#!/bin/sh
config="/etc/default/lxd-bridge"
varrun="/run/lxd-bridge/"
varlib="/var/lib/lxd-bridge/"

# lxdbr0 defaults to only setting up the standard IPv6 link-local network
# to enable routable IPv4 and/or IPv6, please edit /etc/default/lxd

# The values below are defaults
USE_LXD_BRIDGE="true"
LXD_BRIDGE="lxdbr0"
LXD_CONFILE=""
LXD_DOMAIN=""

# IPv4
LXD_IPV4_ADDR=""
LXD_IPV4_NETMASK=""
LXD_IPV4_NETWORK=""
LXD_IPV4_DHCP_RANGE=""
LXD_IPV4_DHCP_MAX=""
LXD_IPV4_NAT="false"
LXD_IPV4_FIREWALL="true"

# IPv6
LXD_IPV6_ADDR=""
LXD_IPV6_MASK=""
LXD_IPV6_NETWORK=""
LXD_IPV6_NAT="false"
LXD_IPV6_FIREWALL="true"
LXD_IPV6_PROXY="true"

# shellcheck disable=SC1090
[ ! -f "${config}" ] || . "${config}"

use_iptables_lock="-w"
iptables -w -L -n > /dev/null 2>&1 || use_iptables_lock=""

HAS_IPV6=false
[ -e "/proc/sys/net/ipv6/conf/default/disable_ipv6" ] && \
    [ "$(cat /proc/sys/net/ipv6/conf/default/disable_ipv6)" = "0" ] && HAS_IPV6=true

_netmask2cidr ()
{
    # Assumes there's no "255." after a non-255 byte in the mask
    x=${1##*255.}
    set -- "0^^^128^192^224^240^248^252^254^" "$(( (${#1} - ${#x})*2 ))" "${x%%.*}"
    x=${1%%${3}*}
    echo $(( ${2} + (${#x}/4) ))
}

ifdown() {
    ip addr flush dev "${1}"
    ip link set dev "${1}" down
}

ifup() {
    [ "${HAS_IPV6}" = "true" ] && [ "${LXD_IPV6_PROXY}" = "true" ] && ip addr add fe80::1/64 dev "${1}"
    if [ -n "${LXD_IPV4_NETMASK}" ] && [ -n "${LXD_IPV4_ADDR}" ]; then
        MASK=$(_netmask2cidr ${LXD_IPV4_NETMASK})
        CIDR_ADDR="${LXD_IPV4_ADDR}/${MASK}"
        ip addr add "${CIDR_ADDR}" dev "${1}"
    fi
    ip link set dev "${1}" up
}

start() {
    [ "x${USE_LXD_BRIDGE}" = "xtrue" ] || { exit 0; }

    [ ! -f "${varrun}/network_up" ] || { echo "lxd-bridge is already running"; exit 1; }

    if [ -d /sys/class/net/${LXD_BRIDGE} ]; then
        stop force 2>/dev/null || true
    fi

    FAILED=1

    cleanup() {
        set +e
        if [ "${FAILED}" = "1" ]; then
            echo "Failed to setup lxd-bridge." >&2
            stop force
        fi
    }

    trap cleanup EXIT HUP INT TERM
    set -e

    # set up the lxd network
    [ ! -d "/sys/class/net/${LXD_BRIDGE}" ] && ip link add dev "${LXD_BRIDGE}" type bridge

    if [ "${HAS_IPV6}" = "true" ]; then
        echo 0 > "/proc/sys/net/ipv6/conf/${LXD_BRIDGE}/autoconf" || true
        echo 0 > "/proc/sys/net/ipv6/conf/${LXD_BRIDGE}/accept_dad" || true
    fi

    # if we are run from systemd on a system with selinux enabled,
    # the mkdir will create /run/lxd as init_var_run_t which dnsmasq
    # can't write its pid into, so we restorecon it (to var_run_t)
    if [ ! -d "${varrun}" ]; then
        mkdir -p "${varrun}"
        if which restorecon >/dev/null 2>&1; then
            restorecon "${varrun}"
        fi
    fi

    if [ ! -d "${varlib}" ]; then
        mkdir -p "${varlib}"
        if which restorecon >/dev/null 2>&1; then
            restorecon "${varlib}"
        fi
    fi

    ifup "${LXD_BRIDGE}" "${LXD_IPV4_ADDR}" "${LXD_IPV4_NETMASK}"

    LXD_IPV4_ARG=""
    if [ -n "${LXD_IPV4_ADDR}" ] && [ -n "${LXD_IPV4_NETMASK}" ] && [ -n "${LXD_IPV4_NETWORK}" ]; then
        echo 1 > /proc/sys/net/ipv4/ip_forward
        if [ "${LXD_IPV4_NAT}" = "true" ]; then
            iptables "${use_iptables_lock}" -t nat -A POSTROUTING -s "${LXD_IPV4_NETWORK}" ! -d "${LXD_IPV4_NETWORK}" -j MASQUERADE -m comment --comment "managed by lxd-bridge"
        fi
        LXD_IPV4_ARG="--listen-address ${LXD_IPV4_ADDR} --dhcp-range ${LXD_IPV4_DHCP_RANGE} --dhcp-lease-max=${LXD_IPV4_DHCP_MAX}"
    fi

    LXD_IPV6_ARG=""
    if [ "${HAS_IPV6}" = "true" ] && [ -n "${LXD_IPV6_ADDR}" ] && [ -n "${LXD_IPV6_MASK}" ] && [ -n "${LXD_IPV6_NETWORK}" ]; then
        # IPv6 sysctls don't respect the "all" path...
        for interface in /proc/sys/net/ipv6/conf/*; do
            echo 2 > "${interface}/accept_ra"
        done

        for interface in /proc/sys/net/ipv6/conf/*; do
            echo 1 > "${interface}/forwarding"
        done

        ip -6 addr add dev "${LXD_BRIDGE}" "${LXD_IPV6_ADDR}/${LXD_IPV6_MASK}"
        if [ "${LXD_IPV6_NAT}" = "true" ]; then
            ip6tables "${use_iptables_lock}" -t nat -A POSTROUTING -s "${LXD_IPV6_NETWORK}" ! -d "${LXD_IPV6_NETWORK}" -j MASQUERADE -m comment --comment "managed by lxd-bridge"
        fi
        LXD_IPV6_ARG="--dhcp-range=${LXD_IPV6_ADDR},ra-stateless,ra-names --listen-address ${LXD_IPV6_ADDR}"
    fi

    iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge"
    iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
    iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
    if [ "${LXD_IPV4_FIREWALL}" = "true" ]; then
        iptables "${use_iptables_lock}" -I FORWARD -i "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge"
        iptables "${use_iptables_lock}" -I FORWARD -o "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge"
    fi
    iptables "${use_iptables_lock}" -t mangle -A POSTROUTING -o "${LXD_BRIDGE}" -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -m comment --comment "managed by lxd-bridge" || true

    if [ "${HAS_IPV6}" = "true" ]; then
        ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        if [ "${LXD_IPV6_FIREWALL}" = "true" ]; then
            ip6tables "${use_iptables_lock}" -I FORWARD -i "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge"
            ip6tables "${use_iptables_lock}" -I FORWARD -o "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge"
        fi
    fi

    LXD_DOMAIN_ARG=""
    if [ -n "${LXD_DOMAIN}" ]; then
        LXD_DOMAIN_ARG="-s ${LXD_DOMAIN} -S /${LXD_DOMAIN}/"
    fi

    LXD_CONFILE_ARG=""
    if [ -n "${LXD_CONFILE}" ]; then
        LXD_CONFILE_ARG="--conf-file=${LXD_CONFILE}"
    fi

    # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
    for DNSMASQ_USER in lxd dnsmasq nobody
    do
        if getent passwd "${DNSMASQ_USER}" >/dev/null; then
            break
        fi
    done

    if [ -n "${LXD_IPV4_ADDR}" ] || [ -n "${LXD_IPV6_ADDR}" ]; then
        # shellcheck disable=SC2086
        dnsmasq ${LXD_CONFILE_ARG} ${LXD_DOMAIN_ARG} -u "${DNSMASQ_USER}" --strict-order --bind-interfaces --pid-file="${varrun}/dnsmasq.pid" --dhcp-no-override --except-interface=lo --interface="${LXD_BRIDGE}" --dhcp-leasefile="${varlib}/dnsmasq.${LXD_BRIDGE}.leases" --dhcp-authoritative ${LXD_IPV4_ARG} ${LXD_IPV6_ARG}
    fi

    if [ "${HAS_IPV6}" = "true" ] && [ "${LXD_IPV6_PROXY}" = "true" ]; then
        PATH="${PATH}:$(dirname "${0}")" lxd-bridge-proxy --addr="[fe80::1%${LXD_BRIDGE}]:13128" &
        PID=$!
        echo "${PID}" > "${varrun}/proxy.pid"
    fi

    touch "${varrun}/network_up"
    FAILED=0
}

stop() {
    [ -f "${varrun}/network_up" ] || [ "${1}" = "force" ] || { echo "lxd-bridge isn't running"; exit 1; }

    if [ -d /sys/class/net/${LXD_BRIDGE} ]; then
        ifdown ${LXD_BRIDGE}
        iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
        if [ "${LXD_IPV4_FIREWALL}" = "true" ]; then
            iptables ${use_iptables_lock} -D FORWARD -i ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge"
            iptables ${use_iptables_lock} -D FORWARD -o ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge"
        fi
        iptables ${use_iptables_lock} -t mangle -D POSTROUTING -o ${LXD_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -m comment --comment "managed by lxd-bridge" || true

        if [ -n "${LXD_IPV4_NETWORK}" ] && [ "${LXD_IPV4_NAT}" = "true" ]; then
            iptables ${use_iptables_lock} -t nat -D POSTROUTING -s ${LXD_IPV4_NETWORK} ! -d ${LXD_IPV4_NETWORK} -j MASQUERADE -m comment --comment "managed by lxd-bridge"
        fi

        if [ "${HAS_IPV6}" = "true" ]; then
            ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge"
            ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
            ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge"
            if [ "${LXD_IPV6_FIREWALL}" = "true" ]; then
                ip6tables ${use_iptables_lock} -D FORWARD -i ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge"
                ip6tables ${use_iptables_lock} -D FORWARD -o ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge"
            fi
        fi

        if [ "${HAS_IPV6}" = "true" ] && [ -n "${LXD_IPV6_NETWORK}" ] && [ "${LXD_IPV6_NAT}" = "true" ]; then
            ip6tables ${use_iptables_lock} -t nat -D POSTROUTING -s ${LXD_IPV6_NETWORK} ! -d ${LXD_IPV6_NETWORK} -j MASQUERADE -m comment --comment "managed by lxd-bridge"
        fi

        if [ -e "${varrun}/dnsmasq.pid" ]; then
            pid=$(cat "${varrun}/dnsmasq.pid" 2>/dev/null) && kill -9 "${pid}"
            rm -f "${varrun}/dnsmasq.pid"
        fi

        if [ -e "${varrun}/proxy.pid" ]; then
            pid=$(cat "${varrun}/proxy.pid" 2>/dev/null) && kill -9 "${pid}"
            rm -f "${varrun}/proxy.pid"
        fi

        # if ${LXD_BRIDGE} has attached interfaces, don't destroy the bridge
        ls /sys/class/net/${LXD_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete "${LXD_BRIDGE}"
    fi

    rm -f "${varrun}/network_up"
}

# See how we were called.
case "${1}" in
    start)
        start
    ;;

    stop)
        stop
    ;;

    restart|reload|force-reload)
        ${0} stop
        ${0} start
    ;;

    *)
        echo "Usage: ${0} {start|stop|restart|reload|force-reload}"
        exit 2
esac

exit $?