From 82a0b8777ec81b1bda23e8315f5ec54eaafe1ac4 Mon Sep 17 00:00:00 2001
From: dovholuknf <46322585+dovholuknf@users.noreply.github.com>
Date: Wed, 22 Sep 2021 18:47:03 -0400
Subject: [PATCH] add snapcraft steps back to etc in case we want it someday

---
 etc/ubuntu-snap/README.md              |  36 ++++++++
 etc/ubuntu-snap/all.sh                 |  13 +++
 etc/ubuntu-snap/create-3rdparty.sh     | 111 +++++++++++++++++++++++++
 etc/ubuntu-snap/newid-thirdPartyOTT.sh | 109 ++++++++++++++++++++++++
 etc/ubuntu-snap/newid.sh               |  58 +++++++++++++
 etc/ubuntu-snap/ott.sh                 |  48 +++++++++++
 etc/ubuntu-snap/snapcraft.yaml         |  39 +++++++++
 7 files changed, 414 insertions(+)
 create mode 100755 etc/ubuntu-snap/README.md
 create mode 100755 etc/ubuntu-snap/all.sh
 create mode 100755 etc/ubuntu-snap/create-3rdparty.sh
 create mode 100755 etc/ubuntu-snap/newid-thirdPartyOTT.sh
 create mode 100755 etc/ubuntu-snap/newid.sh
 create mode 100755 etc/ubuntu-snap/ott.sh
 create mode 100644 etc/ubuntu-snap/snapcraft.yaml

diff --git a/etc/ubuntu-snap/README.md b/etc/ubuntu-snap/README.md
new file mode 100755
index 000000000..c36dc6736
--- /dev/null
+++ b/etc/ubuntu-snap/README.md
@@ -0,0 +1,36 @@
+# quick notes on builing a snap from scratch...
+
+* checkout branch
+* install snapd if needed - https://docs.snapcraft.io/installing-snapd/6735
+* install snapcraft --classic to build snaps 
+    
+    snap install snapcraft --classic
+    hash -r
+
+* navigate to the root of the git checkout - not the $GOPATH
+* cd ~/git_or_wherever/nf/src/bitbucket.org/netfoundry/ziti
+* issue `snapcraft` you should see results (in green maybe) like (you may need the `--destructive-mode` flag):
+
+    Cleaning later steps and re-staging ziti ('build' step changed)
+    Priming ziti 
+    Snapping 'netfoundry' -                                                                                   
+    Snapped netfoundry_0.0.1_amd64.snap
+
+* install the snap in spoooky 'dangerous' and 'devmode': 
+
+    sudo snap install --devmode --dangerous netfoundry*.snap
+
+* ensure the snap is listed:
+
+    snap list | grep netfoundry
+    
+    should return something like:
+    netfoundry            0.0.1                      x1    -            -           devmode
+
+* try the enroller out:
+
+    netfoundry.ziti-enroller
+
+* try the tunneler out:
+
+   netfoundry.ziti-tunneler
diff --git a/etc/ubuntu-snap/all.sh b/etc/ubuntu-snap/all.sh
new file mode 100755
index 000000000..a6d8afc8c
--- /dev/null
+++ b/etc/ubuntu-snap/all.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+set -e
+
+if [ "$1" == "" ]
+then
+        echo "please provide the name of the ca already created"
+        exit 1
+fi;
+ca_name=$1
+
+./newid.sh $1
+./ott.sh $1
+./newid-thirdPartyOTT.sh $1
diff --git a/etc/ubuntu-snap/create-3rdparty.sh b/etc/ubuntu-snap/create-3rdparty.sh
new file mode 100755
index 000000000..62c52c160
--- /dev/null
+++ b/etc/ubuntu-snap/create-3rdparty.sh
@@ -0,0 +1,111 @@
+#!/bin/bash
+###################################################
+#                                                 #
+#  START CA VERIFICATION PROCESS                  #
+#                                                 #
+###################################################
+#
+# setup all the necessary parameters
+#
+set -e
+if [[ "xx" == "xx$1" ]]
+then
+  edge_controller_uri="https://local-edge-controller:1280"
+else
+  edge_controller_uri="$1"
+fi
+
+echo "Edge controller set to: ${edge_controller_uri}"
+
+ca_name="ca_$(date +"%m%d%y_%H%M%S")"
+
+pki_root=~/ziti/pki/${ca_name}
+#pki_root=~/ziti/quickstart/auto-enroll-example/${ca_name}
+
+mkdir -p ${pki_root}
+echo "pki root: ${pki_root}"
+
+# make a root certificate using the ziti CLI
+ziti pki create ca --pki-root=$pki_root --ca-file=${ca_name}
+
+#sleep a second to make sure the certs are not detected to be invalid if submitted too quickly
+sleep 1
+
+# the ziti CLI puts keys and certs at a known location
+path_to_private_key=${pki_root}/${ca_name}/keys/${ca_name}.key
+path_to_cert=${pki_root}/${ca_name}/certs/${ca_name}.cert
+
+# convert the key and cert which are in pem format into something that can be curl'ed
+private_key=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${path_to_private_key})
+cert=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ${path_to_cert})
+
+echo -n Enter the Password for the admin user: 
+read -s adminpwd
+echo
+# Run Command
+echo $adminpwd
+
+
+# obtain a ziti session so the CA can be pushed into the edge controller
+zt_session=$(curl -sk -H "Content-Type: application/json" \
+    ${edge_controller_uri}/authenticate?method=password \
+    -d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
+    jq -r .data.token)
+
+# capture the result of the ca registration specifically to pull the id out of the response which is used later
+ca_registration_result=$(cat <<HERE | curl -sk -H "Content-Type: application/json" \
+             -H "zt-session: ${zt_session}" \
+             "${edge_controller_uri}/cas" \
+             -d @- | jq . 
+{
+  "name": "${ca_name}",
+  "isAutoCaEnrollmentEnabled": true,
+  "isOttCaEnrollmentEnabled": true,
+  "isAuthEnabled": true,
+  "certPem": "${cert}"
+}
+HERE
+)
+
+# use jq to pull out the id from the (presumably) successful ca registration
+ca_id=$(echo $ca_registration_result | jq -r '.data.id')
+echo "CA ID set to: ${ca_id}"
+sleep 1 #trying to avoid edge race conditions?
+
+# fetch the verificationToken from the edge controller. this token needs to be put into a certifiate
+# signed by the CA just registered
+verificationResponse=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}")
+verificationToken=$(echo ${verificationResponse} | jq -r ".data.verificationToken")
+path_to_verificationToken_cert="$pki_root/${ca_name}/certs/${verificationToken}.cert"
+echo "CA Verification token set to: ${verificationToken}"
+sleep 1 #trying to avoid edge race conditions?
+
+# using the ziti CLI - make a client cert for the verificationToken
+ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${verificationToken} --client-file=${verificationToken}
+
+#sleep a second to make sure the certs are not detected to be invalid
+sleep 1
+
+# print out if the CA is now verified - expect false
+the_ca=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}" | jq -r ".data")
+sleep 1 #trying to avoid edge race conditions?
+echo "at this point the ca should not be verified. is ca verified? $(echo ${the_ca} | jq -r ".isVerified")"
+
+# submit the client cert to the proper endpoint using --data-binary or curl munges the file
+result=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}/verify" --data-binary @${path_to_verificationToken_cert})
+
+# print out if the CA is now verified - expect true
+the_ca=$(curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}" | jq -r ".data")
+sleep 1 #trying to avoid edge race conditions?
+echo "at this point the ca _*SHOULD*_ be verified. is ca verified? $(echo ${the_ca} | jq -r ".isVerified")"
+
+echo "acuiring the jwt from ${edge_controller_uri}/cas/${ca_id}/jwt into ${pki_root}/auto.jwt"
+curl -X GET -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${edge_controller_uri}/cas/${ca_id}/jwt" -o ${pki_root}/auto.jwt
+
+###################################################
+#                                                 #
+#  END CA VERIFICATION PROCESS                    #
+#                                                 #
+###################################################
+
+
diff --git a/etc/ubuntu-snap/newid-thirdPartyOTT.sh b/etc/ubuntu-snap/newid-thirdPartyOTT.sh
new file mode 100755
index 000000000..2d199d548
--- /dev/null
+++ b/etc/ubuntu-snap/newid-thirdPartyOTT.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+###################################################
+#                                                 #
+#  START CA AUTOMATIC REGISTRATION PROCESS        #
+#                                                 #
+###################################################
+set -e
+
+
+
+if [[ "xx" == "xx$2" ]]
+then
+  edge_controller_uri="https://local-edge-controller:1280"
+else
+  edge_controller_uri="$2"
+fi
+echo "Edge controller set to: ${edge_controller_uri}"
+
+if [ "$1" == "" ]
+then
+	echo "please provide the name of the ca already created"
+	exit 1
+fi;
+#ca_name=$(cat /home/cd/pki/current-pki)
+ca_name=$1
+pki_root=/home/cd/ziti/pki/${ca_name}
+identity_name="${ca_name}_auto_ident_$(date +"%H%M%S")"
+identity_name="caott_$(date +"%H%M%S")"
+
+echo "identity name: $identity_name"
+
+# make a client certificate using the ziti CLI
+ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${identity_name} --client-file=${identity_name}
+sleep 1 #avoiding the same NotAfter making the certificate invalid
+
+# setup some variables to the key and cert
+###################################################################
+# NOTE: the identity_ca_path is very important and is not able to be fetched at this time!
+#       you must obtain this file through some other means. you also MUST provide the full chain as shown
+#
+curl -sk ${edge_controller_uri}/.well-known/est/cacerts > ${pki_root}/fetched-ca-certs.p7
+openssl base64 -d -in ${pki_root}/fetched-ca-certs.p7 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${pki_root}/fetched-ca-certs.pem
+identity_full_ca_path="${pki_root}/fetched-ca-certs.pem"
+
+#
+###################################################################
+identity_path_to_key="${pki_root}/${ca_name}/keys/${identity_name}.key"
+identity_path_to_cert="${pki_root}/${ca_name}/certs/${identity_name}.cert"
+
+echo $identity_path_to_key
+echo $identity_path_to_cert
+
+echo -n Enter the Password for the admin user: 
+read -s adminpwd
+echo
+# Run Command
+echo $adminpwd
+
+# establish a session by user/pwd
+export zt_session=$(curl -sk -H "Content-Type: application/json" \
+    ${edge_controller_uri}/authenticate?method=password \
+    -d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
+    jq -j .data.token)
+
+#fetch the ca's id from the controller
+url="${edge_controller_uri}/cas?filter=name%3d%22${ca_name}%22"
+ca_id=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${url}" | jq -j '.data[].id')
+echo "CA ID found by name ${ca_name}: ${ca_id}"
+
+if [[ "xx" == "xx${ca_id}" ]]
+then
+  echo "ERROR: ca not found by name!"
+  cat << HERE
+curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" "${url}" | jq -j '.data[].id'
+HERE
+  bash
+  exit 1
+fi
+
+#create the new identity
+identity_id=$(cat <<HERE | curl -sk -H "Content-Type: application/json" \
+             -H "zt-session: ${zt_session}" \
+             "${edge_controller_uri}/identities" \
+             -d @- | jq -j '.data.id'
+{
+  "name": "caott_${identity_name}",
+  "type": "User",
+  "enrollment": {
+    "ottca": "${ca_id}"
+  }
+}
+HERE
+)
+
+jwt_file="${pki_root}/${identity_name}.jwt"
+
+echo "Third Party OTT identity created. ID: ${identity_id}"
+echo "fetching the jwt into ${jwt_file}"
+
+curl -sk -H "Content-Type: application/json" \
+     -H "zt-session: ${zt_session}" \
+     "${edge_controller_uri}/identities/${identity_id}" \
+     | jq -j .data.enrollment.ottca.jwt > ${jwt_file}
+     
+echo "using jwt to enroll"
+
+#enroll it
+ziti-enroller -v --jwt ${jwt_file} --cert $identity_path_to_cert --key $identity_path_to_key --idname ${identity_name}
+
diff --git a/etc/ubuntu-snap/newid.sh b/etc/ubuntu-snap/newid.sh
new file mode 100755
index 000000000..3a4ba0643
--- /dev/null
+++ b/etc/ubuntu-snap/newid.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+###################################################
+#                                                 #
+#  START CA AUTOMATIC REGISTRATION PROCESS        #
+#                                                 #
+###################################################
+set -e
+
+
+if [[ "xx" == "xx$2" ]]
+then
+  edge_controller_uri="https://local-edge-controller:1280"
+else
+  edge_controller_uri="$2"
+fi
+echo "Edge controller set to: ${edge_controller_uri}"
+
+
+if [ "$1" == "" ]
+then
+	echo "please provide the name of the ca already created"
+	exit 1
+fi;
+#ca_name=$(cat /home/cd/pki/current-pki)
+ca_name=$1
+pki_root=/home/cd/ziti/pki/${ca_name}
+#pki_root=~/ziti/quickstart/auto-enroll-example/${ca_name}
+identity_name="${ca_name}_auto_ident_$(date +"%H%M%S")"
+identity_name="caauto_$(date +"%H%M%S")"
+
+echo "identity name: $identity_name"
+
+# make a client certificate using the ziti CLI
+ziti pki create client --pki-root="${pki_root}" --ca-name=${ca_name} --client-name=${identity_name} --client-file=${identity_name}
+sleep 1 #avoiding the same NotAfter making the certificate invalid
+
+# setup some variables to the key and cert
+###################################################################
+# NOTE: the identity_ca_path is very important and is not able to be fetched at this time!
+#       you must obtain this file through some other means. you also MUST provide the full chain as shown
+#
+curl -sk ${edge_controller_uri}/.well-known/est/cacerts > ${pki_root}/fetched-ca-certs.p7
+openssl base64 -d -in ${pki_root}/fetched-ca-certs.p7 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${pki_root}/fetched-ca-certs.pem
+identity_full_ca_path="${pki_root}/fetched-ca-certs.pem"
+
+#
+###################################################################
+identity_path_to_key="${pki_root}/${ca_name}/keys/${identity_name}.key"
+identity_path_to_cert="${pki_root}/${ca_name}/certs/${identity_name}.cert"
+
+echo $identity_path_to_key
+echo $identity_path_to_cert
+
+#cp $identity_path_to_key /mnt/v/temp/key
+#cp $identity_path_to_cert /mnt/v/temp/cert
+
+echo ""
+ziti-enroller -v --jwt ${pki_root}/auto.jwt --cert $identity_path_to_cert --key $identity_path_to_key --idname ${identity_name} --out "${pki_root}/${identity_name}.json"
diff --git a/etc/ubuntu-snap/ott.sh b/etc/ubuntu-snap/ott.sh
new file mode 100755
index 000000000..d42fb8414
--- /dev/null
+++ b/etc/ubuntu-snap/ott.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -e
+
+if [ "$1" == "" ]
+then
+        echo "please provide the name of the ca already created"
+        exit 1
+fi;
+#ca_name=$(cat /home/cd/pki/current-pki)
+ca_name=$1
+pki_root=/home/cd/ziti/pki/${ca_name}
+
+if [[ "xx" == "xx$2" ]]
+then
+  edge_controller_uri="https://local-edge-controller:1280"
+else
+  edge_controller_uri="$2"
+fi
+echo "Edge controller set to: ${edge_controller_uri}"
+
+echo -n Enter the Password for the admin user: 
+read -s adminpwd
+echo
+
+# Run Command
+echo $adminpwd
+
+export zt_session=$(curl -sk -H "Content-Type: application/json" \
+    ${edge_controller_uri}/authenticate?method=password \
+    -d "{\"username\":\"admin\",\"password\":\"${adminpwd}\"}" | \
+    jq -j .data.token)
+
+echo "zt_session: ${zt_session}"
+
+identity_name="ott_$(date +"%H%M%S")"
+
+export ziti_user_id=$(curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" \
+    "${edge_controller_uri}/identities" \
+    -d "{ \"name\": \"${identity_name}\", \"type\": \"User\", \"enrollment\": { \"ott\": true } }" \
+    | jq -j .data.id)
+echo "ziti_user_id=$ziti_user_id"
+
+curl -sk -H "Content-Type: application/json" -H "zt-session: ${zt_session}" \
+    "${edge_controller_uri}/identities/${ziti_user_id}" \
+    | jq -j .data.enrollment.ott.jwt > "${pki_root}/${identity_name}.jwt"
+
+echo "Writing jwt file to: ${pki_root}/${identity_name}.jwt"
+ziti-enroller -v --jwt "${pki_root}/${identity_name}.jwt"
diff --git a/etc/ubuntu-snap/snapcraft.yaml b/etc/ubuntu-snap/snapcraft.yaml
new file mode 100644
index 000000000..359b12064
--- /dev/null
+++ b/etc/ubuntu-snap/snapcraft.yaml
@@ -0,0 +1,39 @@
+name: openziti
+version: 0.22.5
+base: core18
+summary: Netfoundry ziti application suite
+description: |
+  The ziti-tunneler provides access to the NetFoundry network 
+grade: devel
+confinement: strict
+
+parts:
+  ziti:
+    source: .
+    plugin: go
+    go-importpath: bitbucket.org/netfoundry/ziti
+    go-channel: 1.17/stable
+    build-packages:
+      - gcc
+
+  random-scripts:
+    source: etc/ubuntu-snap
+    plugin: dump
+
+apps:
+  ziti:
+    command: bin/ziti
+    plugs:
+      - home
+      - network
+  ziti-tunnel:
+    daemon: simple
+    command: bin/ziti-tunnel run $SNAP_COMMON/ziti.json
+    plugs:
+      - home
+      - network
+      - network-control
+
+#hooks:
+#  configure:
+#    plugs: [network]