vyinstall

#!/bin/bash
#
# vyInstall - Install configs, OpenSSL keypairs & SSH keyrings generated by vyTool
#
SID=${RANDOM}
DATETIME="$(date +%Y%m%d%H%M%S)"

if [ -d "/config/auth" ]; then
  DATA_ROOT="/config/auth/vyinstall"
else
  DATA_ROOT="/var/cache/vyinstall"
fi

OPENSSL_DIR="${DATA_ROOT}/openssl"
OPENSSL_CA_CRT_FILE="${OPENSSL_DIR}/CA.crt"
OPENSSL_CRT_FILE="${OPENSSL_DIR}/device.crt"
OPENSSL_CRL_FILE="${OPENSSL_DIR}/crl.pem"
OPENSSL_PRIVATE_DIR="${OPENSSL_DIR}/private"
OPENSSL_KEY_FILE="${OPENSSL_PRIVATE_DIR}/device.key"

CONFIG_FILE="${vyatta_sysconfdir}/config/config.boot"
DEFAULT_CONFIG_FILE="${vyatta_sysconfdir}/config/config.boot.default"
EXCLUDE_CONFIG_SETS_REGEX="^set interfaces ethernet eth[0-9]{1,4} (duplex|hw-id|smp_affinity|speed) "

source /etc/default/vyatta
source /etc/default/vyinstall

if [ ${#SUDO_USER} -eq 0 ]; then
  VYATTA_USER="${USER}"
else
  VYATTA_USER="${SUDO_USER}"
fi

function cleanup() {
  rm -f /tmp/vyinstall.*.${SID}.*
}

function cleanup_all() {
  rm -f /tmp/vyinstall.*
}

function save_config() 
{
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper begin >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper save ${1} >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper end >/dev/null
  if [ ${#1} -gt 0 ]; then
    SAVED_CONFIG_FILE=${1}
  else
    SAVED_CONFIG_FILE=${CONFIG_FILE}
  fi
  chown root:${VYATTA_CFG_GROUP_NAME} "${SAVED_CONFIG_FILE}"
  chmod 0660 "${SAVED_CONFIG_FILE}"
}

function load_config() {
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper begin >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper load ${1} >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper end >/dev/null
}

function suicide() {
  echo
  echo "[ ERROR ]" >&2
  echo -e "${@}" >&2
  echo
  cleanup
  exit 1
}

function suicide_if_ne() {
  VAL1=${1}; shift
  VAL2=${1}; shift
  if [ ${VAL1} -ne ${VAL2} ]; then
    suicide "${@}"
  fi
}

function suicide_if_not_in_range() {
  ACT_VAL=${1}; shift
  MIN_VAL=${1}; shift
  MAX_VAL=${1}; shift
  if [ ${ACT_VAL} -lt ${MIN_VAL} ] || [ ${ACT_VAL} -gt ${MAX_VAL} ]; then
    suicide "${@}"
  fi
}

function suicide_if_running_config_differs_from_saved() {
  TMP_CONFIG_FILE="/tmp/vyinstall.config.boot.${SID}.${RANDOM}"
  save_config "${TMP_CONFIG_FILE}"
  TMP_CONFIG_SETS_FILE_A="/tmp/vyinstall.config.sets.a.${SID}.${RANDOM}"
  TMP_CONFIG_SETS_FILE_B="/tmp/vyinstall.config.sets.b.${SID}.${RANDOM}"
  ${vyatta_sbindir}/vyatta-config-gen-sets.pl "${CONFIG_FILE}" | egrep -v "${EXCLUDE_CONFIG_SETS_REGEX}" >"${TMP_CONFIG_SETS_FILE_A}"
  ${vyatta_sbindir}/vyatta-config-gen-sets.pl "${TMP_CONFIG_FILE}" | egrep -v "${EXCLUDE_CONFIG_SETS_REGEX}" >"${TMP_CONFIG_SETS_FILE_B}"
  diff -q "${TMP_CONFIG_SETS_FILE_A}" "${TMP_CONFIG_SETS_FILE_B}" >/dev/null
  suicide_if_ne ${?} 0 "Running config differs from saved."
  rm "${TMP_CONFIG_FILE}" "${TMP_CONFIG_SETS_FILE_A}" "${TMP_CONFIG_SETS_FILE_B}"
}

function show_help() {
  echo "[ vyInstall - Install configs, OpenSSL keypairs & SSH keyrings generated by vyTool ]"
  echo "Usage:"
  echo "  vyinstall config <host-name> <password> [--load]"
  echo "            bundle <host-name> <password> [--load]"
  echo "            openssl-keypair <host-name> <password>"
  echo "            openssl-ca"
  echo "            openssl-crl"
  echo "            ssh-keyring <keyring> [<user>]"
  echo ""
  echo "            default-config [--load]"
  echo "            config-partial <partial> [--save]"
  echo "            var-spool <partition>"
  echo ""
  echo "More information: http://www.vyatta4people.org/vyinstall/"
}

function install_remote_file() {
  REMOTE_FILE_URL="${ROOT_URL}/${1}"
  LOCAL_FILE="${2}"
  LOCAL_FILE_OWNER="${3}"
  LOCAL_FILE_MODE="${4}"
  REMOTE_FILE_PASSWORD="${5}"
  TMP_FILE="/tmp/vyinstall.remote_file.${SID}.${RANDOM}"
  wget -q -O "${TMP_FILE}" "${WGET_OPTIONS}" "${REMOTE_FILE_URL}" >/dev/null
  suicide_if_ne ${?} 0 "Failed to download remote file: ${REMOTE_FILE_URL}"
  if [ ${#REMOTE_FILE_PASSWORD} -ne 0 ]; then
    openssl enc -d -aes-256-cbc -a -salt -in "${TMP_FILE}" -out "${TMP_FILE}.decrypted" -pass pass:"${REMOTE_FILE_PASSWORD}"
    suicide_if_ne ${?} 0 "Failed to decrypt downloaded file. Wrong password?"
    mv "${TMP_FILE}.decrypted" "${TMP_FILE}"
  fi
  FILES_ARE_THE_SAME="yes"
  if [ -f "${LOCAL_FILE}" ]; then
    REMOTE_FILE_MD5SUM=$(md5sum "${TMP_FILE}" | awk '{print $1}')
    LOCAL_FILE_MD5SUM=$(md5sum "${LOCAL_FILE}" | awk '{print $1}')
    if [ ${REMOTE_FILE_MD5SUM} != ${LOCAL_FILE_MD5SUM} ]; then
      FILES_ARE_THE_SAME="no"
    fi
  else
    FILES_ARE_THE_SAME="no"
  fi
  if [ "${FILES_ARE_THE_SAME}" = "no" ]; then
    if [ -f "${LOCAL_FILE}" ]; then
      cp -p "${LOCAL_FILE}" "${LOCAL_FILE}.${DATETIME}.${SID}"
      suicide_if_ne ${?} 0 "Failed to backup file: ${LOCAL_FILE}"
    fi
    mv "${TMP_FILE}" "${LOCAL_FILE}"
    suicide_if_ne ${?} 0 "Failed to move ${TMP_FILE} to ${LOCAL_FILE}"
    chown ${LOCAL_FILE_OWNER} "${LOCAL_FILE}"
    suicide_if_ne ${?} 0 "Failed to set file ${LOCAL_FILE} owner to ${LOCAL_FILE_OWNER}"
    chmod ${LOCAL_FILE_MODE} "${LOCAL_FILE}"
    suicide_if_ne ${?} 0 "Failed to set file ${LOCAL_FILE} mode to ${LOCAL_FILE_MODE}"
    echo "+ ${LOCAL_FILE}"
  else
    echo "= ${LOCAL_FILE}"
    rm "${TMP_FILE}"
  fi
}

function install_config() {
  HOST_NAME="${1}"
  PASSWORD="${2}"
  LOAD_FLAG="${3}"
  LOAD_CONFIG="no"
  if [ ${#LOAD_FLAG} -gt 0 ]; then
    if [ "${LOAD_FLAG}" = "--load" ]; then
      LOAD_CONFIG="yes"
    else
      suicide "Unknown option: ${LOAD_FLAG}"
    fi
  fi
  install_remote_file "configs/${HOST_NAME}.config" "${CONFIG_FILE}" root:${VYATTA_CFG_GROUP_NAME} 0660 "${PASSWORD}"
  if [ "${LOAD_CONFIG}" = "yes" ]; then
    load_config
  fi
}

function install_bundle() {
  HOST_NAME="${1}"
  PASSWORD="${2}"
  LOAD_FLAG="${3}"
  install_config "${HOST_NAME}" "${PASSWORD}" "${LOAD_FLAG}"
  install_openssl_keypair "${HOST_NAME}" "${PASSWORD}"
}

function install_openssl_keypair() {
  HOST_NAME="${1}"
  PASSWORD="${2}"
  install_remote_file "openssl/keypairs/${HOST_NAME}.crt" "${OPENSSL_CRT_FILE}" root:root 0644
  install_remote_file "openssl/keypairs/${HOST_NAME}.key" "${OPENSSL_KEY_FILE}" root:root 0600 "${PASSWORD}"
}

function install_openssl_ca() {
  install_remote_file "openssl/CA.crt" "${OPENSSL_CA_CRT_FILE}" root:root 0644
}

function install_openssl_crl() {
  install_remote_file "openssl/crl.pem" "${OPENSSL_CRL_FILE}" root:root 0644
}

function install_ssh_keyring() {
  SSH_KEYRING="${1}"
  if [ ${#2} -gt 0 ]; then
    SSH_USER="${2}"
  else
    SSH_USER="${VYATTA_USER}"
  fi
  suicide_if_running_config_differs_from_saved
  TMP_SSH_KEYRING_FILE="/tmp/vyinstall.authorized_keys.${SID}.${RANDOM}"
  install_remote_file "ssh-keyrings/${SSH_KEYRING}.authorized_keys" "${TMP_SSH_KEYRING_FILE}" ${VYATTA_USER}:${VYATTA_CFG_GROUP_NAME} 0644 >/dev/null
  LC=$(cat "${TMP_SSH_KEYRING_FILE}" | wc -l)
  CL=1
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper begin >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper delete system login user "${SSH_USER}" authentication public-keys >/dev/null 2>&1
  while [ ${CL} -le ${LC} ]; do
    SSH_KEY_LINE=$(head -n ${CL} "${TMP_SSH_KEYRING_FILE}" | tail -n1)
    SSH_KEY_ID=$(echo ${SSH_KEY_LINE} | awk '{print $3}')
    SSH_KEY_TYPE=$(echo ${SSH_KEY_LINE} | awk '{print $1}')
    SSH_KEY_DATA=$(echo ${SSH_KEY_LINE} | awk '{print $2}')
    ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper set system login user "${SSH_USER}" authentication public-keys "${SSH_KEY_ID}" type "${SSH_KEY_TYPE}" >/dev/null
    ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper set system login user "${SSH_USER}" authentication public-keys "${SSH_KEY_ID}" key  "${SSH_KEY_DATA}" >/dev/null
    let CL++
    echo "+ ${SSH_KEY_ID}"
  done
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper commit >/dev/null
  ${vyatta_sbindir}/vyatta-cfg-cmd-wrapper end >/dev/null
  save_config
  rm "${TMP_SSH_KEYRING_FILE}"
}

function install_default_config() {
  LOAD_FLAG="${1}"
  LOAD_CONFIG="no"
  if [ ${#LOAD_FLAG} -gt 0 ]; then
    if [ "${LOAD_FLAG}" = "--load" ]; then
      LOAD_CONFIG="yes"
    else
      suicide "Unknown option: ${LOAD_FLAG}"
    fi
  fi
  if [ -f "${DEFAULT_CONFIG_FILE}" ]; then
    cp -p "${CONFIG_FILE}" "${CONFIG_FILE}.${DATETIME}.${SID}"
    cp -p "${DEFAULT_CONFIG_FILE}" "${CONFIG_FILE}"
    if [ "${LOAD_CONFIG}" = "yes" ]; then
      load_config
    else
      echo "* Default config installed, but NOT loaded!"
      echo "  NB! You need to load it manually from configuration mode or reboot system."
    fi
  else
    suicide "Default config file not found: ${DEFAULT_CONFIG_FILE}"
  fi
}

function install_config_partial() {
  CONFIG_PARTIAL="${1}"
  SAVE_FLAG="${2}"
  SAVE_CONFIG="no"
  if [ ${#SAVE_FLAG} -gt 0 ]; then
    if [ "${SAVE_FLAG}" = "--save" ]; then
      SAVE_CONFIG="yes"
    else
      suicide "Unknown option: ${SAVE_FLAG}"
    fi
  fi
  TMP_CONFIG_PARTIAL_FILE="/tmp/nodelete.vyinstall.partial.${SID}.${RANDOM}"
  install_remote_file "config-partials/${CONFIG_PARTIAL}.partial" "${TMP_CONFIG_PARTIAL_FILE}" root:${VYATTA_CFG_GROUP_NAME} 0660 >/dev/null
  session_env=$(/bin/cli-shell-api getSessionEnv ${PPID}) >/dev/null
  eval ${session_env} >/dev/null
  cli-shell-api setupSession >/dev/null
  cli-shell-api getEditResetEnv >/dev/null
  ${vyatta_sbindir}/vyatta-load-config.pl "${TMP_CONFIG_PARTIAL_FILE}" --merge >/dev/null
  ${vyatta_sbindir}/my_commit >/dev/null
  COMMIT_RETURN_CODE=${?}
  cli-shell-api teardownSession >/dev/null
  if [ ${COMMIT_RETURN_CODE} -eq 0 ]; then
    if [ "${SAVE_CONFIG}" = "yes" ]; then
      save_config
    else
      echo "* Partial successfully loaded, but modified configuration was NOT saved!"
      echo "  NB! You need to enter configuration mode, review changes and save it manually!"
    fi
    rm "${TMP_CONFIG_PARTIAL_FILE}"
  else
    suicide "Can not load config partial: ${TMP_CONFIG_PARTIAL_FILE}"
  fi
}

function move_path_to_partition() {
  SRC_PATH="${1}"
  DST_PARTITION="${2}"
  VOLUME_LABEL="${SRC_PATH}"
  TMP_MOUNT_POINT="/mnt/_vyinstall_${RANDOM}"

  if [ -z $(echo "${DST_PARTITION}" | egrep "^/dev/[shv]d[a-z][1-9]{1,2}$") ]; then
    suicide "Not sane partition device: ${DST_PARTITION}"
  fi

  if [ $(mount | awk '{print $1}' | egrep "^${DST_PARTITION}$" | wc -l) -ne 0 ]; then
    suicide "Device already mounted: ${DST_PARTITION}"
  fi

  DST_DISK="$(echo "${DST_PARTITION}" | sed 's/[0-9]*$//')"
  DST_PARTITION_NUMBER="$(echo "${DST_PARTITION}" | sed 's/^[\/a-z]*//')"
  DST_PARTITION_COUNT="$(fdisk -l "${DST_DISK}" | egrep "^/dev/" | wc -l)"
  if [ ${DST_PARTITION_COUNT} -eq 1 ]; then
    FDISK_COMMAND="t\n83\nw\n"
  else
    FDISK_COMMAND="t\n${DST_PARTITION_NUMBER}\n83\nw\n"
  fi
  echo -e "${FDISK_COMMAND}" | fdisk "${DST_DISK}" >/dev/null

  mkfs.ext3 -q -L "${VOLUME_LABEL}" "${DST_PARTITION}"
  suicide_if_ne ${?} 0 "Formatting of partition failed: ${DST_PARTITION}"

  sudo mkdir "${TMP_MOUNT_POINT}"
  sudo mount "${DST_PARTITION}" "${TMP_MOUNT_POINT}"
  suicide_if_ne ${?} 0 "Mount of temporary mount point failed: ${TMP_MOUNT_POINT}"

  sudo rsync -aH "${SRC_PATH}/" "${TMP_MOUNT_POINT}/"
  suicide_if_ne ${?} 0 "RSync to temporary mount point failed: ${TMP_MOUNT_POINT}"

  sudo umount "${TMP_MOUNT_POINT}"
  suicide_if_ne ${?} 0 "Unmount of temporary mount point failed: ${TMP_MOUNT_POINT}"
  rmdir "${TMP_MOUNT_POINT}"

  echo "* Moved ${SRC_PATH} content to ${DST_PARTITION}"
  if [ $(egrep "^\#LABEL=${VOLUME_LABEL}" /etc/fstab | wc -l ) -eq 1 ]; then
    echo "sed -i 's\^#LABEL=${VOLUME_LABEL}\LABEL=${VOLUME_LABEL}\' /etc/fstab" | bash
  else
    echo "NB! You need to edit /etc/fstab manually!"
  fi
  echo "NB! It will be used ONLY after reboot!"
}

if [ ${UID} -ne 0 ]; then
  suicide "vyInstall must be launched from root!"
fi

test -d "${DATA_ROOT}" || mkdir "${DATA_ROOT}"
test -d "${OPENSSL_DIR}" || mkdir "${OPENSSL_DIR}"
test -d "${OPENSSL_PRIVATE_DIR}" || mkdir "${OPENSSL_PRIVATE_DIR}"

case ${1} in
  'cleanup-all')
    suicide_if_ne ${#} 1 "Option '${1}' takes no arguments"
    cleanup_all;;
  'config')
    suicide_if_not_in_range ${#} 3 4 "Option '${1}' takes 2 or 3 arguments: <host_name> <password> [--load]"
    install_config ${2} ${3} ${4};;
  'bundle')
    suicide_if_not_in_range ${#} 3 4 "Option '${1}' takes 2 or 3 arguments: <host_name> <password> [--load]"
    install_bundle ${2} ${3} ${4};;
  'openssl-keypair')
    suicide_if_ne ${#} 3 "Option '${1}' takes 2 arguments: <host_name> <password>"
    install_openssl_keypair ${2} ${3};;
  'openssl-ca')
    suicide_if_ne ${#} 1 "Option '${1}' takes no arguments"
    install_openssl_ca;;
  'openssl-crl')
    suicide_if_ne ${#} 1 "Option '${1}' takes no arguments"
    install_openssl_crl;;
  'ssh-keyring')
    suicide_if_not_in_range ${#} 2 3 "Option '${1}' takes 1 or 2 arguments: <keyring> [<user>]"
    install_ssh_keyring ${2} ${3} ${4};;
  'default-config')
    suicide_if_not_in_range ${#} 1 2 "Option '${1}' takes no or just 1 argument: [--load]"
    install_default_config ${2};;
  'config-partial')
    suicide_if_not_in_range ${#} 2 3 "Option '${1}' takes 1 or 2 arguments: <partial> [--save]"
    install_config_partial ${2} ${3};;
  'var-spool')
    suicide_if_ne ${#} 2 "Option '${1}' takes 1 argument: <partition>"
    move_path_to_partition "/var/spool" ${2};;
  'install-remote-file')
    suicide_if_not_in_range ${#} 5 6 "Option '${1}' takes 4 or 5 arguments: <remote_file> <local_file> <local_file_owner> <local_file_mode> [<remote_file_password>]"
    install_remote_file ${2} ${3} ${4} ${5} ${6};;
  'move-path-to-partition')
    suicide_if_ne ${#} 3 "Option '${1}' takes 2 arguments: <path> <partition>"
    move_path_to_partition ${2} ${3};;
  'show-help'|'--help')
    show_help;;
  *)
    show_help
    suicide "Unknown option: ${1}";;
esac

chgrp -R ${VYATTA_CFG_GROUP_NAME} "${vyatta_configdir}"/*

echo "[ OK ]"