[ipfire-2.x.git] / src / initscripts / helper / azure-setup

#!/bin/bash

. /etc/sysconfig/rc
. ${rc_functions}

# Set PATH to find our own executables
export PATH=/usr/local/sbin:/usr/local/bin:${PATH}

get() {
	local file="${1}"

	wget -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&format=text"
}

format_mac() {
	local mac="${1,,}"

	echo "${mac:0:2}:${mac:2:2}:${mac:4:2}:${mac:6:2}:${mac:8:2}:${mac:10:2}"
}

to_address() {
	local n="${1}"

	local o1=$(( (n & 0xff000000) >> 24 ))
	local o2=$(( (n & 0xff0000) >> 16 ))
	local o3=$(( (n & 0xff00) >> 8 ))
	local o4=$(( (n & 0xff) ))

	printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
}

to_integer() {
	local address="${1}"

	local integer=0

	local i
	for i in ${address//\./ }; do
		integer=$(( (integer << 8) + i ))
	done

	printf "%d\n" "${integer}"
}

prefix2netmask() {
	local prefix=${1}

	local zeros=$(( 32 - prefix ))
	local netmask=0

	local i
	for (( i=0; i<${zeros}; i++ )); do
		netmask=$(( (netmask << 1) ^ 1 ))
	done

	to_address "$(( netmask ^ 0xffffffff ))"
}

import_azure_configuration() {
	local instance_id="$(get compute/vmId)"
	if [ -z "${instance_id}" ]; then
		return 0
	fi

	boot_mesg "Importing Microsoft Azure configuration for instance ${instance_id}..."

	# Store instance ID
	echo "${instance_id}" > /var/run/azure-instance-id

	# Initialise system settings
	local hostname=$(get compute/name)

	# Set hostname
	if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
		echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
	fi

	# Set domainname
	if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
		echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
	fi

	# Import SSH keys for setup user
	local line
	for line in $(get "compute/publicKeys/"); do
		# Remove trailing slash
		local key_no="${line//\//}"

		# Get the path where this key should be installed
		local path="$(get "compute/publicKeys/${key_no}/path")"
		local key="$(get "compute/publicKeys/${key_no}/keyData")"

		local user
		if [[ "${path}" =~ ^/home ]]; then
			user="${path:6}"
			user="${user%%/*}"
		else
			# Cannot process this user
			continue
		fi

		# Create user if it does not exist
		if ! getent passwd "${user}" &>/dev/null; then
			useradd "${user}" -s /usr/bin/run-setup -g nobody -m

			# Unlock the account
			usermod -p "x" "${user}"
		fi

		if [ -n "${key}" ] && ! grep -q "^${key}$" "${path}" 2>/dev/null; then
			local dir="$(dirname "${path}")"

			# Install directory
			mkdir -p "${dir}"
			chmod 700 "${dir}"
			chown "${user}.nobody" "${dir}"

			# Install the key
			echo "${key}" >> "${path}"
			chmod 600 "${path}"
			chown "${user}.nobody" "${path}"
		fi
	done

	# Download the user-data script only on the first boot
	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
		# Download user-data
		local user_data="$(get customData)"

		# Save user-data script to be executed later
		if [ "${user_data:0:2}" = "#!" ]; then
			echo "${user_data}" > /tmp/azure-user-data.script
			chmod 700 /tmp/azure-user-data.script

			# Run the user-data script
			local now="$(date -u +"%s")"
			/tmp/azure-user-data.script &>/var/log/user-data.log.${now}

			# Delete the script right away
			rm /tmp/azure-user-data.script
		fi
	fi

	# Import network configuration
	# After this, no network connectivity will be available from this script due to the
	# renaming of the network interfaces for which they have to be shut down
	local config_type=1
	: > /var/ipfire/ethernet/settings

	local device_number
	for device_number in $(get network/interface); do
		# Remove trailing slash
		device_number="${device_number//\//}"

		local mac="$(get "network/interface/${device_number}/macAddress")"
		mac="$(format_mac "${mac}")"

		# First IPv4 address
		local ipv4_address="$(get "network/interface/${device_number}/ipv4/ipAddress/0/privateIpAddress")"
		local ipv4_address_num="$(to_integer "${ipv4_address}")"
		local prefix="$(get "network/interface/${device_number}/ipv4/subnet/0/prefix")"
		local netmask="$(prefix2netmask "${prefix}")"

		# Get the network address
		local netaddress="$(get "network/interface/${device_number}/ipv4/subnet/0/address")"
		local netaddress_num="$(to_integer "${netaddress}")"

		case "${device_number}" in
			# RED
			0)
				local interface_name="red0"

				# The gateway is always the first IP address in the subnet
				local gateway="$(to_address $(( netaddress_num + 1 )))"

				(
					echo "RED_TYPE=STATIC"
					echo "RED_DEV=${interface_name}"
					echo "RED_MACADDR=${mac}"
					echo "RED_DESCRIPTION='${interface_id}'"
					echo "RED_ADDRESS=${ipv4_address}"
					echo "RED_NETMASK=${netmask}"
					echo "RED_NETADDRESS=${netaddress}"
					echo "DEFAULT_GATEWAY=${gateway}"
				) >> /var/ipfire/ethernet/settings

				# Import aliases for RED
				local address_no
				for address_no in $(get "network/interface/0/ipv4/ipAddress"); do
					# Remove trailing slash
					address_no="${address_no//\//}"

					# Skip the first address
					[ "${address_no}" = "0" ] && continue

					# Fetch the IP address
					local alias="$(get "network/interface/0/ipv4/ipAddress/${address_no}/privateIpAddress")"
					echo "${alias},on,"
				done > /var/ipfire/ethernet/aliases
				;;

			# GREEN
			1)
				local interface_name="green0"

				(
					echo "GREEN_DEV=${interface_name}"
					echo "GREEN_MACADDR=${mac}"
					echo "GREEN_DESCRIPTION='${interface_id}'"
					echo "GREEN_ADDRESS=${ipv4_address}"
					echo "GREEN_NETMASK=${netmask}"
					echo "GREEN_NETADDRESS=${netaddress}"
				) >> /var/ipfire/ethernet/settings
				;;

			# ORANGE
			2)
				local interface_name="orange0"
				config_type=2

				(
					echo "ORANGE_DEV=${interface_name}"
					echo "ORANGE_MACADDR=${mac}"
					echo "ORANGE_DESCRIPTION='${interface_id}'"
					echo "ORANGE_ADDRESS=${ipv4_address}"
					echo "ORANGE_NETMASK=${netmask}"
					echo "ORANGE_NETADDRESS=${netaddress}"
				) >> /var/ipfire/ethernet/settings
				;;
		esac
	done

	# Save CONFIG_TYPE
	echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings

	# Actions performed only on the very first start
	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
		# Disable using ISP nameservers
		sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings

		# Enable SSH
		sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings

		# Disable SSH password authentication
		sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings

		# Enable SSH key authentication
		sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings

		# Apply SSH settings
		/usr/local/bin/sshctrl

		# Mark SSH to start immediately (but not right now)
		touch /var/ipfire/remote/enablessh
		chown nobody:nobody /var/ipfire/remote/enablessh

		# Firewall rules for SSH and WEBIF
		(
			echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
			echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
		) >> /var/ipfire/firewall/input

		# This script has now completed the first steps of setup
		touch /var/ipfire/main/firstsetup_ok
	fi

	# All done
	echo_ok
}

case "${reason}" in
	PREINIT)
		# Bring up the interface
		ip link set "${interface}" up
		;;

	BOUND|RENEW|REBIND|REBOOT)
		# Remove any previous IP addresses
		ip addr flush dev "${interface}"

		# Add (or re-add) the new IP address
		ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"

		# Add the default route
		ip route add default via "${new_routers}"

		# Setup DNS
		for domain_name_server in ${new_domain_name_servers}; do
			echo "nameserver ${domain_name_server}"
		done > /etc/resolv.conf

		# The system is online now
		touch /var/ipfire/red/active

		# Import Azure configuration
		import_azure_configuration
		;;

	EXPIRE|FAIL|RELEASE|STOP)
		# The system is no longer online
		rm -f /var/ipfire/red/active

		# Remove all IP addresses
		ip addr flush dev "${interface}"

		# Shut down the interface
		ip link set "${interface}" down
		;;

	*)
		echo "Unhandled reason: ${reason}" >&2
		exit 2
		;;
esac

# Terminate
exit 0
Commit	Line	Data
acf47bfa MT	1	#!/bin/bash
	2
	3	. /etc/sysconfig/rc
	4	. ${rc_functions}
	5
	6	# Set PATH to find our own executables
	7	export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
	8
	9	get() {
	10	local file="${1}"
	11
	12	wget -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&format=text"
	13	}
	14
	15	format_mac() {
	16	local mac="${1,,}"
	17
abccd997	18	echo "${mac:0:2}:${mac:2:2}:${mac:4:2}:${mac:6:2}:${mac:8:2}:${mac:10:2}"
acf47bfa MT	19	}
	20
	21	to_address() {
	22	local n="${1}"
	23
	24	local o1=$(( (n & 0xff000000) >> 24 ))
	25	local o2=$(( (n & 0xff0000) >> 16 ))
	26	local o3=$(( (n & 0xff00) >> 8 ))
	27	local o4=$(( (n & 0xff) ))
	28
	29	printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
	30	}
	31
	32	to_integer() {
	33	local address="${1}"
	34
	35	local integer=0
	36
	37	local i
	38	for i in ${address//\./ }; do
	39	integer=$(( (integer << 8) + i ))
	40	done
	41
	42	printf "%d\n" "${integer}"
	43	}
	44
	45	prefix2netmask() {
	46	local prefix=${1}
	47
	48	local zeros=$(( 32 - prefix ))
	49	local netmask=0
	50
	51	local i
	52	for (( i=0; i<${zeros}; i++ )); do
	53	netmask=$(( (netmask << 1) ^ 1 ))
	54	done
	55
	56	to_address "$(( netmask ^ 0xffffffff ))"
	57	}
	58
	59	import_azure_configuration() {
	60	local instance_id="$(get compute/vmId)"
26eab1fe MT	61	if [ -z "${instance_id}" ]; then
	62	return 0
	63	fi
acf47bfa MT	64
	65	boot_mesg "Importing Microsoft Azure configuration for instance ${instance_id}..."
	66
	67	# Store instance ID
	68	echo "${instance_id}" > /var/run/azure-instance-id
	69
	70	# Initialise system settings
	71	local hostname=$(get compute/name)
	72
	73	# Set hostname
	74	if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
	75	echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
	76	fi
	77
	78	# Set domainname
	79	if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
	80	echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
	81	fi
	82
	83	# Import SSH keys for setup user
	84	local line
	85	for line in $(get "compute/publicKeys/"); do
	86	# Remove trailing slash
	87	local key_no="${line//\//}"
	88
	89	# Get the path where this key should be installed
	90	local path="$(get "compute/publicKeys/${key_no}/path")"
	91	local key="$(get "compute/publicKeys/${key_no}/keyData")"
	92
	93	local user
	94	if [[ "${path}" =~ ^/home ]]; then
	95	user="${path:6}"
	96	user="${user%%/*}"
	97	else
	98	# Cannot process this user
	99	continue
	100	fi
	101
	102	# Create user if it does not exist
	103	if ! getent passwd "${user}" &>/dev/null; then
	104	useradd "${user}" -s /usr/bin/run-setup -g nobody -m
	105
	106	# Unlock the account
	107	usermod -p "x" "${user}"
	108	fi
	109
	110	if [ -n "${key}" ] && ! grep -q "^${key}$" "${path}" 2>/dev/null; then
	111	local dir="$(dirname "${path}")"
	112
	113	# Install directory
	114	mkdir -p "${dir}"
	115	chmod 700 "${dir}"
	116	chown "${user}.nobody" "${dir}"
	117
	118	# Install the key
	119	echo "${key}" >> "${path}"
	120	chmod 600 "${path}"
	121	chown "${user}.nobody" "${path}"
	122	fi
	123	done
	124
	125	# Download the user-data script only on the first boot
	126	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
	127	# Download user-data
128	local user_data="$(get customData)"
129
130	# Save user-data script to be executed later
131	if [ "${user_data:0:2}" = "#!" ]; then
132	echo "${user_data}" > /tmp/azure-user-data.script
133	chmod 700 /tmp/azure-user-data.script
134
135	# Run the user-data script
136	local now="$(date -u +"%s")"
137	/tmp/azure-user-data.script &>/var/log/user-data.log.${now}
138
139	# Delete the script right away
140	rm /tmp/azure-user-data.script
141	fi
142	fi
143
acf47bfa MT	144	# Import network configuration
	145	# After this, no network connectivity will be available from this script due to the
	146	# renaming of the network interfaces for which they have to be shut down
	147	local config_type=1
	148	: > /var/ipfire/ethernet/settings
	149
	150	local device_number
	151	for device_number in $(get network/interface); do
	152	# Remove trailing slash
	153	device_number="${device_number//\//}"
	154
	155	local mac="$(get "network/interface/${device_number}/macAddress")"
	156	mac="$(format_mac "${mac}")"
	157
	158	# First IPv4 address
	159	local ipv4_address="$(get "network/interface/${device_number}/ipv4/ipAddress/0/privateIpAddress")"
	160	local ipv4_address_num="$(to_integer "${ipv4_address}")"
	161	local prefix="$(get "network/interface/${device_number}/ipv4/subnet/0/prefix")"
	162	local netmask="$(prefix2netmask "${prefix}")"
acf47bfa	163
b67f02d5	164	# Get the network address
acf47bfa MT	165	local netaddress="$(get "network/interface/${device_number}/ipv4/subnet/0/address")"
acf47bfa MT	166	local netaddress_num="$(to_integer "${netaddress}")"
acf47bfa MT	167
	168	case "${device_number}" in
	169	# RED
	170	0)
	171	local interface_name="red0"
	172
	173	# The gateway is always the first IP address in the subnet
	174	local gateway="$(to_address $(( netaddress_num + 1 )))"
	175
acf47bfa MT	176	(
	177	echo "RED_TYPE=STATIC"
	178	echo "RED_DEV=${interface_name}"
	179	echo "RED_MACADDR=${mac}"
	180	echo "RED_DESCRIPTION='${interface_id}'"
	181	echo "RED_ADDRESS=${ipv4_address}"
	182	echo "RED_NETMASK=${netmask}"
	183	echo "RED_NETADDRESS=${netaddress}"
acf47bfa	184	echo "DEFAULT_GATEWAY=${gateway}"
acf47bfa MT	185	) >> /var/ipfire/ethernet/settings
	186
	187	# Import aliases for RED
	188	local address_no
	189	for address_no in $(get "network/interface/0/ipv4/ipAddress"); do
	190	# Remove trailing slash
	191	address_no="${address_no//\//}"
	192
	193	# Skip the first address
	194	[ "${address_no}" = "0" ] && continue
	195
	196	# Fetch the IP address
	197	local alias="$(get "network/interface/0/ipv4/ipAddress/${address_no}/privateIpAddress")"
	198	echo "${alias},on,"
	199	done > /var/ipfire/ethernet/aliases
	200	;;
	201
	202	# GREEN
	203	1)
	204	local interface_name="green0"
	205
	206	(
	207	echo "GREEN_DEV=${interface_name}"
	208	echo "GREEN_MACADDR=${mac}"
	209	echo "GREEN_DESCRIPTION='${interface_id}'"
	210	echo "GREEN_ADDRESS=${ipv4_address}"
	211	echo "GREEN_NETMASK=${netmask}"
	212	echo "GREEN_NETADDRESS=${netaddress}"
acf47bfa MT	213	) >> /var/ipfire/ethernet/settings
	214	;;
	215
	216	# ORANGE
	217	2)
	218	local interface_name="orange0"
	219	config_type=2
	220
	221	(
	222	echo "ORANGE_DEV=${interface_name}"
	223	echo "ORANGE_MACADDR=${mac}"
	224	echo "ORANGE_DESCRIPTION='${interface_id}'"
	225	echo "ORANGE_ADDRESS=${ipv4_address}"
	226	echo "ORANGE_NETMASK=${netmask}"
	227	echo "ORANGE_NETADDRESS=${netaddress}"
acf47bfa MT	228	) >> /var/ipfire/ethernet/settings
	229	;;
	230	esac
	231	done
	232
	233	# Save CONFIG_TYPE
	234	echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
	235
	236	# Actions performed only on the very first start
	237	if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
88cb5eb1 MT	238	# Disable using ISP nameservers
	239	sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings
	240
acf47bfa MT	241	# Enable SSH
	242	sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
	243
	244	# Disable SSH password authentication
	245	sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
	246
	247	# Enable SSH key authentication
	248	sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
	249
	250	# Apply SSH settings
	251	/usr/local/bin/sshctrl
	252
	253	# Mark SSH to start immediately (but not right now)
	254	touch /var/ipfire/remote/enablessh
	255	chown nobody:nobody /var/ipfire/remote/enablessh
	256
	257	# Firewall rules for SSH and WEBIF
	258	(
	259	echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
	260	echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
	261	) >> /var/ipfire/firewall/input
	262
	263	# This script has now completed the first steps of setup
	264	touch /var/ipfire/main/firstsetup_ok
	265	fi
	266
	267	# All done
	268	echo_ok
	269	}
	270
	271	case "${reason}" in
	272	PREINIT)
	273	# Bring up the interface
	274	ip link set "${interface}" up
	275	;;
	276
	277	BOUND\|RENEW\|REBIND\|REBOOT)
	278	# Remove any previous IP addresses
	279	ip addr flush dev "${interface}"
	280
	281	# Add (or re-add) the new IP address
	282	ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
	283
	284	# Add the default route
	285	ip route add default via "${new_routers}"
	286
	287	# Setup DNS
	288	for domain_name_server in ${new_domain_name_servers}; do
	289	echo "nameserver ${domain_name_server}"
	290	done > /etc/resolv.conf
	291
	292	# The system is online now
	293	touch /var/ipfire/red/active
	294
	295	# Import Azure configuration
	296	import_azure_configuration
	297	;;
	298
	299	EXPIRE\|FAIL\|RELEASE\|STOP)
	300	# The system is no longer online
	301	rm -f /var/ipfire/red/active
	302
	303	# Remove all IP addresses
	304	ip addr flush dev "${interface}"
305
306	# Shut down the interface
307	ip link set "${interface}" down
308	;;
309
310	*)
311	echo "Unhandled reason: ${reason}" >&2
312	exit 2
313	;;
314	esac
315
316	# Terminate
317	exit 0