src/initscripts/helper/azure-setup

   1 #!/bin/bash
   2
   3 . /etc/sysconfig/rc
   4 . ${rc_functions}
   5
   6 # Set PATH to find our own executables
   7 export PATH=/usr/local/sbin:/usr/local/bin:${PATH}
   8
   9 get() {
  10         local file="${1}"
  11
  12         wget -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&format=text"
  13 }
  14
  15 format_mac() {
  16         local mac="${1,,}"
  17
  18         echo "${mac:0:2}:${mac:2:2}:${mac:4:2}:${mac:6:2}:${mac:8:2}:${mac:10:2}"
  19 }
  20
  21 to_address() {
  22         local n="${1}"
  23
  24         local o1=$(( (n & 0xff000000) >> 24 ))
  25         local o2=$(( (n & 0xff0000) >> 16 ))
  26         local o3=$(( (n & 0xff00) >> 8 ))
  27         local o4=$(( (n & 0xff) ))
  28
  29         printf "%d.%d.%d.%d\n" "${o1}" "${o2}" "${o3}" "${o4}"
  30 }
  31
  32 to_integer() {
  33         local address="${1}"
  34
  35         local integer=0
  36
  37         local i
  38         for i in ${address//\./ }; do
  39                 integer=$(( (integer << 8) + i ))
  40         done
  41
  42         printf "%d\n" "${integer}"
  43 }
  44
  45 prefix2netmask() {
  46         local prefix=${1}
  47
  48         local zeros=$(( 32 - prefix ))
  49         local netmask=0
  50
  51         local i
  52         for (( i=0; i<${zeros}; i++ )); do
  53                 netmask=$(( (netmask << 1) ^ 1 ))
  54         done
  55
  56         to_address "$(( netmask ^ 0xffffffff ))"
  57 }
  58
  59 import_azure_configuration() {
  60         local instance_id="$(get compute/vmId)"
  61         if [ -z "${instance_id}" ]; then
  62                 return 0
  63         fi
  64
  65         boot_mesg "Importing Microsoft Azure configuration for instance ${instance_id}..."
  66
  67         # Store instance ID
  68         echo "${instance_id}" > /var/run/azure-instance-id
  69
  70         # Initialise system settings
  71         local hostname=$(get compute/name)
  72
  73         # Set hostname
  74         if ! grep -q "^HOSTNAME=" /var/ipfire/main/settings; then
  75                 echo "HOSTNAME=${hostname%%.*}" >> /var/ipfire/main/settings
  76         fi
  77
  78         # Set domainname
  79         if ! grep -q "^DOMAINNAME=" /var/ipfire/main/settings; then
  80                 echo "DOMAINNAME=${hostname#*.}" >> /var/ipfire/main/settings
  81         fi
  82
  83         # Import SSH keys for setup user
  84         local line
  85         for line in $(get "compute/publicKeys/"); do
  86                 # Remove trailing slash
  87                 local key_no="${line//\//}"
  88
  89                 # Get the path where this key should be installed
  90                 local path="$(get "compute/publicKeys/${key_no}/path")"
  91                 local key="$(get "compute/publicKeys/${key_no}/keyData")"
  92
  93                 local user
  94                 if [[ "${path}" =~ ^/home ]]; then
  95                         user="${path:6}"
  96                         user="${user%%/*}"
  97                 else
  98                         # Cannot process this user
  99                         continue
 100                 fi
 101
 102                 # Create user if it does not exist
 103                 if ! getent passwd "${user}" &>/dev/null; then
 104                         useradd "${user}" -s /usr/bin/run-setup -g nobody -m
 105
 106                         # Unlock the account
 107                         usermod -p "x" "${user}"
 108                 fi
 109
 110                 if [ -n "${key}" ] && ! grep -q "^${key}$" "${path}" 2>/dev/null; then
 111                         local dir="$(dirname "${path}")"
 112
 113                         # Install directory
 114                         mkdir -p "${dir}"
 115                         chmod 700 "${dir}"
 116                         chown "${user}.nobody" "${dir}"
 117
 118                         # Install the key
 119                         echo "${key}" >> "${path}"
 120                         chmod 600 "${path}"
 121                         chown "${user}.nobody" "${path}"
 122                 fi
 123         done
 124
 125         # Download the user-data script only on the first boot
 126         if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
 127                 # Download user-data
 128                 local user_data="$(get customData)"
 129
 130                 # Save user-data script to be executed later
 131                 if [ "${user_data:0:2}" = "#!" ]; then
 132                         echo "${user_data}" > /tmp/azure-user-data.script
 133                         chmod 700 /tmp/azure-user-data.script
 134
 135                         # Run the user-data script
 136                         local now="$(date -u +"%s")"
 137                         /tmp/azure-user-data.script &>/var/log/user-data.log.${now}
 138
 139                         # Delete the script right away
 140                         rm /tmp/azure-user-data.script
 141                 fi
 142         fi
 143
 144         # Import network configuration
 145         # After this, no network connectivity will be available from this script due to the
 146         # renaming of the network interfaces for which they have to be shut down
 147         local config_type=1
 148         : > /var/ipfire/ethernet/settings
 149
 150         local device_number
 151         for device_number in $(get network/interface); do
 152                 # Remove trailing slash
 153                 device_number="${device_number//\//}"
 154
 155                 local mac="$(get "network/interface/${device_number}/macAddress")"
 156                 mac="$(format_mac "${mac}")"
 157
 158                 # First IPv4 address
 159                 local ipv4_address="$(get "network/interface/${device_number}/ipv4/ipAddress/0/privateIpAddress")"
 160                 local ipv4_address_num="$(to_integer "${ipv4_address}")"
 161                 local prefix="$(get "network/interface/${device_number}/ipv4/subnet/0/prefix")"
 162                 local netmask="$(prefix2netmask "${prefix}")"
 163                 local netmask_num="$(to_integer "${netmask}")"
 164
 165                 # Calculate the network and broadcast addresses
 166                 local netaddress="$(get "network/interface/${device_number}/ipv4/subnet/0/address")"
 167                 local netaddress_num="$(to_integer "${netaddress}")"
 168                 local broadcast="$(to_address $(( ipv4_address_num | (0xffffffff ^ netmask_num) )))"
 169
 170                 case "${device_number}" in
 171                         # RED
 172                         0)
 173                                 local interface_name="red0"
 174
 175                                 # The gateway is always the first IP address in the subnet
 176                                 local gateway="$(to_address $(( netaddress_num + 1 )))"
 177
 178                                 (
 179                                         echo "RED_TYPE=STATIC"
 180                                         echo "RED_DEV=${interface_name}"
 181                                         echo "RED_MACADDR=${mac}"
 182                                         echo "RED_DESCRIPTION='${interface_id}'"
 183                                         echo "RED_ADDRESS=${ipv4_address}"
 184                                         echo "RED_NETMASK=${netmask}"
 185                                         echo "RED_NETADDRESS=${netaddress}"
 186                                         echo "RED_BROADCAST=${broadcast}"
 187                                         echo "DEFAULT_GATEWAY=${gateway}"
 188                                 ) >> /var/ipfire/ethernet/settings
 189
 190                                 # Import aliases for RED
 191                                 local address_no
 192                                 for address_no in $(get "network/interface/0/ipv4/ipAddress"); do
 193                                         # Remove trailing slash
 194                                         address_no="${address_no//\//}"
 195
 196                                         # Skip the first address
 197                                         [ "${address_no}" = "0" ] && continue
 198
 199                                         # Fetch the IP address
 200                                         local alias="$(get "network/interface/0/ipv4/ipAddress/${address_no}/privateIpAddress")"
 201                                         echo "${alias},on,"
 202                                 done > /var/ipfire/ethernet/aliases
 203                                 ;;
 204
 205                         # GREEN
 206                         1)
 207                                 local interface_name="green0"
 208
 209                                 (
 210                                         echo "GREEN_DEV=${interface_name}"
 211                                         echo "GREEN_MACADDR=${mac}"
 212                                         echo "GREEN_DESCRIPTION='${interface_id}'"
 213                                         echo "GREEN_ADDRESS=${ipv4_address}"
 214                                         echo "GREEN_NETMASK=${netmask}"
 215                                         echo "GREEN_NETADDRESS=${netaddress}"
 216                                         echo "GREEN_BROADCAST=${broadcast}"
 217                                 ) >> /var/ipfire/ethernet/settings
 218                                 ;;
 219
 220                         # ORANGE
 221                         2)
 222                                 local interface_name="orange0"
 223                                 config_type=2
 224
 225                                 (
 226                                         echo "ORANGE_DEV=${interface_name}"
 227                                         echo "ORANGE_MACADDR=${mac}"
 228                                         echo "ORANGE_DESCRIPTION='${interface_id}'"
 229                                         echo "ORANGE_ADDRESS=${ipv4_address}"
 230                                         echo "ORANGE_NETMASK=${netmask}"
 231                                         echo "ORANGE_NETADDRESS=${netaddress}"
 232                                         echo "ORANGE_BROADCAST=${broadcast}"
 233                                 ) >> /var/ipfire/ethernet/settings
 234                                 ;;
 235                 esac
 236         done
 237
 238         # Save CONFIG_TYPE
 239         echo "CONFIG_TYPE=${config_type}" >> /var/ipfire/ethernet/settings
 240
 241         # Actions performed only on the very first start
 242         if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
 243                 # Enable SSH
 244                 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
 245
 246                 # Disable SSH password authentication
 247                 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var/ipfire/remote/settings
 248
 249                 # Enable SSH key authentication
 250                 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
 251
 252                 # Apply SSH settings
 253                 /usr/local/bin/sshctrl
 254
 255                 # Mark SSH to start immediately (but not right now)
 256                 touch /var/ipfire/remote/enablessh
 257                 chown nobody:nobody /var/ipfire/remote/enablessh
 258
 259                 # Firewall rules for SSH and WEBIF
 260                 (
 261                         echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
 262                         echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
 263                 ) >> /var/ipfire/firewall/input
 264
 265                 # This script has now completed the first steps of setup
 266                 touch /var/ipfire/main/firstsetup_ok
 267         fi
 268
 269         # All done
 270         echo_ok
 271 }
 272
 273 case "${reason}" in
 274         PREINIT)
 275                 # Bring up the interface
 276                 ip link set "${interface}" up
 277                 ;;
 278
 279         BOUND|RENEW|REBIND|REBOOT)
 280                 # Remove any previous IP addresses
 281                 ip addr flush dev "${interface}"
 282
 283                 # Add (or re-add) the new IP address
 284                 ip addr add "${new_ip_address}/${new_subnet_mask}" dev "${interface}"
 285
 286                 # Add the default route
 287                 ip route add default via "${new_routers}"
 288
 289                 # Setup DNS
 290                 for domain_name_server in ${new_domain_name_servers}; do
 291                         echo "nameserver ${domain_name_server}"
 292                 done > /etc/resolv.conf
 293
 294                 # The system is online now
 295                 touch /var/ipfire/red/active
 296
 297                 # Import Azure configuration
 298                 import_azure_configuration
 299                 ;;
 300
 301         EXPIRE|FAIL|RELEASE|STOP)
 302                 # The system is no longer online
 303                 rm -f /var/ipfire/red/active
 304
 305                 # Remove all IP addresses
 306                 ip addr flush dev "${interface}"
 307
 308                 # Shut down the interface
 309                 ip link set "${interface}" down
 310                 ;;
 311
 312         *)
 313                 echo "Unhandled reason: ${reason}" >&2
 314                 exit 2
 315                 ;;
 316 esac
 317
 318 # Terminate
 319 exit 0