#!/bin/bash
# Builds the Linux bridge that carries Spinifex's external datapath over the
# secondary OCI VNIC. Discovers that VNIC from the instance metadata service,
# because Terraform attaches it after the instance is already RUNNING and its
# MAC and address are therefore unknown when user-data is written.
set -euo pipefail

BRIDGE="${BRIDGE:-br-wan}"
MTU="${MTU:-9000}"
IMDS="${IMDS:-http://169.254.169.254/opc/v2}"

# A file of our own. 50-cloud-init.yaml belongs to cloud-init, so anything added
# there is lost when it re-renders. netplan merges every file in the directory,
# which is also why strip_cloud_init_secondary below has work to do.
NETPLAN_FILE="${NETPLAN_FILE:-/etc/netplan/60-spinifex-wan.yaml}"

log() { printf '[spinifex-wan-bridge] %s\n' "$*"; }
die() {
    log "ERROR: $*"
    exit 1
}

# The VNIC holding the default route is the host plane and must be left alone.
primary_mac() {
    local dev
    dev="$(ip -4 route show default | awk '{for (i=1;i<NF;i++) if ($i=="dev") print $(i+1); exit}')"
    [ -n "$dev" ] || die "no default route, so the primary VNIC cannot be identified"
    cat "/sys/class/net/$dev/address"
}

# One tab-separated record per VNIC that is not the primary.
imds_secondaries() {
    curl -sf --max-time 10 -H 'Authorization: Bearer Oracle' "$IMDS/vnics/" |
        python3 -c '
import ipaddress, json, sys

primary = sys.argv[1].lower()
for vnic in json.load(sys.stdin):
    mac = vnic["macAddr"].lower()
    if mac == primary:
        continue
    net = ipaddress.ip_network(vnic["subnetCidrBlock"])
    print("\t".join([mac, vnic["privateIp"], str(net.prefixlen),
                     vnic["subnetCidrBlock"], vnic["virtualRouterIp"]]))
' "$1"
}

# Picks the secondary VNIC the kernel actually has an interface for, and sets the
# WAN_* variables from it. Deliberately not "the first non-primary": IMDS order is
# not documented, and on bare metal a VNIC sharing a port has no interface at all.
select_secondary() {
    local primary="$1" mac ip prefix cidr router iface
    while IFS=$'\t' read -r mac ip prefix cidr router; do
        [ -n "$mac" ] || continue
        if iface="$(iface_for_mac "$mac")"; then
            WAN_MAC="$mac"
            WAN_IP="$ip"
            WAN_PREFIX="$prefix"
            WAN_CIDR="$cidr"
            WAN_ROUTER="$router"
            WAN_IFACE="$iface"
            return 0
        fi
    done < <(imds_secondaries "$primary")
    return 1
}

wait_for_secondary() {
    local primary i
    primary="$(primary_mac)"
    log "primary VNIC MAC is $primary"

    for i in $(seq 1 60); do
        if select_secondary "$primary"; then
            log "secondary VNIC after $((i * 5))s: $WAN_MAC on $WAN_IFACE, $WAN_IP/$WAN_PREFIX via $WAN_ROUTER"
            return 0
        fi
        sleep 5
    done
    die "no secondary VNIC with an interface appeared within 300s; on bare metal check it is attached at nic_index 1, because a VNIC sharing the primary's port never becomes an interface"
}

# The physical interface for a MAC. Matching on the address rather than trusting a
# name means a rename between boots cannot silently bridge the wrong interface.
#
# Bridges are skipped deliberately: once this has run, $BRIDGE wears the same
# cloned MAC as its member, and a plain match finds the bridge and tries to
# enslave it to itself.
iface_for_mac() {
    local mac="$1" dev name
    for dev in /sys/class/net/*; do
        name="$(basename "$dev")"
        [ -e "$dev/address" ] || continue
        [ -d "$dev/bridge" ] && continue
        [ "$name" = "$BRIDGE" ] && continue
        if [ "$(cat "$dev/address")" = "$mac" ]; then
            printf '%s\n' "$name"
            return 0
        fi
    done
    return 1
}

# Source routing is not optional on OCI: it enforces the source address per VNIC,
# so a reply leaving through the primary from a secondary address is dropped.
write_netplan() {
    local iface="$1"
    cat > "$NETPLAN_FILE" <<EOF
# Generated by spinifex-setup-wan-bridge. Do not edit; regenerate instead.
network:
  version: 2
  ethernets:
    # Keyed by name, not by a macaddress match. The bridge clones the member's MAC,
    # so once it exists a match finds two devices and netplan refuses the interface
    # as non-unique. The script re-resolves the name from the MAC on every run and
    # rewrites this file if it ever changes, which covers the rename case instead.
    ${iface}:
      dhcp4: false
      dhcp6: false
      mtu: ${MTU}
  bridges:
    ${BRIDGE}:
      interfaces: [${iface}]
      macaddress: "${WAN_MAC}"
      mtu: ${MTU}
      dhcp4: false
      dhcp6: false
      # /32, not /${WAN_PREFIX}. Both VNICs sit in one subnet, so the on-link
      # route the kernel derives from the address would land in the main table at
      # metric 0 and take the whole subnet off the primary VNIC. Replies to the
      # primary's own address then leave by br-wan and OCI drops them, because it
      # enforces the source address per VNIC. Table 200 carries the on-link route.
      addresses:
        - ${WAN_IP}/32
      routes:
        - to: ${WAN_CIDR}
          scope: link
          table: 200
        - to: default
          via: ${WAN_ROUTER}
          table: 200
      routing-policy:
        - from: ${WAN_IP}/32
          table: 200
          priority: 1000
EOF
    chmod 0600 "$NETPLAN_FILE"
}

# cloud-init renders 50-cloud-init.yaml from the datasource's network config, so
# whether the secondary VNIC appears there depends on whether it was attached when
# that ran — a race Terraform loses on some nodes and wins on others. When it does
# appear it carries the VNIC address as a /PREFIX, and netplan merges both files:
# the bridge gets its /32 and the member keeps the prefixed address, whose metric-0
# on-link route takes the whole subnet off the primary VNIC. Every packet between
# nodes then leaves the wrong VNIC and OCI drops it. The stanza also matches on the
# MAC the bridge later clones, so once the bridge exists netplan refuses the whole
# directory with "Cannot find unique matching interface".
#
# Overriding it from 60- cannot work for the same reason, so remove it, and stop
# cloud-init re-rendering the file on a later boot. The primary VNIC's own stanza
# stays exactly as cloud-init wrote it.
STRIPPED=0

strip_cloud_init_secondary() {
    local file=/etc/netplan/50-cloud-init.yaml
    [ -f "$file" ] || return 0

    local removed
    removed="$(MAC="$WAN_MAC" python3 - "$file" <<'PY'
import os, sys, yaml

path, mac = sys.argv[1], os.environ["MAC"].lower()
with open(path) as fh:
    cfg = yaml.safe_load(fh) or {}

eths = cfg.get("network", {}).get("ethernets", {})
drop = [n for n, e in eths.items()
        if str((e or {}).get("match", {}).get("macaddress", "")).lower() == mac]
if not drop:
    sys.exit(0)

for name in drop:
    del eths[name]
with open(path, "w") as fh:
    yaml.safe_dump(cfg, fh, default_flow_style=False, sort_keys=False)
print(", ".join(drop))
PY
    )" || die "could not edit $file"

    if [ -n "$removed" ]; then
        log "removed the secondary VNIC stanza for $removed from $file"
        STRIPPED=1
    fi

    printf 'network: {config: disabled}\n' > /etc/cloud/cloud.cfg.d/99-spinifex-network.cfg
    chmod 0644 /etc/cloud/cloud.cfg.d/99-spinifex-network.cfg
}

main() {
    wait_for_secondary
    log "bridging $WAN_IFACE into $BRIDGE"

    strip_cloud_init_secondary

    local previous=""
    [ -f "$NETPLAN_FILE" ] && previous="$(cat "$NETPLAN_FILE")"
    write_netplan "$WAN_IFACE"

    if [ "$STRIPPED" = 0 ] && [ "$previous" = "$(cat "$NETPLAN_FILE")" ] && ip link show "$BRIDGE" >/dev/null 2>&1; then
        log "$BRIDGE is already configured and unchanged"
        return 0
    fi

    netplan apply
    for _ in $(seq 1 30); do
        ip -4 addr show "$BRIDGE" 2>/dev/null | grep -q "inet ${WAN_IP}/" && break
        sleep 2
    done

    ip -br addr show "$BRIDGE" || die "$BRIDGE did not come up"
    ip -4 addr show "$BRIDGE" | grep -q "inet ${WAN_IP}/" \
        || die "$BRIDGE is up but does not hold ${WAN_IP}"
    log "table 200: $(ip route show table 200 | tr '\n' ';')"
}

main "$@"