#!/bin/bash # postinst script for #PACKAGE# # # see: dh_installdeb(1) set -xe # summary of how this script can be called: # * `configure' # * `abort-upgrade' # * `abort-remove' `in-favour' # # * `abort-remove' # * `abort-deconfigure' `in-favour' # `removing' # # for details, see https://www.debian.org/doc/debian-policy/ or # the debian-policy package case "$1" in configure) IFCONFIG="/etc/network/interfaces" UDEVCONFIG="/etc/udev/rules.d/70-persistent-net.rules" FRRCONFIG="/etc/frr/frr.conf.wit" HOSTNAME=edge2.usw2.admin.wit.com IFCONFIG="/tmp/interfaces" UDEVCONFIG="/tmp/70-persistent-net.rules" FRRCONFIG="/tmp/frr.conf.wit" cp files/frr.conf.wit /tmp ## START gather all the info from the box and generate the variabels dig_txt() { TMPDIG=$(dig txt +short $1) [ -z $TMPDIG ] && exit 2 TMPDIG=${TMPDIG//\//\\\/} TMPDIG=${TMPDIG//\"/} #" fix the god damn syntax highlighter echo ${TMPDIG} } LOOPBACKv4=$(dig a +short ${HOSTNAME}) LOOPBACKv6=$(dig aaaa +short ${HOSTNAME}) NODEASN=$(dig_txt asn.${HOSTNAME}) if [ -z $LOOPBACKv4 ] || [ -z $LOOPBACKv6 ] || [ -z $NODEASN ]; then echo "unable to find my LOOPBACK IP and/or ASN: $LOOPBACKv4/$LOOPBACKv6/$NODEASN" exit 2 fi ## END variables ## START nic config compile # wiping existing config in prep for de-deploying it mv -f ${IFCONFIG} ${IFCONFIG}.dpkg-old || true mv -f ${UDEVCONFIG} ${UDEVCONFIG}.dpkg-old || true # write loopback config cat <<-EOF >>$IFCONFIG auto lo iface lo inet loopback iface lo inet static address ${LOOPBACKv4}/32 iface lo inet6 static address ${LOOPBACKv6}/128 EOF # gathering defined interfaces FRR_IFS="!" for if in mgmt feth up ibgp gre; do for i in {1..2}; do #### for now we support/cound only to 2 interfaces of each type, we can just raise this to whatever number we want (exeption mgmt) ifname=${if}${i} ifalias=$(dig_txt name.${ifname}.${HOSTNAME}) || true ## still thinking how to do this cleaner if [[ $ifname = gre? ]] && [[ ! -z $ifalias ]]; then ifmtu=$(dig_txt mtu.${ifname}.${HOSTNAME}) local=$(dig_txt local.${ifname}.${HOSTNAME}) remote=$(dig_txt remote.${ifname}.${HOSTNAME}) ## build FRR interface config to enable ND adv for ipv6 unmanaged FRR_IFS="$FRR_IFS\ninterface $ifname" FRR_IFS="$FRR_IFS\n description $ifalias" FRR_IFS="$FRR_IFS\n ipv6 nd ra-interval 10" FRR_IFS="$FRR_IFS\n no ipv6 nd suppress-ra\n!" ## build FRR neightbor interfaces FRR_EDGE_NEIGH=" !!! neighbor $ifname interface peer-group GRE\n$FRR_EDGE_NEIGH" ## build regular linux network interface config cat <<-EOF >>$IFCONFIG auto $ifname iface $ifname inet manual ## $ifalias pre-up ip tunnel add $ifname mode gre local $local remote $remote down ip tunnel del $ifname mtu $ifmtu EOF fi ## physical interfaces ifmac=$(dig_txt mac.${ifname/mgmt1/mgmt}.${HOSTNAME}) || continue ## skip undefined interfaces echo 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="'${ifmac}'", ATTR{type}=="1", NAME="'${ifname}'"' >>$UDEVCONFIG if [[ $ifname = up? ]]; then ipv4=$(dig_txt ipv4.$ifname.${HOSTNAME}) ipv6=$(dig_txt ipv6.$ifname.${HOSTNAME}) peerv4=$(dig_txt peerv4.$ifname.${HOSTNAME}) || true ## we dont know if we will always have both available peerv6=$(dig_txt peerv6.$ifname.${HOSTNAME}) || true ## we dont know if we will always have both available [ -z $peerv4 ] || FRR_EDGE_NEIGH=" !!! neighbor $peerv4 peer-group eBGPv4\n$FRR_EDGE_NEIGH" [ -z $peerv6 ] || FRR_EDGE_NEIGH=" !!! neighbor $peerv6 peer-group eBGPv6\n$FRR_EDGE_NEIGH" # we have a edge box, uncomment all edge special frr configs SEDEXTRA='-e s/!!!\s\s//' cat <<-EOF >>$IFCONFIG auto $ifname iface $ifname inet static address $ipv4 mtu 9000 iface $ifname inet6 static address $ipv6 EOF fi if [[ $ifname = ibgp? ]]; then cat <<-EOF >>$IFCONFIG auto $ifname iface $ifname inet manual mtu 9000 EOF fi if [[ $ifname = feth? ]]; then cat <<-EOF >>$IFCONFIG auto $ifname iface $ifname inet manual mtu 9000 EOF fi if [[ $ifname = mgmt? ]]; then cat <<-EOF >>$IFCONFIG auto $ifname iface $ifname inet6 auto iface $ifname inet dhcp pre-up /bin/ip link add mgmt type vrf table mgmt pre-up /bin/ip link set up dev mgmt pre-up /bin/ip link set master mgmt dev $ifname post-down /bin/ip link del dev mgmt EOF fi done done ## STOP nic config compile ## START compiling frr config i=1 while true; do TEMP="$(dig_txt $i.ipv4.public.prefixlist.usw2.admin.wit.com)" || break TEMPAGGS=" !!! aggregate-address ${TEMP}\n" FRR_IPV4_EDGE_SUMMARIES_AGGREGATS="${FRR_IPV4_EDGE_SUMMARIES_AGGREGATS}${TEMPAGGS}" TEMPSUM="!!! ip prefix-list WITv4-SUMMARIES seq $((i*5)) permit ${TEMP}\n" FRR_IPV4_EDGE_SUMMARIES_PFLIST="${FRR_IPV4_EDGE_SUMMARIES_PFLIST}${TEMPSUM}" let i+=1 done i=1 while true; do TEMP="$(dig_txt $i.ipv6.public.prefixlist.usw2.admin.wit.com)" || break TEMPAGGS=" !!! aggregate-address ${TEMP}\n" FRR_IPV6_EDGE_SUMMARIES_AGGREGATS="${FRR_IPV6_EDGE_SUMMARIES_AGGREGATS}${TEMPAGGS}" TEMPSUM="!!! ipv6 prefix-list WITv6-SUMMARIES seq $((i*5)) permit ${TEMP}\n" FRR_IPV6_EDGE_SUMMARIES_PFLIST="${FRR_IPV6_EDGE_SUMMARIES_PFLIST}${TEMPSUM}" let i+=1 done i=1 while true; do TEMP="$(dig_txt $i.ipv4.customers.prefixlist.usw2.admin.wit.com)" || break TEMPSUM="ip prefix-list WITv4-CUSTOMERS seq $((i*5)) permit ${TEMP} ge 25\n" FRR_IPV4_CUSTOMERS_PFLIST="${FRR_IPV4_CUSTOMERS_PFLIST}${TEMPSUM}" let i+=1 done i=1 while true; do TEMP="$(dig_txt $i.ipv6.customers.prefixlist.usw2.admin.wit.com)" || break TEMPSUM="ipv6 prefix-list WITv6-CUSTOMERS seq $((i*5)) permit ${TEMP} ge 64\n" FRR_IPV6_CUSTOMERS_PFLIST="${FRR_IPV6_CUSTOMERS_PFLIST}${TEMPSUM}" let i+=1 done i=1 while true; do TEMP="$(dig_txt $i.ipv4.loopback.prefixlist.usw2.admin.wit.com)" || break TEMPSUM="ip prefix-list LOOPBACKv4 seq $((i*5)) permit ${TEMP} ge 32\n" FRR_IPV4_LOOPBACK_PFLIST="${FRR_IPV4_LOOPBACK_PFLIST}${TEMPSUM}" let i+=1 done i=1 while true; do TEMP="$(dig_txt $i.ipv6.loopback.prefixlist.usw2.admin.wit.com)" || break TEMPSUM="ipv6 prefix-list LOOPBACKv6 seq $((i*5)) permit ${TEMP} ge 128\n" FRR_IPV6_LOOPBACK_PFLIST="${FRR_IPV6_LOOPBACK_PFLIST}${TEMPSUM}" let i+=1 done ## STOP compiling frr config ## START writing config files # set frr config sed -i \ -e "s/^!!! FRR_IFS/$FRR_IFS/" \ -e "s/^ !!! FRR_EDGE_NEIGH/$FRR_EDGE_NEIGH/" \ -e "s/^ !!! FRR_IPV4_EDGE_SUMMARIES_AGGREGATS/$FRR_IPV4_EDGE_SUMMARIES_AGGREGATS/" \ -e "s/^ !!! FRR_IPV6_EDGE_SUMMARIES_AGGREGATS/$FRR_IPV6_EDGE_SUMMARIES_AGGREGATS/" \ -e "s/^!!! FRR_IPV4_EDGE_SUMMARIES_PFLIST/$FRR_IPV4_EDGE_SUMMARIES_PFLIST/" \ -e "s/^!!! FRR_IPV6_EDGE_SUMMARIES_PFLIST/$FRR_IPV6_EDGE_SUMMARIES_PFLIST/" \ -e "s/^!!! FRR_IPV4_CUSTOMERS_PFLIST/$FRR_IPV4_CUSTOMERS_PFLIST/" \ -e "s/^!!! FRR_IPV6_CUSTOMERS_PFLIST/$FRR_IPV6_CUSTOMERS_PFLIST/" \ -e "s/^!!! FRR_IPV4_LOOPBACK_PFLIST/$FRR_IPV4_LOOPBACK_PFLIST/" \ -e "s/^!!! FRR_IPV6_LOOPBACK_PFLIST/$FRR_IPV6_LOOPBACK_PFLIST/" \ -e "s/FRRROUTERID/${LOOPBACKv4}/" \ -e "s/NODEASN/${NODEASN}/" \ $SEDEXTRA \ $FRRCONFIG exit 2 chown frr.frr $FRRCONFIG /etc/frr/daemons.wit # set ipsec config sed -i -e "s/FQHOSTNAME/${HOSTNAME}/" /etc/ipsec.conf.wit echo ": RSA ${HOSTNAME}.key" >/etc/ipsec.secrets # wite grub rules for serial terminal sed -i -e '/GRUB_CMDLINE_LINUX_DEFAULT=/d' -e '/GRUB_CMDLINE_LINUX=/d' -e '/GRUB_SERIAL_COMMAND=/d' -e '/GRUB_TERMINAL=/d' /etc/default/grub cat <<-EOF >>/etc/default/grub GRUB_CMDLINE_LINUX_DEFAULT="" GRUB_CMDLINE_LINUX="console=tty0 console=ttyS1,115200n8" GRUB_TERMINAL=serial GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=1 --word=8 --parity=no --stop=1" EOF # disable password logins on ssh sed -i -e '/#*\s*PasswordAuthentication /d' /etc/ssh/sshd_config echo "PasswordAuthentication no" >>/etc/ssh/sshd_config ## END config file section ## START configuring services as we need it systemctl disable strongswan # disable ipsec till we have the certs and all systemctl enable firewall systemctl restart systemd-timesyncd systemctl restart ssh update-grub sysctl -p /etc/sysctl.d/10-frr.conf ## END services section ;; abort-upgrade|abort-remove|abort-deconfigure) ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0