#!/bin/sh
#
# Copyright (c) 2000-2021 University of Utah and the Flux Group.
# 
# {{{EMULAB-LICENSE
# 
# This file is part of the Emulab network testbed software.
# 
# This file is free software: you can redistribute it and/or modify it
# under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or (at
# your option) any later version.
# 
# This file is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public
# License for more details.
# 
# You should have received a copy of the GNU Affero General Public License
# along with this file.  If not, see <http://www.gnu.org/licenses/>.
# 
# }}}
#

if [ -r /etc/emulab/paths.sh ]; then
	. /etc/emulab/paths.sh
else
	BINDIR=/etc/testbed
	BOOTDIR=/var/emulab/boot
	ETCDIR=/etc/emulab
fi

# XXX super-specialized, minimum-impact hack for FreeBSD MFSes...
if [ "$ETCDIR" = "/etc/testbed" -a -e "/etc/emulab/emulab.pem" ]; then
    ETCDIR=/etc/emulab
fi

MNT="/mnt"

case $# in
1)
	MNT=$1
	;;
*)
	echo "Usage: $0 mountpoint"
	exit 1
esac

#
# Localize the image. We only do this if the MFS we are running in
# has the necessary files. 
#
localize_image() {
    # Check the certs.
    if [ ! -d $MNT/etc/emulab ]; then
	mkdir -m 755 $MNT/etc/emulab || {
	    echo "Failed to mkdir $MNT/etc/emulab"
	    return 1
	}
    fi
    if [ -e $ETCDIR/emulab.pem ]; then
	cmp -s $ETCDIR/emulab.pem $MNT/etc/emulab/emulab.pem
	if [ $? -ne 0 ]; then
	    echo "  updating $MNT/etc/emulab/emulab.pem"
	    cp -pf $ETCDIR/emulab.pem $MNT/etc/emulab/ || {
		echo "Failed to create $ETCDIR/emulab.pem"
		return 1
	    }
	fi
    fi
    if [ -e $ETCDIR/client.pem ]; then
	cmp -s $ETCDIR/client.pem $MNT/etc/emulab/client.pem
	if [ $? -ne 0 ]; then
	    echo "  updating $MNT/etc/emulab/client.pem"
	    cp -pf $ETCDIR/client.pem $MNT/etc/emulab/ || {
		echo "Failed to create $ETCDIR/client.pem"
		return 1
	    }
	fi
    fi
    # Check the root keys.
    if [ -e /root/.ssh/authorized_keys2 ]; then
	cmp -s /root/.ssh/authorized_keys2 $MNT/root/.ssh/authorized_keys
	if [ $? -ne 0 ]; then
	    echo "  updating /root/.ssh/authorized_keys"
	    
	    if [ ! -d $MNT/root/.ssh ]; then
		mkdir -m 700 $MNT/root/.ssh || {
		    echo "Failed to mkdir /root/.ssh"
		    return 1
		}
	    fi
	    # copy to authorized_keys
	    cp -pf /root/.ssh/authorized_keys2 $MNT/root/.ssh/authorized_keys || {
		echo "Failed to create /root/.ssh/authorized_keys"
		return 1
	    }
	fi
    fi

    # Check the host keys.
    changehostkeys=0
    for k in "" dsa_ ecdsa_ ed25519_ rsa_; do
	if [ -e /etc/ssh/ssh_host_${k}key ]; then
	    cmp -s /etc/ssh/ssh_host_${k}key $MNT/etc/ssh/ssh_host_${k}key
	    if [ $? -ne 0 ]; then
		changehostkeys=1
	    fi
	fi
    done

    if [ $changehostkeys -eq 1 ]; then
	echo "  updating /etc/ssh host keys"
	
	if [ ! -d $MNT/etc/ssh ]; then
	    mkdir -m 755 $MNT/etc/ssh || {
		echo "Failed to mkdir $MNT/etc/ssh"
		return 1
	    }
	fi
	cp -pf /etc/ssh/ssh_host_* $MNT/etc/ssh/ || {
	    echo "Failed to update /etc/ssh host keys"
	    return 1
	}
    fi

    #
    # XXX more host key processing. We have to do this regardless of
    # whether the keys have actually changed.
    #
    # On CentOS private keys must be readable by the group "ssh_keys".
    # So we look up that group in the group file. If it exists, we chgrp
    # the private key files and allow group readability.
    #
    _gid=`grep ssh_keys $MNT/etc/group 2>/dev/null | awk -F : '{ print $3; }'`
    if [ -n "$_gid" ]; then
	echo "  changing group of host keys to ssh_keys ($_gid)"
	chown root:$_gid $MNT/etc/ssh/*_key
	chmod g+r $MNT/etc/ssh/*_key
    fi

    # Check the time zone.
    if [ -e /etc/localtime ]; then
	# XXX might be a symlink to /usr/share which we cannot resolve to
	# compare, so just unconditionally replace it.
	rm -f $MNT/etc/localtime

	echo "  updating /etc/localtime"
	cp -pf /etc/localtime $MNT/etc/localtime || {
	    echo "Failed to create /etc/localtime"
	    return 1
	}
    fi

    # Check the NTP configuration.
    if [ -e /etc/ntp.conf ]; then
	echo "  updating /etc/ntp.conf"

	cp -pf /etc/ntp.conf $MNT/etc/ntp.conf || {
	    echo "Failed to create /etc/ntp.conf"
	    return 1
	}

	# XXX cannot put drift in /etc/ntp.drift on Linux
	if [ -d "$MNT/var/lib/ntp" ]; then
	    sed -i '' -e 's;/etc/ntp.drift;/var/lib/ntp/ntp.drift;' $MNT/etc/ntp.conf
	fi
    fi

    return 0
}

localize_image
exit $?
