update security
This commit is contained in:
David Schroeder
+210
@@ -0,0 +1,210 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
TAPM_FLEET_STATE_DIR="${TAPM_FLEET_STATE_DIR:-/var/lib/ta-proxmenu}"
|
||||
TAPM_FLEET_IDENTITY_FILE="${TAPM_FLEET_IDENTITY_FILE:-${TAPM_FLEET_STATE_DIR}/identity.env}"
|
||||
TAPM_FLEET_INSTALLATION_ID=''
|
||||
TAPM_FLEET_CREDENTIAL=''
|
||||
TAPM_FLEET_LAST_VERSION=''
|
||||
TAPM_FLEET_REGISTERED=0
|
||||
TAPM_FLEET_STARTED_AT=0
|
||||
TAPM_FLEET_VERSION=''
|
||||
|
||||
TAPM_FLEET_READ_VALUE() {
|
||||
local key="$1"
|
||||
local value=''
|
||||
if [[ -r "$TAPM_FLEET_IDENTITY_FILE" ]]; then
|
||||
value="$(
|
||||
sed -n "s/^${key}=//p" "$TAPM_FLEET_IDENTITY_FILE" |
|
||||
tail -n 1
|
||||
)"
|
||||
fi
|
||||
printf '%s' "$value"
|
||||
}
|
||||
|
||||
TAPM_FLEET_LOAD_IDENTITY() {
|
||||
TAPM_FLEET_INSTALLATION_ID="$(TAPM_FLEET_READ_VALUE INSTALLATION_ID)"
|
||||
TAPM_FLEET_CREDENTIAL="$(TAPM_FLEET_READ_VALUE CREDENTIAL)"
|
||||
TAPM_FLEET_LAST_VERSION="$(TAPM_FLEET_READ_VALUE LAST_VERSION)"
|
||||
}
|
||||
|
||||
TAPM_FLEET_VALID_IDENTITY() {
|
||||
[[ "$TAPM_FLEET_INSTALLATION_ID" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ &&
|
||||
"$TAPM_FLEET_CREDENTIAL" =~ ^[0-9a-f]{64}$ ]]
|
||||
}
|
||||
|
||||
TAPM_FLEET_WRITE_IDENTITY() {
|
||||
local temporary_file
|
||||
|
||||
mkdir -p "$TAPM_FLEET_STATE_DIR" 2>/dev/null || return 1
|
||||
chmod 0700 "$TAPM_FLEET_STATE_DIR" 2>/dev/null || return 1
|
||||
temporary_file="$(mktemp "${TAPM_FLEET_IDENTITY_FILE}.tmp.XXXXXX")" || return 1
|
||||
if ! {
|
||||
printf 'INSTALLATION_ID=%s\n' "$TAPM_FLEET_INSTALLATION_ID"
|
||||
printf 'CREDENTIAL=%s\n' "$TAPM_FLEET_CREDENTIAL"
|
||||
printf 'LAST_VERSION=%s\n' "$TAPM_FLEET_LAST_VERSION"
|
||||
} >"$temporary_file" ||
|
||||
! chmod 0600 "$temporary_file" ||
|
||||
! mv -f "$temporary_file" "$TAPM_FLEET_IDENTITY_FILE"; then
|
||||
rm -f "$temporary_file"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
TAPM_FLEET_ENSURE_IDENTITY() {
|
||||
TAPM_FLEET_LOAD_IDENTITY
|
||||
TAPM_FLEET_VALID_IDENTITY && return 0
|
||||
command -v openssl >/dev/null 2>&1 || return 1
|
||||
if [[ -r /proc/sys/kernel/random/uuid ]]; then
|
||||
IFS= read -r TAPM_FLEET_INSTALLATION_ID </proc/sys/kernel/random/uuid
|
||||
elif command -v uuidgen >/dev/null 2>&1; then
|
||||
TAPM_FLEET_INSTALLATION_ID="$(uuidgen | tr '[:upper:]' '[:lower:]')"
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
TAPM_FLEET_CREDENTIAL="$(openssl rand -hex 32)" || return 1
|
||||
TAPM_FLEET_LAST_VERSION=''
|
||||
TAPM_FLEET_WRITE_IDENTITY
|
||||
}
|
||||
|
||||
TAPM_FLEET_COLLECT_METADATA() {
|
||||
TAPM_FLEET_GIT_COMMIT="$(git -C "${FOLDER:-/opt/idssys/ta-proxmenu}" rev-parse HEAD 2>/dev/null || true)"
|
||||
TAPM_FLEET_PVE_VERSION="$(pveversion 2>/dev/null | head -n 1 || true)"
|
||||
TAPM_FLEET_OS_VERSION="$(
|
||||
if [[ -r /etc/os-release ]]; then
|
||||
(
|
||||
# shellcheck disable=SC1091
|
||||
source /etc/os-release
|
||||
printf '%s' "${PRETTY_NAME:-}"
|
||||
)
|
||||
fi
|
||||
)"
|
||||
TAPM_FLEET_KERNEL_VERSION="$(uname -r 2>/dev/null || true)"
|
||||
TAPM_FLEET_ARCHITECTURE="$(
|
||||
dpkg --print-architecture 2>/dev/null ||
|
||||
uname -m 2>/dev/null ||
|
||||
true
|
||||
)"
|
||||
if [[ -s /etc/pve/corosync.conf ]]; then
|
||||
TAPM_FLEET_CLUSTERED=true
|
||||
else
|
||||
TAPM_FLEET_CLUSTERED=false
|
||||
fi
|
||||
}
|
||||
|
||||
TAPM_FLEET_JSON() {
|
||||
local event="$1"
|
||||
local result="$2"
|
||||
local error_code="${3:-}"
|
||||
local duration="${4:-0}"
|
||||
|
||||
TAPM_FLEET_EVENT="$event" \
|
||||
TAPM_FLEET_RESULT="$result" \
|
||||
TAPM_FLEET_ERROR_CODE="$error_code" \
|
||||
TAPM_FLEET_DURATION="$duration" \
|
||||
TAPM_FLEET_INSTALLATION_ID="$TAPM_FLEET_INSTALLATION_ID" \
|
||||
TAPM_FLEET_CREDENTIAL="$TAPM_FLEET_CREDENTIAL" \
|
||||
TAPM_FLEET_VERSION="$TAPM_FLEET_VERSION" \
|
||||
TAPM_FLEET_GIT_COMMIT="$TAPM_FLEET_GIT_COMMIT" \
|
||||
TAPM_FLEET_PVE_VERSION="$TAPM_FLEET_PVE_VERSION" \
|
||||
TAPM_FLEET_OS_VERSION="$TAPM_FLEET_OS_VERSION" \
|
||||
TAPM_FLEET_KERNEL_VERSION="$TAPM_FLEET_KERNEL_VERSION" \
|
||||
TAPM_FLEET_ARCHITECTURE="$TAPM_FLEET_ARCHITECTURE" \
|
||||
TAPM_FLEET_CLUSTERED="$TAPM_FLEET_CLUSTERED" \
|
||||
TAPM_FLEET_INCLUDE_CREDENTIAL="${TAPM_FLEET_INCLUDE_CREDENTIAL:-0}" \
|
||||
python3 -c '
|
||||
import json, os, sys
|
||||
payload = {
|
||||
"schema_version": 1,
|
||||
"installation_id": os.environ["TAPM_FLEET_INSTALLATION_ID"],
|
||||
"event": os.environ["TAPM_FLEET_EVENT"],
|
||||
"result": os.environ["TAPM_FLEET_RESULT"],
|
||||
"proxmenu_version": os.environ["TAPM_FLEET_VERSION"],
|
||||
"git_commit": os.environ["TAPM_FLEET_GIT_COMMIT"],
|
||||
"pve_version": os.environ["TAPM_FLEET_PVE_VERSION"],
|
||||
"os_version": os.environ["TAPM_FLEET_OS_VERSION"],
|
||||
"kernel_version": os.environ["TAPM_FLEET_KERNEL_VERSION"],
|
||||
"architecture": os.environ["TAPM_FLEET_ARCHITECTURE"],
|
||||
"clustered": os.environ["TAPM_FLEET_CLUSTERED"] == "true",
|
||||
"error_code": os.environ["TAPM_FLEET_ERROR_CODE"],
|
||||
"duration_seconds": int(os.environ["TAPM_FLEET_DURATION"]),
|
||||
}
|
||||
if os.environ.get("TAPM_FLEET_INCLUDE_CREDENTIAL") == "1":
|
||||
payload["credential"] = os.environ["TAPM_FLEET_CREDENTIAL"]
|
||||
json.dump(payload, sys.stdout, separators=(",", ":"))
|
||||
'
|
||||
}
|
||||
|
||||
TAPM_FLEET_REGISTER() {
|
||||
TAPM_FLEET_INCLUDE_CREDENTIAL=1 TAPM_FLEET_JSON installed success |
|
||||
curl --fail --silent --show-error \
|
||||
--connect-timeout 3 --max-time 10 \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-binary @- \
|
||||
"${TAPM_BROKER_URL}/api/v1/hosts/register" \
|
||||
>/dev/null 2>&1
|
||||
}
|
||||
|
||||
TAPM_FLEET_EVENT_SEND() {
|
||||
local event="$1"
|
||||
local result="$2"
|
||||
local error_code="${3:-}"
|
||||
local duration="${4:-0}"
|
||||
local event_payload=''
|
||||
|
||||
(( TAPM_FLEET_REGISTERED == 1 )) || return 0
|
||||
event_payload="$(mktemp "${TMPDIR:-/tmp}/tapm-fleet-event.XXXXXX")" || return 0
|
||||
chmod 0600 "$event_payload" 2>/dev/null || {
|
||||
rm -f "$event_payload"
|
||||
return 0
|
||||
}
|
||||
if ! TAPM_FLEET_JSON "$event" "$result" "$error_code" "$duration" >"$event_payload"; then
|
||||
rm -f "$event_payload"
|
||||
return 0
|
||||
fi
|
||||
printf 'header = "Content-Type: application/json"\nheader = "Authorization: Bearer %s"\nurl = "%s/api/v1/hosts/events"\n' \
|
||||
"$TAPM_FLEET_CREDENTIAL" "$TAPM_BROKER_URL" |
|
||||
curl --fail --silent --show-error \
|
||||
--connect-timeout 3 --max-time 10 \
|
||||
--config - --data-binary "@${event_payload}" \
|
||||
>/dev/null 2>&1 || true
|
||||
rm -f "$event_payload"
|
||||
}
|
||||
|
||||
TAPM_FLEET_START() {
|
||||
TAPM_FLEET_VERSION="$1"
|
||||
TAPM_FLEET_STARTED_AT="$(date +%s)"
|
||||
TAPM_FLEET_ENSURE_IDENTITY || return 0
|
||||
command -v python3 >/dev/null 2>&1 || return 0
|
||||
command -v curl >/dev/null 2>&1 || return 0
|
||||
TAPM_FLEET_COLLECT_METADATA
|
||||
if TAPM_FLEET_REGISTER; then
|
||||
TAPM_FLEET_REGISTERED=1
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
if [[ -n "$TAPM_FLEET_LAST_VERSION" &&
|
||||
"$TAPM_FLEET_LAST_VERSION" != "$TAPM_FLEET_VERSION" ]]; then
|
||||
TAPM_FLEET_EVENT_SEND upgraded success
|
||||
fi
|
||||
TAPM_FLEET_EVENT_SEND run_started started
|
||||
}
|
||||
|
||||
TAPM_FLEET_FINISH() {
|
||||
local exit_status="${1:-0}"
|
||||
local duration=0
|
||||
|
||||
if [[ "$TAPM_FLEET_STARTED_AT" =~ ^[0-9]+$ ]] &&
|
||||
(( TAPM_FLEET_STARTED_AT > 0 )); then
|
||||
duration="$(( $(date +%s) - TAPM_FLEET_STARTED_AT ))"
|
||||
fi
|
||||
if (( exit_status == 0 )); then
|
||||
TAPM_FLEET_EVENT_SEND run_completed success '' "$duration"
|
||||
else
|
||||
TAPM_FLEET_EVENT_SEND run_failed failure exit_nonzero "$duration"
|
||||
fi
|
||||
if (( TAPM_FLEET_REGISTERED == 1 )) && TAPM_FLEET_VALID_IDENTITY; then
|
||||
TAPM_FLEET_LAST_VERSION="$TAPM_FLEET_VERSION"
|
||||
TAPM_FLEET_WRITE_IDENTITY || true
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
Reference in New Issue
Block a user