4 use Debconf::Client::ConfModule ':all';
7 use Digest::SHA1 'sha1_hex';
11 # XXX should support configuring SWITCH_NETMASK and SWITCH_GATEWAY
12 # when the mode is in-band.
14 my $debconf_owner = 'openflow-switch';
16 my $default = '/etc/default/openflow-switch';
17 my $etc = '/etc/openflow-switch';
18 my $rundir = '/var/run';
19 my $privkey_file = "$etc/of0-privkey.pem";
20 my $req_file = "$etc/of0-req.pem";
21 my $cert_file = "$etc/of0-cert.pem";
22 my $cacert_file = "$etc/cacert.pem";
23 my $ofp_discover_pidfile = "$rundir/ofp-discover.pid";
25 my $ua = LWP::UserAgent->new;
29 system("/etc/init.d/openflow-switch stop 1>&2");
34 title('OpenFlow Switch Setup');
36 my (%netdevs) = find_netdevs();
37 db_subst('netdevs', 'choices',
38 join(', ', map($netdevs{$_}, sort(keys(%netdevs)))));
39 db_set('netdevs', join(', ', grep(!/IP/, values(%netdevs))));
42 my (%config) = load_config($default);
46 db_set('netdevs', join(', ', map($netdevs{$_},
47 grep(exists $netdevs{$_}, split))))
51 $_ eq 'in-band' || $_ eq 'out-of-band' ? $_ : 'discovery')
53 SWITCH_IP => sub { db_set('switch-ip', $_) },
54 CONTROLLER => sub { db_set('controller-vconn', $_) },
55 PRIVKEY => sub { $privkey_file = $_ },
56 CERT => sub { $cert_file = $_ },
57 CACERT => sub { $cacert_file = $_ },
60 for my $key (keys(%map)) {
61 local $_ = $config{$key};
62 &{$map{$key}}() if defined && !/^\s*$/;
66 my $cacert_preverified = -e $cacert_file;
67 my ($req, $req_fingerprint);
73 # User backed up from first dialog box.
77 # Prompt for ports to include in switch.
82 # Validate the chosen ports.
83 my (@netdevs) = split(', ', db_get('netdevs'));
85 # No ports chosen. Disable switch.
86 db_input('no-netdevs');
87 return 'prev' if db_go();
89 } elsif (my (@conf_netdevs) = grep(/IP/, @netdevs)) {
90 # Point out that some ports have configured IP addresses.
91 db_subst('configured-netdevs', 'configured-netdevs',
92 join(', ', @conf_netdevs));
93 db_input('configured-netdevs');
101 # Discovery or in-band or out-of-band controller?
106 return 'skip' if db_get('mode') ne 'discovery';
108 # Notify user that we are going to do discovery.
109 db_input('discover');
110 return 'prev' if db_go();
111 print STDERR "Please wait up to 30 seconds for discovery...\n";
113 # Make sure that there's no running discovery process.
118 open(DISCOVER, '-|', 'ofp-discover --timeout=30 --pidfile '
119 . join(' ', netdev_names()));
122 if (my ($name, $value) = /^([^=]+)=(.*)$/) {
123 if ($value =~ /^"(.*)"$/) {
125 $value =~ s/\\([0-7][0-7][0-7])/chr($1)/ge;
127 $value =~ s/^(0x[[:xdigit:]]+)$/hex($1)/e;
128 $value = '' if $value eq 'empty';
129 next if $value eq 'null'; # Shouldn't happen.
131 $options{$name} = $value;
137 my $vconn = $options{'ofp-controller-vconn'};
138 my $pki_uri = $options{'ofp-pki-uri'};
141 && is_valid_vconn($vconn)
142 && (!is_ssl_vconn($vconn) || defined($pki_uri)));
146 db_input('discovery-failure');
151 return 'skip' if db_get('mode') ne 'discovery';
153 my $vconn = $options{'ofp-controller-vconn'};
154 my $pki_uri = $options{'ofp-pki-uri'};
155 db_subst('discovery-success', 'controller-vconn', $vconn);
156 db_subst('discovery-success',
157 'pki-uri', is_ssl_vconn($vconn) ? $pki_uri : "no PKI in use");
158 db_input('discovery-success');
159 return 'prev' if db_go();
160 db_set('controller-vconn', $vconn);
161 db_set('pki-uri', $pki_uri);
165 return 'skip' if db_get('mode') ne 'in-band';
167 db_input('switch-ip');
168 return 'prev' if db_go();
170 my $ip = db_get('switch-ip');
171 return 'next' if $ip =~ /^dhcp|\d+\.\d+.\d+.\d+$/i;
173 db_input('switch-ip-error');
178 return 'skip' if db_get('mode') eq 'discovery';
180 my $old_vconn = db_get('controller-vconn');
181 db_input('controller-vconn');
182 return 'prev' if db_go();
184 my $vconn = db_get('controller-vconn');
185 if (is_valid_vconn($vconn)) {
186 if ($old_vconn ne $vconn || db_get('pki-uri') eq '') {
187 db_set('pki-uri', pki_host_to_uri($2));
192 db_input('controller-vconn-error');
197 return 'skip' if !ssl_enabled();
199 if (! -e $privkey_file) {
200 my $old_umask = umask(077);
201 run_cmd("ofp-pki req $etc/of0 >&2 2>/dev/null");
202 chmod(0644, $req_file) or die "$req_file: chmod: $!\n";
206 if (! -e $cert_file) {
207 open(REQ, '<', $req_file) or die "$req_file: open: $!\n";
208 $req = join('', <REQ>);
210 $req_fingerprint = sha1_hex($req);
215 return 'skip' if !ssl_enabled();
216 return 'skip' if -e $cacert_file && -e $cert_file;
219 return 'prev' if db_go();
223 return 'skip' if !ssl_enabled();
224 return 'skip' if -e $cacert_file;
226 my $pki_uri = db_get('pki-uri');
227 if ($pki_uri !~ /:/) {
228 $pki_uri = pki_host_to_uri($pki_uri);
230 # Trim trailing slashes.
233 db_set('pki-uri', $pki_uri);
235 my $url = "$pki_uri/controllerca/cacert.pem";
236 my $response = $ua->get($url, ':content_file' => $cacert_file);
237 if ($response->is_success) {
241 db_subst('fetch-cacert-failed', 'url', $url);
242 db_subst('fetch-cacert-failed', 'error', $response->status_line);
243 db_subst('fetch-cacert-failed', 'pki-uri', $pki_uri);
244 db_input('fetch-cacert-failed');
249 return 'skip' if !ssl_enabled();
250 return 'skip' if -e $cert_file;
253 db_set('send-cert-req', 'yes');
254 db_input('send-cert-req');
255 return 'prev' if db_go();
256 return 'next' if db_get('send-cert-req') eq 'no';
258 my $pki_uri = db_get('pki-uri');
259 my ($pki_base_uri) = $pki_uri =~ m%^([^/]+://[^/]+)/%;
260 my $url = "$pki_base_uri/cgi-bin/ofp-pki-cgi";
261 my $response = $ua->post($url, {'type' => 'switch',
263 return 'next' if $response->is_success;
265 db_subst('send-cert-req-failed', 'url', $url);
266 db_subst('send-cert-req-failed', 'error',
267 $response->status_line);
268 db_subst('send-cert-req-failed', 'pki-uri', $pki_uri);
269 db_input('send-cert-req-failed');
274 return 'skip' if !ssl_enabled();
275 return 'skip' if $cacert_preverified;
277 my ($cacert_fingerprint) = x509_fingerprint($cacert_file);
278 db_subst('verify-controller-ca', 'fingerprint', $cacert_fingerprint);
279 db_input('verify-controller-ca');
280 return 'prev' if db_go();
281 return 'next' if db_get('verify-controller-ca') eq 'yes';
282 unlink($cacert_file);
286 return 'skip' if !ssl_enabled();
287 return 'skip' if -e $cert_file;
290 db_set('fetch-switch-cert', 'yes');
291 db_input('fetch-switch-cert');
292 return 'prev' if db_go();
293 exit(1) if db_get('fetch-switch-cert') eq 'no';
295 my $pki_uri = db_get('pki-uri');
296 my $url = "$pki_uri/switchca/certs/$req_fingerprint-cert.pem";
297 my $response = $ua->get($url, ':content_file' => $cert_file);
298 if ($response->is_success) {
302 db_subst('fetch-switch-cert-failed', 'url', $url);
303 db_subst('fetch-switch-cert-failed', 'error',
304 $response->status_line);
305 db_subst('fetch-switch-cert-failed', 'pki-uri', $pki_uri);
306 db_input('fetch-switch-cert-failed');
311 db_input('complete');
323 my $ret = &{$states[$state]}();
324 $ret = db_go() ? 'prev' : 'next' if !defined $ret;
325 if ($ret eq 'next') {
327 } elsif ($ret eq 'prev') {
329 } elsif ($ret eq 'skip') {
331 } elsif ($ret eq 'done') {
334 die "unknown ret $ret";
336 $state += $direction;
340 $config{NETDEVS} = join(' ', netdev_names());
341 $config{MODE} = db_get('mode');
342 if (db_get('mode') eq 'in-band') {
343 $config{SWITCH_IP} = db_get('switch-ip');
345 if (db_get('mode') ne 'discovery') {
346 $config{CONTROLLER} = db_get('controller-vconn');
348 $config{PRIVKEY} = $privkey_file;
349 $config{CERT} = $cert_file;
350 $config{CACERT} = $cacert_file;
351 save_config($default, %config);
353 dup2(2, 1); # Get stdout back.
355 system("/etc/init.d/openflow-switch start");
358 return is_ssl_vconn(db_get('controller-vconn'));
362 my ($question, $key, $value) = @_;
363 $question = "$debconf_owner/$question";
364 my ($ret, $seen) = subst($question, $key, $value);
365 if ($ret && $ret != 30) {
366 die "Error substituting $value for $key in debconf question "
367 . "$question: $seen";
372 my ($question, $value) = @_;
373 $question = "$debconf_owner/$question";
374 my ($ret, $seen) = set($question, $value);
375 if ($ret && $ret != 30) {
376 die "Error setting debconf question $question to $value: $seen";
382 $question = "$debconf_owner/$question";
383 my ($ret, $seen) = get($question);
385 die "Error getting debconf question $question answer: $seen";
391 my ($question, $flag, $value) = @_;
392 $question = "$debconf_owner/$question";
393 my ($ret, $seen) = fset($question, $flag, $value);
394 if ($ret && $ret != 30) {
395 die "Error setting debconf question $question flag $flag to $value: "
401 my ($question, $flag) = @_;
402 $question = "$debconf_owner/$question";
403 my ($ret, $seen) = fget($question, $flag);
405 die "Error getting debconf question $question flag $flag: $seen";
412 db_fset($question, "seen", "false");
414 $question = "$debconf_owner/$question";
415 my ($ret, $seen) = input('high', $question);
416 if ($ret && $ret != 30) {
417 die "Error requesting debconf question $question: $seen";
423 my ($ret, $seen) = go();
424 if (!defined($ret)) {
425 exit(1); # Cancel button was pushed.
427 if ($ret && $ret != 30) {
428 die "Error asking debconf questions: $seen";
435 return if system($cmd) == 0;
438 die "$cmd: failed to execute: $!\n";
440 die sprintf("$cmd: child died with signal %d, %s coredump\n",
441 ($? & 127), ($? & 128) ? 'with' : 'without');
443 die sprintf("$cmd: child exited with value %d\n", $? >> 8);
447 sub x509_fingerprint {
449 my $cmd = "openssl x509 -noout -in $file -fingerprint";
450 open(OPENSSL, '-|', $cmd) or die "$cmd: failed to execute: $!\n";
451 my $line = <OPENSSL>;
453 my ($fingerprint) = $line =~ /SHA1 Fingerprint=(.*)/;
454 return $line if !defined $fingerprint;
455 $fingerprint =~ s/://g;
460 my ($netdev, %netdevs);
461 open(IFCONFIG, "/sbin/ifconfig -a|") or die "ifconfig failed: $!";
463 if (my ($nd) = /^([^\s]+)/) {
465 $netdevs{$netdev} = "$netdev";
466 if (my ($hwaddr) = /HWaddr (\S+)/) {
467 $netdevs{$netdev} .= " (MAC: $hwaddr)";
469 } elsif (my ($ip4) = /^\s*inet addr:(\S+)/) {
470 $netdevs{$netdev} .= " (IP: $ip4)";
471 } elsif (my ($ip6) = /^\s*inet6 addr:(\S+)/) {
472 $netdevs{$netdev} .= " (IPv6: $ip6)";
475 foreach my $nd (keys(%netdevs)) {
476 delete $netdevs{$nd} if $nd eq 'lo' || $nd =~ /^wmaster/;
484 my ($cmd) = "set -a && . $file && env";
485 if (!open(VARS, '-|', $cmd)) {
486 print STDERR "$cmd: failed to execute: $!\n";
491 my ($var, $value) = /^([^=]+)=(.*)$/ or next;
492 $config{$var} = $value;
502 } elsif (m&^[-a-zA-Z0-9:./%^_+,]*$&) {
511 my ($var, $value) = @_;
512 return $var . '=' . shell_escape($value);
516 my ($file, %config) = @_;
518 if (open(FILE, '<', $file)) {
524 # Replace all existing variable assignments.
525 for (my ($i) = 0; $i <= $#lines; $i++) {
526 local $_ = $lines[$i];
527 my ($var, $value) = /^\s*([^=#]+)=(.*)$/ or next;
528 if (exists($config{$var})) {
529 $lines[$i] = shell_assign($var, $config{$var});
530 delete $config{$var};
532 $lines[$i] = "#$lines[$i]";
536 # Find a place to put any remaining variable assignments.
538 for my $var (keys(%config)) {
539 my $assign = shell_assign($var, $config{$var});
541 # Replace the last commented-out variable assignment to $var, if any.
542 for (my ($i) = $#lines; $i >= 0; $i--) {
543 local $_ = $lines[$i];
544 if (/^\s*#\s*$var=/) {
545 $lines[$i] = $assign;
550 # Find a place to add the var: after the final commented line
551 # just after a line that contains "$var:".
552 for (my ($i) = 0; $i <= $#lines; $i++) {
553 if ($lines[$i] =~ /^\s*#\s*$var:/) {
554 for (my ($j) = $i + 1; $j <= $#lines; $j++) {
555 if ($lines[$j] !~ /^\s*#/) {
556 splice(@lines, $j, 0, $assign);
564 push(@lines, $assign);
567 open(NEWFILE, '>', "$file.tmp") or die "$file.tmp: create: $!\n";
568 print NEWFILE join('', map("$_\n", @lines));
570 rename("$file.tmp", $file) or die "$file.tmp: rename to $file: $!\n";
573 sub pki_host_to_uri {
575 return "http://$pki_host/openflow/pki";
578 sub kill_ofp_discover {
579 # Delegate this to a subprocess because there is no portable way
580 # to invoke fcntl(F_GETLK) from Perl.
581 system("ofp-kill --force $ofp_discover_pidfile");
585 return map(/^(\S+)/, split(', ', db_get('netdevs')));
590 return scalar($vconn =~ /^(tcp|ssl):([^:]+)(:.*)?/);
595 return scalar($vconn =~ /^ssl:/);