src/initscripts/helper/azure-setup

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /etc/sysconfig/rc
  23 . ${rc_functions}
  24
  25 # Set PATH to find our own executables
  26 export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
  27
  28 get() {
  29         local file="${1}"
  30
  31         wget --timeout=3 --tries=3 -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&format=text"
  32 }
  33
  34 format_mac() {
  35         local mac="${1,,}"
  36
  37         echo "${mac:0:2}:${mac:2:2}:${mac:4:2}:${mac:6:2}:${mac:8:2}:${mac:10:2}"
  38 }
  39
  40 to_address() {
  41         local n="${1}"
  42
  43         local o1=$(( (n & 0xff000000) >> 24 ))
  44         local o2=$(( (n & 0xff0000) >> 16 ))
  45         local o3=$(( (n & 0xff00) >> 8 ))
  46         local o4=$(( (n & 0xff) ))
  47
  48         printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
  49 }
  50
  51 to_integer() {
  52         local address="${1}"
  53
  54         local integer=0
  55
  56         local i
  57         for i in ${address//\./ }; do
  58                 integer=$(( (integer << 8) + i ))
  59         done
  60
  61         printf "%d\n" "${integer}"
  62 }
  63
  64 prefix2netmask() {
  65         local prefix=${1}
  66
  67         local zeros=$(( 32 - prefix ))
  68         local netmask=0
  69
  70         local i
  71         for (( i=0; i<${zeros}; i++ )); do
  72                 netmask=$(( (netmask << 1) ^ 1 ))
  73         done
  74
  75         to_address "$(( netmask ^ 0xffffffff ))"
  76 }
  77
  78 import_azure_configuration() {
  79         local instance_id="$(get compute/vmId)"
  80         if [ -z "${instance_id}" ]; then
  81                 return 0
  82         fi
  83
  84         boot_mesg "Importing Microsoft Azure configuration for instance ${instance_id}..."
  85
  86         # Store instance ID
  87         echo "${instance_id}" > /var/run/azure-instance-id
  88
  89         # Initialise system settings
  90         local hostname=$(get compute/name)
  91
  92         # Set hostname
  93         if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
  94                 echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
  95         fi
  96
  97         # Set domainname
  98         if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
  99                 echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
 100         fi
 101
 102         # Import SSH keys for setup user
 103         local line
 104         for line in $(get "compute/publicKeys/"); do
 105                 # Remove trailing slash
 106                 local key_no="${line//\//}"
 107
 108                 # Get the path where this key should be installed
 109                 local path="$(get "compute/publicKeys/${key_no}/path")"
 110                 local key="$(get "compute/publicKeys/${key_no}/keyData")"
 111
 112                 local user
 113                 if [[ "${path}" =~ ^/home ]]; then
 114                         user="${path:6}"
 115                         user="${user%%/*}"
 116                 else
 117                         # Cannot process this user
 118                         continue
 119                 fi
 120
 121                 # Create user if it does not exist
 122                 if ! getent passwd "${user}" &>/dev/null; then
 123                         useradd "${user}" -s /usr/bin/run-setup -g nobody -m
 124
 125                         # Unlock the account
 126                         usermod -p "x" "${user}"
 127                 fi
 128
 129                 if [ -n "${key}" ] && ! grep -q "^${key}$" "${path}" 2>/dev/null; then
 130                         local dir="$(dirname "${path}")"
 131
 132                         # Install directory
 133                         mkdir -p "${dir}"
 134                         chmod 700 "${dir}"
 135                         chown "${user}.nobody" "${dir}"
 136
 137                         # Install the key
 138                         echo "${key}" >> "${path}"
 139                         chmod 600 "${path}"
 140                         chown "${user}.nobody" "${path}"
 141                 fi
 142         done
 143
 144         # Import network configuration
 145         # After this, no network connectivity will be available from this script due to the
 146         # renaming of the network interfaces for which they have to be shut down
 147         local config_type=1
 148         : > /var/ipfire/ethernet/settings
 149
 150         local device_number
 151         for device_number in $(get network/interface); do
 152                 # Remove trailing slash
 153                 device_number="${device_number//\//}"
 154
 155                 local mac="$(get "network/interface/${device_number}/macAddress")"
 156                 mac="$(format_mac "${mac}")"
 157
 158                 # First IPv4 address
 159                 local ipv4_address="$(get "network/interface/${device_number}/ipv4/ipAddress/0/privateIpAddress")"
 160                 local ipv4_address_num="$(to_integer "${ipv4_address}")"
 161                 local prefix="$(get "network/interface/${device_number}/ipv4/subnet/0/prefix")"
 162                 local netmask="$(prefix2netmask "${prefix}")"
 163
 164                 # Get the network address
 165                 local netaddress="$(get "network/interface/${device_number}/ipv4/subnet/0/address")"
 166                 local netaddress_num="$(to_integer "${netaddress}")"
 167
 168                 case "${device_number}" in
 169                         # RED
 170                         0)
 171                                 local interface_name="red0"
 172
 173                                 # The gateway is always the first IP address in the subnet
 174                                 local gateway="$(to_address $(( netaddress_num + 1 )))"
 175
 176                                 (
 177                                         echo "RED_TYPE=STATIC"
 178                                         echo "RED_DEV=${interface_name}"
 179                                         echo "RED_MACADDR=${mac}"
 180                                         echo "RED_DESCRIPTION='${interface_id}'"
 181                                         echo "RED_ADDRESS=${ipv4_address}"
 182                                         echo "RED_NETMASK=${netmask}"
 183                                         echo "RED_NETADDRESS=${netaddress}"
 184                                         echo "DEFAULT_GATEWAY=${gateway}"
 185                                 ) >> /var/ipfire/ethernet/settings
 186
 187                                 # Import aliases for RED
 188                                 local address_no
 189                                 for address_no in $(get "network/interface/0/ipv4/ipAddress"); do
 190                                         # Remove trailing slash
 191                                         address_no="${address_no//\//}"
 192
 193                                         # Skip the first address
 194                                         [ "${address_no}" = "0" ] && continue
 195
 196                                         # Fetch the IP address
 197                                         local alias="$(get "network/interface/0/ipv4/ipAddress/${address_no}/privateIpAddress")"
 198                                         echo "${alias},on,"
 199                                 done > /var/ipfire/ethernet/aliases
 200                                 ;;
 201
 202                         # GREEN
 203                         1)
 204                                 local interface_name="green0"
 205
 206                                 (
 207                                         echo "GREEN_DEV=${interface_name}"
 208                                         echo "GREEN_MACADDR=${mac}"
 209                                         echo "GREEN_DESCRIPTION='${interface_id}'"
 210                                         echo "GREEN_ADDRESS=${ipv4_address}"
 211                                         echo "GREEN_NETMASK=${netmask}"
 212                                         echo "GREEN_NETADDRESS=${netaddress}"
 213                                 ) >> /var/ipfire/ethernet/settings
 214                                 ;;
 215
 216                         # ORANGE
 217                         2)
 218                                 local interface_name="orange0"
 219                                 config_type=2
 220
 221                                 (
 222                                         echo "ORANGE_DEV=${interface_name}"
 223                                         echo "ORANGE_MACADDR=${mac}"
 224                                         echo "ORANGE_DESCRIPTION='${interface_id}'"
 225                                         echo "ORANGE_ADDRESS=${ipv4_address}"
 226                                         echo "ORANGE_NETMASK=${netmask}"
 227                                         echo "ORANGE_NETADDRESS=${netaddress}"
 228                                 ) >> /var/ipfire/ethernet/settings
 229                                 ;;
 230                 esac
 231         done
 232
 233         # Save CONFIG_TYPE
 234         echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
 235
 236         # Actions performed only on the very first start
 237         if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
 238                 # Disable using ISP nameservers
 239                 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var/ipfire/dns/settings
 240
 241                 # Enable SSH
 242                 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
 243
 244                 # Disable SSH password authentication
 245                 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
 246
 247                 # Enable SSH key authentication
 248                 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
 249
 250                 # Apply SSH settings
 251                 /usr/local/bin/sshctrl
 252
 253                 # Mark SSH to start immediately (but not right now)
 254                 touch /var/ipfire/remote/enablessh
 255                 chown nobody:nobody /var/ipfire/remote/enablessh
 256
 257                 # Firewall rules for SSH and WEBIF
 258                 (
 259                         echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
 260                         echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
 261                 ) >> /var/ipfire/firewall/input
 262
 263                 # Download user-data
 264                 local user_data="$(get customData)"
 265
 266                 # Save user-data script to be executed later
 267                 if [ "${user_data:0:2}" = "#!" ]; then
 268                         echo "${user_data}" > /tmp/azure-user-data.script
 269                         chmod 700 /tmp/azure-user-data.script
 270
 271                         # Run the user-data script
 272                         local now="$(date -u +"%s")"
 273                         /tmp/azure-user-data.script &>/var/log/user-data.log.${now}
 274
 275                         # Delete the script right away
 276                         rm /tmp/azure-user-data.script
 277                 fi
 278
 279                 # This script has now completed the first steps of setup
 280                 touch /var/ipfire/main/firstsetup_ok
 281         fi
 282
 283         # All done
 284         echo_ok
 285 }
 286
 287 case "${reason}" in
 288         PREINIT)
 289                 # Bring up the interface
 290                 ip link set "${interface}" up
 291                 ;;
 292
 293         BOUND|RENEW|REBIND|REBOOT)
 294                 # Remove any previous IP addresses
 295                 ip addr flush dev "${interface}"
 296
 297                 # Add (or re-add) the new IP address
 298                 ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
 299
 300                 # Add the default route
 301                 ip route add default via "${new_routers}"
 302
 303                 # Setup DNS
 304                 for domain_name_server in ${new_domain_name_servers}; do
 305                         echo "nameserver ${domain_name_server}"
 306                 done > /etc/resolv.conf
 307
 308                 # The system is online now
 309                 touch /var/ipfire/red/active
 310
 311                 # Import Azure configuration
 312                 import_azure_configuration
 313                 ;;
 314
 315         EXPIRE|FAIL|RELEASE|STOP)
 316                 # The system is no longer online
 317                 rm -f /var/ipfire/red/active
 318
 319                 # Remove all IP addresses
 320                 ip addr flush dev "${interface}"
 321
 322                 # Shut down the interface
 323                 ip link set "${interface}" down
 324                 ;;
 325
 326         *)
 327                 echo "Unhandled reason: ${reason}" >&2
 328                 exit 2
 329                 ;;
 330 esac
 331
 332 # Terminate
 333 exit 0