root
70a64e3709
Freeze the running offline FUT backend into version control as fifa17-recon/docker/fifa17-python/ - declarative and rebuildable from a fresh checkout: * OPENFUT_BIND / OPENFUT_ADVERTISE client/server split in the responders (lsx, blaze, roster, utas, pow) + entrypoint.sh; OPENFUT_ADVERTISE is required for remote mode (compose and entrypoint fail without it) * docker-compose.yml reproducing the frozen baseline container exactly (env, ports incl. the 8085->8080 POW-content remap, /state bind, restart) * .env.example / .env for site config - the LAN IP is never hardcoded in source * tools/ + data/ staged from openfut-fut-backend:python-baseline-2026-08-10, verified byte-identical to the running container at freeze time * client_arm.sh (the 105 client-side arming counterpart) * Dockerfile bakes /app/SHA256SUMS.txt so any image is self-identifying * docs/BASELINE-python-2026-08-10.md: frozen image/container/hash record, restore instructions and rebuild-equivalence procedure Secrets (redir key/cert, .env) and runtime state (docker/state) stay gitignored. The live container is untouched pending the .105 launcher audit.
68 lines
3.5 KiB
Bash
68 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# ============================================================================
|
|
# OpenFUT FIFA-17 — CLIENT-side arming (runs on the GAME machine, e.g. 105).
|
|
#
|
|
# Companion to the dev container on the SERVER (120). The server runs the heavy
|
|
# responders (Blaze / UTAS / roster / POW). Two pieces are inherently local to
|
|
# the game and therefore stay here:
|
|
#
|
|
# * autopatch.py — patches FIFA17.exe process memory (ProtoSSL cert-verify).
|
|
# Must run where the game runs; cannot be containerised.
|
|
# * lsx_responder — the Origin/EADesktop emulator the game dials on the
|
|
# hardcoded loopback 127.0.0.1:4216. Loopback IPC can't be
|
|
# cleanly redirected to a remote host, so it lives here.
|
|
#
|
|
# Everything the game reaches by a routable address is redirected to the server:
|
|
# * winter15.gosredirector.ea.com (hardcoded EA IP 159.153.51.20) -> SERVER:42127
|
|
# * easw.easports.com (dead hardcoded UTAS host) -> SERVER (:8099)
|
|
#
|
|
# The server's responders were started with OPENFUT_ADVERTISE=<SERVER_IP>, so
|
|
# after these first redirected contacts the game is handed <SERVER_IP> for every
|
|
# later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly.
|
|
#
|
|
# Usage: sudo OPENFUT_SERVER=10.10.0.120 ./client_arm.sh
|
|
# (re-run after every reboot; the sysctl/iptables state is volatile)
|
|
# ============================================================================
|
|
set -euo pipefail
|
|
|
|
SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 10.10.0.120}"
|
|
GOS_EA_IP="159.153.51.20" # winter15.gosredirector.ea.com (hardcoded in FIFA17)
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "!! must run as root (sudo). Re-run: sudo OPENFUT_SERVER=$SERVER $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "[client_arm] backend server = $SERVER"
|
|
|
|
# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
|
|
sysctl -q kernel.yama.ptrace_scope=0
|
|
|
|
# 2) Redirect the hardcoded Blaze redirector IP to the server's redirector.
|
|
# (Replace any stale rule first so re-runs and IP changes are clean.)
|
|
while iptables -t nat -D OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT \
|
|
--to-destination "$SERVER:42127" 2>/dev/null; do :; done
|
|
iptables -t nat -A OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT --to-destination "$SERVER:42127"
|
|
|
|
# 2b) DNAT from OUTPUT to a REMOTE host needs a matching source-NAT on the way
|
|
# out, or the server's replies (from its own IP) won't match the game's
|
|
# conntrack entry. MASQUERADE the redirected flow so it is SNAT'd to this
|
|
# host's outbound IP. (Harmless duplicate-guarded like the DNAT above.)
|
|
while iptables -t nat -D POSTROUTING -p tcp -d "$SERVER" --dport 42127 \
|
|
-j MASQUERADE 2>/dev/null; do :; done
|
|
iptables -t nat -A POSTROUTING -p tcp -d "$SERVER" --dport 42127 -j MASQUERADE
|
|
|
|
# 3) Point the dead hardcoded UTAS host at the server. The port (8099) is carried
|
|
# in the game's own URL, so only the name needs redirecting. Remove any prior
|
|
# OpenFUT-managed line (loopback or other server) and write the current one.
|
|
sed -i '/[[:space:]]easw\.easports\.com\b.*# openfut$/d' /etc/hosts
|
|
printf '%s\teasw.easports.com\t# openfut\n' "$SERVER" >> /etc/hosts
|
|
|
|
echo "[client_arm] --- armed ---"
|
|
sysctl kernel.yama.ptrace_scope
|
|
iptables -t nat -L OUTPUT -n | grep -i "$GOS_EA_IP" || echo " (DNAT missing!)"
|
|
grep 'easw.easports.com' /etc/hosts && echo " /etc/hosts ok" || echo " (/etc/hosts easw missing!)"
|
|
echo
|
|
echo "[client_arm] Next: start the LOCAL pieces (LSX + autopatch) with client_local.sh,"
|
|
echo " ensure the container is up on $SERVER, then launch FIFA 17."
|