Configure network bridge interfaces for VM networking and container communication

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Default values
PHYSICAL_INTERFACE=""
BRIDGE_SUBNET="192.168.100.0/24"
BRIDGE_IP="192.168.100.1"

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Usage message
usage() {
    cat << EOF
Usage: $0 [-i interface] [-s subnet] [-g gateway]

Options:
    -i interface    Physical network interface to bridge (auto-detected if not specified)
    -s subnet       Bridge subnet (default: 192.168.100.0/24)
    -g gateway      Bridge gateway IP (default: 192.168.100.1)
    -h              Show this help message

Examples:
    $0 -i ens18
    $0 -i eth0 -s 192.168.200.0/24 -g 192.168.200.1
EOF
    exit 1
}

# Parse command line arguments
while getopts "i:s:g:h" opt; do
    case $opt in
        i) PHYSICAL_INTERFACE="$OPTARG" ;;
        s) BRIDGE_SUBNET="$OPTARG" ;;
        g) BRIDGE_IP="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Cleanup function
cleanup() {
    log_error "Installation failed. Cleaning up..."
    # Remove any partial configurations
    if [ -f /etc/netplan/99-bridge.yaml.backup ]; then
        mv /etc/netplan/99-bridge.yaml.backup /etc/netplan/99-bridge.yaml 2>/dev/null || true
    fi
    exit 1
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            NETWORK_METHOD="netplan"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            NETWORK_METHOD="networkmanager"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            NETWORK_METHOD="networkmanager"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

# Auto-detect network interface if not specified
if [ -z "$PHYSICAL_INTERFACE" ]; then
    PHYSICAL_INTERFACE=$(ip route | grep default | head -1 | awk '{print $5}')
    if [ -z "$PHYSICAL_INTERFACE" ]; then
        log_error "Cannot auto-detect network interface. Please specify with -i option."
        exit 1
    fi
    log_info "Auto-detected network interface: $PHYSICAL_INTERFACE"
fi

# Verify interface exists
if ! ip link show "$PHYSICAL_INTERFACE" &>/dev/null; then
    log_error "Network interface $PHYSICAL_INTERFACE does not exist"
    exit 1
fi

log_info "[1/8] Starting bridge network configuration for $ID"

# Update system packages
log_info "[2/8] Updating system packages..."
$PKG_UPDATE

# Install bridge utilities
log_info "[3/8] Installing bridge utilities..."
if [ "$PKG_MGR" = "apt" ]; then
    $PKG_INSTALL bridge-utils net-tools vlan iproute2
else
    $PKG_INSTALL bridge-utils net-tools iproute
fi

# Enable IP forwarding
log_info "[4/8] Enabling IP forwarding..."
if ! grep -q "net.ipv4.ip_forward = 1" /etc/sysctl.conf; then
    echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
fi
if ! grep -q "net.ipv6.conf.all.forwarding = 1" /etc/sysctl.conf; then
    echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.conf
fi
sysctl -p

# Configure bridge based on network method
log_info "[5/8] Configuring bridge interfaces..."

if [ "$NETWORK_METHOD" = "netplan" ]; then
    # Backup existing netplan config
    if [ -f /etc/netplan/99-bridge.yaml ]; then
        cp /etc/netplan/99-bridge.yaml /etc/netplan/99-bridge.yaml.backup
    fi
    
    # Create netplan bridge configuration
    cat > /etc/netplan/99-bridge.yaml << EOF
network:
  version: 2
  renderer: networkd
  ethernets:
    $PHYSICAL_INTERFACE:
      dhcp4: false
      dhcp6: false
  bridges:
    br0:
      interfaces: [$PHYSICAL_INTERFACE]
      dhcp4: true
      parameters:
        stp: true
        forward-delay: 4
    br1:
      dhcp4: false
      addresses:
        - $BRIDGE_IP/$(echo $BRIDGE_SUBNET | cut -d'/' -f2)
      parameters:
        stp: true
        forward-delay: 4
EOF
    chmod 644 /etc/netplan/99-bridge.yaml
    
    # Apply netplan configuration
    log_info "[6/8] Applying netplan configuration..."
    netplan apply
    systemctl restart systemd-networkd
    
else
    # NetworkManager configuration
    # Create primary bridge for external connectivity
    nmcli connection add type bridge con-name br0 ifname br0 2>/dev/null || true
    nmcli connection modify br0 bridge.stp yes
    nmcli connection modify br0 ipv4.method auto
    
    # Add physical interface to bridge
    nmcli connection add type bridge-slave con-name br0-port1 ifname $PHYSICAL_INTERFACE master br0 2>/dev/null || true
    
    # Create internal bridge for VM/container communication
    nmcli connection add type bridge con-name br1 ifname br1 2>/dev/null || true
    nmcli connection modify br1 bridge.stp yes
    nmcli connection modify br1 ipv4.method manual ipv4.addresses $BRIDGE_IP/$(echo $BRIDGE_SUBNET | cut -d'/' -f2)
    
    # Apply NetworkManager configuration
    log_info "[6/8] Applying NetworkManager configuration..."
    nmcli connection up br0 2>/dev/null || true
    nmcli connection up br1 2>/dev/null || true
    systemctl restart NetworkManager
fi

# Configure basic iptables rules for bridge security
log_info "[7/8] Configuring bridge security policies..."

# Enable bridge netfilter
modprobe br_netfilter
echo 'br_netfilter' >> /etc/modules-load.d/bridge.conf 2>/dev/null || echo 'br_netfilter' >> /etc/modules

# Basic iptables rules for bridge security
iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT 2>/dev/null || true
iptables -I FORWARD -i br1 -o br1 -j ACCEPT 2>/dev/null || true

# Save iptables rules based on distribution
if [ "$PKG_MGR" = "apt" ]; then
    if command -v netfilter-persistent &> /dev/null; then
        netfilter-persistent save
    fi
else
    if command -v iptables-save &> /dev/null; then
        iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
    fi
fi

# Verification
log_info "[8/8] Verifying bridge configuration..."

# Wait for interfaces to come up
sleep 5

# Check if bridges exist
if ip link show br0 &>/dev/null && ip link show br1 &>/dev/null; then
    log_success "Bridge interfaces br0 and br1 created successfully"
else
    log_error "Failed to create bridge interfaces"
    exit 1
fi

# Check bridge status
if brctl show | grep -q br0 && brctl show | grep -q br1; then
    log_success "Bridge utilities functioning correctly"
else
    log_warning "Bridge utilities may not be functioning properly"
fi

# Check IP forwarding
if [ "$(cat /proc/sys/net/ipv4/ip_forward)" = "1" ]; then
    log_success "IP forwarding enabled"
else
    log_warning "IP forwarding not enabled"
fi

# Display final status
echo
log_success "Bridge network configuration completed successfully!"
echo
echo "Bridge Status:"
brctl show
echo
echo "IP Configuration:"
ip addr show br0 2>/dev/null || true
ip addr show br1 2>/dev/null || true
echo
log_info "You can now use these bridges for VM and container networking"
log_info "Primary bridge (br0): External connectivity"
log_info "Internal bridge (br1): VM/container communication on $BRIDGE_SUBNET"