pdu-update

#!/usr/bin/env perl

use strict;
use warnings;

use URI;
use Getopt::Std;
use Net::OpenSSH;
use Net::Telnet;
use Net::FTP;
use Net::Ping;
use File::Temp;
use Data::Validate::IP;
use Socket;

#
# Supports:
# * ServerTech PRO1/PRO2 and Switched CDU Power Distribution Units
# * Schneider Electric APC AP8XXX Rack PDUs
#
# This script does two things for two different kinds of rack/cabinet PDUs:
# 1. It checks and then performs firmware upgrades of the PDU management cards
# 2. It can optionall run a list of commands on the PDU prior to the above.
#
# The requirement for this script is a working FTP server where the firmware
# for both the STech and APC PDUs will reside, along with an associated
# text file which contains the desired version info for each brand of PDU.
#
# The expected directory structure on the FTP server is as follows:
# ServerTech PDUs:
#     /pdu/sentry/
#              -> current-pro.txt    (PRO series version file. ex: "8.0k")
#              -> current-swcdu.txt  (Switched CDU version file. ex: "7.1c")
#              -> pro-vXX.bin        (PRO series firmware ex: pro-v80k.bin)
#              -> swcdu-vXX.bin      (Switched CDU fimrware ex: swcdu-v71c.bin)
#
#     /pdu/apc/
#              -> current-apc.txt          (APC PDU version info. See below)
#              -> apc_hw05_aos_XXX.bin     (AOS firmware image)
#              -> apc_hw05_rpdu2g_652.bin  (App firmware image)
#              -> apc_hw05_bootmon_108.bin (Bootmon firmware image)
#
# The current-apc.txt file format is more than just a version string since we
# must track the versions of 3 separate firmware images for APC PDUs. The file
# format is as follows:
#
# aos=6.5.2
# rpdu2g=6.5.2
# bootmon=1.0.8
#

our %opt;
our $pdu_ip;
our $ssh;
our $telnet;
our %pdu_info;

my $opts = 'chnu:U:P:';
getopts("$opts", \%opt) or usage();
usage() if $opt{h};

#
# ServerTech CDU/PDU default creds are 'admn' and 'admn'
# We first try to read the credentials from two env vars:
# $PDU_USER and $PDU_PASS
#
# If the -U or -P flags were specified, we then use the
# values provided with them.
#
our $pdu_user = $ENV{'PDU_USER'} || 'admn';
our $pdu_pass = $ENV{'PDU_PASS'} || 'admn';
$pdu_user = $opt{U} if $opt{U};
$pdu_pass = $opt{P} if $opt{P};

#
# The FTP server paramters we program into each PDU
# Define a default, and then use -u if specified.
#
# NOTE: as of firmware 7.1c and 8.0k, only FTP is supported
# on ServerTech PDUs as a firmware fetching protocol. One day we might
# get http/https as an option, hence the URI format.
#
my $url = 'ftp://ftp:pdu-update@10.66.128.19/';
$url = $opt{u} if $opt{u};

my $fw_url = URI->new($url);

if ($fw_url->scheme() ne "ftp") {
	die "Currently only ftp:// URLs are supported!";
}

my $ftp_userinfo = $fw_url->userinfo();

our $ftp_user = $1 if $ftp_userinfo =~ /(.*):.*/;
our $ftp_pass = $1 if $ftp_userinfo =~ /.*:(.*)/;
our $ftp_server = $fw_url->host();
our $ftp_path = "";

# We expect to operate on at least one IP/hostname
my @pdus;
if (@ARGV) {
	@pdus = @ARGV;
} else {
	usage();
}

my $ip_validator = Data::Validate::IP->new;

#
# Iterate over each IP address given on the command line
#
foreach $pdu_ip (@pdus) {

	%pdu_info = ();

	# Resolve hostnames to IPs, and mke sure we get a valid IP.
	unless ( $ip_validator->is_ipv4($pdu_ip) ) {
		my $packed_ip = inet_aton($pdu_ip)
			or die "could not resolve $pdu_ip";
		$pdu_ip = inet_ntoa($packed_ip);
	}

	print "Connecting to $pdu_ip ...\n";

	# In order to SSH to APC and ServerTech PDUs, we need to enable some
	# crypto options which OpenSSH has removed from its default set
	# (read: they're bad crypto.) We initialize the OpenSSH object with
	# options to enable them, as well as quiet the Host Key checking. We
	# then initialize a Net::Telnet object and wire that over the OpenSSH
	# pty to issue commands to the PDU's CLI.
	$ssh = Net::OpenSSH->new($pdu_ip, (
		master_opts => [
			-o => 'KexAlgorithms=+diffie-hellman-group1-sha1',
			-o => 'HostKeyAlgorithms=+ssh-dss',
			-o => 'Ciphers=+aes256-cbc',
			-o => 'LogLevel=QUIET',
			-o => 'StrictHostKeyChecking=no'
			],
		user => $pdu_user,
		password => $pdu_pass
	));

	my ($pty, $pid) = $ssh->open2pty({stderr_to_stdout => 1})
		or die "unable to start remote shell: $ssh->error";

	$telnet = Net::Telnet->new(
		Fhopen => $pty,
		# Dump_Log => '/tmp/dumplog',
		Telnetmode => 0,
		Cmd_remove_mode => 1,
		Timeout => 10,
		Errmode => 'die',
		Prompt  => '/(Switched [CP]DU: |apc>)/'
	);

	# Wait for a string to show up which matches the prompt regex we
	# set. Once we see it, echo a line feed to get last_prompt populated
	# so that we can make a determination as to what brand of PDU we are
	# dealing with. Yeah, it's silly.
	$telnet->waitfor($telnet->prompt);
	$telnet->cmd('');
	my $prompt = $telnet->last_prompt;

	# Use the prompt style to determine if we are a ServerTech ('stech')
	# or an APC ('apc') PDU. Die if we cannot determine the PDU type.
	if ($prompt =~ /Switched [CP]DU: /) {
		$pdu_info{brand} = 'stech';
		process_stech();
	} elsif ($prompt eq 'apc>') {
		$pdu_info{brand} = 'apc';
		process_apc();
	} else {
		die "FATAL: Could not determine PDU type!";
	}

	$telnet->close;
	waitpid($pid, 0);
}

#
# Gets info on, optionally runs CLI commands on, and if needed upgrades the
# firmware. The firmware upgrade process is straight forward but kind of
# limited. We program FTP server parameters over the CLI and then tell the PDU
# to do a upgrade reboot, where it will then take the FTP info to fetch the
# firmware image from an FTP server and perform the upgrade.
#
sub process_stech {

	my $cmd_file = "";
	my $ver_file = "";
	my $restart_needed = undef;
	$ftp_path = "/pdu/sentry";

	$telnet->print('set option more disabled')
		or die "command failed: set option more disabled";

	# Figure out what kind of ServerTech PDU model we are.
	# PRO1/PRO2 and non-PRO PDU/CDUs are referred to differently:
	# PRO1/PRO2 PDU = "PDU"
	# Switched CDU = "CDU" (Cabinet Distribution Unit)
	# We use this info to then set which firmware version file to check
	# as well as which command file we may need to run, if asked to.
	$telnet->waitfor($telnet->prompt);
	my @output = $telnet->cmd('show system')
		or die "command failed: show system";

	foreach (@output) {
		if (/:\s+Sentry Switched (PDU|CDU) Version (.*)/) {
			my $model = $1;
			$pdu_info{fw_ver} = $2;

			if ($model eq "PDU") {
				$pdu_info{model} = "pro";
				$ver_file = "current-pro.txt";
				$cmd_file = "cmds-pro.txt";
			} elsif ($model eq "CDU")  {
				$pdu_info{model} = "swcdu";
				$ver_file = "current-swcdu.txt";
				$cmd_file = "cmds-swcdu.txt";
			} else {
				die "FATAL: Could not determine PDU model!";
			}
		}
	}

	die "FATAL: Could not determine PDU model!" unless $pdu_info{model};

	print "$pdu_ip is of type " . uc($pdu_info{brand}) . " " .
		uc($pdu_info{model}) . ", firmware " . $pdu_info{fw_ver} . "\n";

	# Get our wanted firmware version level from the FTP server
	my $wanted_ver = get_wanted_ver($ftp_path . "/" . $ver_file);

	# If -c was specified, run any command file
	if ($opt{c}) {
		$restart_needed = run_commands($cmd_file);
	}

	# Skip firmware updates if -n was specified
	next if $opt{n};

	# See if we need to upgrade the PDU. Do so if yes. Doing so would
	# initiate a reset of the PDU. Else, report that firmware is up to
	# date, and check if any commands we ran flagged the unit for a
	# restart and do that if needed. Restarting the PDU does NOT cut power!
	if ($pdu_info{fw_ver} ne $wanted_ver) {
		print "$pdu_ip firmware not current: " .
			"Has $pdu_info{fw_ver}, Want $wanted_ver\n";
		update_stech_fw($wanted_ver);
	} else {
		print "$pdu_ip firmware is up to date: " .
			$pdu_info{fw_ver} . "\n";

		if ($restart_needed) {
			print "$pdu_ip Commands were ran which require" .
				" the PDU be restarted. Restarting...\n";
			$telnet->print('restart')
				or die "cmd restart failed";

			# Answer confirm restart yes/no prompt
			# We need to pause for 2 seconds after answering
			# because if we close the session too quickly, the
			# restart process will abort.
			$telnet->waitfor('/want to restart\?? \(Y\/es N\/o\): /')
				or die "did not receive restart confirm prompt: " .
					$telnet->lastline;
			$telnet->print('y');
			sleep 2;
		} else {
			print "$pdu_ip no PDU restart required. Done.\n";
		}
	}
}

#
# Sets up PDU with firmware FTP settings and initiates PDU restart in order
# to download and apply the new firmware.
#
sub update_stech_fw {
	my $fw_ver = shift;

	# Derive the firmware filename we want based on whether we are
	# a PRO or non-PRO PDU, and deired firmware version string (with
	# no dots).
	$fw_ver =~ s/\.//;

	my $fw_file;
	if ($pdu_info{model} eq "swcdu") {
		$fw_file = "swcdu-v" . $fw_ver . ".bin";
	} elsif ($pdu_info{model} eq "pro") {
		$fw_file = "pro-v" . $fw_ver . ".bin";
	}

	# Set up our ftp parameters in order to fetch the firmware
	print "$pdu_ip Setting FTP parameters in PDU...\n";

	$telnet->print('set ftp host ' . $ftp_server) 
		or die "cmd set ftp host failed";
	$telnet->print('set ftp username ' . $ftp_user) 
		or die "cmd set ftp username failed";
	$telnet->print('set ftp password ' . $ftp_pass) 
		or die "cmd set ftp password failed";
	$telnet->print('set ftp directory ' . $ftp_path) 
		or die "cmd set ftp directory failed";
	$telnet->print('set ftp filename ' . $fw_file) 
		or die "cmd set ftp filename failed";


	# Initiate firmware update with 'restart ftpload'
	print "$pdu_ip Restarting PDU to load new firmware...\n";
	$telnet->print('restart ftpload')
		or die "cmd restart ftpload failed";

	# Answer confirm restart yes/no prompt
	# We need to pause for 2 seconds after answering because if we
	# close the session too quickly, the restart process will abort.
	$telnet->waitfor('/want to restart\?? \(Y\/es N\/o\): /')
		or die "did not receive restart confirm prompt: " .
			$telnet->lastline;
	$telnet->print('y');
	sleep 2;
}

#
# Sets up PDU to get new firmware. Unlike ServerTech PDUs, APC PDUs have no way
# of fetching new firmware from a source - you have to use either FTP or SCP to
# copy the files to the PDU's filesystem, and then issue a reboot over the CLI.
#
# APC PDUs have 3 firmware components: AOS, App (rpdu2g), and Bootmon. Per the
# PDU docs, the Bootmon image must be upgraded first, before the AOS and App
# images. After each image is uploaded to the PDU, the PDU automatically unpacks
# it and reboots the PDU management card. This is normal and can happen up to
# 3 times if all 3 firmware components require upgrading. This is very annoying.
#
# http://www.apc.com/salestools/MLAN-9F8QVU/MLAN-9F8QVU_R6_EN.pdf
#
sub process_apc {

	my $cmd_file = "cmds-apc.txt";
	my $ver_file = "current-apc.txt";
	my $restart_needed = undef;
	$ftp_path = "/pdu/apc";

	my @output;

	@output = $telnet->cmd('prodinfo')
		or die "command failed: about";

	foreach (@output) {
		$pdu_info{model} = $1 if (/^Model:\s+(.*)/);
	}

	die "FATAL: Could not determine PDU model!"
		unless $pdu_info{model};


	@output = $telnet->cmd('system')
		or die "command failed: system";

	foreach (@output) {
		$pdu_info{aos_ver} = $1 if (/^AOS:\s+aos:v(\S+)/);
		$pdu_info{rpdu2g_ver} = $1 if (/^App:\s+rpdu2g:v(\S+)/);
		$pdu_info{bootmon_ver} = $1 if (/^Bootmon:\s+bootmon:v(\S+)/);
	}

	die "FATAL: Could not determine PDU aos version!"
		unless $pdu_info{aos_ver};
	die "FATAL: Could not determine PDU app version!"
		unless $pdu_info{rpdu2g_ver};
	die "FATAL: Could not determine PDU bootmon version!"
		unless $pdu_info{bootmon_ver};

	print "$pdu_ip is of type " . uc($pdu_info{brand}) . " " .
		uc($pdu_info{model}) . ": " .
		"AOS=" . $pdu_info{aos_ver} . ", " .
		"App=" . $pdu_info{rpdu2g_ver} . ", " .
		"Bootmon=" . $pdu_info{bootmon_ver} . "\n";

	# If -c was specified, run any command file
	if ($opt{c}) {
		$restart_needed = run_commands($cmd_file);
	}

	# Skip firmware updates if -n was specified
	next if $opt{n};

	# Get our desired firmware version level from the FTP server
	my @wanted_ver = split(/^/,
		get_wanted_ver($ftp_path . "/" . $ver_file));

	foreach (@wanted_ver) {
		$pdu_info{aos_ver_want} = $1 if (/^aos=(\S+)$/);
		$pdu_info{rpdu2g_ver_want} = $1 if (/^rpdu2g=(\S+)$/);
		$pdu_info{bootmon_ver_want} = $1 if (/^bootmon=(\S+)$/);
	}

	# Iterate over each firmware type and see if any need to be updated.
	# The ordering is important here, as bootmon should be uploaded prior
	# to the others.
	foreach my $fw_type (qw / bootmon aos rpdu2g /) {
		my $have = $fw_type . "_ver";
		my $want = $fw_type . "_ver_want";

		if ($pdu_info{$have} ne $pdu_info{$want}) {
			print "$pdu_ip $fw_type not current: " .
				"Have: $pdu_info{$have}, " .
				"Want: $pdu_info{$want}\n";
			update_apc_fw($fw_type, $pdu_info{$want});
		} else {
			print "$pdu_ip $fw_type is up to date: " .
				"$pdu_info{$have}\n";
		}
	}
}

#
# Does the necessary things to update an APC PDU's firmware. See the large
# block comment before process_apc() to get an idea about what's involved.
# It sucks, and we do a lot of things here to be careful of wonky connectivity
# edge cases. Needless to say, The APC PDU firmware upgrade process is probably
# one of the worst I've encountered.
#
sub update_apc_fw {
	my $fw_type = shift;
	my $fw_ver = shift;

	# De-periodize the version string
	$fw_ver =~ s/\.//g;

	# Construct the expected firmware image name, as provided by APC
	my $fw_file = "apc_hw05_" . $fw_type . "_" . $fw_ver . ".bin";

	if (! -f $fw_file) {
		print "$pdu_ip Fetching $fw_file from $ftp_server...\n";
		get_fw_file($ftp_path . "/" . $fw_file);
	}

	my $ssh = Net::OpenSSH->new($pdu_ip, (
		master_opts => [
			-o => 'KexAlgorithms=+diffie-hellman-group1-sha1',
			-o => 'HostKeyAlgorithms=+ssh-dss',
			-o => 'Ciphers=+aes256-cbc',
			-o => 'LogLevel=QUIET',
			-o => 'StrictHostKeyChecking=no'
			],
		user => $pdu_user,
		password => $pdu_pass
		));

	# We can't catch an error with scp_put because the PDU will immediately
	# close the connection itself upon completion of the upload. It does
	# this because it immediately unpacks the firmware and reboots the
	# unit, so we have no real way of knowing if there was a failure for
	# other reasons. Yeah, really!
	print "$pdu_ip SCP'ing $fw_file to PDU\n";
	$ssh->scp_put({ quiet => 0 }, $fw_file, $fw_file);
	$ssh->disconnect();

	# Annoyingly, we should spin and not call this done until the PDU
	# reboots and SSH is listening again. This is so we can upload another
	# firmware component image if we need to. We do have to sleep a little
	# before trying to ping the SSH port because it might linger for a short
	# while before going offline. Yeah, really!
	sleep 5;

	my $timeout = 10;
	my $ping = Net::Ping->new('tcp', $timeout);

	$ping->port_number(22);

	my $i = 1;
	while (! $ping->ping($pdu_ip)) {
		print "$pdu_ip Waiting for PDU to reboot... (" .
			$i*$timeout . "s)\n";
		$i++;
	}
	print "$pdu_ip PDU has finished rebooting.\n";
	$ping->close();
}

#
# Fetch a file from a FTP server
#
sub get_fw_file {
	my $file = shift;

	my $ftp = Net::FTP->new($ftp_server)
		or die "FTP cannot connect to $ftp_server: $@";

	$ftp->login($ftp_user, $ftp_pass)
		or die "FTP login failed: user=$ftp_user";
	$ftp->passive(1) or die "FTP set passive failed";
	$ftp->binary() or die "FTP set binary failed";
	$ftp->get($file) or die "FTP could not fetch $file";
	$ftp->quit;
}


#
# Gets the contents of the "wanted version" file for PDU firmware from the
# FTP server. This should be converted to use LWP in the future in order to
# support protocols other than FTP.
#
sub get_wanted_ver {
	my $ftp_path = shift;

	my $version;

	my $ftp = Net::FTP->new($ftp_server)
		or die "FTP cannot connect to $ftp_server: $@";

	$ftp->login($ftp_user, $ftp_pass)
		or die "FTP login failed: user=$ftp_user";
	$ftp->passive(1)
		or die "FTP set passive failed";

	# Create a temp file to store our retrieved version file
	my $tmp = File::Temp->new(
		TEMPLATE => 'tmpXXXXX',
		DIR => '/tmp');

	# Save the retrieved version file to the File::Tmp file and quit.
	$ftp->get($ftp_path, $tmp->filename)
		or die "FTP could not fetch $ftp_path";
	$ftp->quit;

	# Read the tmp file contents, store the it as a variable.
	# and then delete the Tmp::File.
	$version = slurp($tmp->filename);
	chomp($version);
	$tmp->DESTROY;

	return $version;
}

#
# Run any commands from command files if -c was specified. If the
# expected command file does not, this will die(). On ServerTech
# PDUs, it is sometimes required to restart the unit in order for
# a command to take (enabling/disabling things, etc). Generally,
# it will tell you after the command is ran if that is needed.
# We will look for 'Restart required to apply changes' and restart
# the PDU later if we observe that, even if there's no firmware update
# required.
#
sub run_commands {
	my $cmd_file = shift;

	my $restart = undef;
	my @output;

	print "  Running commands in $cmd_file ...\n";
	my @cmds = split($/, slurp($cmd_file));

	foreach my $cmd (@cmds) {
		print "  Running: $cmd\n";
		@output = $telnet->cmd($cmd);

		print "  Output:\n";
		foreach my $line (@output) {
			chomp($line);
			$restart = 1
				if $line =~ /Restart required to apply changes/;
			$line =~ s/\s+$//g; # compact by trimming
			print "    " . $line . "\n";
		}
	}

	return $restart;
}

#
# Open a file an slurp its contents into a variable
#
sub slurp {
	my $file = shift;

	open my $fh, '<', $file
		or die "Could not open $file: $@";
	local $/ = undef;
	my $content = <$fh>;
	close $fh;

	return $content;
}

#
# Usage info
#
sub usage {
	print STDERR << "EOF";
Usage: $0 [-hcn] [-u url] [-U user] [-P password] pdu_ip ...

	-h	This help output
	-c	Program the PDU with the contents of:
		  cmds-pro.txt, cmds-swcdu.txt, or cmds-apc.txt
	-n	Do not perform any firmware updates
	-u	PDU firmware in URL format (ftp://user:pass\@host/path/)
	-U	PDU user (or \$PDU_USER env var) Default: admn
	-P	PDU password (or \$PDU_PASS env var) Default: admn
EOF
	exit;
}