444 lines
11 KiB
Bash
Executable File
444 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Functions
|
|
|
|
trim() {
|
|
local extglobWasOff=1
|
|
local var=$1
|
|
|
|
shopt extglob >/dev/null && extglobWasOff=0
|
|
(( extglobWasOff )) && shopt -s extglob
|
|
var=${var##+([[:space:]])}
|
|
var=${var%%+([[:space:]])}
|
|
(( extglobWasOff )) && shopt -u extglob
|
|
var=${var%%\#*}
|
|
printf '%s' "$var"
|
|
}
|
|
|
|
valid_ipv4() {
|
|
local ip=$1
|
|
local stat=1
|
|
local ipaddr
|
|
|
|
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
|
IFS='.' read -ra ipaddr <<< "$ip"
|
|
[[ $((10#${ipaddr[0]})) -le 255 \
|
|
&& $((10#${ipaddr[0]})) -gt 0 \
|
|
&& $((10#${ipaddr[1]})) -le 255 \
|
|
&& $((10#${ipaddr[1]})) -gt -1 \
|
|
&& $((10#${ipaddr[2]})) -le 255 \
|
|
&& $((10#${ipaddr[2]})) -gt -1 \
|
|
&& $((10#${ipaddr[3]})) -le 255 \
|
|
&& $((10#${ipaddr[3]})) -gt -1 ]]
|
|
stat=$?
|
|
fi
|
|
return "$stat"
|
|
}
|
|
|
|
valid_ipv6() {
|
|
local ip=$1
|
|
local regex='^([[:xdigit:]]{0,4}:){1,7}[[:xdigit:]]{0,4}$'
|
|
#local regex='^$|^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$'
|
|
|
|
#if [[ $ip =~ ^$|^[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}$ ]]; then
|
|
if [[ $ip =~ $regex ]]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
detect_ip_version() {
|
|
local ip=$1
|
|
|
|
if valid_ipv4 "$ip"; then
|
|
return 4;
|
|
elif valid_ipv6 "$ip"; then
|
|
return 6
|
|
else
|
|
return 0;
|
|
fi
|
|
}
|
|
|
|
valid_ip() {
|
|
local ip=$1
|
|
local iptype
|
|
|
|
detect_ip_version "$ip"
|
|
iptype=$?
|
|
|
|
case $iptype in
|
|
4) return 0;;
|
|
6) return 0;;
|
|
*) return 1;;
|
|
esac
|
|
}
|
|
|
|
getRecords() {
|
|
local file=$1
|
|
local r
|
|
|
|
if [[ ! -r "$file" ]]; then
|
|
return 1
|
|
else
|
|
while read -r r;
|
|
do
|
|
r=$(trim "$r")
|
|
[[ ${r:0:1} == '#' ]] && continue
|
|
[[ -z "$r" ]] && continue
|
|
|
|
echo "$r"
|
|
done <"$file"
|
|
fi
|
|
}
|
|
|
|
getIPv4() {
|
|
local result
|
|
local cmd
|
|
|
|
[[ ! -r "${script_dir}/checks.lst" ]] && return 1
|
|
|
|
while read -r cmd; do
|
|
cmd=$(trim "$cmd")
|
|
[[ "$cmd" == \#* ]] && continue
|
|
[[ -n "$cmd" ]] || continue
|
|
|
|
result=$($cmd) || continue
|
|
|
|
if valid_ipv4 "$result"; then
|
|
echo "$result"
|
|
return 0
|
|
fi
|
|
done <"${script_dir}/checks.lst"
|
|
return 1
|
|
}
|
|
|
|
getIPv6() {
|
|
local result
|
|
|
|
#result=$(/sbin/ip -6 addr | grep inet6 | awk -F '[ \t]+|/' '{print $3}' | grep -v ^::1 | grep -v ^fe80) || return 1
|
|
result=$(ip -6 route get to 2001:4860:4860::8888 | sed 's/^.*src \([^ ]*\).*$/\1/;q') || return 1
|
|
|
|
if valid_ipv6 "$result"; then
|
|
echo "$result"
|
|
fi
|
|
}
|
|
|
|
getDnsNS() {
|
|
local rec=$1
|
|
local domain
|
|
local result
|
|
|
|
domain=$(sed 's/[^.]*\.\([^.]*\..*\)/\1/' <<<"$rec")
|
|
|
|
while read -r result; do
|
|
echo "$result"
|
|
done < <(dig +short @8.8.8.8 NS "$domain" | sed -e 's/.$//')
|
|
}
|
|
|
|
getDnsRecord() {
|
|
local rec=$1
|
|
local rectype=$2
|
|
local result
|
|
local getrecord
|
|
|
|
while read -r getrecord; do
|
|
[[ "$getrecord" == "ERROR" ]] && return 1
|
|
|
|
result=$(dig +short @"$getrecord" "$rectype" "$rec" | head -n1) || continue
|
|
[[ -z "$result" ]] && continue
|
|
|
|
if valid_ip "$result"; then
|
|
echo "$result"
|
|
return 0
|
|
else
|
|
continue
|
|
fi
|
|
done < <(getDnsNS "$rec")
|
|
return 1
|
|
}
|
|
|
|
getIPv6Prefix() {
|
|
local rec=$1
|
|
local result
|
|
|
|
if valid_ipv6 "$rec"
|
|
then
|
|
result=$(echo "$rec" | cut -d':' -f1-4)
|
|
result="${result}::/64"
|
|
echo "$result"
|
|
else
|
|
logerr "Not IPv6"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
getZabbixProxyIP() {
|
|
local result
|
|
|
|
result=$(awk -F "=" '/^Server/ { print $2 }' /etc/zabbix/zabbix_proxy.conf) || return 1
|
|
|
|
if valid_ip "$result"; then
|
|
echo "$result"
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
getShorewallIP() {
|
|
local result
|
|
|
|
result=$(awk -F "=" '/HOME_IP/ { print $2 }' /etc/shorewall/params) || return 1
|
|
|
|
if valid_ip "$result"; then
|
|
echo "$result"
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
getCachedIP() {
|
|
local result
|
|
|
|
result=$(<"$HOME/.cached_ip") || return 1
|
|
|
|
if valid_ip "$result"; then
|
|
echo "$result"
|
|
fi
|
|
}
|
|
|
|
log() {
|
|
echo "$*"
|
|
}
|
|
|
|
logerr() {
|
|
>&2 log "$@"
|
|
}
|
|
|
|
run-parts() {
|
|
# Ignore *~ and *, scripts
|
|
for i in ${1%/}/*[^~]; do
|
|
[[ -d "$i" ]] && continue
|
|
# Don't run *.{rpmsave,rpmorig,rpmnew,swp,cfsaved} scripts
|
|
[[ "${i%.cfsaved}" != "${i}" ]] && continue
|
|
[[ "${i%.rpmsave}" != "${i}" ]] && continue
|
|
[[ "${i%.rpmorig}" != "${i}" ]] && continue
|
|
[[ "${i%.rpmnew}" != "${i}" ]] && continue
|
|
[[ "${i%.swp}" != "${i}" ]] && continue
|
|
[[ "${i%,v}" != "${i}" ]] && continue
|
|
|
|
# jobs.deny prevents specific files from being executed
|
|
# jobs.allow prohibits all non-named jobs from being run.
|
|
# can be used in conjunction but there's no reason to do so.
|
|
if [[ -r "${1}/jobs.deny" ]]; then
|
|
grep -q "^$(basename "$i")$" "${1}/jobs.deny" && continue
|
|
fi
|
|
if [[ -r "${1}/jobs.allow" ]]; then
|
|
grep -q "^$(basename "$i")$" "${1}/jobs.allow" || continue
|
|
fi
|
|
|
|
if [[ -e $i ]]; then
|
|
if [[ -r "${1}/whitelist" ]]; then
|
|
grep -q "^$(basename "$i")$" "${1}/whitelist" && continue
|
|
fi
|
|
|
|
if [[ -x "$i" ]]; then
|
|
# run executable files
|
|
echo "$i"
|
|
fi
|
|
fi
|
|
done
|
|
}
|
|
|
|
run-hook() {
|
|
local hook_dir=$1
|
|
local errors=0
|
|
local hook_script
|
|
shift
|
|
|
|
if [[ ! -d "${hook_dir}" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
while read -r hook_script; do
|
|
log "Running agent: $(basename "$hook_script")"
|
|
if ! \
|
|
DIP_FUNCTIONS="$(readlink -f "$0")" \
|
|
DIP_AGENT_NAME="$(basename "$(readlink -f "$hook_script")")" \
|
|
DIP_AGENT_EXEC="$(basename "$hook_script")" \
|
|
DIP_AGENT_DIR="$(dirname "$(readlink -f "$hook_script")")" \
|
|
DIP_BASE_DIR="${script_dir}" \
|
|
DIP_CUR_IP="$1" \
|
|
DIP_OLD_IP="$2" \
|
|
DIP_RECORD="$3" \
|
|
DIP_DOMAIN="$4" \
|
|
"$hook_script" "$@"
|
|
then
|
|
logerr "WARNING: Agent $(basename "$hook_script") had errors"
|
|
(( errors++ )) || true
|
|
fi
|
|
done < <(run-parts "${hook_dir}")
|
|
|
|
return "$errors"
|
|
}
|
|
|
|
run-update() {
|
|
local cip=$1
|
|
local eip=$2
|
|
local rec=$3
|
|
local dom=$4
|
|
|
|
if [[ "$cip" != "$eip" ]]; then
|
|
run-hook "${script_dir}/update.d" "$cip" "$eip" "$rec" "$dom" || return $?
|
|
else
|
|
log "No change detected"
|
|
fi
|
|
}
|
|
|
|
# Caches current local IP so it doesn't have to every time.
|
|
getCurrentLocalIP() {
|
|
local iptype=$1
|
|
local cip
|
|
|
|
if [[ -z "$currentip" ]]; then
|
|
case "$iptype" in
|
|
4) cip=$(getIPv4) || return 1;;
|
|
6) cip=$(getIPv6) || return 1;;
|
|
*) return 3;;
|
|
esac
|
|
|
|
echo "$cip"
|
|
else
|
|
case "$iptype" in
|
|
4) valid_ipv4 "$currentip" || return 1;;
|
|
6) valid_ipv6 "$currentip" || return 1;;
|
|
*) return 3;;
|
|
esac
|
|
|
|
echo "$currentip"
|
|
fi
|
|
}
|
|
|
|
getCurrentIP() {
|
|
local iptype=$1
|
|
local record=$2
|
|
|
|
[[ -z "$iptype" ]] && return 1
|
|
[[ -z "$record" ]] && return 1
|
|
|
|
case "$iptype" in
|
|
4) log "Checking if internet IP has changed for $record"
|
|
currentip=$(getCurrentLocalIP 4) || return "$?"
|
|
externalip=$(getDnsRecord "$record" "A") || return 2
|
|
return 0
|
|
;;
|
|
6) log "Checking if internet IPv6 has changed for $record"
|
|
currentip=$(getCurrentLocalIP 6) || return "$?"
|
|
externalip=$(getDnsRecord "$record" "AAAA") || return 2
|
|
return 0
|
|
;;
|
|
*) logerr "FATAL"; return 3 ;;
|
|
esac
|
|
}
|
|
|
|
check-update() {
|
|
local iptype=$1
|
|
local record=$2
|
|
local domain
|
|
|
|
[[ -z "$iptype" ]] && return 1
|
|
[[ -z "$record" ]] && return 1
|
|
|
|
if [[ "$record" == *":"* ]]; then
|
|
domain="${record##*:}"
|
|
#record="${record%%."$domain"}" # FIXME
|
|
record="${record%%:*}"
|
|
fi
|
|
|
|
getCurrentIP "$iptype" "$record"
|
|
local status=$?
|
|
|
|
case $status in
|
|
0) if [[ "$currentip" != "$externalip" ]]; then
|
|
log "Updates found: $externalip is not $currentip"
|
|
log "Running Agents for ${record}" #${domain:+."$domain"}
|
|
if run-update "$currentip" "$externalip" "$record" "$domain"; then
|
|
log "Agents ran successfully"
|
|
else
|
|
logerr "WARNING: Agents had $? errors"
|
|
fi
|
|
else
|
|
log "No change detected"
|
|
fi
|
|
;;
|
|
1) logerr "ERROR: Failed to determine current public IP"
|
|
logerr "DEBUG: dig output '$currentip'"
|
|
exit 4
|
|
;;
|
|
2) logerr "ERROR: Failed to determine external DNS IP"
|
|
logerr "DEBUG: dig output '$externalip'"
|
|
;;
|
|
*) logerr "Unknown fatal error occurred"
|
|
logerr "(${BASH_SOURCE[0]}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }"
|
|
exit $status
|
|
;;
|
|
esac
|
|
}
|
|
|
|
prog_lock() {
|
|
local lock_name=$1
|
|
|
|
## Locking
|
|
|
|
if [[ "$USER" == "root" ]]; then
|
|
LOCKFILE="/var/lock/${lock_name}"
|
|
else
|
|
LOCKFILE="/tmp/${USER}/lock/${lock_name}"
|
|
mkdir -p "/tmp/${USER}/lock"
|
|
fi
|
|
LOCKFD=99
|
|
|
|
# PRIVATE
|
|
_lock() { flock -"$1" $LOCKFD; }
|
|
_no_more_locking() { _lock u; _lock xn && rm -f "$LOCKFILE"; }
|
|
_prepare_locking() { eval "exec $LOCKFD>\"$LOCKFILE\""; trap _no_more_locking EXIT; }
|
|
|
|
# ON START
|
|
_prepare_locking
|
|
|
|
# PUBLIC
|
|
exlock_now() { _lock xn; } # obtain an exclusive lock immediately or fail
|
|
exlock() { _lock x; } # obtain an exclusive lock
|
|
shlock() { _lock s; } # obtain a shared lock
|
|
unlock() { _lock u; } # drop a lock
|
|
|
|
### BEGIN OF SCRIPT ###
|
|
|
|
# Simplest example is avoiding running multiple instances of script.
|
|
exlock_now || exit 1
|
|
|
|
# Remember! Lock file is removed when one of the scripts exits and it is
|
|
# the only script holding the lock or lock is not acquired at all.
|
|
}
|
|
|
|
|
|
# This section doesn't run if this script was sourced.
|
|
|
|
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
|
# Internal Initialization
|
|
|
|
prog_name=$(basename "$0")
|
|
#script_dir=$(dirname "$(readlink -f "$0")")
|
|
script_dir=$(readlink -f "$(dirname "$0")")
|
|
|
|
|
|
# Main
|
|
if [[ -r "${script_dir}/plugins/${1}" ]]; then
|
|
prog_lock "${prog_name}-${1}"
|
|
# shellcheck source=plugins/update-ipv4
|
|
source "${script_dir}/plugins/${1}"
|
|
else
|
|
logerr "ERROR: Unknown plugin '${1}'"
|
|
fi
|
|
fi
|