From 326d580ebc2cdac2d69c30b43fcd798394ccde81 Mon Sep 17 00:00:00 2001
From: nqb <nquiniou@akamai.com>
Date: Fri, 5 May 2023 04:45:06 +0000
Subject: [PATCH 1/5] run a custom script in pfupdate

---
 bin/cluster/pfupdate | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bin/cluster/pfupdate b/bin/cluster/pfupdate
index 15a1bb2674e6..c73b7e772b74 100755
--- a/bin/cluster/pfupdate
+++ b/bin/cluster/pfupdate
@@ -13,6 +13,7 @@ use Getopt::Long;
 use pf::util;
 
 my $mode;
+my $custom_script_path = '/usr/local/bin/pfupdate-packetfence.sh';
 
 GetOptions(
     "mode=s" => \$mode,
@@ -23,3 +24,8 @@ if (! ($mode =~ /^master|slave$/)) {
 }
 
 pf_run("pkill -1 pfdhcplistener");
+
+if (-e "$custom_script_path" && -x "$custom_script_path") {
+    print "Running custom script\n";
+    pf_run("$custom_script_path $mode");
+}

From d0a66b16eb980963406d0b63eb5b11a977f7f84d Mon Sep 17 00:00:00 2001
From: nqb <nquiniou@akamai.com>
Date: Fri, 5 May 2023 04:59:13 +0000
Subject: [PATCH 2/5] pass vip to pfupdate

---
 bin/cluster/pfupdate                  | 6 ++++--
 lib/pf/services/manager/keepalived.pm | 6 +++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/bin/cluster/pfupdate b/bin/cluster/pfupdate
index c73b7e772b74..bd2303e3e617 100755
--- a/bin/cluster/pfupdate
+++ b/bin/cluster/pfupdate
@@ -13,10 +13,12 @@ use Getopt::Long;
 use pf::util;
 
 my $mode;
+my $vip;
 my $custom_script_path = '/usr/local/bin/pfupdate-packetfence.sh';
 
 GetOptions(
     "mode=s" => \$mode,
+    "vip=s" => \$vip,
 ) ;
 
 if (! ($mode =~ /^master|slave$/)) {
@@ -26,6 +28,6 @@ if (! ($mode =~ /^master|slave$/)) {
 pf_run("pkill -1 pfdhcplistener");
 
 if (-e "$custom_script_path" && -x "$custom_script_path") {
-    print "Running custom script\n";
-    pf_run("$custom_script_path $mode");
+    print "Running $custom_script_path\n";
+    pf_run("$custom_script_path $mode $vip");
 }
diff --git a/lib/pf/services/manager/keepalived.pm b/lib/pf/services/manager/keepalived.pm
index 102f17924c25..3b7a7f33eb26 100644
--- a/lib/pf/services/manager/keepalived.pm
+++ b/lib/pf/services/manager/keepalived.pm
@@ -141,9 +141,9 @@ $active_members
 }
 EOT
             }
-            $tags{'vrrp'} .= "  notify_master \"$install_dir/bin/cluster/pfupdate --mode=master\"\n";
-            $tags{'vrrp'} .= "  notify_backup \"$install_dir/bin/cluster/pfupdate --mode=slave\"\n";
-            $tags{'vrrp'} .= "  notify_fault \"$install_dir/bin/cluster/pfupdate --mode=slave\"\n";
+            $tags{'vrrp'} .= "  notify_master \"$install_dir/bin/cluster/pfupdate --mode=master --vip=$cluster_ip\"\n";
+            $tags{'vrrp'} .= "  notify_backup \"$install_dir/bin/cluster/pfupdate --mode=slave --vip=$cluster_ip\"\n";
+            $tags{'vrrp'} .= "  notify_fault \"$install_dir/bin/cluster/pfupdate --mode=slave --vip=$cluster_ip\"\n";
 
             $tags{'vrrp'} .= <<"EOT";
   track_script {

From a8ef7ea37ad65beb29f2ec56089929b596d8e350 Mon Sep 17 00:00:00 2001
From: nqb <nquiniou@akamai.com>
Date: Thu, 11 May 2023 09:19:03 +0000
Subject: [PATCH 3/5] define path to script in backend

---
 bin/cluster/pfupdate    | 5 ++++-
 conf/documentation.conf | 7 +++++++
 conf/pf.conf.defaults   | 5 +++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/bin/cluster/pfupdate b/bin/cluster/pfupdate
index bd2303e3e617..93d061c647a1 100755
--- a/bin/cluster/pfupdate
+++ b/bin/cluster/pfupdate
@@ -11,10 +11,13 @@ use lib (INSTALL_DIR . "/lib", INSTALL_DIR . "/lib_perl/lib/perl5");
 
 use Getopt::Long;
 use pf::util;
+use pf::config qw(
+    %Config
+);
 
 my $mode;
 my $vip;
-my $custom_script_path = '/usr/local/bin/pfupdate-packetfence.sh';
+my $custom_script_path = $Config{'advanced'}{'pfupdate_custom_script_path'};
 
 GetOptions(
     "mode=s" => \$mode,
diff --git a/conf/documentation.conf b/conf/documentation.conf
index 63e6e5148341..337cc9f45050 100644
--- a/conf/documentation.conf
+++ b/conf/documentation.conf
@@ -1444,6 +1444,13 @@ description=<<EOT
 The netmask (in numerical bits value) of the Zero Trust network. Only change if you know what you are doing. Changing this value requires to restart all the PacketFence services and requires all the clients of the Zero Trust network to be restarted
 EOT
 
+[advanced.pfupdate_custom_script_path]
+type=text
+description=<<EOT
+Path to a custom script called by pfupdate
+EOT
+
+
 [provisioning.autoconfig]
 type=toggle
 options=enabled|disabled
diff --git a/conf/pf.conf.defaults b/conf/pf.conf.defaults
index 36275738766c..0eeaf328f257 100644
--- a/conf/pf.conf.defaults
+++ b/conf/pf.conf.defaults
@@ -1064,6 +1064,11 @@ zero_trust_network_starting_ip=100.64.0.1
 # The netmask (in numerical bits value) of the Zero Trust network. Only change if you know what you are doing. Changing this value requires to restart all the PacketFence services and requires all the clients of the Zero Trust network to be restarted
 zero_trust_network_netmask=10
 
+# advanced.pfupdate_custom_script_path
+#
+# Path to a custom script called by pfupdate
+pfupdate_custom_script_path=/usr/local/bin/pfupdate-packetfence.sh
+
 [provisioning]
 #
 # provisioning.autoconfig

From 1138d593d28db6df0cfeadbe7e4c36a8dc251dac Mon Sep 17 00:00:00 2001
From: nqb <nquiniou@akamai.com>
Date: Thu, 11 May 2023 09:29:10 +0000
Subject: [PATCH 4/5] define path to script in frontend

---
 .../views/Configuration/advanced/_components/TheForm.vue   | 7 +++++++
 .../src/views/Configuration/advanced/_components/index.js  | 1 +
 2 files changed, 8 insertions(+)

diff --git a/html/pfappserver/root/src/views/Configuration/advanced/_components/TheForm.vue b/html/pfappserver/root/src/views/Configuration/advanced/_components/TheForm.vue
index 72439c292e41..c331bbb94fb6 100644
--- a/html/pfappserver/root/src/views/Configuration/advanced/_components/TheForm.vue
+++ b/html/pfappserver/root/src/views/Configuration/advanced/_components/TheForm.vue
@@ -130,6 +130,11 @@
       :text="$i18n.t('Enable to bypass the operating system domain join verification.')"
     />
 
+    <form-group-pfupdate-custom-script-path namespace="pfupdate_custom_script_path"
+      :column-label="$i18n.t('Path to a custom script called by pfupdate')"
+      :text="$i18n.t('Path to a custom script called by pfupdate if present.')"
+    />
+
     <form-group-netflow-on-all-networks namespace="netflow_on_all_networks"
       :column-label="$i18n.t('NetFlow on all networks')"
       :text="$i18n.t('Listen to NetFlow on all networks. Changing this requires to restart pfacct.')"
@@ -179,6 +184,7 @@ import {
   FormGroupPfperlApiProcesses,
   FormGroupPfperlApiTimeout,
   FormGroupPortalCspSecurityHeaders,
+  FormGroupPfupdateCustomScriptPath,
   FormGroupScanOnAccounting,
   FormGroupSourceToSendSmsWhenCreatingUsers,
   FormGroupSsoOnAccessReevaluation,
@@ -210,6 +216,7 @@ const components = {
   FormGroupPfperlApiProcesses,
   FormGroupPfperlApiTimeout,
   FormGroupPortalCspSecurityHeaders,
+  FormGroupPfupdateCustomScriptPath,
   FormGroupScanOnAccounting,
   FormGroupSourceToSendSmsWhenCreatingUsers,
   FormGroupSsoOnAccessReevaluation,
diff --git a/html/pfappserver/root/src/views/Configuration/advanced/_components/index.js b/html/pfappserver/root/src/views/Configuration/advanced/_components/index.js
index 5b421823707b..8e4d50190797 100644
--- a/html/pfappserver/root/src/views/Configuration/advanced/_components/index.js
+++ b/html/pfappserver/root/src/views/Configuration/advanced/_components/index.js
@@ -35,6 +35,7 @@ export {
   BaseFormGroupInputNumber            as FormGroupPfperlApiProcesses,
   BaseFormGroupInputNumber            as FormGroupPfperlApiTimeout,
   BaseFormGroupToggleDisabledEnabled  as FormGroupPortalCspSecurityHeaders,
+  BaseFormGroupInput                  as FormGroupPfupdateCustomScriptPath,
   BaseFormGroupToggleDisabledEnabled  as FormGroupScanOnAccounting,
   BaseFormGroupChosenOne              as FormGroupSourceToSendSmsWhenCreatingUsers,
   BaseFormGroupToggleDisabledEnabled  as FormGroupSsoOnAccessReevaluation,

From 0eec96dcabd0b36eeb271410eeddcd9f939f03f7 Mon Sep 17 00:00:00 2001
From: Darren Satkunas <dsatkuna@akamai.com>
Date: Tue, 16 May 2023 10:17:39 -0700
Subject: [PATCH 5/5] add news

---
 NEWS.asciidoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/NEWS.asciidoc b/NEWS.asciidoc
index 2e473a306bec..2d4d74494a0e 100644
--- a/NEWS.asciidoc
+++ b/NEWS.asciidoc
@@ -32,6 +32,7 @@ For a list of compatibility related changes see the <<PacketFence_Upgrade_Guide.
  * Upgrade coredns libraries (#7197)
  * Added Palo Alto switch module to manage web admin login using RADIUS (#7643)
  * Remove WMI (#7649)
+ * Allow to call a custom script from pfupdate to handle VIP in cloud environments (#7654)
 
 === Bug Fixes