package           : tis-remote-repo-tftp
version           : 2.3.0.13470-2
architecture      : all
section           : base
priority          : optional
name              : Remote Repository TFTP
categories        : System and network
maintainer        : WAPT Team,Tranquil IT,Jimmy PELÉ
description       : Package for installing WaptTFTPServer for remote repositories agents
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : linux
min_wapt_version  : 2.2
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : 
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : b5cbea36-1c66-497a-a51a-4824a7ea1738
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : acf25a5bf4648fb69b647251505df68019472da42a27876e373b9979f0fe1801
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature         : ZplPg6VHZ//6lcCDlQjlT7lt+lGk90KYD2CftdK5jbTTb+GqTqCbkdR0jYuGo9WZrsn0C/4WwNZqnv3w9L20wFZJ4uS02/9SJHjhWTXnWNbuMuv3r44Vvl7BurDJxQj8kpXHqTb7LeBAjHwChVgvFGPh6kF8GPO013EpjfALttGn9RyEEM9ftDqVHaIbq88wJcAP8ToFvx5w9AB8L1DipymtuXeRQFTzZj1JHDDJZ7JAe6EAOPQqbFMrDEG9JyUAGmG7WCS4A5BdsHfysdv5naSbB96uStYbUePNsnDUwxI0ks6NeilIqJcZxdsYBeAoEfXluJFoedWlECMJaK2GRw==
signature_date    : 2023-02-01T13:00:08.325013
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes

# -*- coding: utf-8 -*-
from setuphelpers import *
import re

bin_name = "wapttftpserver.bin"
service_name = "wapttftpserver"


def install():
    tftp_bin = os.path.join(WAPT.wapt_base_dir, bin_name)
    if service_is_enabled(service_name):
        run("systemctl stop %s" % service_name)
    killalltasks(bin_name)
    filecopyto(bin_name, tftp_bin)
    run("chmod +x %s" % tftp_bin)

    # print("Apply wapttftpserver config")
    repo_path = inifile_readstring(WAPT.config_filename, "repo-sync", "local_repo_path")
    if not repo_path:
        if is_debian_based():
            repo_path = "/var/www"
        elif is_redhat_based():
            repo_path = "/var/www/html"
        else:
            makepath(WAPT.wapt_base_dir, "repository")
    tftp_path = makepath(repo_path, "wads", "pxe")
    mkdirs(tftp_path)
    # server_conf_dir = makepath(WAPT.wapt_base_dir, "conf")
    # server_ini = makepath(server_conf_dir, "waptserver.ini")
    # mkdirs(server_conf_dir)
    # inifile_writestring(server_ini, "tftpserver", "service_name", service_name)
    # inifile_writestring(server_ini, "tftpserver", "root_dir", tftp_path)

    if is_redhat_based():
        print("Add wapttftpserver firewall rule")
        setup_firewall()

        package_prefix = control.package.split("-", 1)[0]
        pkg_name = package_prefix + "-" + "remote-repo-nginx"
        if not WAPT.is_installed(pkg_name):
            # SELinux rules for CentOS/RedHat
            if re.match("^SELinux status:.*enabled", run("sestatus")):
                print("Redhat/Centos detected, tweaking SELinux rules")
                selinux_rules(repo_path)
                print("Nginx - SELinux correctly configured for Nginx reverse proxy")

    print("Create wapttftpserver service")
    if is_debian_based():
        shutil.copy2(
            os.path.join("scripts", "wapttftpserver-debian.service"),
            os.path.join("/", "usr", "lib", "systemd", "system", "wapttftpserver.service"),
        )
    else:
        shutil.copy2(
            os.path.join("scripts", "wapttftpserver-redhat.service"),
            os.path.join("/", "usr", "lib", "systemd", "system", "wapttftpserver.service"),
        )
        run("chmod 644  /usr/lib/systemd/system/wapttftpserver.service")
        run("chcon -vR system_u:object_r:systemd_unit_file_t:s0  /usr/lib/systemd/system/wapttftpserver.service")

    run("systemctl enable /usr/lib/systemd/system/%s.service" % service_name)
    run("systemctl restart %s.service" % service_name)


def uninstall():
    tftp_bin = os.path.join(WAPT.wapt_base_dir, bin_name)
    server_conf_dir = makepath(WAPT.wapt_base_dir, "conf")

    print("Disable wapttftpserver service")
    if service_is_enabled(service_name):
        run("systemctl disable %s" % service_name)
    run("systemctl stop %s" % service_name)

    if isfile(tftp_bin):
        remove_file(tftp_bin)
    if len(glob.glob(server_conf_dir + os.sep + "*")) == 1:
        remove_tree(server_conf_dir)


def setup_firewall():
    """Add permanent rules for firewalld"""
    if not type_redhat():
        # only firewalld is supported right now
        return
    # check if firewalld is running
    if run("firewall-cmd --state", accept_returncodes=[0, 252]).strip() == "running":
        run("firewall-cmd --permanent --add-service=tftp")
        run("firewall-cmd --reload")
    else:
        run("firewall-offline-cmd --add-service=tftp")


def selinux_rules(local_repo):
    """SELinux httpd security rules"""
    run("setsebool -P httpd_can_network_connect 1")
    run("setsebool -P httpd_setrlimit on")
    for sepath in "wads":
        path = makepath(local_repo, sepath)
        mkdirs(path)
        try:
            run('semanage fcontext -a -t httpd_sys_content_t "%s(/.*)?"' % (path))
        except:
            run('semanage fcontext -m -t httpd_sys_content_t "%s(/.*)?"' % (path))
        run("restorecon -R -v %s" % (path))


def service_is_enabled(service):
    try:
        res = run("systemctl is-enabled %s" % service)
        return res.splitlines()[0] == "enabled"
    except:
        return False

# -*- coding: utf-8 -*-
from setuphelpers import *
import json


def update_package():
    # Declaring local variables
    package_updated = False
    proxies = get_proxies()
    if not proxies:
        proxies = get_proxies_from_wapt_console()
    download_url = "https://wapt.tranquil.it/wapt/releases/latest/binaries/linux/wapttftpserver.bin"
    latest_bin = download_url.split("/")[-1]
    version = json.loads(wgets("https://wapt.tranquil.it/wapt/releases/latest/wapt_agent_list.json", proxies=proxies))[0]["wapt_version"]

    # Deleting binaries
    for f in glob.glob("*.exe") + glob.glob("*.msi") + glob.glob("*.bin"):
        print("Removing: %s" % f)
        remove_file(f)

    # Downloading latest binaries
    print("Download URL is: %s" % download_url)
    if not isfile(latest_bin):
        print("Downloading: %s" % latest_bin)
        wget(download_url, latest_bin, proxies=proxies)
    else:
        print("Binary is present: %s" % latest_bin)

    # Changing version of the package
    if Version(version) > Version(control.get_software_version()):
        print("Software version updated (from: %s to: %s)" % (control.get_software_version(), Version(version)))
        package_updated = True
    else:
        print("Software version up-to-date (%s)" % Version(version))
    control.set_software_version(version)
    control.save_control_to_wapt()

    # Validating or not update-package-sources
    return package_updated