geliremoteunlock

#!/bin/sh

# $FreeBSD$
#
# PROVIDE: geliremoteunlock
# REQUIRE: netwait
# BEFORE: jail

. /etc/rc.subr

name=geliremoteunlock
# shellcheck disable=2034
rcvar="${name}_enable"

# shellcheck disable=2034
start_cmd="${name}_start"
# shellcheck disable=2034
stop_cmd=":"

load_rc_config "$name"
: "${geliremoteunlock_enable:="NO"}"


__var() {
    pool="$1"
    entry="$2"
    res=""
    eval "res=\${""${name}_${pool}_${entry}""}"
    [ -z "$res" ] && eval "res=\${""${name}_${entry}""}"
    echo "$res"
}

__in_list() {
    match="$1"
    elems="$2"
    for elem in $elems; do
        if [ "$match" = "$elem" ]; then
            return 0
        fi
    done
    return 1
}
__is_cmd() {
    cmd="$1"
    debug "checking for command $cmd"
    command -v "$cmd" > /dev/null
    return $?
}

__delete() {
    obj="$1"
    debug "checking for $obj to remove"
    if [ -f "$obj" ]; then
        if __is_cmd "gshred"; then
            info "shredding $obj"
            gshred -fxu "$obj"
        else
            info "deleting $obj"
            rm -fP "$obj"
        fi
    fi
}

geliremoteunlock_start() {
    conf_pools="$(__var "_" "pools")"
    pools=""

    if [ -z "$*" ]; then
        pools="$conf_pools"
    else
        for arg_pool in "$@"; do
            if ! __in_list "$arg_pool" "$conf_pools"; then
                err 1 "$arg_pool is not configured"
            fi
        done
        pools="$*"
    fi

    ### Helper Functions ###

    __pull_file() {
        host="$1"
        ident="$2"
        action="$3"
        fname="$4"
        tname="$5"
        info "retrieving $fname from $host"
        if ! res=$(ssh \
            "$host" -i "$ident" \
            -C  "$action $fname" \
        ); then
            warn "$action fetch failed"
        else
            debug "got $fname from $host - store in $tname"
            echo "$res" > "$tname"
        fi
    }

    __decrypt() {
        fname="$1"
        tname="$2"
        pass="$3"
        if [ -n "$pass" ]; then
            info "decrypting $fname"
            mv "$tname" "${tname}.aes"
            if ! openssl enc \
                -aes-256-cbc -a -pbkdf2 -salt -d \
                -in "${tname}.aes" \
                -out "$tname" \
                -pass "pass:$pass" \
            ; then
                warn "unable to decrypt" "$fname"
            fi
            __delete "${tname}.aes"
        fi
    }

    ### Main part ###

    for pool in $pools; do

        info "unlocking pool $pool"

        devices="$(__var                "$pool" "devices")"

        keyfile_host="$(__var           "$pool" "keyfile_host")"
        keyfile_ident="$(__var          "$pool" "keyfile_ident")"
        keyfile_name="$(__var           "$pool" "keyfile_name")"
        keyfile_password="$(__var       "$pool" "keyfile_password")"

        passphrase_host="$(__var        "$pool" "passphrase_host")"
        passphrase_ident="$(__var       "$pool" "passphrase_ident")"
        passphrase_name="$(__var        "$pool" "passphrase_name")"
        passphrase_password="$(__var    "$pool" "passphrase_password")"

        keyfile_temp="/tmp/${name}_${pool}_temp.key"
        passphrase_temp="/tmp/${name}_${pool}_temp.pwd"


        __pull_file \
            "$keyfile_host" "$keyfile_ident" "keyfile" \
            "$keyfile_name" "$keyfile_temp"

        __decrypt \
            "$keyfile_name" "$keyfile_temp" "$keyfile_password"

        if [ -n "$passphrase_host" ] && [ -n "$passphrase_ident" ]; then
            __pull_file \
                "$passphrase_host" "$passphrase_ident" "passphrase" \
                "$passphrase_name" "$passphrase_temp"

            __decrypt \
                "$passphrase_name" "$passphrase_temp" "$passphrase_password"
        fi

        for device in $devices; do
            info "unlocking device $device for pool $pool"

            if [ -n "$passphrase_password" ]; then
                if ! geli attach \
                    -k "${keyfile_temp}" \
                    -j "${passphrase_temp}" \
                    "${device}" \
                ; then
                    warn "unable to attach $device"
                fi
            else
                if ! geli attach \
                    -k "${keyfile_temp}" \
                    -p "${device}" \
                ; then
                    warn "unable to attach $device"
                fi
            fi
        done

        __delete  "$keyfile_temp"
        __delete  "$passphrase_temp"

        info "importing pool $pool"
        zpool import "$pool"

    done

    info "$name done"
}


run_rc_command "$@"