OLD_INIT"
+	fi
+	# create_key left the old copy world readable.
+	chmod 0600 /usr/libexec/atlas-probe-scripts/etc/probe_key /etc/atlas/probe_key \
+		2> /dev/null
+	exit 0
+}
+
+# The key atlas-sw-probe used, then the /etc/atlas copy create_key made,
+# which is all a sysupgrade keeps.
+for old_key in /usr/libexec/atlas-probe-scripts/etc/probe_key /etc/atlas/probe_key; do
+	[ -s "$old_key" ] && break
+	old_key=
+done
+[ -n "$old_key" ] || exit 0
+
+if [ -s "$NEW_KEY" ]; then
+	# The same key: finish a takeover that was interrupted.
+	cmp -s "$old_key" "$NEW_KEY" && finish
+	exit 0
+fi
+
+(umask 077 && cp "$old_key" "$NEW_KEY.new") || fail "cannot copy $old_key"
+# Deriving the public key also checks the private one. ssh-keygen does not
+# notice when the write fails.
+{ ssh-keygen -y -P '' -f "$NEW_KEY.new" < /dev/null > "$NEW_KEY.pub.new" &&
+	[ -s "$NEW_KEY.pub.new" ]; } || fail "cannot derive the public key of $old_key"
+
+# A full flash may have left the config empty, see the commit below.
+uci -q get "$SEC" > /dev/null ||
+	{ (umask 077 && touch /etc/config/ripe-atlas) &&
+		uci -q add ripe-atlas ripe-atlas > /dev/null; } ||
+	fail "cannot add a ripe-atlas section"
+if uci -q get atlas.common > /dev/null; then
+	uci set "$SEC.log_stdout=$(get_bool "$(uci -q get atlas.common.log_stdout)" 0)"
+	uci set "$SEC.log_stderr=$(get_bool "$(uci -q get atlas.common.log_stderr)" 0)"
+	uci set "$SEC.rxtx_report=$(get_bool "$(uci -q get atlas.common.rxtxrpt)" 1)"
+else
+	# The package manager removed the unmodified atlas.conf: its defaults.
+	uci set "$SEC.log_stderr=1"
+	uci set "$SEC.rxtx_report=1"
+fi
+mode="$(cat /usr/libexec/atlas-probe-scripts/state/mode 2> /dev/null)"
+case "$mode" in
+	prod|test|dev) uci set "$SEC.mode=$mode" ;;
+esac
+[ -x "$OLD_INIT" ] && ! "$OLD_INIT" enabled && uci set "$SEC.enabled=0"
+# uci commit can miss a full flash and leave an empty file.
+{ uci commit ripe-atlas && uci -q get "$SEC" > /dev/null; } ||
+	fail "cannot save the ripe-atlas config"
+
+{ mv "$NEW_KEY.pub.new" "$NEW_KEY.pub" && mv "$NEW_KEY.new" "$NEW_KEY"; } ||
+	fail "cannot install $NEW_KEY"
+# The caller deletes this script right away.
+sync
+logger -t ripe-atlas -p daemon.notice "took over the atlas-sw-probe key from $old_key"
+finish

net/ripe-atlas/files/ripe-atlas.init

@@ -130,6 +130,20 @@ start_instance()
 			;;
 	esac
 
+	# Only one probe may present the key: wait until the atlas-sw-probe
+	# one is taken over and atlas is disabled. While the key is not taken
+	# over, log the wait, as at boot the takeover runs before the log
+	# daemon and its errors are lost.
+	if [ -e /etc/uci-defaults/80-ripe-atlas ]; then
+		if [ ! -s "${key}" ] &&
+				{ [ -s /usr/libexec/atlas-probe-scripts/etc/probe_key ] ||
+				[ -s /etc/atlas/probe_key ]; }; then
+			logger -t ripe-atlas -p daemon.warn \
+				'waiting for /etc/uci-defaults/80-ripe-atlas'
+		fi
+		return 1
+	fi
+
 	# ripe-atlas-probe or -anchor brings the rest. apk installs it only after
 	# this package started the service, also over an older variant without
 	# this file.