funman300
fbc0da2a1b
The FUT hub failed to load with "An error occurred downloading the FUT Squad
Update" because the client dials the roster (https://<advertise>:8081) and the
redirector BY IP, while the served certificate carried DNS SANs only
(winter15.gosredirector.ea.com + wildcards). The client aborts that handshake with
fatal certificate_unknown. Root cause and evidence in
docs/FIFA17_FUT_SQUAD_UPDATE_TLS.md (commit 082246c): a wire capture shows the client
offering TLS1.2 with RSA suites, the server selecting them, then rejecting the cert —
and autopatch demonstrably patched both ProtoSSL gates in that process, so this
validation path is NOT one of the two the client-side patch covers. The SAN is the fix.
Three generators produced the cert and none put the advertised IP in the SAN:
* docker entrypoint.sh — the production path. The advertised IP is a RUNTIME value
(OPENFUT_ADVERTISE), unknown at image-build time, so the cert is now reconciled at
startup: reissued with IP:$ADV,IP:127.0.0.1 in the SAN only when the current cert
lacks it. That makes a restart reuse the same cert (no per-start fingerprint churn,
which would otherwise recreate the Aug-13 surprise) and self-heal if $ADV changes.
* Dockerfile — installs openssl unconditionally so the entrypoint can reissue at
runtime (previously it was dropped with the apt lists), and bakes a loopback-IP
baseline cert so a plain `docker build` still yields a usable image.
* openfut-fut.sh — the local orchestrator. ensure_cert now defaults the SAN IP to this
host's primary LAN IP (OPENFUT_ADVERTISE overrides) and reissues when the cert lacks
it, instead of only generating when the file is absent.
Verified without the client, which is the strongest evidence obtainable here: a
verifying TLS client checking the cert BY IP rejects the old DNS-only cert ("IP address
mismatch, certificate is not valid for '10.10.0.120'") and accepts the new
IP-bearing cert; and the entrypoint reconcile is idempotent end to end — an old cert is
reissued to carry IP:$ADV, a simulated restart leaves the fingerprint unchanged, and
the final SAN carries both the advertised and loopback IPs.
Live confirmation needs the production container rebuilt with OPENFUT_ADVERTISE set
(operator-gated); production is otherwise untouched.
entrypoint.sh carries unrelated pre-existing uncommitted work (env-based component
selection) that is not on any branch; only the cert-reconcile block is committed here,
and that work is left intact in the working tree.
71 lines
3.3 KiB
Docker
71 lines
3.3 KiB
Docker
# OpenFUT FIFA-17 FUT backend — Python migration deployment.
|
|
#
|
|
# Runs the 5 network responders (LSX / Blaze / roster / UTAS / POW) that FIFA 17
|
|
# dials to reach the FUT hub. Pure-Python; the only third-party dep is
|
|
# pycryptodome (LSX AES handshake). autopatch.py is intentionally NOT run here —
|
|
# it patches the game process memory and belongs on the client (105).
|
|
#
|
|
# Build context is fifa17-recon/ (the repo tree). tools/ is the AUTHORITATIVE
|
|
# recon tree (fifa17-recon/tools/). Only the runtime file set listed in
|
|
# docker/fifa17-python/runtime-tools.list is installed into /app/tools, so the
|
|
# deployed manifest stays byte-identical to the frozen baseline image
|
|
# openfut-fut-backend:python-baseline-2026-08-10 (see docs/BASELINE-*.md) while
|
|
# recon scripts, ghidra_queries and docs stay out of the image. data/ comes
|
|
# from the authoritative fifa17-recon/data. A SHA256SUMS.txt is baked into the
|
|
# image so any running backend can be matched to the exact dataset it was built
|
|
# from.
|
|
FROM python:3.12-slim
|
|
|
|
RUN pip install --no-cache-dir pycryptodome==3.20.0
|
|
|
|
WORKDIR /app
|
|
|
|
# Stage the authoritative tools tree in full...
|
|
COPY tools/ /app/tools-full/
|
|
|
|
# ...then install ONLY the runtime manifest (baseline image minus the two
|
|
# git-ignored certs, which are regenerated below).
|
|
COPY docker/fifa17-python/runtime-tools.list /app/runtime-tools.list
|
|
RUN set -eu; \
|
|
mkdir -p /app/tools; \
|
|
while IFS= read -r f; do \
|
|
[ -n "$f" ] || continue; \
|
|
mkdir -p "/app/tools/$(dirname "$f")"; \
|
|
cp "/app/tools-full/$f" "/app/tools/$f"; \
|
|
done < /app/runtime-tools.list; \
|
|
rm -rf /app/tools-full
|
|
|
|
COPY data/ /app/data/
|
|
|
|
# Redirector/roster TLS cert (CN/SAN = winter15.gosredirector.ea.com). ProtoSSL
|
|
# cert-verify is patched client-side, so a self-signed cert is fine — but the
|
|
# client dials the roster and redirector BY IP, and that path still checks the
|
|
# SAN against the dialed address (it is NOT covered by the two patched gates), so
|
|
# a cert without a matching IP SAN is rejected with fatal certificate_unknown
|
|
# (docs/FIFA17_FUT_SQUAD_UPDATE_TLS.md). The advertised LAN IP is a RUNTIME value,
|
|
# unknown here, so this bakes only a loopback-IP baseline and the entrypoint
|
|
# reissues with IP:$OPENFUT_ADVERTISE at start.
|
|
#
|
|
# openssl therefore has to remain in the image for the entrypoint, not be dropped
|
|
# with the apt lists. The pair is git-ignored (*.pem/*.key); regenerate if absent
|
|
# so a fresh checkout builds without extra steps.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends openssl && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
RUN if [ ! -s tools/redir_cert.pem ] || [ ! -s tools/redir_key.pem ]; then \
|
|
openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout tools/redir_key.pem -out tools/redir_cert.pem \
|
|
-days 3650 -subj "/CN=winter15.gosredirector.ea.com" \
|
|
-addext "subjectAltName=DNS:winter15.gosredirector.ea.com,DNS:*.gosredirector.ea.com,DNS:*.ea.com,IP:127.0.0.1"; \
|
|
fi
|
|
|
|
# Bake a dataset manifest so every image is self-identifying.
|
|
RUN find /app/tools /app/data -type f | LC_ALL=C sort | xargs sha256sum > /app/SHA256SUMS.txt
|
|
|
|
COPY docker/fifa17-python/entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
# LSX 4216 | Blaze redir/main/nucleus 42127/42130/42131 | roster 8081 | UTAS 8099 | POW 8094/8080
|
|
EXPOSE 4216 42127 42130 42131 8081 8099 8094 8080
|
|
|
|
ENTRYPOINT ["/app/entrypoint.sh"]
|