vyos-router
No OneTemporary
Actions

Size

19 KB

Referenced Files

None

Subscribers

None

vyos-router
View Options

	#!/bin/bash
	# Copyright (C) 2021-2024 VyOS maintainers and contributors
	#
	# This program is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License version 2 or later as
	# published by the Free Software Foundation.
	#
	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.

	. /lib/lsb/init-functions

	: ${vyatta_env:=/etc/default/vyatta}
	source $vyatta_env

	declare progname=${0##*/}
	declare action=$1; shift

	declare -x BOOTFILE=$vyatta_sysconfdir/config/config.boot
	declare -x DEFAULT_BOOTFILE=$vyatta_sysconfdir/config.boot.default

	declare -x VYCONF_CONFIG_DIR=/usr/libexec/vyos/vyconf/config

	# If vyos-config= boot option is present, use that file instead
	for x in $(cat /proc/cmdline); do
	[[ $x = vyos-config=* ]] \|\| continue
	VYOS_CONFIG="${x#vyos-config=}"
	done

	if [ ! -z "$VYOS_CONFIG" ]; then
	if [ -r "$VYOS_CONFIG" ]; then
	echo "Config selected manually: $VYOS_CONFIG"
	declare -x BOOTFILE="$VYOS_CONFIG"
	else
	echo "WARNING: Could not read selected config file, using default!"
	fi
	fi

	declare -a subinit
	declare -a all_subinits=( firewall )

	if [ $# -gt 0 ] ; then
	for s in $@ ; do
	[ -x ${vyatta_sbindir}/${s}.init ] && subinit[${#subinit}]=$s
	done
	else
	for s in ${all_subinits[@]} ; do
	[ -x ${vyatta_sbindir}/${s}.init ] && subinit[${#subinit}]=$s
	done
	fi

	GROUP=vyattacfg

	# easy way to make empty file without any command
	empty()
	{
	>$1
	}

	# check if bootup of this portion is disabled
	disabled () {
	grep -q -w no-vyos-$1 /proc/cmdline
	}

	# Load encrypted config volume
	mount_encrypted_config() {
	persist_path=$(/opt/vyatta/sbin/vyos-persistpath)
	if [ $? == 0 ]; then
	if [ -e $persist_path/boot ]; then
	image_name=$(cat /proc/cmdline \| sed -e s+^.vyos-union=/boot/++ \| sed -e 's/ .$//')

	if [ -z "$image_name" ]; then
	return
	fi

	if [ ! -f $persist_path/luks/$image_name ]; then
	return
	fi

	vyos_tpm_key=$(python3 -c 'from vyos.tpm import read_tpm_key; print(read_tpm_key().decode())' 2>/dev/null)

	if [ $? -ne 0 ]; then
	echo "ERROR: Failed to fetch encryption key from TPM. Encrypted config volume has not been mounted"
	echo "Use 'encryption load' to load volume with recovery key"
	echo "or 'encryption disable' to decrypt volume with recovery key"
	return
	fi

	echo $vyos_tpm_key \| tr -d '\r\n' \| cryptsetup open $persist_path/luks/$image_name vyos_config --key-file=-

	if [ $? -ne 0 ]; then
	echo "ERROR: Failed to decrypt config volume. Encrypted config volume has not been mounted"
	echo "Use 'encryption load' to load volume with recovery key"
	echo "or 'encryption disable' to decrypt volume with recovery key"
	return
	fi

	mount /dev/mapper/vyos_config /config
	mount /dev/mapper/vyos_config $vyatta_sysconfdir/config

	echo "Mounted encrypted config volume"
	fi
	fi
	}

	unmount_encrypted_config() {
	persist_path=$(/opt/vyatta/sbin/vyos-persistpath)
	if [ $? == 0 ]; then
	if [ -e $persist_path/boot ]; then
	image_name=$(cat /proc/cmdline \| sed -e s+^.vyos-union=/boot/++ \| sed -e 's/ .$//')

	if [ -z "$image_name" ]; then
	return
	fi

	if [ ! -f $persist_path/luks/$image_name ]; then
	return
	fi

	umount /config
	umount $vyatta_sysconfdir/config

	cryptsetup close vyos_config
	fi
	fi
	}

	# if necessary, provide initial config
	init_bootfile () {
	# define and version default boot config if not present
	if [ ! -r $DEFAULT_BOOTFILE ]; then
	if [ -f $vyos_data_dir/config.boot.default ]; then
	cp $vyos_data_dir/config.boot.default $DEFAULT_BOOTFILE
	$vyos_libexec_dir/add-system-version.py >> $DEFAULT_BOOTFILE
	fi
	fi
	if [ ! -r $BOOTFILE ] ; then
	if [ -f $DEFAULT_BOOTFILE ]; then
	cp $DEFAULT_BOOTFILE $BOOTFILE
	else
	$vyos_libexec_dir/add-system-version.py > $BOOTFILE
	fi
	chgrp ${GROUP} $BOOTFILE
	chmod 660 $BOOTFILE
	fi
	if [ -d $VYCONF_CONFIG_DIR ] ; then
	cp -f $BOOTFILE $VYCONF_CONFIG_DIR/config.boot
	cp -f $DEFAULT_BOOTFILE $VYCONF_CONFIG_DIR/config.failsafe
	fi
	}

	# if necessary, migrate initial config
	migrate_bootfile ()
	{
	if [ -x $vyos_libexec_dir/run-config-migration.py ]; then
	log_progress_msg migrate
	sg ${GROUP} -c "$vyos_libexec_dir/run-config-migration.py $BOOTFILE"
	# update vyconf copy after migration
	if [ -d $VYCONF_CONFIG_DIR ] ; then
	cp -f $BOOTFILE $VYCONF_CONFIG_DIR/config.boot
	fi
	fi
	}

	# configure system-specific settings
	system_config ()
	{
	if [ -x $vyos_libexec_dir/run-config-activation.py ]; then
	log_progress_msg system
	sg ${GROUP} -c "$vyos_libexec_dir/run-config-activation.py $BOOTFILE"
	fi
	}

	# load the initial config
	load_bootfile ()
	{
	log_progress_msg configure
	(
	if [ -f /etc/default/vyatta-load-boot ]; then
	# build-specific environment for boot-time config loading
	source /etc/default/vyatta-load-boot
	fi
	if [ -x $vyos_libexec_dir/vyos-boot-config-loader.py ]; then
	sg ${GROUP} -c "$vyos_libexec_dir/vyos-boot-config-loader.py $BOOTFILE"
	fi
	)
	}

	# restore if missing pre-config script
	restore_if_missing_preconfig_script ()
	{
	if [ ! -x ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script ]; then
	mkdir -p ${vyatta_sysconfdir}/config/scripts
	chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts
	chmod 775 ${vyatta_sysconfdir}/config/scripts
	cp ${vyos_rootfs_dir}/opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script ${vyatta_sysconfdir}/config/scripts/
	chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script
	chmod 750 ${vyatta_sysconfdir}/config/scripts/vyos-preconfig-bootup.script
	fi
	}

	# execute the pre-config script
	run_preconfig_script ()
	{
	if [ -x $vyatta_sysconfdir/config/scripts/vyos-preconfig-bootup.script ]; then
	$vyatta_sysconfdir/config/scripts/vyos-preconfig-bootup.script
	fi
	}

	# restore if missing post-config script
	restore_if_missing_postconfig_script ()
	{
	if [ ! -x ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script ]; then
	mkdir -p ${vyatta_sysconfdir}/config/scripts
	chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts
	chmod 775 ${vyatta_sysconfdir}/config/scripts
	cp ${vyos_rootfs_dir}/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script ${vyatta_sysconfdir}/config/scripts/
	chgrp ${GROUP} ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script
	chmod 750 ${vyatta_sysconfdir}/config/scripts/vyos-postconfig-bootup.script
	fi
	}

	# execute the post-config scripts
	run_postconfig_scripts ()
	{
	if [ -x $vyatta_sysconfdir/config/scripts/vyatta-postconfig-bootup.script ]; then
	$vyatta_sysconfdir/config/scripts/vyatta-postconfig-bootup.script
	fi
	if [ -x $vyatta_sysconfdir/config/scripts/vyos-postconfig-bootup.script ]; then
	$vyatta_sysconfdir/config/scripts/vyos-postconfig-bootup.script
	fi
	}

	run_postupgrade_script ()
	{
	if [ -f $vyatta_sysconfdir/config/.upgraded ]; then
	# Run the system script
	/usr/libexec/vyos/system/post-upgrade

	# Run user scripts
	if [ -d $vyatta_sysconfdir/config/scripts/post-upgrade.d ]; then
	run-parts $vyatta_sysconfdir/config/scripts/post-upgrade.d
	fi
	rm -f $vyatta_sysconfdir/config/.upgraded
	fi
	}

	#
	# On image booted machines, we need to mount /boot from the image-specific
	# boot directory so that kernel package installation will put the
	# files in the right place. We also have to mount /boot/grub from the
	# system-wide grub directory so that tools that edit the grub.cfg
	# file will find it in the expected location.
	#
	bind_mount_boot ()
	{
	persist_path=$(/opt/vyatta/sbin/vyos-persistpath)
	if [ $? == 0 ]; then
	if [ -e $persist_path/boot ]; then
	image_name=$(cat /proc/cmdline \| sed -e s+^.vyos-union=/boot/++ \| sed -e 's/ .$//')

	if [ -n "$image_name" ]; then
	mount --bind $persist_path/boot/$image_name /boot
	if [ $? -ne 0 ]; then
	echo "Couldn't bind mount /boot"
	fi

	if [ ! -d /boot/grub ]; then
	mkdir /boot/grub
	fi

	mount --bind $persist_path/boot/grub /boot/grub
	if [ $? -ne 0 ]; then
	echo "Couldn't bind mount /boot/grub"
	fi
	fi
	fi
	fi
	}

	clear_or_override_config_files ()
	{
	for conf in snmp/snmpd.conf snmp/snmptrapd.conf snmp/snmp.conf \
	keepalived/keepalived.conf cron.d/vyos-crontab \
	ipvsadm.rules default/ipvsadm resolv.conf
	do
	if [ -s /etc/$conf ] ; then
	empty /etc/$conf
	chmod 0644 /etc/$conf
	fi
	done
	}

	update_interface_config ()
	{
	if [ -d /run/udev/vyos ]; then
	$vyos_libexec_dir/vyos-interface-rescan.py $BOOTFILE
	fi
	}

	cleanup_post_commit_hooks () {
	# Remove links from the post-commit hooks directory.
	# note that this approach only supports hooks that are "configured",
	# i.e., it does not support hooks that need to always be present.
	cpostdir=$(cli-shell-api getPostCommitHookDir)
	# exclude commit hooks that need to always be present
	excluded="00vyos-sync 10vyatta-log-commit.pl 99vyos-user-postcommit-hooks"
	if [ -d "$cpostdir" ]; then
	for f in $cpostdir/*; do
	if [[ ! $excluded =~ $(basename $f) ]]; then
	rm -f $cpostdir/$(basename $f)
	fi
	done
	fi
	}

	# These are all the default security setting which are later
	# overridden when configuration is read. These are the values the
	# system defaults.
	security_reset ()
	{

	# restore NSS cofniguration back to sane system defaults
	# will be overwritten later when configuration is loaded
	cat <<EOF >/etc/nsswitch.conf
	passwd: files
	group: files
	shadow: files
	gshadow: files

	# Per T2678, commenting out myhostname
	hosts: files dns #myhostname
	networks: files

	protocols: db files
	services: db files
	ethers: db files
	rpc: db files

	netgroup: nis
	EOF

	# restore PAM back to virgin state (no radius/tacacs services)
	pam-auth-update --disable radius-mandatory radius-optional
	rm -f /etc/pam_radius_auth.conf
	pam-auth-update --disable tacplus-mandatory tacplus-optional
	rm -f /etc/tacplus_nss.conf /etc/tacplus_servers
	# and no Google authenticator for 2FA/MFA
	pam-auth-update --disable mfa-google-authenticator

	# Certain configuration files are re-generated by the configuration
	# subsystem and must reside under /etc and can not easily be moved to /run.
	# So on every boot we simply delete any remaining files and let the CLI
	# regenearte them.

	# PPPoE
	rm -f /etc/ppp/peers/pppoe* /etc/ppp/peers/wlm*

	# IPSec
	rm -rf /etc/ipsec.conf /etc/ipsec.secrets
	find /etc/swanctl -type f \| xargs rm -f

	# limit cleanup
	rm -f /etc/security/limits.d/10-vyos.conf

	# iproute2 cleanup
	rm -f /etc/iproute2/rt_tables.d/vyos-*.conf

	# Container
	rm -f /etc/containers/storage.conf /etc/containers/registries.conf /etc/containers/containers.conf
	# Clean all networks and re-create them from our CLI
	rm -f /etc/containers/networks/*

	# System Options (SSH/cURL)
	rm -f /etc/ssh/ssh_config.d/vyos.conf
	rm -f /etc/curlrc
	}

	# XXX: T3885 - generate persistend DHCPv6 DUID (Type4 - UUID based)
	gen_duid ()
	{
	DUID_FILE="/var/lib/dhcpv6/dhcp6c_duid"
	UUID_FILE="/sys/class/dmi/id/product_uuid"
	UUID_FILE_ALT="/sys/class/dmi/id/product_serial"
	if [ ! -f ${UUID_FILE} ] && [ ! -f ${UUID_FILE_ALT} ]; then
	return 1
	fi

	# DUID is based on the BIOS/EFI UUID. We omit additional - characters
	if [ -f ${UUID_FILE} ]; then
	UUID=$(cat ${UUID_FILE} \| tr -d -)
	fi
	if [ -z ${UUID} ]; then
	UUID=$(uuidgen --sha1 --namespace @dns --name $(cat ${UUID_FILE_ALT}) \| tr -d -)
	fi
	# Add DUID type4 (UUID) information
	DUID_TYPE="0004"

	# The length-information (as per RFC6355 UUID is 128 bits long) is in big-endian
	# format - beware when porting to ARM64. The length field consists out of the
	# UUID (128 bit + 16 bits DUID type) resulting in hex 12.
	DUID_LEN="0012"
	if [ "$(echo -n I \| od -to2 \| head -n1 \| cut -f2 -d" " \| cut -c6 )" -eq 1 ]; then
	# true on little-endian (x86) systems
	DUID_LEN="1200"
	fi

	for i in $(echo -n ${DUID_LEN}${DUID_TYPE}${UUID} \| sed 's/../& /g'); do
	echo -ne "\x$i"
	done > ${DUID_FILE}
	}

	start ()
	{
	# reset and clean config files
	security_reset \|\| log_failure_msg "security reset failed"

	# some legacy directories migrated over from old rl-system.init
	mkdir -p /var/run/vyatta /var/log/vyatta
	chgrp vyattacfg /var/run/vyatta /var/log/vyatta
	chmod 775 /var/run/vyatta /var/log/vyatta

	log_daemon_msg "Waiting for NICs to settle down"
	# On boot time udev migth take a long time to reorder nic's, this will ensure that
	# all udev activity is completed and all nics presented at boot-time will have their
	# final name before continuing with vyos-router initialization.
	SECONDS=0
	udevadm settle
	STATUS=$?
	log_progress_msg "settled in ${SECONDS}sec."
	log_end_msg ${STATUS}

	# mountpoint for bpf maps required by xdp
	mount -t bpf none /sys/fs/bpf

	# Clear out Debian APT source config file
	empty /etc/apt/sources.list

	# Generate DHCPv6 DUID
	gen_duid \|\| log_failure_msg "could not generate DUID"

	# Mount a temporary filesystem for container networks.
	# Configuration should be loaded from VyOS cli.
	cni_dir="/etc/cni/net.d"
	[ ! -d ${cni_dir} ] && mkdir -p ${cni_dir}
	mount -t tmpfs none ${cni_dir}

	# Init firewall
	nfct helper add rpc inet tcp
	nfct helper add rpc inet udp
	nfct helper add tns inet tcp
	nfct helper add rpc inet6 tcp
	nfct helper add rpc inet6 udp
	nfct helper add tns inet6 tcp
	nft --file /usr/share/vyos/vyos-firewall-init.conf \|\| log_failure_msg "could not initiate firewall rules"

	# Ensure rsyslog is the default syslog daemon
	SYSTEMD_SYSLOG="/etc/systemd/system/syslog.service"
	SYSTEMD_RSYSLOG="/lib/systemd/system/rsyslog.service"
	if [ ! -L ${SYSTEMD_SYSLOG} ] \|\| [ "$(readlink -f ${SYSTEMD_SYSLOG})" != "${SYSTEMD_RSYSLOG}" ]; then
	ln -sf ${SYSTEMD_RSYSLOG} ${SYSTEMD_SYSLOG}
	systemctl daemon-reload
	fi

	# As VyOS does not execute commands that are not present in the CLI we call
	# the script by hand to have a single source for the login banner and MOTD
	${vyos_conf_scripts_dir}/system_syslog.py \|\| log_failure_msg "could not reset syslog"
	${vyos_conf_scripts_dir}/system_console.py \|\| log_failure_msg "could not reset serial console"
	${vyos_conf_scripts_dir}/system_login_banner.py \|\| log_failure_msg "could not reset motd and issue files"
	${vyos_conf_scripts_dir}/system_option.py \|\| log_failure_msg "could not reset system option files"
	${vyos_conf_scripts_dir}/system_ip.py \|\| log_failure_msg "could not reset system IPv4 options"
	${vyos_conf_scripts_dir}/system_ipv6.py \|\| log_failure_msg "could not reset system IPv6 options"
	${vyos_conf_scripts_dir}/system_conntrack.py \|\| log_failure_msg "could not reset conntrack subsystem"
	${vyos_conf_scripts_dir}/container.py \|\| log_failure_msg "could not reset container subsystem"

	clear_or_override_config_files \|\| log_failure_msg "could not reset config files"

	# enable some debugging before loading the configuration
	if grep -q vyos-debug /proc/cmdline; then
	log_action_begin_msg "Enable runtime debugging options"
	FRR_DEBUG=$(python3 -c "from vyos.defaults import frr_debug_enable; print(frr_debug_enable)")
	touch $FRR_DEBUG
	touch /tmp/vyos.container.debug
	touch /tmp/vyos.ifconfig.debug
	touch /tmp/vyos.container.debug
	touch /tmp/vyos.smoketest.debug
	fi

	# Cleanup PKI CAs
	if [ -d /usr/local/share/ca-certificates/vyos ]; then
	rm -f /usr/local/share/ca-certificates/vyos/*.crt
	update-ca-certificates >/dev/null 2>&1
	fi

	log_action_begin_msg "Mounting VyOS Config"
	# ensure the vyatta_configdir supports a large number of inodes since
	# the config hierarchy is often inode-bound (instead of size).
	# impose a minimum and then scale up dynamically with the actual size
	# of the system memory.
	local tmem=$(sed -n 's/^MemTotal: \+$[0-9]\+$ kB$/\1/p' /proc/meminfo)
	local tpages
	local tmpfs_opts="nosuid,nodev,mode=775,nr_inodes=0" #automatically allocate inodes
	mount -o $tmpfs_opts -t tmpfs none ${vyatta_configdir} \
	&& chgrp ${GROUP} ${vyatta_configdir}
	log_action_end_msg $?

	mount_encrypted_config

	# T5239: early read of system hostname as this value is read-only once during
	# FRR initialisation
	tmp=$(${vyos_libexec_dir}/read-saved-value.py --path "system host-name")
	hostnamectl set-hostname --static "$tmp"

	${vyos_conf_scripts_dir}/system_frr.py \|\| log_failure_msg "could not reset FRR config"
	# If for any reason FRR was not started by system_frr.py - start it anyways.
	# This is a safety net!
	systemctl start frr.service

	disabled bootfile \|\| init_bootfile

	cleanup_post_commit_hooks

	log_daemon_msg "Starting VyOS router"
	disabled migrate \|\| migrate_bootfile

	restore_if_missing_preconfig_script

	run_preconfig_script

	run_postupgrade_script

	update_interface_config

	disabled system_config \|\| system_config

	systemctl start vyconfd.service

	for s in ${subinit[@]} ; do
	if ! disabled $s; then
	log_progress_msg $s
	if ! ${vyatta_sbindir}/${s}.init start
	then log_failure_msg
	exit 1
	fi
	fi
	done

	bind_mount_boot

	disabled configure \|\| load_bootfile
	log_end_msg $?

	telinit q
	chmod g-w,o-w /

	restore_if_missing_postconfig_script

	run_postconfig_scripts
	tmp=$(${vyos_libexec_dir}/read-saved-value.py --path "protocols rpki cache")
	if [[ ! -z "$tmp" ]]; then
	vtysh -c "rpki start"
	fi

	# Start netplug daemon
	systemctl start netplug.service
	}

	stop()
	{
	local -i status=0
	log_daemon_msg "Stopping VyOS router"
	for ((i=${#sub_inits[@]} - 1; i >= 0; i--)) ; do
	s=${subinit[$i]}
	log_progress_msg $s
	${vyatta_sbindir}/${s}.init stop
	let status\\|=$?
	done
	log_end_msg $status
	log_action_begin_msg "Un-mounting VyOS Config"
	umount ${vyatta_configdir}
	log_action_end_msg $?

	systemctl stop netplug.service
	systemctl stop vyconfd.service
	systemctl stop frr.service

	unmount_encrypted_config
	}

	case "$action" in
	start) start ;;
	stop) stop ;;
	restart\|force-reload) stop && start ;;
	*) log_failure_msg "usage: $progname [ start\|stop\|restart ] [ subinit ... ]" ;
	false ;;
	esac

	exit $?

	# Local Variables:
	# mode: shell-script
	# sh-indentation: 4
	# End:

File Metadata

Mime Type: text/x-shellscript
Expires: Tue, Dec 9, 10:52 PM (1 d, 22 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3110126
Default Alt Text: vyos-router (19 KB)

vyos-routerNo OneTemporaryActions

vyos-routerView Options

File Metadata

Event Timeline

vyos-router
No OneTemporary
Actions

vyos-router
View Options