#! /bin/sh
# /etc/init.d/sshd_operns : start and stop OpenBSD "secure shell" daemon in OPERNS
#
# Copyright (c) 2015-2017 by cisco Systems, Inc.
# All rights reserved.
#
# chkconfig: 345 97 1
# description: OpenSSH server daemon for OPERNS
#
# processname: sshd
# config: /etc/ssh/sshd_config_operns
# pidfile: /var/run/sshd_operns.pid

# source function library
. /etc/init.d/functions
. /etc/rc.d/init.d/app-hosting-functions

#
# Check 2nd parameter and set it to global-vrf if not specified
#
if [[ -z "$2" ]]; then
    vrf_name="global-vrf"
else
    vrf_name="$2"
fi

if operns_is_thinxr; then
    #
    # On ThinXR, use the standard sshd config file as the base.
    #
    CONFIG=/etc/ssh/sshd_config
else
    CONFIG=/etc/ssh/sshd_config_operns
fi

NETNS=/var/run/netns/"$vrf_name"
NS_VRF_TEMPLATE=/etc/rc.d/init.d/sshd_operns_template
NS_VRF_OPERNS=/etc/rc.d/init.d/sshd_operns_${vrf_name}

#
# Create /var/run/vrf, a copy of sshd_config for each vrf and a corresponding pid
# file for each vrf.
#
if [ ! -d /var/run/vrf ]; then
    mkdir -p /var/run/vrf
fi
if [ ! -f ${CONFIG}_"$vrf_name" ]; then
    cp -f $CONFIG ${CONFIG}_"$vrf_name"
fi

if operns_is_thinxr; then
    #
    # PidFile isn't yet set in /etc/ssh/sshd_config, so need to set it here.
    #
    sed -i "s|#PidFile\ /var/run/sshd.pid|PidFile /var/run/vrf/sshd_operns_"${vrf_name}".pid|g" ${CONFIG}_"${vrf_name}"
else
    sed -i "s|run/sshd_operns.pid|run/vrf/sshd_operns_"${vrf_name}".pid|g" ${CONFIG}_"$vrf_name"
fi
PIDFILE=/var/run/vrf/sshd_operns_"${vrf_name}".pid

#
# Wait for operns to become ready if starting
#
case "$1" in
    start)
        # Check if sshd already runs in the namespace; if yes, do nothing and exit
        if [ -f $PIDFILE ]; then
            start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd -a nsenter -- --net=${NETNS} /usr/sbin/sshd -- $SSHD_OPTS
            exit
        fi
        . /etc/init.d/operns-functions
        check_if_vrf_exists "$vrf_name"
        if [[ $? != 0 ]]; then
            echo "Vrf $vrf_name not created yet! Please try again later"
            exit 1
        fi
        # If invoked first time, check if sshd_operns_$vrf_name exists, else create and edit
        if ! [ -f $NS_VRF_OPERNS ]; then
            cp $NS_VRF_TEMPLATE $NS_VRF_OPERNS
            sed -i "s,daemon for VRF,daemon for VRF "${vrf_name}",g" $NS_VRF_OPERNS
            sed -i "/To be copied and edited on per-vrf basis/d" $NS_VRF_OPERNS
            sed -i "s,vrf_name=,vrf_name=\""${vrf_name}"\",g" $NS_VRF_OPERNS
            echo "SSH service for $vrf_name has been created. You may use 'service sshd_operns_$vrf_name <start|stop|reload|restart|status>'. "
            echo "Service can be configured to run on reload using 'chkconfig --add sshd_operns_$vrf_name' "
        fi
        operns_wait_until_ready "$vrf_name"
        operns_log "Start sshd_operns"
        ;;
esac

test -x /usr/sbin/sshd || exit 0
( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0

# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS
if test -f /etc/default/ssh; then
    . /etc/default/ssh
fi

[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
mkdir -p $SYSCONFDIR

SSHD_OPTS+=" -f ${CONFIG}_"${vrf_name}""

HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key_operns
HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key_operns
HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key_operns
HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key_operns

check_for_no_start() {
    # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
    if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then
        echo "OpenBSD Secure Shell server not in use ($SYSCONFDIR/sshd_not_to_be_run)"
        exit 0
    fi
}

check_privsep_dir() {
    # Create the PrivSep empty dir if necessary
    if [ ! -d /var/run/sshd ]; then
        mkdir /var/run/sshd
        chmod 0755 /var/run/sshd
    fi
}

check_config() {
        /usr/sbin/sshd -t || exit 1
}

check_keys() {
    # create keys if necessary
    if [ ! -s $HOST_KEY_RSA ]; then
        /bin/rm -f $HOST_KEY_RSA
        echo "  generating ssh RSA key..."
        ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
    fi
    if [ ! -s $HOST_KEY_ECDSA ]; then
        /bin/rm -f $HOST_KEY_ECDSA
        echo "  generating ssh ECDSA key..."
        ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
    fi
    if [ ! -s $HOST_KEY_DSA ]; then
        /bin/rm -f $HOST_KEY_DSA
        echo "  generating ssh DSA key..."
        ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
    fi
    if [ ! -s $HOST_KEY_ED25519 ]; then
        /bin/rm -f $HOST_KEY_ED25519
        echo "  generating ssh ED25519 key..."
        ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
    fi
}

export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
  start)
        check_for_no_start
        echo "Starting OpenBSD Secure Shell server: sshd"
        check_keys
        check_privsep_dir
        start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd -a nsenter -- --net=${NETNS} /usr/sbin/sshd -- $SSHD_OPTS
        ;;
  stop)
        echo -n "Stopping OpenBSD Secure Shell server: sshd"
        start-stop-daemon -K -p $PIDFILE -x /usr/sbin/sshd
        echo "."
        ;;

  reload|force-reload)
        check_for_no_start
        check_keys
        check_config
        echo -n "Reloading OpenBSD Secure Shell server's configuration"
        start-stop-daemon -K -p $PIDFILE -s 1 -x /usr/sbin/sshd
        echo "."
        ;;

  restart)
        check_keys
        check_config
        echo -n "Restarting OpenBSD Secure Shell server: sshd"
        start-stop-daemon -K -p $PIDFILE --oknodo -x /usr/sbin/sshd
        check_for_no_start
        check_privsep_dir
        sleep 2
        start-stop-daemon -S -p $PIDFILE -x /usr/sbin/sshd -a nsenter -- --net=${NETNS} /usr/sbin/sshd -- $SSHD_OPTS
        echo "."
        ;;

  status)
        status -p $PIDFILE /usr/sbin/sshd
        exit $?
  ;;

  *)
        echo "Usage: /etc/init.d/sshd_operns {start|stop|status|reload|force-reload|restart}"
        exit 1
esac

exit 0
