From 8fd31bdc64a607fb3565bf8eefa1c4cc2d584065 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 16 Feb 2022 10:49:37 -0500 Subject: [PATCH] can't use the new scripts until a release is produced --- .../docker/image/ziti-cli-functions-new.sh | 1343 +++++++++++++++++ quickstart/docker/image/ziti-cli-functions.sh | 506 ++++++- 2 files changed, 1787 insertions(+), 62 deletions(-) create mode 100644 quickstart/docker/image/ziti-cli-functions-new.sh diff --git a/quickstart/docker/image/ziti-cli-functions-new.sh b/quickstart/docker/image/ziti-cli-functions-new.sh new file mode 100644 index 000000000..f0ff30cb9 --- /dev/null +++ b/quickstart/docker/image/ziti-cli-functions-new.sh @@ -0,0 +1,1343 @@ +#!/bin/bash + +set -uo pipefail + +# shellcheck disable=SC2155 +export DEFAULT_ZITI_HOME_LOCATION="${HOME}/.ziti/quickstart/$(hostname)" + +export ZITI_QUICKSTART_ENVROOT="${HOME}/.ziti/quickstart" + +ASCI_WHITE='\033[01;37m' +ASCI_RESTORE='\033[0m' +ASCI_RED='\033[00;31m' +ASCI_GREEN='\033[00;32m' +ASCI_YELLOW='\033[00;33m' +ASCI_BLUE='\033[00;34m' +#ASCI_MAGENTA='\033[00;35m' +#ASCI_PURPLE='\033[00;35m' +#ASCI_CYAN='\033[00;36m' +#ASCI_LIGHTGRAY='\033[00;37m' +#ASCI_LRED='\033[01;31m' +#ASCI_LGREEN='\033[01;32m' +#ASCI_LYELLOW='\033[01;33m' +#ASCI_LBLUE='\033[01;34m' +#ASCI_LMAGENTA='\033[01;35m' +#ASCI_LPURPLE='\033[01;35m' +#ASCI_LCYAN='\033[01;36m' + +function WHITE { + echo "${ASCI_WHITE}${1-}${ASCI_RESTORE}" +} +function RED { + echo "${ASCI_RED}${1-}${ASCI_RESTORE}" +} +function GREEN { + echo "${ASCI_GREEN}${1-}${ASCI_RESTORE}" +} +function YELLOW { + echo "${ASCI_YELLOW}${1-}${ASCI_RESTORE}" +} +function BLUE { + echo "${ASCI_BLUE}${1-}${ASCI_RESTORE}" +} + +function zitiLogin { + "${ZITI_BIN_DIR-}/ziti" edge login "${ZITI_EDGE_CTRL_ADVERTISED}" -u "${ZITI_USER-}" -p "${ZITI_PWD}" -c "${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert" +} +function cleanZitiController { + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + rm -rf "${ZITI_HOME}/db" + mkdir "${ZITI_HOME}/db" + initializeController +} +function initializeController { + log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log" +"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}" + echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details" +} +function startZitiController { + log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}.log" + # shellcheck disable=SC2034 + ("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" > "${log_file}" 2>&1 &) + pid=$! + echo -e "ziti-controller started as process id: $pid. log located at: $(BLUE "${log_file}")" + return $pid +} + +function stopZitiController { + killall ziti-controller + # shellcheck disable=SC2181 + if [[ $? == 0 ]]; then echo "Controller stopped."; fi +} + +function startExpressEdgeRouter { + log_file="${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" + "${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${log_file}" 2>&1 & + pid=$! + echo -e "Express Edge Router started as process id: $pid. log located at: $(BLUE "${log_file}")" + return $pid +} + +function stopAllEdgeRouters { + killall ziti-router + # shellcheck disable=SC2181 + if [[ $? == 0 ]]; then echo "Router(s) stopped."; fi +} + +function checkHostsFile { + ctrlexists=$(grep -c "${ZITI_CONTROLLER_HOSTNAME}" /etc/hosts) + edgectrlexists=$(grep -c "${ZITI_EDGE_CONTROLLER_HOSTNAME}" /etc/hosts) + erexists=$(grep -c "${ZITI_EDGE_ROUTER_HOSTNAME}" /etc/hosts) + + if [[ "0" = "${ctrlexists}" ]] || [[ "0" = "${edgectrlexists}" ]] || [[ "0" = "${erexists}" ]]; then + echo " " + echo -e "$(YELLOW "Ziti is generally used to create an overlay network. Generally speaking this will involve more than one host")" + echo -e "$(YELLOW "Since this is a script geared towards setting up a very minimal development environment it needs to make some")" + echo -e "$(YELLOW "assumptions. One of these assumptions is that the three specific entries are entered onto your hosts file.")" + echo -e "$(YELLOW "One or more of these are missing:")" + echo " " + if [[ "0" == "${ctrlexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") " + fi + if [[ "0" == "${edgectrlexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_CONTROLLER_HOSTNAME}") " + fi + if [[ "0" == "${erexists}" ]]; then + echo -e " * $(RED "MISSING: ${ZITI_EDGE_ROUTER_HOSTNAME}") " + else + echo -e " * $(GREEN " FOUND: ${ZITI_EDGE_ROUTER_HOSTNAME}") " + fi + + echo " " + echo "The easiest way to correct this is to run the following command:" + echo " echo \"127.0.0.1 ${ZITI_CONTROLLER_HOSTNAME} ${ZITI_EDGE_CONTROLLER_HOSTNAME} ${ZITI_EDGE_ROUTER_HOSTNAME}\" | sudo tee -a /etc/hosts" + echo " " + echo "add these entries to your hosts file, and rerun the script when ready" + return 1 + else + echo -e "$(GREEN "Hosts file looks good")" + fi +} + +function getLatestZitiVersion { + setupZitiHome + + if ! setOs; then + return 1 + fi + + ZITI_ARCH="amd64" + if [[ "$(uname -a)" == *"arm"* ]]; then + ZITI_ARCH="arm" + fi + + unset ZITI_BINARIES_VERSION + + if [[ "${ZITI_BINARIES_VERSION-}" == "" ]]; then + zitilatest=$(curl -s https://api.github.com/repos/openziti/ziti/releases/latest) + # shellcheck disable=SC2155 + export ZITI_BINARIES_FILE=$(echo "${zitilatest}" | tr '\r\n' ' ' | jq -r '.assets[] | select(.name | startswith("'"ziti-${ZITI_OSTYPE}-${ZITI_ARCH}"'")) | .name') + # shellcheck disable=SC2155 + export ZITI_BINARIES_VERSION=$(echo "${zitilatest}" | tr '\r\n' ' ' | jq -r '.tag_name') + fi + echo "ZITI_BINARIES_VERSION: ${ZITI_BINARIES_VERSION}" +} + +function getLatestZiti { + setupZitiHome + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + + ziti_bin_root="${ZITI_BIN_ROOT-}" + if [[ "${ziti_bin_root}" == "" ]]; then + ziti_bin_root="${ZITI_HOME-}/ziti-bin" + fi + export ZITI_BIN_ROOT="${ziti_bin_root}/ziti-bin" + + mkdir -p "${ziti_bin_root}" + + if ! getLatestZitiVersion; then + return 1 + fi + + if [[ "${ZITI_BIN_DIR-}" == "" ]]; then export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION}"; else echo "Using ZITI_BIN_DIR: ${ZITI_BIN_DIR}"; fi + + ZITI_BINARIES_FILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_FILE}" + if ! test -f "${ZITI_BINARIES_FILE_ABSPATH}"; then + zitidl="https://github.com/openziti/ziti/releases/download/${ZITI_BINARIES_VERSION-}/${ZITI_BINARIES_FILE}" + echo -e 'Downloading '"$(BLUE "${zitidl}")"' to '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")" + curl -Ls "${zitidl}" -o "${ZITI_BINARIES_FILE_ABSPATH}" + else + echo -e "$(YELLOW 'Already Downloaded ')""$(BLUE "${ZITI_BINARIES_FILE}")"' at: '"${ZITI_BINARIES_FILE_ABSPATH}" + fi + + echo -e 'UNZIPPING '"$(BLUE "${ZITI_BINARIES_FILE_ABSPATH}")"' into: '"$(GREEN "${ZITI_BIN_DIR}")" + rm -rf "${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION-}" + if [[ "${ZITI_OSTYPE}" == "windows" ]]; then + unzip "${ZITI_BINARIES_FILE_ABSPATH}" -d "${ZITI_BIN_DIR}" + mv "${ZITI_BIN_DIR}/ziti/"* "${ZITI_BIN_DIR}/" + rm -rf "${ZITI_BIN_DIR}/ziti/"* + rmdir "${ZITI_BIN_DIR}/ziti/" + chmod +x "${ZITI_BIN_DIR}/"* + else + tar -xf "${ZITI_BINARIES_FILE_ABSPATH}" --directory "${ziti_bin_root}" + mv "${ziti_bin_root}/ziti" "${ZITI_BIN_DIR}" + fi + + echo -e 'Marking executables at '"$(GREEN "${ZITI_BIN_DIR}")"' executable' + chmod +x "${ZITI_BIN_DIR}/"* + + if [[ "${1-}" == "yes" ]]; then + echo "Adding ${ZITI_BIN_DIR} to the path if necessary:" + if [[ "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then + echo -e "$(GREEN "${ZITI_BIN_DIR}") is already on the path" + else + echo -e "adding $(RED "${ZITI_BIN_DIR}") to the path" + export PATH=$PATH:"${ZITI_BIN_DIR}" + fi + fi +} + +function checkPrereqs { + commands_to_test=(curl jq) + missing_requirements="" + # verify all the commands required in the automation exist before trying to run the full suite + for cmd in "${commands_to_test[@]}" + do + # checking all commands are on the path before continuing... + if ! [[ -x "$(command -v "${cmd}")" ]]; then + missing_requirements="${missing_requirements} * ${cmd}" + fi + done + # are requirements ? if yes, stop here and help 'em out + if ! [[ "" = "${missing_requirements}" ]]; then + echo " " + echo "You're missing one or more commands that are used in this script." + echo "Please ensure the commands listed are on the path and then try again." + echo "${missing_requirements}" + echo " " + echo " " + return 1 + else + echo -e "$(GREEN "Prerequisites confirmed")" + fi +} + +function checkControllerName { + if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME}" == *['!'@#\$%^\&*\(\)_+]* ]]; then + echo -e "$(RED " - The provided Network name contains an invalid character: '!'@#\$%^\&*()_+")" + return 1 + fi + return 0 +} + +function unsetZitiEnv { + if [[ "${1-}" == "-s" ]]; then + # Silent... + for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; unset "${envvar}"; done + else + for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; echo unsetting "[${envvar}]${zEnvVar}"; unset "${envvar}"; done + fi + unset ZITIx_EXPRESS_COMPLETE +} + +function issueGreeting { + #echo "-------------------------------------------------------------" + echo " " + echo " _ _ _" + echo " ____ (_) | |_ (_)" + echo " |_ / | | | __| | |" + echo " / / | | | |_ | |" + echo " /___| |_| \__| |_|" + echo "-------------------------------------------------------------" + echo " " + echo "This script will make it trivial to setup a very simple environment locally which will allow you to start" + echo "learning ziti. This environment is suitable for development work only and is not a decent representation of" + echo "a fully redundant production-caliber network." + echo "" + echo "Please note that this script will write files to your home directory into a directory named .ziti." + echo -n "For you this location will be: " + echo -e "$(BLUE "${ZITI_QUICKSTART_ENVROOT}")" + echo " " +} + +function setupZitiNetwork { + if [[ "${1-}" == "" ]]; then + echo " " + echo "Creating a controller is effectively creating a network. The name of the network will be used when writing" + echo "configuration files locally. Choose the name of your network now. The format of the network name should resemble" + echo -n "what a hostname looks like. A good choice is to actually use your system's hostname: " + echo -e "$(BLUE "$(hostname)")" + echo " " + echo -en "$(echo -ne "Network Name [$(BLUE "$(hostname)")]: ")" + read -r ZITI_NETWORK + echo " " + if checkControllerName; then + : #clear to continue + if [[ "${ZITI_NETWORK-}" == "" ]]; then + ZITI_NETWORK="$(hostname)" + fi + echo "name: ${ZITI_NETWORK-}" + else + echo "" + echo "============ FAILED TO SETUP NETWORK ============" + return 1 + fi + echo " " + else + ZITI_NETWORK="${1-}" + fi +} + +function setupZitiHome { + if [[ "${ZITI_HOME-}" == "" ]]; then + export ZITI_HOME="${HOME}/.ziti/quickstart/${ZITI_NETWORK-}" + echo -e "using default ZITI_HOME: $(BLUE "${ZITI_HOME}")" + fi +} + +function generateEnvFile { + + echo -e "Generating new network with name: $(BLUE "${ZITI_NETWORK-}")" + + if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi + if [[ "${ZITI_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi + if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-edge-controller"; fi + if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi + if [[ "${ZITI_ZAC_RAWNAME-}" == "" ]]; then export export ZITI_ZAC_RAWNAME="${ZITI_NETWORK-}"; fi + if [[ "${ZITI_ZAC_HOSTNAME-}" == "" ]]; then export export ZITI_ZAC_HOSTNAME="${ZITI_NETWORK-}"; fi + if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK-}-edge-router"; fi + if [[ "${ZITI_EDGE_ROUTER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_NETWORK-}"; fi + if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi + if [[ "${ZITI_CTRL_ADVERTISED_ADDRESS-}" == "" ]]; then export ZITI_CTRL_ADVERTISED_ADDRESS="${ZITI_NETWORK-}"; fi + + if [[ "${ZITI_BIN_ROOT-}" == "" ]]; then + export ZITI_BIN_ROOT="${ZITI_HOME-}/ziti-bin" + fi + + if ! ziti_createEnvFile; then + return 1 + fi + + export ENV_FILE="${ZITI_HOME-}/${ZITI_NETWORK-}.env" + + echo -e "environment file sourced from: $(BLUE "${ENV_FILE}")" +} + +function ziti_expressConfiguration { + if [[ "${ZITIx_EXPRESS_COMPLETE-}" != "" ]]; then + echo -e "$(RED " --- It looks like you've run an express install in this shell already. ---")" + echo -en "Would you like to clear existing Ziti variables and continue (y/N)? " + read -r + echo " " + if [[ "${REPLY}" == [Yy]* ]]; then + echo -e "$(GREEN "Clearing existing Ziti variables and continuing with express install")" + unsetZitiEnv "-s" + # Stop any devices currently running to avoid port collisions + stopAllEdgeRouters + stopZitiController + else + echo -e "$(RED " --- Exiting express install ---")" + return 1 + fi + fi + export ZITIx_EXPRESS_COMPLETE="true" + echo " " + echo "___________ _______________________________________^__" + echo " ___ ___ ||| ___ ___ ___ ___ ___ | __ ,----\ " + echo "| | | |||| | | | | | | | | | | | | |_____\ " + echo "|___| |___|||| |___| |___| |___| | O | O | | | | \ " + echo " ||| ===== EXPRESS ==== |___|___| | |__| )" + echo "___________|||______________________________|______________/" + echo " ||| /--------" + echo "-----------'''---------------------------------------'" + echo "" + if [[ "${ZITI_CONTROLLER_RAWNAME-}" != "" ]]; then echo "ZITI_CONTROLLER_RAWNAME OVERRIDDEN: $ZITI_CONTROLLER_RAWNAME"; fi + if [[ "${ZITI_CONTROLLER_HOSTNAME-}" != "" ]]; then echo "ZITI_CONTROLLER_HOSTNAME OVERRIDDEN: $ZITI_CONTROLLER_HOSTNAME"; fi + if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" != "" ]]; then echo "ZITI_EDGE_CONTROLLER_RAWNAME OVERRIDDEN: $ZITI_EDGE_CONTROLLER_RAWNAME"; fi + if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME-}" != "" ]]; then echo "ZITI_EDGE_CONTROLLER_HOSTNAME OVERRIDDEN: $ZITI_EDGE_CONTROLLER_HOSTNAME"; fi + if [[ "${ZITI_ZAC_RAWNAME-}" != "" ]]; then echo "ZITI_ZAC_RAWNAME OVERRIDDEN: $ZITI_ZAC_RAWNAME"; fi + if [[ "${ZITI_ZAC_HOSTNAME-}" != "" ]]; then echo "ZITI_ZAC_HOSTNAME OVERRIDDEN: $ZITI_ZAC_HOSTNAME"; fi + if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" != "" ]]; then echo "ZITI_EDGE_ROUTER_RAWNAME OVERRIDDEN: $ZITI_EDGE_ROUTER_RAWNAME"; fi + if [[ "${ZITI_EDGE_ROUTER_HOSTNAME-}" != "" ]]; then echo "ZITI_EDGE_ROUTER_HOSTNAME OVERRIDDEN: $ZITI_EDGE_ROUTER_HOSTNAME"; fi + if [[ "${ZITI_EDGE_ROUTER_PORT-}" != "" ]]; then echo "ZITI_EDGE_ROUTER_PORT OVERRIDDEN: $ZITI_EDGE_ROUTER_PORT"; fi + + echo " " + echo " " + echo -e "******** Setting Up Environment ********" + if [[ "${1-}" == "" ]]; then + nw="$(hostname)" + else + nw="${1-}" + fi + + setupZitiNetwork "${nw}" + setupZitiHome + echo -e "ZITI HOME SET TO: $(BLUE "${ZITI_HOME}")" + + if ! getLatestZiti "no"; then + echo -e "$(RED "getLatestZiti failed")" + return 1 + fi + if ! generateEnvFile; then + echo "Exiting as env file was not generated" + return 1 + fi + #checkHostsFile + + echo " " + echo " " + echo -e "******** Setting Up Public Key Infrastructure ********" + createPki + + echo " " + echo " " + echo -e "******** Setting Up Controller ********" + createControllerConfig + #createControllerSystemdFile + initializeController + startZitiController + echo "waiting for the controller to come online to allow the edge router to enroll" + + waitForController + + zitiLogin + + echo " " + echo " " + echo -e "******** Setting Up Edge Routers ********" + echo -e "---------- Creating an edge router policy allowing all identities to connect to routers with a $(GREEN "#public") attribute" + "${ZITI_BIN_DIR-}/ziti" edge delete edge-router-policy allEdgeRouters > /dev/null + "${ZITI_BIN_DIR-}/ziti" edge create edge-router-policy allEdgeRouters --edge-router-roles '#public' --identity-roles '#all' > /dev/null + + echo -e "---------- Creating a service edge router policy allowing all services to use $(GREEN "#public") edge routers" + "${ZITI_BIN_DIR-}/ziti" edge delete service-edge-router-policy allSvcPublicRouters > /dev/null + "${ZITI_BIN_DIR-}/ziti" edge create service-edge-router-policy allSvcPublicRouters --edge-router-roles '#public' --service-roles '#all' > /dev/null + + createRouterPki + createEdgeRouterConfig "${ZITI_EDGE_ROUTER_RAWNAME}" + #createRouterSystemdFile "${ZITI_EDGE_ROUTER_RAWNAME}" + + echo "---------- Creating edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." + "${ZITI_BIN_DIR-}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" > /dev/null + "${ZITI_BIN_DIR-}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_RAWNAME}" -o "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" -t -a "public"> /dev/null + sleep 1 + echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_RAWNAME}...." + + "${ZITI_BIN_DIR-}/ziti-router" enroll "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" --jwt "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.jwt" &> "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.enrollment.log" + echo "" + + stopZitiController + echo "Edge Router enrolled. Controller stopped." + + echo "" + echo -e "$(GREEN "Congratulations. Express setup complete!")" + echo -e "Start your Ziti Controller by running the function: $(BLUE "startZitiController")" + echo -e "Start your Ziti Edge Router by running : $(BLUE 'startExpressEdgeRouter')" + echo "" +} + +function decideToUseDefaultZitiHome { + yn="" + while true + do + echo "ZITI_HOME has not been set. Do you want to use the default ZITI_HOME: ${DEFAULT_ZITI_HOME_LOCATION}" + echo " " + echo -en "Select an action: " + read -r yn + case $yn in + [yY]* ) + ZITI_HOME="${DEFAULT_ZITI_HOME_LOCATION}" + break;; + [Nn]* ) + echo "" + return 1;; + * ) + echo " " + echo "Answer $yn is not valid. Please answer yes or no. (y/n [yes/NO])";; + esac + yn= + done + echo " " +} + +function decideOperation { + yn="${1-}" + while true + do + if [[ "${yn}" == "" ]]; then + echo "What sort of operation are you looking to perform?" + echo " 1.) Express configuration - a simple overlay will be spawned containing one controller and two edge routers" + echo " 2.) Create Controller configuration - answer a few questions and a controller config will be emitted" + echo " 3.) Create Edge Router configuration - answer a few questions and an edge router config will be emitted" + echo " 4.) Start a network with the provided name" + echo " " + echo -en "Select an action: " + read -r yn + fi + case $yn in + [1]* ) + ziti_expressConfiguration "$2" + break;; + [2]* ) + generateEnvFile + + ;; + [3]* ) + echo "333 has been chosen" + echo " " + ;; + [4]* ) + echo "4444 has been chosen" + echo " " + ;; + [yYqQeE]* ) + break + ;; + [Nn]* ) + echo ""; echo "Ok - come back when you're ready." + exit;; + * ) echo "Please answer yes or no. (yes/NO)";; + esac + yn= + done + echo " " +} + +function expressInstall { + #greet the user with the banner and quick blurb about what to expect + issueGreeting + + #make sure the user has all the necessary commands to be successful + checkPrereqs + retval=$? + if [ $retval -ne 0 ]; then + return 1 + fi + echo "Let's get started creating your local development network!" + echo "" + echo "" + + #prompt the user for input and do what they want/need + decideOperation 1 "${1-}" +} + +function pki_client_server { + name_local=${1-} + ZITI_CA_NAME_local=$2 + ip_local=$3 + + if [[ "${ip_local}" == "" ]]; then + ip_local="127.0.0.1" + fi + + if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then + echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + "${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ + --server-file "${name_local}-server" \ + --dns "${name_local},localhost" --ip "${ip_local}" \ + --server-name "${name_local} server certificate" + else + echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + echo "key exists" + fi + + if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then + echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ + --client-file "${name_local}-client" \ + --key-file "${name_local}-server" \ + --client-name "${name_local}" + else + echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + echo "key exists" + fi + echo " " +} + +function pki_create_ca { + cert=$1 + + echo "Creating CA: ${cert}" + if ! test -f "${ZITI_PKI}/${cert}/keys/${cert}.key"; then + "${ZITI_BIN_DIR}/ziti" pki create ca --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-file="${cert}" --ca-name="${cert} Root CA" + else + echo "key exists" + fi + echo " " +} + +function pki_create_intermediate { + echo "Creating intermediate: ${1} ${2} ${3}" + if ! test -f "${ZITI_PKI}/${2}/keys/${2}.key"; then + "${ZITI_BIN_DIR}/ziti" pki create intermediate --pki-root "${ZITI_PKI_OS_SPECIFIC}" --ca-name "${1}" \ + --intermediate-name "${2}" \ + --intermediate-file "${2}" --max-path-len "${3}" + else + echo "key exists" + fi + echo " " +} +function printUsage() { + echo "Usage: ${1-} [cert to test] [ca pool to use]" +} + +function verifyCertAgainstPool() { + if [[ "" == "${1-}" ]] + then + printUsage "verifyCertAgainstPool" + return 1 + fi + + if [[ "" == "$2" ]] + then + printUsage "verifyCertAgainstPool" + return 1 + fi + + echo " Verifying that this certificate:" + echo " - ${1-}" + echo " is valid for this ca pool:" + echo " - $2" + echo "" + openssl verify -partial_chain -CAfile "$2" "${1-}" + # shellcheck disable=SC2181 + if [ $? -eq 0 ]; then + echo "" + echo "============ SUCCESS! ============" + else + echo "" + echo "============ FAILED TO VALIDATE ============" + fi +} + +function showIssuerAndSubjectForPEM() { + echo "Displaying Issuer and Subject for cert pool:" + echo " ${1-}" + openssl crl2pkcs7 -nocrl -certfile "${1-}" | openssl pkcs7 -print_certs -text -noout | grep -E "(Subject|Issuer)" +} + +function createRouterPki { + #TODO: this needs to be parameterized to take other router_name + pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" +} + +function createPrivateRouterConfig { + # Allow router name to be passed in as arg + router_name="${1-}" + if [[ "${router_name}" == "" ]]; then + + # If router name is not passed as arg, prompt user for input + echo -e "$(YELLOW "createPrivateRouterConfig requires a router name to be supplied") " + default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" + echo -en "Enter router name (${default_router_name}):" + read -r router_name + + # Accept the default if no name provided + if [[ "${router_name}" == "" ]]; then + # Check for overwrite of default file + router_name="${default_router_name}" + if [[ -f "${ZITI_HOME-}/${router_name}.yaml" ]]; then + echo -en "This will overwrite the existing file, continue (y/N)? " + read -r + echo " ${REPLY}" + if [[ "${REPLY}" == [^Yy]* ]]; then + echo -e "$(RED " --- Cancelling overwrite ---")" + return 1 + fi + fi + fi + fi + + # Make sure necessary env variables are set + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME-}/${router_name}.yaml" +"${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" --private > "${output_file}" + +echo -e "Controller configuration file written to: $(BLUE "${output_file}")" +} + +function createPki { + echo "Generating PKI" + + pki_create_ca "${ZITI_CONTROLLER_ROOTCA_NAME}" + pki_create_ca "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}" + pki_create_ca "${ZITI_SIGNING_ROOTCA_NAME}" + + ZITI_SPURIOUS_INTERMEDIATE="${ZITI_SIGNING_INTERMEDIATE_NAME}_spurious_intermediate" + pki_create_intermediate "${ZITI_CONTROLLER_ROOTCA_NAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" 1 + pki_create_intermediate "${ZITI_EDGE_CONTROLLER_ROOTCA_NAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" 1 + pki_create_intermediate "${ZITI_SIGNING_ROOTCA_NAME}" "${ZITI_SPURIOUS_INTERMEDIATE}" 2 + pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1 + + if ! test -f "${ZITI_PKI}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_NETWORK-}-dotzeet.key"; then + echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}" + "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name="${ZITI_CONTROLLER_INTERMEDIATE_NAME}" \ + --client-file="${ZITI_NETWORK-}-dotzeet" \ + --client-name "${ZITI_NETWORK-} Management" + else + echo "Creating ziti-fabric client certificate for network: ${ZITI_NETWORK-}" + echo "key exists" + fi + echo " " + + pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" + pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" + +} + + + +function createFabricRouterConfig { + # Allow router name to be passed in as arg + router_name="${1-}" + if [[ "${router_name}" == "" ]]; then + + # If router name is not passed as arg, prompt user for input + echo -e "$(YELLOW "createFabricRouterConfig requires a router name to be supplied") " + default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" + echo -en "Enter router name (${default_router_name}):" + read -r router_name + + # Accept the default if no name provided + if [[ "${router_name}" == "" ]]; then + # Check for overwrite of default file + router_name="${default_router_name}" + getFileOverwritePermission "${ZITI_HOME-}/${router_name}.yaml" + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + fi + fi + + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME}/${router_name}.yaml" +"${ZITI_BIN_DIR}/ziti" create config router fabric --routerName "${router_name}" > "${output_file}" + +echo -e "Fabric router configuration file written to: $(BLUE "${output_file}")" +} + +function createEdgeRouterWssConfig { + # Allow router name to be passed in as arg + router_name="${1-}" + if [[ "${router_name}" == "" ]]; then + + # If router name is not passed as arg, prompt user for input + echo -e "$(YELLOW "createEdgeRouterWssConfig requires a router name to be supplied") " + default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" + echo -en "Enter router name (${default_router_name}):" + read -r router_name + + # Accept the default if no name provided + if [[ "${router_name}" == "" ]]; then + # Check for overwrite of default file + router_name="${default_router_name}" + getFileOverwritePermission "${ZITI_HOME-}/${router_name}.yaml" + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + fi + fi + + # Make sure necessary env variables are set + checkEnvVariable ZITI_HOME ZITI_BIN_DIR + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME-}/${router_name}.yaml" +"${ZITI_BIN_DIR}/ziti" create config router edge --wss --routerName "${router_name}" > "${output_file}" + +echo -e "Edge router wss configuration file written to: $(BLUE "${output_file}")" +} + +# shellcheck disable=SC2120 +function createEdgeRouterConfig { + # Allow router name to be passed in as arg + router_name="${1-}" + if [[ "${router_name}" == "" ]]; then + + # If router name is not passed as arg, prompt user for input + echo -e "$(YELLOW "createEdgeRouterConfig requires a router name to be supplied") " + default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" + echo -en "Enter router name (${default_router_name}):" + read -r router_name + + # Accept the default if no name provided + if [[ "${router_name}" == "" ]]; then + # Check for overwrite of default file + router_name="${default_router_name}" + getFileOverwritePermission "${ZITI_HOME-}/${router_name}.yaml" + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + fi + fi + + # Make sure necessary env variables are set + checkEnvVariable ZITI_HOME ZITI_BIN_DIR + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + + output_file="${ZITI_HOME}/${router_name}.yaml" + + mkdir -p "${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}" + export ZITI_ROUTER_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/client.cert" + export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert" + export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key" + export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert" + "${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" > "${output_file}" + echo -e "edge router configuration file written to: $(BLUE "${output_file}")" + unset ZITI_ROUTER_IDENTITY_CERT + unset ZITI_ROUTER_IDENTITY_SERVER_CERT + unset ZITI_ROUTER_IDENTITY_KEY + unset ZITI_ROUTER_IDENTITY_CA +} + +function createFabricIdentity { + output_file="${ZITI_HOME}/identities.yml" +cat > "${output_file}" < "${ZITI_CTRL_IDENTITY_CA}" + cat "${ZITI_SIGNING_CERT}" >> "${ZITI_CTRL_IDENTITY_CA}" + echo -e "wrote CA file to: $(BLUE "${ZITI_CTRL_IDENTITY_CA}")" + + output_file="${ZITI_HOME}/${controller_name}.yaml" + "${ZITI_BIN_DIR}/ziti" create config controller > "${output_file}" + + echo -e "Controller configuration file written to: $(BLUE "${output_file}")" +} + +# shellcheck disable=SC2120 +function ziti_createEnvFile { + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + if decideToUseDefaultZitiHome; then + # shellcheck disable=SC2155 + export ZITI_NETWORK="$(hostname)" + ZITI_HOME="${DEFAULT_ZITI_HOME_LOCATION}" + else + return 1 + fi + fi + + export ZITI_HOME="${ZITI_HOME}" + if [[ "${ZITI_OSTYPE}" == "windows" ]]; then + export ZITI_HOME_OS_SPECIFIC="$(cygpath -m "${ZITI_HOME}")" + else + export ZITI_HOME_OS_SPECIFIC="${ZITI_HOME}" + fi + export ENV_FILE="${ZITI_HOME}/${ZITI_NETWORK}.env" + export ZITI_SHARED="${ZITI_HOME}" + + checkEnvVariable ENV_FILE + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + + if [[ "${network_name-}" != "" ]]; then + export ZITI_NETWORK="${network_name}" + fi + + if [[ "${ZITI_NETWORK-}" == "" ]]; then + if [[ "${1-}" != "" ]]; then + export ZITI_NETWORK="${1-}" + fi + if [[ "${ZITI_NETWORK-}" = "" ]]; then + echo -e "$(YELLOW "WARN: ZITI_NETWORK HAS NOT BEEN DECLARED! USING hostname: $(hostname)")" + # shellcheck disable=SC2155 + export ZITI_NETWORK="$(hostname)" + fi + fi + + echo "ZITI_NETWORK set to: ${ZITI_NETWORK}" + + if [[ "${ZITI_USER-}" == "" ]]; then export ZITI_USER="admin"; fi + if [[ "${ZITI_PWD-}" == "" ]]; then export ZITI_PWD="admin"; fi + if [[ "${ZITI_DOMAIN_SUFFIX-}" == "" ]]; then export ZITI_DOMAIN_SUFFIX=""; fi + if [[ "${ZITI_ID-}" == "" ]]; then export ZITI_ID="${ZITI_HOME}/identities.yaml"; fi + if [[ "${ZITI_FAB_CTRL_PORT-}" == "" ]]; then export ZITI_FAB_CTRL_PORT="6262"; fi + + if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK}-controller"; fi + if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK}-edge-controller"; fi + + export ZITI_PKI="${ZITI_SHARED}/pki" + if [[ "${ZITI_OSTYPE}" == "windows" ]]; then + export ZITI_PKI_OS_SPECIFIC="$(cygpath -m "${ZITI_PKI}")" + else + export ZITI_PKI_OS_SPECIFIC="${ZITI_PKI}" + fi + if [[ "${ZITI_EDGE_CONTROLLER_PORT-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_PORT="1280"; fi + + if [[ "${ZITI_CONTROLLER_HOSTNAME-}" == "" ]]; then export ZITI_CONTROLLER_HOSTNAME="${ZITI_CONTROLLER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi + if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME-}" == "" ]]; then export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_EDGE_CONTROLLER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi + if [[ "${ZITI_ZAC_HOSTNAME-}" == "" ]]; then export ZITI_ZAC_HOSTNAME="${ZITI_ZAC_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi + if [[ "${ZITI_EDGE_CTRL_ADVERTISED-}" == "" ]]; then export ZITI_EDGE_CTRL_ADVERTISED="${ZITI_EDGE_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}"; fi + + export ZITI_SIGNING_CERT_NAME="${ZITI_NETWORK}-signing" + + export ZITI_CONTROLLER_ROOTCA_NAME="${ZITI_CONTROLLER_HOSTNAME}-root-ca" + export ZITI_CONTROLLER_INTERMEDIATE_NAME="${ZITI_CONTROLLER_HOSTNAME}-intermediate" + + export ZITI_EDGE_CONTROLLER_ROOTCA_NAME="${ZITI_EDGE_CONTROLLER_HOSTNAME}-root-ca" + export ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME="${ZITI_EDGE_CONTROLLER_HOSTNAME}-intermediate" + + export ZITI_SIGNING_ROOTCA_NAME="${ZITI_SIGNING_CERT_NAME}-root-ca" + export ZITI_SIGNING_INTERMEDIATE_NAME="${ZITI_SIGNING_CERT_NAME}-intermediate" + + export ZITI_BIN_ROOT="${ZITI_HOME}/ziti-bin" + + if [[ "${ZITI_CTRL_MGMT_HOST_PORT-}" == "" ]]; then export ZITI_CTRL_MGMT_HOST_PORT="${ZITI_CONTROLLER_HOSTNAME}:10000"; fi + if [[ "${ZITI_CTRL_IDENTITY_CERT-}" == "" ]]; then export ZITI_CTRL_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert"; fi + if [[ "${ZITI_CTRL_IDENTITY_SERVER_CERT-}" == "" ]]; then export ZITI_CTRL_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem"; fi + if [[ "${ZITI_CTRL_IDENTITY_KEY-}" == "" ]]; then export ZITI_CTRL_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key"; fi + if [[ "${ZITI_CTRL_IDENTITY_CA-}" == "" ]]; then export ZITI_CTRL_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/cas.pem"; fi + if [[ "${ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT}" == "" ]]; then export export ZITI_EDGE_CTRL_ADVERTISED_HOST_PORT="${ZITI_CONTROLLER_HOSTNAME}:${ZITI_EDGE_CONTROLLER_PORT}"; fi + if [[ "${ZITI_EDGE_CTRL_IDENTITY_CERT}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-client.cert"; fi + if [[ "${ZITI_EDGE_CTRL_IDENTITY_SERVER_CERT}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.chain.pem"; fi + if [[ "${ZITI_EDGE_CTRL_IDENTITY_KEY}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_CONTROLLER_HOSTNAME}-server.key"; fi + if [[ "${ZITI_EDGE_CTRL_IDENTITY_CA}" == "" ]]; then export export ZITI_EDGE_CTRL_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert"; fi + + if [[ "${ZITI_SIGNING_CERT}" == "" ]]; then export export ZITI_SIGNING_CERT="${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert"; fi + if [[ "${ZITI_SIGNING_KEY}" == "" ]]; then export export ZITI_SIGNING_KEY="${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/keys/${ZITI_SIGNING_INTERMEDIATE_NAME}.key"; fi + + mkdir -p "${ZITI_BIN_ROOT}" + mkdir -p "${ZITI_HOME}/db" + mkdir -p "${ZITI_PKI}" + + echo "" > "${ENV_FILE}" + for zEnvVar in $(set | grep -e "^ZITI_" | sort); do envvar="$(echo "${zEnvVar}" | cut -d '=' -f1)"; envval="$(echo "${zEnvVar}" | cut -d '=' -f2-100)"; echo "export ${envvar}=\"${envval}\"" >> "${ENV_FILE}"; done + + export PFXLOG_NO_JSON=true + # shellcheck disable=SC2129 + echo "export PFXLOG_NO_JSON=true" >> "${ENV_FILE}" + + echo "alias zec='ziti edge'" >> "${ENV_FILE}" + echo "alias zlogin='ziti edge login \"\${ZITI_EDGE_CTRL_ADVERTISED}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" + echo "alias zitiLogin='ziti edge login \"\${ZITI_EDGE_CTRL_ADVERTISED}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" + echo "alias psz='ps -ef | grep ziti'" >> "${ENV_FILE}" + + #when sourcing the emitted file add the bin folder to the path + tee -a "${ENV_FILE}" > /dev/null <<'heredoc' +echo " " +if [[ ! "$(echo "$PATH"|grep -q "${ZITI_BIN_DIR}" && echo "yes")" == "yes" ]]; then + echo "adding ${ZITI_BIN_DIR} to the path" + export PATH=$PATH:"${ZITI_BIN_DIR}" +else +echo " ziti binaries are located at: ${ZITI_BIN_DIR}" +echo -e 'add this to your path if you want by executing: export PATH=$PATH:'"${ZITI_BIN_DIR}" +echo " " +fi +heredoc + +echo -e "env file written to: $(BLUE "${ENV_FILE}")" +} + +function waitForController { + #devnull="/dev/null" + #if [[ "${ZITI_OSTYPE}" == "windows" ]]; then + # devnull="nul" + #fi + # shellcheck disable=SC2091 + #until $(curl -o /dev/null -sk /dev/null --fail "https://${ZITI_EDGE_CTRL_ADVERTISED}"); do + # echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED}" + # sleep 2 + #done + while [[ "$(curl -w "%{http_code}" -m 1 -s -k -o /dev/null https://"${ZITI_EDGE_CTRL_ADVERTISED}"/version)" != "200" ]]; do + echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED}" + sleep 3 + done +} + +function createControllerSystemdFile { + # Allow controller name to be passed in as arg + controller_name="${1-}" + # If no controller name provided and env var is not set, prompt user for a controller name + if [[ "${controller_name}" == "" ]] && [[ -z "${ZITI_EDGE_CONTROLLER_RAWNAME}" ]]; then + echo -e "$(YELLOW "createControllerSystemdFile requires a controller name to be supplied") " + echo -en "Enter controller name:" + read -r controller_name + + # Quit if no name is provided + if [[ "${controller_name}" == "" ]]; then + echo -e "$(RED " --- Invalid controller name provided ---")" + return 1 + fi + # If no controller name provided and env var is set, use env var + elif [[ "${controller_name}" == "" ]] && [[ -n "${ZITI_EDGE_CONTROLLER_RAWNAME}" ]]; then + controller_name="${ZITI_EDGE_CONTROLLER_RAWNAME}" + fi + + # Make sure necessary env variables are set + checkEnvVariable ZITI_HOME ZITI_BIN_DIR + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME}/${controller_name}.service" +cat > "${output_file}" < "${output_file}" < "${output_file}" < + + + + Label + ziti-controller-${controller_name} + ProgramArguments + + $ZITI_BIN_DIR/ziti-controller + run + $ZITI_HOME/${controller_name}.yaml + + WorkingDirectory + ${ZITI_HOME} + KeepAlive + + PathState + + ${ZITI_HOME}/launchd-enabled + + + + StandardOutPath + ${ZITI_HOME}/Logs/${controller_name}-{ZITI_BINARIES_VERSION}.log + StandardErrorPath + ${ZITI_HOME}/Logs/${controller_name}-{ZITI_BINARIES_VERSION}.log + + +HeredocForLaunchd + echo -e "Controller launchd file written to: $(BLUE "${output_file}")" + + showLaunchdMessage +} + +function createRouterLaunchdFile { + # Allow router name to be passed in as arg + router_name="${1-}" + if [[ "${router_name}" == "" ]]; then + + # If router name is not passed as arg, prompt user for input + echo -e "$(YELLOW "createRouterLaunchdFile requires a router name to be supplied") " + default_router_name="${ZITI_EDGE_ROUTER_RAWNAME}" + echo -en "Enter router name (${default_router_name}):" + read -r router_name + + # Accept the default if no name provided + if [[ "${router_name}" == "" ]]; then + # Check for overwrite of default file + router_name="${default_router_name}" + getFileOverwritePermission "${ZITI_HOME-}/${router_name}.plist" + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + fi + fi + + # Make sure necessary env variables are set + checkEnvVariable ZITI_HOME ZITI_BIN_DIR + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME-}/${router_name}.plist" +cat > "${output_file}" < + + + + Label + $router_name + ProgramArguments + + $ZITI_BIN_DIR/ziti-router + run + $ZITI_HOME/ctrl.with.edge.yml + + WorkingDirectory + ${ZITI_HOME} + KeepAlive + + + PathState + + ${ZITI_HOME}/launchd-enabled + + + + StandardOutPath + ${ZITI_HOME}/Logs/${router_name}-${ZITI_BINARIES_VERSION}.log + StandardErrorPath + ${ZITI_HOME}/Logs/${router_name}-${ZITI_BINARIES_VERSION}.log + + +HeredocForLaunchd + echo -e "Router launchd file written to: $(BLUE "${output_file}")" + + showLaunchdMessage +} + +function showLaunchdMessage { + echo -e " " + echo -e "$(YELLOW "The generated launchd file is designed to keep the service alive while the file")" + echo -e "$(BLUE "${ZITI_HOME}/launchd-enabled") $(YELLOW "remains present.")" + echo -e "$(YELLOW "If this file is not present, the service will end.")" +} + +function createZacSystemdFile { + + checkEnvVariable ZITI_HOME + retVal=$? + if [[ "${retVal}" != 0 ]]; then + return 1 + fi + +output_file="${ZITI_HOME}/ziti-console.service" +cat > "${output_file}" < "${log_file}" - echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details" +"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${ZITI_HOME_OS_SPECIFIC}/controller-init.log" + echo -e "ziti-controller initialized. see $(BLUE "${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log") for details" } function startZitiController { - log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}.log" # shellcheck disable=SC2034 - ("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" > "${log_file}" 2>&1 &) + ("${ZITI_BIN_DIR-}/ziti-controller" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" > "${ZITI_HOME_OS_SPECIFIC}/ziti-edge-controller.log" 2>&1 &) pid=$! - echo -e "ziti-controller started as process id: $pid. log located at: $(BLUE "${log_file}")" + echo -e "ziti-controller started as process id: $pid. log located at: $(BLUE "${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}.log")" return $pid } @@ -75,10 +73,9 @@ function stopZitiController { } function startExpressEdgeRouter { - log_file="${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" - "${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${log_file}" 2>&1 & + "${ZITI_BIN_DIR}/ziti-router" run "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.yaml" > "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log" 2>&1 & pid=$! - echo -e "Express Edge Router started as process id: $pid. log located at: $(BLUE "${log_file}")" + echo -e "Express Edge Router started as process id: $pid. log located at: $(BLUE "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_ROUTER_RAWNAME}.log")" return $pid } @@ -171,7 +168,7 @@ function getLatestZiti { return 1 fi - if [[ "${ZITI_BIN_DIR-}" == "" ]]; then export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION}"; else echo "Using ZITI_BIN_DIR: ${ZITI_BIN_DIR}"; fi + export ZITI_BIN_DIR="${ziti_bin_root}/ziti-${ZITI_BINARIES_VERSION}" ZITI_BINARIES_FILE_ABSPATH="${ZITI_HOME-}/ziti-bin/${ZITI_BINARIES_FILE}" if ! test -f "${ZITI_BINARIES_FILE_ABSPATH}"; then @@ -311,7 +308,7 @@ function generateEnvFile { echo -e "Generating new network with name: $(BLUE "${ZITI_NETWORK-}")" - if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi + if [[ "${ZITI_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-controller"; fi if [[ "${ZITI_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_RAWNAME="${ZITI_NETWORK-}-edge-controller"; fi if [[ "${ZITI_EDGE_CONTROLLER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_CONTROLLER_HOSTNAME="${ZITI_NETWORK-}"; fi @@ -320,7 +317,6 @@ function generateEnvFile { if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK-}-edge-router"; fi if [[ "${ZITI_EDGE_ROUTER_HOSTNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_NETWORK-}"; fi if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi - if [[ "${ZITI_CTRL_ADVERTISED_ADDRESS-}" == "" ]]; then export ZITI_CTRL_ADVERTISED_ADDRESS="${ZITI_NETWORK-}"; fi if [[ "${ZITI_BIN_ROOT-}" == "" ]]; then export ZITI_BIN_ROOT="${ZITI_HOME-}/ziti-bin" @@ -344,9 +340,6 @@ function ziti_expressConfiguration { if [[ "${REPLY}" == [Yy]* ]]; then echo -e "$(GREEN "Clearing existing Ziti variables and continuing with express install")" unsetZitiEnv "-s" - # Stop any devices currently running to avoid port collisions - stopAllEdgeRouters - stopZitiController else echo -e "$(RED " --- Exiting express install ---")" return 1 @@ -409,7 +402,6 @@ function ziti_expressConfiguration { initializeController startZitiController echo "waiting for the controller to come online to allow the edge router to enroll" - waitForController zitiLogin @@ -629,7 +621,6 @@ function showIssuerAndSubjectForPEM() { } function createRouterPki { - #TODO: this needs to be parameterized to take other router_name pki_client_server "${ZITI_EDGE_ROUTER_RAWNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" } @@ -661,14 +652,81 @@ function createPrivateRouterConfig { fi # Make sure necessary env variables are set - checkEnvVariable ZITI_HOME + checkEnvVariable ZITI_HOME ZITI_BIN_DIR retVal=$? if [[ "${retVal}" != 0 ]]; then return 1 fi output_file="${ZITI_HOME-}/${router_name}.yaml" -"${ZITI_BIN_DIR}/ziti" create config router edge --routerName "${router_name}" --private > "${output_file}" +cat > "${output_file}" < "${output_file}" +cat > "${output_file}" < "${output_file}" +cat > "${output_file}" < "${output_file}" < "${output_file}" - echo -e "edge router configuration file written to: $(BLUE "${output_file}")" - unset ZITI_ROUTER_IDENTITY_CERT - unset ZITI_ROUTER_IDENTITY_SERVER_CERT - unset ZITI_ROUTER_IDENTITY_KEY - unset ZITI_ROUTER_IDENTITY_CA +identity: + cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-client.cert" + server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-server.cert" + key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${router_name}-server.key" + ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${router_name}-cas.cert" + +ctrl: + endpoint: tls:${ZITI_CONTROLLER_HOSTNAME}:${ZITI_FAB_CTRL_PORT} + +link: + listeners: + - binding: transport + bind: tls:0.0.0.0:10080 + advertise: tls:${ZITI_EDGE_ROUTER_HOSTNAME}:10080 + options: + outQueueSize: 16 + dialers: + - binding: transport + +listeners: + - binding: tunnel + options: + mode: host #tproxy|tun|host + - binding: edge + address: tls:0.0.0.0:${ZITI_EDGE_ROUTER_PORT} + options: + advertise: ${ZITI_EDGE_ROUTER_HOSTNAME}:${ZITI_EDGE_ROUTER_PORT} + connectTimeoutMs: 5000 + getSessionTimeout: 60s + +edge: + csr: + country: US + province: NC + locality: Charlotte + organization: NetFoundry + organizationalUnit: Ziti + sans: + dns: + - ${ZITI_EDGE_ROUTER_HOSTNAME} + - localhost + ip: + - "127.0.0.1" + +#transport: +# ws: +# writeTimeout: 10 +# readTimeout: 5 +# idleTimeout: 5 +# pongTimeout: 60 +# pingInterval: 54 +# handshakeTimeout: 10 +# readBufferSize: 4096 +# writeBufferSize: 4096 +# enableCompression: true +# server_cert: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.cert +# key: ${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_EDGE_WSS_ROUTER_HOSTNAME-}-router-server.key + +forwarder: + latencyProbeInterval: 1000 + xgressDialQueueLength: 1000 + xgressDialWorkerCount: 128 + linkDialQueueLength: 1000 + linkDialWorkerCount: 10 +HereDocForEdgeRouter + +echo -e "edge router configuration file written to: $(BLUE "${output_file}")" } function createFabricIdentity { - output_file="${ZITI_HOME}/identities.yml" + output_file="${ZITI_HOME}/identities.yaml" cat > "${output_file}" < "${ZITI_CTRL_IDENTITY_CA}" - cat "${ZITI_SIGNING_CERT}" >> "${ZITI_CTRL_IDENTITY_CA}" - echo -e "wrote CA file to: $(BLUE "${ZITI_CTRL_IDENTITY_CA}")" +cat "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem" > "${ZITI_PKI_OS_SPECIFIC}/cas.pem" +cat "${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert" >> "${ZITI_PKI_OS_SPECIFIC}/cas.pem" +echo -e "wrote CA file to: $(BLUE "${ZITI_PKI_OS_SPECIFIC}/cas.pem")" - output_file="${ZITI_HOME}/${controller_name}.yaml" - "${ZITI_BIN_DIR}/ziti" create config controller > "${output_file}" +output_file="${ZITI_HOME}/${controller_name}.yaml" +cat > "${output_file}" <> "${ENV_FILE}" echo "alias zec='ziti edge'" >> "${ENV_FILE}" - echo "alias zlogin='ziti edge login \"\${ZITI_EDGE_CTRL_ADVERTISED}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" - echo "alias zitiLogin='ziti edge login \"\${ZITI_EDGE_CTRL_ADVERTISED}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" + echo "alias zlogin='ziti edge login \"\${ZITI_EDGE_CONTROLLER_API}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" + echo "alias zitiLogin='ziti edge login \"\${ZITI_EDGE_CONTROLLER_API}\" -u \"\${ZITI_USER-}\" -p \"\${ZITI_PWD}\" -c \"\${ZITI_PKI}/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}/certs/\${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}.cert\"'" >> "${ENV_FILE}" echo "alias psz='ps -ef | grep ziti'" >> "${ENV_FILE}" #when sourcing the emitted file add the bin folder to the path @@ -1005,12 +1387,12 @@ function waitForController { # devnull="nul" #fi # shellcheck disable=SC2091 - #until $(curl -o /dev/null -sk /dev/null --fail "https://${ZITI_EDGE_CTRL_ADVERTISED}"); do - # echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED}" + #until $(curl -o /dev/null -sk /dev/null --fail "https://${ZITI_EDGE_CONTROLLER_API}"); do + # echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}" # sleep 2 #done - while [[ "$(curl -w "%{http_code}" -m 1 -s -k -o /dev/null https://"${ZITI_EDGE_CTRL_ADVERTISED}"/version)" != "200" ]]; do - echo "waiting for https://${ZITI_EDGE_CTRL_ADVERTISED}" + while [[ "$(curl -w "%{http_code}" -m 1 -s -k -o /dev/null https://${ZITI_EDGE_CONTROLLER_API}/version)" != "200" ]]; do + echo "waiting for https://${ZITI_EDGE_CONTROLLER_API}" sleep 3 done }