funman300
8f5f54833f
Cheap insurance, explicitly not the real check -- the semantic tests in
deployment_config.rs are what prove propagation, using two TEST-NET addresses
and bind != advertise. This grep only stops the lab subnet reappearing months
from now when the reasoning has been forgotten.
Deployment config legitimately contains real addresses and lives in gitignored
files, so it is never scanned. The frozen baseline doc is allowlisted BY PATH:
it records what a past deployment actually was, and rewriting it would falsify
the record.
Also swapped the lab IP for a TEST-NET placeholder in the usage examples and
error messages of compose/entrypoint/client_arm. Those were already correct
architecture -- every one requires the address via ${VAR:?} -- but using the
real lab IP as the example is the same 'happens to match our lab' smell, and
placeholders keep the tripwire allowlist near-empty.
Mutation-tested: adding a lab address to a source file makes it exit 1.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
3.5 KiB
Bash
68 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# ============================================================================
|
|
# OpenFUT FIFA-17 — CLIENT-side arming (runs on the GAME machine, e.g. 105).
|
|
#
|
|
# Companion to the dev container on the SERVER (120). The server runs the heavy
|
|
# responders (Blaze / UTAS / roster / POW). Two pieces are inherently local to
|
|
# the game and therefore stay here:
|
|
#
|
|
# * autopatch.py — patches FIFA17.exe process memory (ProtoSSL cert-verify).
|
|
# Must run where the game runs; cannot be containerised.
|
|
# * lsx_responder — the Origin/EADesktop emulator the game dials on the
|
|
# hardcoded loopback 127.0.0.1:4216. Loopback IPC can't be
|
|
# cleanly redirected to a remote host, so it lives here.
|
|
#
|
|
# Everything the game reaches by a routable address is redirected to the server:
|
|
# * winter15.gosredirector.ea.com (hardcoded EA IP 159.153.51.20) -> SERVER:42127
|
|
# * easw.easports.com (dead hardcoded UTAS host) -> SERVER (:8099)
|
|
#
|
|
# The server's responders were started with OPENFUT_ADVERTISE=<SERVER_IP>, so
|
|
# after these first redirected contacts the game is handed <SERVER_IP> for every
|
|
# later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly.
|
|
#
|
|
# Usage: sudo OPENFUT_SERVER=203.0.113.10 ./client_arm.sh
|
|
# (re-run after every reboot; the sysctl/iptables state is volatile)
|
|
# ============================================================================
|
|
set -euo pipefail
|
|
|
|
SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}"
|
|
GOS_EA_IP="159.153.51.20" # winter15.gosredirector.ea.com (hardcoded in FIFA17)
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "!! must run as root (sudo). Re-run: sudo OPENFUT_SERVER=$SERVER $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "[client_arm] backend server = $SERVER"
|
|
|
|
# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
|
|
sysctl -q kernel.yama.ptrace_scope=0
|
|
|
|
# 2) Redirect the hardcoded Blaze redirector IP to the server's redirector.
|
|
# (Replace any stale rule first so re-runs and IP changes are clean.)
|
|
while iptables -t nat -D OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT \
|
|
--to-destination "$SERVER:42127" 2>/dev/null; do :; done
|
|
iptables -t nat -A OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT --to-destination "$SERVER:42127"
|
|
|
|
# 2b) DNAT from OUTPUT to a REMOTE host needs a matching source-NAT on the way
|
|
# out, or the server's replies (from its own IP) won't match the game's
|
|
# conntrack entry. MASQUERADE the redirected flow so it is SNAT'd to this
|
|
# host's outbound IP. (Harmless duplicate-guarded like the DNAT above.)
|
|
while iptables -t nat -D POSTROUTING -p tcp -d "$SERVER" --dport 42127 \
|
|
-j MASQUERADE 2>/dev/null; do :; done
|
|
iptables -t nat -A POSTROUTING -p tcp -d "$SERVER" --dport 42127 -j MASQUERADE
|
|
|
|
# 3) Point the dead hardcoded UTAS host at the server. The port (8099) is carried
|
|
# in the game's own URL, so only the name needs redirecting. Remove any prior
|
|
# OpenFUT-managed line (loopback or other server) and write the current one.
|
|
sed -i '/[[:space:]]easw\.easports\.com\b.*# openfut$/d' /etc/hosts
|
|
printf '%s\teasw.easports.com\t# openfut\n' "$SERVER" >> /etc/hosts
|
|
|
|
echo "[client_arm] --- armed ---"
|
|
sysctl kernel.yama.ptrace_scope
|
|
iptables -t nat -L OUTPUT -n | grep -i "$GOS_EA_IP" || echo " (DNAT missing!)"
|
|
grep 'easw.easports.com' /etc/hosts && echo " /etc/hosts ok" || echo " (/etc/hosts easw missing!)"
|
|
echo
|
|
echo "[client_arm] Next: start the LOCAL pieces (LSX + autopatch) with client_local.sh,"
|
|
echo " ensure the container is up on $SERVER, then launch FIFA 17."
|