Add lab-02-security-as-a-system

lab-02-security-as-a-system/scenario/setup.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LAB_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+REPO_ROOT="$(cd "$LAB_DIR/../.." && pwd)"
+
+source "$SCRIPT_DIR/config.sh"
+source "$REPO_ROOT/shared/minicorp/lib/minicorp.sh"
+source "$REPO_ROOT/shared/minicorp/topologies/client-router-server.sh"
+
+printf '\n'
+mc_log "Setting up $LAB_NAME"
+
+#
+# Configuration
+#
+
+if [[ "$LAB_TOPOLOGY" != "client-router-server" ]]; then
+    mc_error "Unsupported topology: $LAB_TOPOLOGY"
+    exit 1
+fi
+
+#
+# Required tools
+#
+
+for command_name in \
+    ip \
+    sysctl \
+    openssl \
+    python3 \
+    ss
+do
+    mc_require_command "$command_name"
+done
+
+#
+# Persistent state
+#
+
+mc_log "Initializing MiniCorp lab state"
+
+"$SCRIPT_DIR/init_state.sh"
+
+source "$LAB_IDENTITY_FILE"
+
+#
+# Runtime service identities
+#
+
+LAB_WEB_SERVICE_ID="web-$(
+    python3 "$SCRIPT_DIR/identity.py" \
+        unpack "${LAB_WEB_SERVICE_TOKEN#web-}"
+)"
+
+LAB_API_SERVICE_ID="api-$(
+    python3 "$SCRIPT_DIR/identity.py" \
+        unpack "${LAB_API_SERVICE_TOKEN#api-}"
+)"
+
+LAB_ADMIN_SERVICE_ID="adm-$(
+    python3 "$SCRIPT_DIR/identity.py" \
+        unpack "${LAB_ADMIN_SERVICE_TOKEN#adm-}"
+)"
+
+#
+# Clean stale runtime
+#
+
+mc_log "Clearing stale MiniCorp runtime"
+
+mc_topology_client_router_server_down \
+    >/dev/null 2>&1 || true
+
+rm -f \
+    "$LAB_WEB_STDOUT" \
+    "$LAB_STATUS_STDOUT" \
+    "$LAB_ADMIN_STDOUT"
+
+#
+# Build network
+#
+
+mc_log "Building MiniCorp virtual network"
+
+mc_topology_client_router_server_up \
+    >/dev/null
+
+if ! mc_topology_client_router_server_check \
+    >/dev/null
+then
+    mc_error "MiniCorp topology validation failed."
+    exit 1
+fi
+
+#
+# Start services
+#
+
+mc_log "Starting MiniCorp services"
+
+sudo ip netns exec "$MC_SERVER_NS" env \
+    MINICORP_SERVICE_HOST="$MC_SERVER_ADDR" \
+    MINICORP_SERVICE_PORT="$LAB_WEB_PORT" \
+    MINICORP_SERVICE_ID="$LAB_WEB_SERVICE_ID" \
+    MINICORP_SERVICE_TOKEN="$LAB_WEB_SERVICE_TOKEN" \
+    MINICORP_EVIDENCE_LOG="$LAB_EVIDENCE_LOG" \
+    python3 -u "$SCRIPT_DIR/web_service.py" \
+    >"$LAB_WEB_STDOUT" 2>&1 &
+
+sudo ip netns exec "$MC_SERVER_NS" env \
+    MINICORP_SERVICE_HOST="$MC_SERVER_ADDR" \
+    MINICORP_SERVICE_PORT="$LAB_STATUS_PORT" \
+    MINICORP_SERVICE_ID="$LAB_API_SERVICE_ID" \
+    MINICORP_SERVICE_TOKEN="$LAB_API_SERVICE_TOKEN" \
+    MINICORP_EVIDENCE_LOG="$LAB_EVIDENCE_LOG" \
+    python3 -u "$SCRIPT_DIR/status_service.py" \
+    >"$LAB_STATUS_STDOUT" 2>&1 &
+
+sudo ip netns exec "$MC_SERVER_NS" env \
+    MINICORP_SERVICE_HOST="$MC_SERVER_ADDR" \
+    MINICORP_SERVICE_PORT="$LAB_ADMIN_PORT" \
+    MINICORP_SERVICE_ID="$LAB_ADMIN_SERVICE_ID" \
+    MINICORP_SERVICE_TOKEN="$LAB_ADMIN_SERVICE_TOKEN" \
+    MINICORP_EVIDENCE_LOG="$LAB_EVIDENCE_LOG" \
+    python3 -u "$SCRIPT_DIR/admin_service.py" \
+    >"$LAB_ADMIN_STDOUT" 2>&1 &
+
+#
+# Verify listeners
+#
+
+for port in \
+    "$LAB_WEB_PORT" \
+    "$LAB_STATUS_PORT" \
+    "$LAB_ADMIN_PORT"
+do
+    ready=0
+
+    for attempt in {1..20}; do
+        if mc_exec "$MC_SERVER_NS" ss -ltn |
+            grep -F "$MC_SERVER_ADDR:$port" \
+                >/dev/null
+        then
+            ready=1
+            break
+        fi
+
+        sleep 0.1
+    done
+
+    if [[ "$ready" -ne 1 ]]; then
+        mc_error \
+            "A required MiniCorp service failed to start."
+        exit 1
+    fi
+done
+
+printf '\n'
+mc_log "$LAB_NAME is ready."