]> git.ipfire.org Git - ipfire-2.x.git/blame - src/initscripts/helper/oci-setup
/var/ipfire/ethernet/settings: Drop BROADCAST variable
[ipfire-2.x.git] / src / initscripts / helper / oci-setup
CommitLineData
138c94a9
MT
1#!/bin/bash
2
3. /etc/sysconfig/rc
4. ${rc_functions}
5
6# Set PATH to find our own executables
7export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
8
9# GCP only supports an MTU of 1460
10DEFAULT_MTU=1460
11
12get() {
13 local file="${1}"
14
15 wget -qO - "http://169.254.169.254/opc/v1/${file}"
16}
17
18to_address() {
19 local n="${1}"
20
21 local o1=$(( (n & 0xff000000) >> 24 ))
22 local o2=$(( (n & 0xff0000) >> 16 ))
23 local o3=$(( (n & 0xff00) >> 8 ))
24 local o4=$(( (n & 0xff) ))
25
26 printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
27}
28
29to_integer() {
30 local address="${1}"
31
32 local integer=0
33
34 local i
35 for i in ${address//\./ }; do
36 integer=$(( (integer << 8) + i ))
37 done
38
39 printf "%d\n" "${integer}"
40}
41
42prefix2netmask() {
43 local prefix=${1}
44
45 local zeros=$(( 32 - prefix ))
46 local netmask=0
47
48 local i
49 for (( i=0; i<${zeros}; i++ )); do
50 netmask=$(( (netmask << 1) ^ 1 ))
51 done
52
53 to_address "$(( netmask ^ 0xffffffff ))"
54}
55
56oci_list_interfaces() {
57 get "vnics/" | python3 -c "import json, sys; print(\"\n\".join([vnic[\"vnicId\"] for vnic in json.load(sys.stdin)]))"
58}
59
60oci_get_interface_param() {
61 local id="${1}"
62 local param="${2}"
63
64 get "vnics/" | python3 -c "import json, sys; print(\"\n\".join(vnic.get(\"${param}\", \"\") for vnic in json.load(sys.stdin) if vnic[\"vnicId\"] == \"${id}\"))"
65}
66
67import_oci_configuration() {
68 local instance_id="$(get instance/id)"
69
70 boot_mesg "Importing Oracle Cloud Infrastructure configuration for instance ${instance_id}..."
71
72 # Store instance ID
73 echo "${instance_id}" > /var/run/oci-instance-id
74
75 # Initialise system settings
76 local hostname=$(get instance/hostname)
77
78 # Set hostname
79 if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
80 echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
81 fi
82
83 # Set domainname
84 if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
85 echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
86 fi
87
88 # Create setup user
89 if ! getent passwd setup &>/dev/null; then
90 useradd setup -s /usr/bin/run-setup -g nobody -m
91
92 # Unlock the account
93 usermod -p "x" setup
94 fi
95
96 # Import SSH keys for setup user
97 local line
98 while read -r line; do
99 # Strip the username part from the key
100 local key="${line#*:}"
101
102 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev/null; then
103 mkdir -p "/home/setup/.ssh"
104 chmod 700 "/home/setup/.ssh"
105 chown setup.nobody "/home/setup/.ssh"
106
107 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
108 chmod 600 "/home/setup/.ssh/authorized_keys"
109 chown setup.nobody "/home/setup/.ssh/authorized_keys"
110 fi
111 done <<<"$(get instance/metadata/ssh_authorized_keys)"
112
113 # Download the user-data script only on the first boot
114 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
115 # Download a startup script
116 local script="$(get instance/metadata/user_data)"
117
118 # Execute the script
119 if [ "${script:0:2}" = "#!" ]; then
120 echo "${script}" > /tmp/user-data.script
121 chmod 700 /tmp/user-data.script
122
123 # Run the script
124 local now="$(date -u +"%s")"
125 /tmp/user-data.script &>/var/log/user-data.log.${now}
126
127 # Delete the script right away
128 rm /tmp/user-data.script
129 fi
130 fi
131
132 # Import network configuration
133 # After this, no network connectivity will be available from this script due to the
134 # renaming of the network interfaces for which they have to be shut down
135 local config_type=1
136 : > /var/ipfire/ethernet/settings
137
138 local id
139 for id in $(oci_list_interfaces); do
140 local mac="$(oci_get_interface_param "${id}" "macAddr")"
141
142 # First IPv4 address
143 local ipv4_address="$(oci_get_interface_param "${id}" "privateIp")"
144 local ipv4_address_num="$(to_integer "${ipv4_address}")"
145
146 local subnet="$(oci_get_interface_param "${id}" "subnetCidrBlock")"
147 local prefix="${subnet#*/}"
148
149 local netmask="$(prefix2netmask "${prefix}")"
138c94a9
MT
150
151 # Calculate the network and broadcast addresses
152 local netaddress="${subnet%/*}"
138c94a9
MT
153
154 local index="$(oci_get_interface_param "${id}" "nicIndex")"
155
156 # Set index to zero if it was empty
157 if [ -z "${index}" ]; then
158 index=0
159 fi
160
161 case "${index}" in
162 # RED
163 0)
164 local interface_name="red0"
165 local gateway="$(oci_get_interface_param "${id}" "virtualRouterIp")"
166
167 (
168 echo "RED_TYPE=STATIC"
169 echo "RED_DEV=${interface_name}"
170 echo "RED_MACADDR=${mac}"
171 echo "RED_DESCRIPTION='${id}'"
172 echo "RED_ADDRESS=${ipv4_address}"
173 echo "RED_NETMASK=${netmask}"
174 echo "RED_NETADDRESS=${netaddress}"
138c94a9
MT
175 echo "RED_MTU=1500"
176 echo "DEFAULT_GATEWAY=${gateway}"
177 ) >> /var/ipfire/ethernet/settings
178
179 # Import aliases for RED
180 #for alias in $(get "instance/network-interfaces/${device_number}/ip-aliases"); do
181 # echo "${alias},on,"
182 #done > /var/ipfire/ethernet/aliases
183 ;;
184
185 # GREEN
186 1)
187 local interface_name="green0"
188
189 (
190 echo "GREEN_DEV=${interface_name}"
191 echo "GREEN_MACADDR=${mac}"
192 echo "GREEN_DESCRIPTION='${id}'"
193 echo "GREEN_ADDRESS=${ipv4_address}"
194 echo "GREEN_NETMASK=${netmask}"
195 echo "GREEN_NETADDRESS=${netaddress}"
138c94a9
MT
196 echo "GREEN_MTU=${DEFAULT_MTU}"
197 ) >> /var/ipfire/ethernet/settings
198 ;;
199
200 # ORANGE
201 2)
202 local interface_name="orange0"
203 config_type=2
204
205 (
206 echo "ORANGE_DEV=${interface_name}"
207 echo "ORANGE_MACADDR=${mac}"
208 echo "ORANGE_DESCRIPTION='${id}'"
209 echo "ORANGE_ADDRESS=${ipv4_address}"
210 echo "ORANGE_NETMASK=${netmask}"
211 echo "ORANGE_NETADDRESS=${netaddress}"
138c94a9
MT
212 echo "ORANGE_MTU=${DEFAULT_MTU}"
213 ) >> /var/ipfire/ethernet/settings
214 ;;
215 esac
216 done
217
218 # Save CONFIG_TYPE
219 echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
220
221 # Actions performed only on the very first start
222 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
223 # Disable using ISP nameservers
224 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings
225
226 # Enable SSH
227 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
228
229 # Disable SSH password authentication
230 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
231
232 # Enable SSH key authentication
233 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
234
235 # Apply SSH settings
236 /usr/local/bin/sshctrl
237
238 # Mark SSH to start immediately (but not right now)
239 touch /var/ipfire/remote/enablessh
240 chown nobody:nobody /var/ipfire/remote/enablessh
241
242 # Firewall rules for SSH and WEBIF
243 (
244 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
245 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
246 ) >> /var/ipfire/firewall/input
247
248 # This script has now completed the first steps of setup
249 touch /var/ipfire/main/firstsetup_ok
250 fi
251
252 # All done
253 echo_ok
254}
255
256case "${reason}" in
257 PREINIT)
258 # Bring up the interface
259 ip link set "${interface}" up
260 ;;
261
262 BOUND|RENEW|REBIND|REBOOT)
263 # Remove any previous IP addresses
264 ip addr flush dev "${interface}"
265
266 # Add (or re-add) the new IP address
267 ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
268
269 # Add the default route
270 ip route add "${new_routers}" dev "${interface}"
271 ip route add default via "${new_routers}"
272
273 # Setup DNS
274 for domain_name_server in ${new_domain_name_servers}; do
275 echo "nameserver ${domain_name_server}"
276 done > /etc/resolv.conf
277
278 # The system is online now
279 touch /var/ipfire/red/active
280
281 # Import OCI configuration
282 import_oci_configuration
283 ;;
284
285 EXPIRE|FAIL|RELEASE|STOP)
286 # The system is no longer online
287 rm -f /var/ipfire/red/active
288
289 # Remove all IP addresses
290 ip addr flush dev "${interface}"
291
292 # Shut down the interface
293 ip link set "${interface}" down
294 ;;
295
296 *)
297 echo "Unhandled reason: ${reason}" >&2
298 exit 2
299 ;;
300esac
301
302# Terminate
303exit 0