fram

#!/bin/bash
# Board FRAM - Board Farm Remote Access Management

set -e

# Prevent local file globbing expansion
set -f

PATH="$HOME/bin:/usr/bin:/bin"

BOARD=$USER
USER=$1

function log()
{
	echo "$(date +'%F %T') $BOARD $USER $*" >> fram.log
	echo "$(date +'%F %T') $BOARD $USER $*" >> /tmp/fram.log
}

# Log access early
log "$SSH_ORIGINAL_COMMAND"

FRAM=$0
FRAMDIR=$(dirname $0)

if [ -d $FRAMDIR/.git ]; then
  FRAMVER="version:$(git -C $FRAMDIR describe --always)"
  FRAMVER=$FRAMVER-$(git -C $FRAMDIR log --oneline | wc -l)
fi

function usage()
{
	# User commands help
	cat <<END

Board FRAM - The Board Farm Remote Access Manager $FRAMVER

Valid commands are:

    help                           This usage information
END
	type "acc-$BOARD-on" >& /dev/null && cat <<END
    acc [on|off|status*]           Control board accessory switch
END
	if type "power-$BOARD-sample" >& /dev/null; then
		sample="|sample"
	else
		filler="       "
	fi
	cat <<END
    console                        Access the board console (use "ssh -t")
    lock                           Lock a board for exclusive access
    steal                          Force release then immediately lock as new user
    ls                             List the TFTP directory contents
    power [on|off$sample|status*]$filler  Control board power
    release                        Release a board lock
    reset                          Reset board
    rsync                          Upload files to TFTP directory (use rsync)
    status                         Show board status
    ssh-proxy                      Open a netcat proxy path to the target
END
	type "ssh-$BOARD" >& /dev/null && cat <<END
    ssh                            SSH directly to the target
END

	type "wake-$BOARD" >& /dev/null && cat <<END
    wake                           Wake board by key
END

	grep -q "\s$BOARD$" /etc/ethers && cat <<END
    wol                            Wake board through Wake-on-LAN
END

	cat <<END

Options marked with an asterisk are the default
END

	# Admin commands help
	test "$ADMIN" == "true" && cat <<END

Valid admin commands are:

    logs                    View and monitor the logs
    all-logs                View and monitor the logs of all boards
    shell                   Launch a shell (use "ssh -t")
    release                 Release a board from any lock

END

	# Show board-specific information, if available
	test -f "$BOARD.txt" && cat "$BOARD.txt"

	exit 0
}

# Load board-specific definitions, if available
test -f "$BOARD.cfg" && source "$BOARD.cfg"

# Initialise defaults
TFTP_ROOT=${TFTP_ROOT:-/var/lib/tftpboot}

# Handle board locking
LOCKFILE=${LOCKFILE:-/var/run/user/$UID/.$BOARD.lockfile}
LOCK_HOLD_TIME=${LOCK_HOLD_TIME:-3600} # seconds

function take_lock()
{
	echo $USER > $LOCKFILE
}

function report_lock()
{
	if [[ ! -e $LOCKFILE ]]; then
		echo "Board is unlocked"
		return 0
	fi

	LOCK_TIME="$(date -r $LOCKFILE +%s)"
	LOCKUSER=$(< $LOCKFILE)
	UNLOCK_TIME=$((LOCK_TIME + LOCK_HOLD_TIME))

	# Lock expired
	if [[ $UNLOCK_TIME < $(date +%s) ]];
	then
		echo "Board is unlocked. Last used by $LOCKUSER at $(date --date @$LOCK_TIME +%c)"
		return 0
	fi

	echo "Board is in use by $LOCKUSER until $(date --date @$UNLOCK_TIME +%c)"
}

function check_lock()
{
	# No lock, no problem.
	if [[ ! -e $LOCKFILE ]]; then
		set -C; set +e
		take_lock
		set +C; set -e

	fi

	LOCK_TIME="$(date -r $LOCKFILE +%s)"
	LOCKUSER=$(< $LOCKFILE)

	# Have lock, no problem.
	if [[ "$LOCKUSER" == "$USER" ]]; then
		# Refresh the timestamp
		take_lock
		return 0
	fi

	UNLOCK_TIME=$((LOCK_TIME + LOCK_HOLD_TIME))

	# Lock expired
	if [[ $UNLOCK_TIME < $(date +%s) ]];
	then
		echo "Board lock released from $LOCKUSER, and now owned by $USER"
		take_lock
		return 0
	fi

	# Lock not expired. Call rejected

	echo -n "Operation denied: "; report_lock

	echo "$(date +'%F %T') $BOARD $USER REJECTED: Board locked by $LOCKUSER" >> fram.log
	exit 13  ## -EACCES - Permission Denied
}

# Admin commands must be enabled explicitly by setting ADMIN_USERS
ADMIN=false
for admin in "${ADMIN_USERS[@]}"; do
    if [ "$USER" == "$admin" ]; then
        ADMIN=true
        break
    fi
done

# Handle help and welcome early, as they do not need locking
case "$SSH_ORIGINAL_COMMAND" in
	help)
		usage
		;;

	"")
		# Welcome banner
		if [ "$ADMIN" == "true" ]; then
			echo "Welcome master $USER, your wish is my command"
		else
			echo "Welcome $USER"
		fi
		exit 0
esac

# Admin commands
if [ "$ADMIN" == "true" ]; then
	case "$SSH_ORIGINAL_COMMAND" in
	logs)
		tail -f fram.log
		exit;
		;;
	all-logs)
		tail -f /tmp/fram.log
		exit;
		;;
	shell)
		exec /bin/bash -l
		;;
	release)
		report_lock
		rm -f $LOCKFILE
		echo "Lock released"
		exit 0
		;;
	scp*)
		$SSH_ORIGINAL_COMMAND
		exit 0
		;;
	esac
fi

# User commands
function parseCommand() {

case "$1" in
	acc)
		check_lock
		# Optional
		if type "acc-$BOARD-on" >& /dev/null; then
			case "$2" in
			on|1)
				"acc-$BOARD-on"
				exit 0
				;;

			off|0)
				"acc-$BOARD-off"
				exit 0
				;;

			status|*)
				"acc-$BOARD-status"
				exit 0
				;;
			esac
		fi
		;;& # fallthrough

	console)
		"screen-$BOARD"
		exit 0
		;;

	lock)
		report_lock
		check_lock
		take_lock
		echo -n "Lock granted: "; report_lock
		exit 0
		;;

	steal)
		report_lock
		take_lock
		echo -n "Board lock stolen: "; report_lock
		exit 0
		;;

	ls)
		exec ls -lAh "$TFTP_ROOT/$BOARD"
		;;

	power)
		case "$2" in
		on|1)
			check_lock
			"power-$BOARD-on"
			exit 0
			;;

		off|0)
			check_lock
			"power-$BOARD-off"
			exit 0
			;;

		sample)
			# Optional
			type "power-$BOARD-sample" >& /dev/null && { "power-$BOARD-sample"; exit 0; }
			;;

		status|*)
			"power-$BOARD-status"
			exit 0
			;;
		esac
		;;& # fallthrough

	release)
		check_lock

		rm $LOCKFILE
		exit 0
		;;
	reset)
		check_lock
		"reset-$BOARD"
		exit 0
		;;

	pwd)
		echo "/"
		;;

	rsync*)
		# Silence check_lock output to prevent breaking rsync. Ideally
		# we should report back failures through the RSync MOTD.
		check_lock >> /dev/null ## Silent operation
		export SSH_ORIGINAL_COMMAND

		if [[ $SSH_ORIGINAL_COMMAND =~ .*nfs ]] ; then
			mkdir -p /opt/root/$BOARD
			exec /usr/bin/rrsync "/opt/root/$BOARD"
		else
			exec /usr/bin/rrsync "$TFTP_ROOT/$BOARD"
		fi
		;;

	scp)
		shift;
		case "$1" in
			-t) shift; scp -t "$TFTP_ROOT/$BOARD"/"$*"; ;;
			*) echo "Not supported?" ;;
		esac
		;;

	status)
		# Report the board lock status
		report_lock

		# Show board status
		power=$("power-$BOARD-status")
		if [ "$power" == "1" ]; then
			power=on
		else
			power=off
		fi
		status="power: $power"

		# Optional
		if type "acc-$BOARD-status" >& /dev/null; then
			acc=$("acc-$BOARD-status")
			if [ "$acc" == "1" ]; then
				acc=on
			else
				acc=off
			fi
			status="$status / acc: $acc"
		fi
		echo "$status"
		exit 0
		;;

	ssh-proxy)
		nc $BOARD_IP 22
		;;


	wait-for-ssh)
		# Allow the visual spinner updates to be disabled
		if [ "$1" = "-s" ]; then
			silent=true
			shift
		fi

		i=0
		spin='-\|/'
		$silent echo -n "Waiting for $BOARD:  "
		until nc -zq 1 $BOARD_IP 22 2>/dev/null; do
			i=$(( (i+1) % 4 ))
			$slient printf "\b${spin:$i:1}"
			sleep 1
		done
		$silent echo ""
		;;

	ssh)
		shift;
		if type "ssh-$BOARD" >& /dev/null; then
			ssh-$BOARD "$@"
		else
			echo "SSH is not supported on this board currently"
		fi
		;;

	wake)
		check_lock
		# Optional
		type "wake-$BOARD" >& /dev/null && { "wake-$BOARD"; exit 0; }
		;;& # fallthrough

	wol)
		check_lock
		# Optional
		grep -q "\s$BOARD$" /etc/ethers && exec wakeonlan "$BOARD"
		;;& # fallthrough

	*)
		echo "Unknown command $SSH_ORIGINAL_COMMAND"
		usage
		;;
esac
}

parseCommand $SSH_ORIGINAL_COMMAND