1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
|
#!/bin/sh
#
# Copyright (C) 2014, Jaguar Land Rover
#
# This program is licensed under the terms and conditions of the
# Mozilla Public License, version 2.0. The full text of the
# Mozilla Public License is at https://www.mozilla.org/MPL/2.0/
#
#
# Setup an RVI release
#
#
SELF_DIR=$(dirname $(readlink -f "$0"))
SETUP_GEN=$SELF_DIR/setup_gen # Ulf's kitchen sink setup utility
usage() {
cat <<EOF
Usage:
$0 -r root_cert -d device_cert -c credentials \\
[-l log_dir ] [-s prefix_strip] target_dir
Install a built RVI system into a target directory
NOTE: The last component of 'taget_dir' must be named 'rvi_core'
Example: /opt/rvi_core
-l log_dir - Log directory. Default: ${target_dir}/log.
-s prefix_strip - See below. Default: nil.
-r root_cert - The certificate to validate received X509 device
certificates and credentials.
-d device_cert - Certificate to use when authenticating self toward
remote nodes.
-c credentials - Credentials to present to remote nodes. Can be specified
multiple times
The created node can be started with: 'target'/rvi_ctl
The RVI installation will rely on a separate erlang install
to run.
PREFIX STRIPPING
If '-s prefix_strip' is provided, that part of the directories above
will be stripped of the given prefix in all internlal references.
This is useful in debian and other build systems.
If, for example, 'target_dir' is './build/root/usr/bin', and
'prefix_strip' is './build/root', all internal paths will
reference '/usr/bin'.
ROOT CERTIFICATE
The root certificate is used to validate remote TLS connections and
device certificates. It is normally generated once and shared across
all RVI nodes. An initial root certificate, and its corresponding
keys can be generated using the following command.
# Create a root key pair
openssl genrsa -out root_key.pem 4096
# Create a self-signed root certificate using the key above.
openssl req -x509 -new -nodes -key root_key.pem \
-days 365 -out root_cert.crt
The root key pair should be stored securely and not be distributed.
Provide the generated root_cert.crt file as a '-r' argument to rvi_install.
DEVICE CERTIFICATE
The device certificate, signed by the root certificate, is sent over
to the remote RVI node to prove that self is an authentic node
provisioned by the owner of the root key and certificate.
A device certificate can be created using the following commands
# Create the device key. In production, increase the bit size to 4096+
openssl genrsa -out device_key.pem 4096
# Create a certificate signing request
openssl req -new -key device_key.pem -out device_cert.csr
# Sign the signing request and create the device_cert.crt file
openssl x509 -req -days 365 -in device_cert.csr \
-CA root_cert.crt -CAkey root_key.pem \
-set_serial 01 -out device_cert.crt
Provide the generated device_cert.crt file as a '-d' argument to rvi_install.
CREDENTIALS
Credentials are provided as JSON Web Tokens (JWT) signed by the root
certificate. The JWT, which has the sender's device certificate
embedded into it, proves that the owner of the root key/certificate
has approved that the owner of the device certificate has the right
to send the credential-specified service calls to the remote node,
and receive the credential-specified service calls from the remote
node.
Credentials can be created using the following command:
rvi_create_credential.py --cred_out="credential.json" \
--jwt_out='credential.jwt' \
--id="my_device_1234" \
--issuer="genivi.org" \
--root_key=root_key.pem \
--device_cert=device_cert.crt \
--invoke='genivi.org/' \
--register='genivi.org/'
Provide the generated credential.jwt file as a '-c' argument to rvi_install.
EOF
exit 1
}
TARGET_DIR=""
LIB_DIR=""
LOG_DIR=""
while getopts "r:s:l:" o; do
case "${o}" in
r)
ROOT_CERT=${OPTARG}
;;
d)
DEVICE_CERT=${OPTARG}
;;
c)
DEVICE_CRED=${OPTARG}
;;
l)
LOG_DIR=${OPTARG}
;;
s)
PREFIX_STRIP=${OPTARG}
;;
*)
usage
;;
esac
done
shift $((${OPTIND}-1))
if [ "${#}" = "0" ]
then
echo "ERROR: Missing 'target_dir'."
echo
usage
fi
if [ "${#}" != "1" ]
then
echo "ERROR: Wrong number of arguments."
echo
usage
fi
TARGET_DIR=${1}
if [ $(basename ${TARGET_DIR}) != "rvi_core" ]
then
echo "ERROR: Last component of 'target_dir' must be named rvi_core."
echo " Example: $(dirname ${TARGET_DIR})/rvi_core"
echo
exit 255
fi
# For now LIB_DIR is always same as TARGET_DIR
LIB_DIR=${TARGET_DIR}
if [ -z "${LOG_DIR}" ]
then
LOG_DIR=${TARGET_DIR}/log
fi
rm -rf ${LIB_DIR} ${TARGET_DIR} > /dev/null 2>&1
install -m 0755 -d ${TARGET_DIR}
install -m 0755 -d ${LIB_DIR}
install -m 0755 -d ${LOG_DIR}
FILE_SET=$(find ebin components deps -name ebin -o -name priv)
tar cf - ${FILE_SET} | (cd ${LIB_DIR} ; tar xf - )
# Patch up the rvi with the correct directories.
if [ -s "${PREFIX_STRIP}" ]
then
STRIP_TARGET_DIR=$(echo ${TARGET_DIR} | sed "s|^${PREFIX_STRIP}||")
STRIP_LIB_DIR=$(echo ${LIB_DIR} | sed "s|^${PREFIX_STRIP}||")
STRIP_LOG_DIR=$(echo ${LOG_DIR} | sed "s|^${PREFIX_STRIP}||")
else
STRIP_TARGET_DIR=${TARGET_DIR}
STRIP_LIB_DIR=${LIB_DIR}
STRIP_LOG_DIR=${LOG_DIR}
fi
sed -e "s|__RVI_LIBDIR__|${STRIP_LIB_DIR}|g" \
-e "s|__RVI_BINDIR__|${STRIP_TARGET_DIR}|g" \
-e "s|__RVI_LOGDIR__|${STRIP_LOG_DIR}|g" < scripts/rvi_ctl > /tmp/rvi_ctl
install -m 0755 /tmp/rvi_ctl ${TARGET_DIR}
install -m 0755 scripts/setup_gen ${TARGET_DIR}
install -m 0755 rel/files/nodetool ${TARGET_DIR}
install -m 0755 python/rvi_service.py ${TARGET_DIR}/rvi_service
install -m 0755 python/rvi_call.py ${TARGET_DIR}/rvi_call
install -m 0644 python/rvilib.py ${TARGET_DIR}
install -m 0755 python/rvi_get_services.py ${TARGET_DIR}/rvi_get_services
install -m 0755 -D priv/config/rvi_common.config ${TARGET_DIR}/priv/config/rvi_common.config
echo "RVI binary files installed under ${TARGET_DIR}"
# echo "RVI library files installed under ${LIB_DIR}"
echo "RVI will log to ${LOG_DIR}"
echo
echo "Start: ${TARGET_DIR}/rvi_ctl -c <config_file> start"
echo "Attach started RVI: ${TARGET_DIR}/rvi_ctl attach"
echo "Stop: ${TARGET_DIR}/rvi_ctl stop"
echo "Start console mode: ${TARGET_DIR}/rvi_ctl -c <config_file> console"
echo
exit 0
|
