zfs-branch and ssh-port

core/base.module.sh

@@ -5,10 +5,10 @@
 
 
 
-function checkAllInputParameters() {
+function base.checkAllInputParameters() {
     local _ALLOWED_CHARS _ARG _SUCCESS
     # Global whitelist for all start-parameters ($1, $2, ...)
-    _ALLOWED_CHARS='-[:alnum:]_.:'
+    _ALLOWED_CHARS='-[:alnum:]/_.:'
     readonly _ALLOWED_CHARS
 
     _SUCCESS="true"
@@ -16,12 +16,12 @@ function checkAllInputParameters() {
         if [[ -n "${_ARG}" ]]; then
             # Has to start with an alphanumeric char or --
             if [[ ! "${_ARG}" =~ ^[[:alnum:]] ]] && [[ ! "${_ARG}" =~ ^--[[:alnum:]] ]]; then
-                echo "❌ Security: No special character is allowed at the bginning of the parameter: '${_ARG}'" >&2
+                echo "❌ Security base.checkAllInputParameters(): No special character is allowed at the beginning of the parameter: '${_ARG}'" >&2
                 _SUCCESS="false"
             fi
             # No forbidden character is allowed to remain
             if [[ -n "${_ARG//[${_ALLOWED_CHARS}]/}" ]]; then
-                echo "❌ Security: Illegal character found in parameter: '${_ARG}'" >&2
+                echo "❌ Security base.checkAllInputParameters(): Illegal character found in parameter: '${_ARG}'" >&2
                 _SUCCESS="false"
             fi
         fi
@@ -33,7 +33,7 @@ function checkAllInputParameters() {
     return 1
 }
 
-function checkScriptforCorrectAssignments() {
+function base.checkScriptforCorrectAssignments() {
     local _LN=0
     local _SUCCESS="true"
 
@@ -326,7 +326,7 @@ function base.set() {
         && readonly "${_VARNAME}" \
         && return 0
 
-    echo "❌ Security: Validation '$_REGEX' failed for ${_VARNAME}" >&2
+    echo "❌ Security base.set(): Validation '$_REGEX' failed for ${_VARNAME}" >&2
     exit 1
 }
 
@@ -354,13 +354,13 @@ if [ "${BASH_SOURCE[0]}" == "${0}" ]; then
 else
     # If not exists, define a global array 'COLOR'
     trap "base.abort '  User-initiated termination.'" INT \
-        && checkAllInputParameters "${@}" \
         && declare -A -g COLOR=([SET]=unprepared) \
         && prepare.setCOLOR \
         && prepare.setPATH "/bin/grep" \
         && declare -A -g CIS=([SET]=unprepared) \
         && prepare.setCIS \
-        && checkScriptforCorrectAssignments \
+        && base.checkAllInputParameters "${@}" \
+        && base.checkScriptforCorrectAssignments \
         || base.abort "The necessary preparations have failed."
 
     base.log debug "Module '${BASH_SOURCE[0]}' loaded by script: ${0}"

definitions/default/hosts/all/etc/sudoers.d/allow-composition-sync-send

@@ -1,9 +1,10 @@
-# Definition: 2 mandantory parameter, 3. and 4. are optional
+# Definition: 3 mandantory parameter, 4. and 5. are optional
 # [[:space:]]+        -> Expects at least on space character
 # ( ... )?            -> defines the group as optional
 Cmnd_Alias C_COMPOSITION_SYNC = \
     /cis/script/host/zfs/composition-sync/sync-send.sh \
-        ^[a-zA-Z0-9][a-zA-Z0-9._-]* \
+        ^[a-zA-Z0-9][a-zA-Z0-9.-]* \
+         [a-zA-Z][a-zA-Z0-9/_-]*[a-zA-Z0-9] \
          [a-zA-Z0-9][a-zA-Z0-9_-]* \
         ([a-zA-Z0-9][a-zA-Z0-9._:-]*)? \
         ([a-zA-Z0-9][a-zA-Z0-9._:-]*)?$

script/host/zfs/composition-sync/sync-send.sh

@@ -94,14 +94,15 @@ function sendResume() {
 }
 
 function send() {
-    local _COMPOSITION _RECEIVERHOST _RECEIVERS_SNAPSHOT _NOW _ZFS _NEW_SNAPSHOT
+    local _ZFS_BRANCH _COMPOSITION _RECEIVERHOST _RECEIVERS_SNAPSHOT _NOW _ZFS _NEW_SNAPSHOT
-    _COMPOSITION="${1:?"send(): Missing first parameter COMPOSITION"}"
+    _ZFS_BRANCH="${1:?"send(): Missing first parameter ZFS_BRANCH"}"
-    _RECEIVERHOST="${2:?"send(): Missing second parameter RECEIVERHOST"}"
+    _COMPOSITION="${2:?"send(): Missing first parameter COMPOSITION"}"
-    _RECEIVERS_SNAPSHOT="${3}"
+    _RECEIVERHOST="${3:?"send(): Missing second parameter RECEIVERHOST"}"
+    _RECEIVERS_SNAPSHOT="${4}"
     _NOW=$(date -u "+%Y-%m-%d_%H:%M:%SZ")
-    _ZFS="zpool1/persistent/${_COMPOSITION:?"Missing COMPOSITION"}"
+    _ZFS="${_ZFS_BRANCH:?"Missing ZFS_BRANCH"}/${_COMPOSITION:?"Missing COMPOSITION"}"
     _NEW_SNAPSHOT="${_ZFS:?"Missing ZFS"}@SYNC_${_RECEIVERHOST:?"Missing RECEIVERHOST"}_${_NOW:?"Missing NOW"}"
-    readonly _COMPOSITION _RECEIVERHOST _RECEIVERS_SNAPSHOT _NOW _ZFS _NEW_SNAPSHOT
+    readonly _ZFS_BRANCH _COMPOSITION _RECEIVERHOST _RECEIVERS_SNAPSHOT _NOW _ZFS _NEW_SNAPSHOT
 
     # This common snapshot is the starting-point, if available.
     ! _COMMON_SNAPSHOT=$(printFoundCommonSnapshot "${_ZFS}" "${_RECEIVERHOST}" "${_RECEIVERS_SNAPSHOT}") \
@@ -125,13 +126,15 @@ function send() {
 
 
 # Parameter 1: Only alphanumeric characters allowed and [._-]  if not leading (due to: -oProxyCommand=...).
-# Parameter 2: Only alphanumeric characters allowed and [.-]   if not leading (due to: -oProxyCommand=...).
+# Parameter 2: Only alphanumeric characters allowed and [/_-]  if not leading (due to: -oProxyCommand=...).
-# Parameter 3: Only alphanumeric characters allowed and [._:-] if not leading (due to: -oProxyCommand=...), but can be empty.
+# Parameter 3: Only alphanumeric characters allowed and [.-]   if not leading (due to: -oProxyCommand=...).
 # Parameter 4: Only alphanumeric characters allowed and [._:-] if not leading (due to: -oProxyCommand=...), but can be empty.
+# Parameter 5: Only alphanumeric characters allowed and [._:-] if not leading (due to: -oProxyCommand=...), but can be empty.
 base.set RECEIVERHOST "${1}" '^[a-zA-Z0-9][a-zA-Z0-9._-]*$' || exit 1
-base.set COMPOSITION "${2}" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$' || exit 1
+base.set ZFS_BRANCH "${2}" '^[a-zA-Z][a-zA-Z0-9/_-]*[a-zA-Z0-9]$' || exit 1
-base.set RECEIVERS_SNAPSHOT "${3}" '(^[a-zA-Z0-9][a-zA-Z0-9._:-]*$)?' || exit 1
+base.set COMPOSITION "${3}" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$' || exit 1
-base.set RESUME_TOKEN "${4}" '(^[a-zA-Z0-9][a-zA-Z0-9._:-]*$)?' || exit 1
+base.set RECEIVERS_SNAPSHOT "${4}" '(^[a-zA-Z0-9][a-zA-Z0-9._:-]*$)?' || exit 1
+base.set RESUME_TOKEN "${5}" '(^[a-zA-Z0-9][a-zA-Z0-9._:-]*$)?' || exit 1
 
 # Resume mode
 if [ "${RECEIVERS_SNAPSHOT}" == "RESUME" ]; then
@@ -141,7 +144,7 @@ if [ "${RECEIVERS_SNAPSHOT}" == "RESUME" ]; then
     exit $?
 fi
 
-send "${COMPOSITION}" "${RECEIVERHOST}" "${RECEIVERS_SNAPSHOT}" \
+send "${ZFS_BRANCH}" "${COMPOSITION}" "${RECEIVERHOST}" "${RECEIVERS_SNAPSHOT}" \
     && exit 0
 
 echo "Failure in sync-send.sh: Something unexpected happend." >&2

script/host/zfs/composition-sync/sync.sh

@@ -119,17 +119,19 @@ function removeOutdatedSyncSnapshots() {
 }
 
 function receive() {
-    local _RECEIVERHOST _COMPOSITION _SSH_PORT _DEFINITIONS  _SOURCEHOST _SSH_COMMAND _SEND_SCRIPT _ZFS_BRANCH _ZFS
+    local _RECEIVERHOST _COMPOSITION _SOURCEHOST _SSH_PORT _SSH_COMMAND _SEND_SCRIPT _ZFS_BRANCH _ZFS
     _RECEIVERHOST="${1:?"receive(): Missing first parameter RECEIVERHOST"}"
     _COMPOSITION="${2:?"receive(): Missing second parameter COMPOSITION"}"
-    _SSH_PORT="${3:-22}"
+    _SOURCEHOST=$(head -n 1 "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION}/current-host" 2> /dev/null)
-    _SOURCEHOST=$(cat "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION}/current-host")
+    base.set _SOURCEHOST "${_SOURCEHOST}" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$'
+    _SSH_PORT=$(head -n 1 "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION}/ssh-port" 2> /dev/null)
+    base.set _SSH_PORT "${_SSH_PORT:-22}" '^[1-9][0-9]{1,4}$'
     _SSH_COMMAND="ssh -p ${_SSH_PORT} -o ConnectTimeout=20 -o ServerAliveInterval=15 -C composition-sync@${_SOURCEHOST}"
     _SEND_SCRIPT="${CIS[SCRIPTSROOT]:?"Missing CIS_SCRIPTSROOT"}host/zfs/composition-sync/sync-send.sh"
-    _ZFS_BRANCH=$(cat "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION}/zfs-branch")
+    _ZFS_BRANCH=$(head -n 1 "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION}/zfs-branch" 2> /dev/null)
-    _ZFS_BRANCH="${_ZFS_BRANCH:-zpool1/persistent}"
+    base.set _ZFS_BRANCH "${_ZFS_BRANCH:-zpool1/persistent}" '^[a-zA-Z][a-zA-Z0-9/_-]*[a-zA-Z0-9]$'
     _ZFS="${_ZFS_BRANCH%/}/${_COMPOSITION}-BACKUP"
-    readonly _RECEIVERHOST _COMPOSITION _SSH_PORT _DEFINITIONS _SOURCEHOST _SSH_COMMAND _SEND_SCRIPT _ZFS_BRANCH _ZFS
+    readonly _RECEIVERHOST _COMPOSITION _SSH_COMMAND _SEND_SCRIPT _ZFS_BRANCH _ZFS
     (
         flock -n 9 || exit 1
 
@@ -147,17 +149,17 @@ function receive() {
         fi
 
         # Add "-s" for resumable streams in the next line at zfs receive. Not done yet because of: cannot receive resume stream: kernel modules must be upgraded to receive this stream.
-        ${_SSH_COMMAND} "sudo ${_SEND_SCRIPT:?"Missing SEND_SCRIPT"} \"${_RECEIVERHOST}\" \"${_COMPOSITION}\" \"${_COMMON_SNAPSHOT#${_ZFS}@}\" \"${_RESUME_TOKEN}\"" | zfs receive -v "${_ZFS}"
+        ${_SSH_COMMAND} "sudo ${_SEND_SCRIPT:?"Missing SEND_SCRIPT"} \"${_RECEIVERHOST}\" \"${_ZFS_BRANCH}\" \"${_COMPOSITION}\" \"${_COMMON_SNAPSHOT#${_ZFS}@}\" \"${_RESUME_TOKEN}\"" | zfs receive -v "${_ZFS}"
         if [ $? -ne 0 ]; then
-            tryRollbackToRepair "${_RECEIVERHOST}" "${_ZFS}" && return 0
             echo "Unable to receive stream using these settings:"
             echo "  - Sending host:     ${_SOURCEHOST}:${_SSH_PORT}"
             echo "  - Receiving host:   ${_RECEIVERHOST}"
             echo "  - Composition:      ${_COMPOSITION}"
-            echo "  - Offered snapshot: ${_COMMON_SNAPSHOT}"
+            echo "  - Offered snapshot: ${_ZFS}@${_COMMON_SNAPSHOT#${_ZFS}@}"
             echo "  - Resume token:     ${_RESUME_TOKEN}"
             echo "Current state of snapshots:"
             zfs list -t snapshot "${_ZFS}" 2> /dev/null | tail
+            tryRollbackToRepair "${_COMPOSITION}" "${_RECEIVERHOST}" "${_ZFS}" && return 0
             return 1
         fi
 
@@ -178,8 +180,9 @@ function tryRollbackToRepair() {
     _RECEIVERHOST="${2:?"tryRollbackToRepair(): Missing second parameter RECEIVERHOST"}"
     _ZFS="${3:?"tryRollbackToRepair(): Missing third parameter ZFS"}"
     _ROLLBACK_DAY=$(head -n 1 "${CIS[DOMAINDEFINITIONS]:?"Missing CIS_DOMAINDEFINITIONS"}compositions/${_COMPOSITION:?"Missing COMPOSITION"}/rollback")
+    base.set _ROLLBACK_DAY "${_ROLLBACK_DAY:-'2020-01-01'}" '^[0-9]{4}-[0-9]{2}-[0-9]{2}$'
     _ROLLBACK_SNAPSHOT=$(zfs list -H -o name -S creation -t snapshot "${_ZFS}" | head -n 1 | grep -F -- "@SYNC_${_RECEIVERHOST}_${_ROLLBACK_DAY}_")
-    readonly _COMPOSITION _RECEIVERHOST _ZFS _ROLLBACK_DAY _ROLLBACK_SNAPSHOT
+    readonly _COMPOSITION _RECEIVERHOST _ZFS _ROLLBACK_SNAPSHOT
 
     # Nothing to do
     [ -z "${_ROLLBACK_SNAPSHOT}" ] && return 0
@@ -196,11 +199,9 @@ function tryRollbackToRepair() {
 
 # Parameter 1: only one of these values are allowed (--all, --once, --loop)
 # Parameter 2: is optional '()?' and only a subset of alphanumeric characters are allowed and [_-] if not leading (due to: -oProxyCommand=...).
-# Parameter 3: only digests between 10-99999 are allowed
+# Value 3    : only a subset of alphanumeric characters are allowed and [.-] if not leading (due to: -oProxyCommand=...).
-# Value 4    : only a subset of alphanumeric characters are allowed and [.-] if not leading (due to: -oProxyCommand=...).
 base.set MODE "${1}" '^(--all|--once|--loop)$'
 base.set COMPOSITION "${2}" '^([a-zA-Z0-9][a-zA-Z0-9_-]*)?$'
-base.set SSH_PORT "${3:-22}" '^[1-9][0-9]{1,4}$'
 base.set RECEIVERHOST "$(hostname -b)" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$'
 
 [ "${MODE}" == "--all" ] \
@@ -209,11 +210,11 @@ base.set RECEIVERHOST "$(hostname -b)" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$'
     && exit 0
 
 [ "${MODE}" == "--once" ] \
-    && receive "${RECEIVERHOST}" "${COMPOSITION}" "${SSH_PORT}" \
+    && receive "${RECEIVERHOST}" "${COMPOSITION}" \
     && exit 0
 
 [ "${MODE}" == "--loop" ] && while true; do
-    receive "${RECEIVERHOST}" "${COMPOSITION}" "${SSH_PORT}" \
+    receive "${RECEIVERHOST}" "${COMPOSITION}" \
         && echo "Sleep for 5s" \
         && sleep 5 \
         && echo \