#!/bin/bash

# Copyright (C) 2023 Pädagogisches Landesinstitut Rheinland-Pfalz
# Copyright (C) 2023 Daniel Teichmann <daniel.teichmann@das-netzwerkteam.de>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the
# Free Software Foundation, Inc.,
# 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.

#
# This file contains functions mostly used by the postinst and config script.
# Sourcing this file in preinst and postrm won't work logically.
#

set -e

# Check if stdout is a terminal and set colors if available.
if test -t 1; then

	# Pause set -e
	set +e
	# See if it supports colors…
	ncolors=$(tput colors 2> /dev/null)
	set -e

	if [[ -n "$ncolors" && "$ncolors" -ge 8 ]]; then
		bold="$(tput bold)"
		underline="$(tput smul)"
		standout="$(tput smso)"
		normal="$(tput sgr0)"
		black="$(tput setaf 0)"
		red="$(tput setaf 1)"
		green="$(tput setaf 2)"
		yellow="$(tput setaf 3)"
		blue="$(tput setaf 4)"
		magenta="$(tput setaf 5)"
		cyan="$(tput setaf 6)"
		white="$(tput setaf 7)"
	fi

fi

# A debug message will only be shown if the right env var is set.
function debug_log() {
	if [ "$DEBCONF_DEBUG" == "developer" ] || [ "$D_E_R_DEBUG" != "" ]; then
		echo -e "${blue}DEBUG: ${green}$@${normal}"
	fi
}

# A debug message will only be shown if the right env var is set.
function debug_log_stderr() {
	if [ "$DEBCONF_DEBUG" == "developer" ] || [ "$D_E_R_DEBUG" != "" ]; then
		echo -e "${blue}DEBUG: ${green}$@${normal}" >&2
	fi
}

# A warning will always be shown
function warning_log() {
	echo -e "${yellow}WARNING: ${bold}$@${normal}"
}

# A warning will always be shown (into stderr)
function warning_log_stderr() {
	echo -e "${yellow}WARNING: ${bold}$@${normal}" >&2
}

# An error will always be shown
function error_log() {
	echo -e "${red}ERROR: ${bold}$@${normal}"
}

# regular expressions
REGEXP_IPV4_ADDR='(\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}'
REGEXP_IPV4_NETMASK='((255\.){3}(255|254|252|248|240|224|192|128+))|((255\.){2}(255|254|252|248|240|224|192|128|0+)\.0)|((255\.)(255|254|252|248|240|224|192|128|0+)(\.0+){2})|((255|254|252|248|240|224|192|128|0+)(\.0+){3}))'
REGEXP_IPV6_ADDR='(([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4})'

function is_address_v4() {
	if [[ "${1}" =~ ^${REGEXP_IPV4_ADDR}$ ]]; then
		return 0
	fi
	return 1
}

function is_address_v6() {
	# our REGEXP_IPV6_ADDR is not 100% perfect, so...
	if [[ "${1}" =~ ^${REGEXP_IPV6_ADDR}$ ]] && ! [[ "${1}" =~ ::: ]]; then
		return 0
	fi
	return 1
}

function is_netmask_v4() {
	# support /8 up to /32 netmasks
	if [[ "${1}" =~ ^[0-9]+$ ]] && [ ${1} -ge 8 ] && [ ${1} -le 32 ]; then
		return 0
	elif [[ "${1}" =~ ^${REGEXP_IPV4_NETMASK}$ ]]; then
		return 0
	fi
	return 1
}

function is_netmask_v6() {
	# support /48 up to /128 netmasks/prefixes
	if [[ "${1}" =~ ^[0-9]+$ ]] && [ ${1} -ge 48 ] && [ ${1} -le 128 ]; then
		return 0
	fi
	return 1
}

function is_vlanid() {
	if [[ $1 =~ ^[0-9]+$ ]] && \
	   [ $1 -ge 1 -a $1 -le 4095 ]; then
		return 0
	else
		return 1
	fi
}

function is_valid_dhcp4_range() {
	if [[ "${1}" =~ ^${REGEXP_IPV4_ADDR},${REGEXP_IPV4_ADDR},(infinite|[0-9]+[hms]{1})$ ]]; then
		return 0
	fi
	return 1
}

# $1: debconfig question (output of `db_get $1` should be
#	  the interface which should be filtered out)
# $2…$n: ifaces to filter through
function filter_iface() {
	db_get "$1"
	if [ -n "${RET}" ]; then
		echo `echo "${@:2}" | sed -Ee "s/${RET}(,\s*|\$)//g" -e "s/,\s*\$//g"`
	else
		echo "${@:2}"
	fi
}

function ipv4_enabled() {
	db_get debian-edu-router-config/net-ip-versions-enabled
	for version in $(echo "${RET}" | sed -e 's/,//g'); do
		if [ "$version" == "IPv4" ]; then
			return 0
		fi
	done
	return 1
}

function ipv6_enabled() {
	db_get debian-edu-router-config/net-ip-versions-enabled
	for version in $(echo "${RET}" | sed -e 's/,//g'); do
		if [ "$version" == "IPv6" ]; then
			return 0
		fi
	done
	return 1
}

# $1 arr1       (Example: "Uplink, Mgmt, WiFi-Guests")
# $2 arr2       (Example: "WiFi-Guests, Uplink")
# returns: $RES (Example: "Mgmt")
function compare_comma_separated_items() {
	arr1=`echo "$1" | sed -e "s| ||g" | tr ',' '\n' | sort -u`
	arr2=`echo "$2" | sed -e "s| ||g" | tr ',' '\n' | sort -u`
	RES=$(comm -3 <(echo $arr1) <(echo $arr2) | xargs | sed -e "s| |, |g")

	# Not needed right now… Activating this trips set -e and exits this script.

	# if [ -z "$RES" ]; then
	# 	return 0; # $RES is empty => arr1 == arr2
	# else
	# 	# $RES is not empty => arr1 != arr2
	# 	# $RES contains all items which are not in both arrays.
	# 	return 1;
	# fi
}

# Converts IPv4 ips and networks (CIDR notation) into decimal numbers.
# Input arguments example: "10.0.0.1/8 192.168.1.1/8 192.168.188.6"
# Output example:          "167772161 -16777216 3232235777 -16777216 3232283654 -1"
# Credits go to: https://unix.stackexchange.com/a/258926
function ipv4_to_decimal () {
	for i; do
		echo $i | {
			IFS=./
			read a b c d e
			test -z "$e" && e=32
			echo -n "$((a<<24|b<<16|c<<8|d)) $((-1<<(32-e))) "
		}
	done
}

function is_valid_ipconfig_v4() {
	_addr="$(echo ${1} | cut -d"/" -f1)"
	_netmask="$(echo ${1} | cut -d"/" -f2)"
	if is_address_v4 "${_addr}" && is_netmask_v4 "${_netmask}"; then
		return 0
	fi
	return 1
}

function is_valid_ipconfig_v6() {
	_addr="$(echo ${1} | cut -d"/" -f1)"
	_netmask="$(echo ${1} | cut -d"/" -f2)"
	if is_address_v6 "${_addr}" && is_netmask_v6 "${_netmask}"; then
		return 0
	fi
	return 1
}

# Checks if IPv4 ipconfig (ip address + network in CIDR notation) is in a
# network (also CIDR notation)
#
# Input  example: "192.168.50.1 192.168.1.1/16"
# Return example: "0" (yes, address is in network)
#
# Input  example: "192.168.1.1/16 192.168.1.1/8"
# Return example: "0" (yes, network1 is part of network2)
#
# Input  example: "192.169.50.1/16 192.168.1.1/16"
# Return example: "1" (no, network1 is not part of network2)
#
# Credits go to: https://unix.stackexchange.com/a/258926
function is_ip4config_in_network() {
	ipv4_to_decimal $1 $2 | {
		read addr1 mask1 addr2 mask2
		echo "$addr1 - $mask1 - $addr2 - $mask2" > /dev/null
		if (( (addr1&mask2) == (addr2&mask2) && mask1 >= mask2 )); then
			return 0
		else
			return 1
		fi
	}
}

# Goes through $supported_internal_networks and gathers the debconf answers
# for all supported internal networks.
#
# returns: $internal_networks: dictionary
#   - internal_networks[networkname]="address/subnet"
function get_internal_networks() {
	if [ -z "${supported_internal_networks}" ]; then
		db_get debian-edu-router-config/net-int-supportednetworks || true
		supported_internal_networks="${RET}"
	fi

	# Converts support networks to lowercase and ommits comma.
	_supported_internal_networks=($(echo ${supported_internal_networks} | tr '[:upper:]' '[:lower:]' | tr -d ','))
	echo "${_supported_internal_networks[@]}" > /dev/null

	for network in ${_supported_internal_networks[@]}; do
		db_question="debian-edu-router-config/net-int-address-v4-$network"

		# Get answer to debconf question
		db_get "$db_question"; db_answer="${RET}"

		if [[ -n "$db_answer" ]]; then
			internal_networks["$network"]="$db_answer"
		fi
	done
}

# Input $1: Reverse NAT config to parse.
#
# Sets var: $error_in_parsing: If input $1 could't be parsed successfully.
#   - "invalid_host_address"
#   - "invalid_extern_port"
#   - "invalid_host_port"
#   - "no_matching_internal_network"
#   - Empty if successfull.
#
# Sets var: $rn_protocol:     Either 'tcp' 'udp' or 'tcp+udp'.
# Sets var: $rn_extern_port:  Port opened on 'Uplink' interface.
# Sets var: $rn_host_address: IP address of device inside of an internal network.
# Sets var: $rn_host_port:    Port opened by $host_address.
# Sets var: $rn_matching_internal_network: Name of internal network which host
#   - address is part of.
function parse_reverse_nat_config() {
	item="$1"

	if [ -z "${service_firewall_networks_nat}" ]; then
		db_get debian-edu-router-config/service-firewall-networks-nat || true
		service_firewall_networks_nat="${RET}"
	fi

	# Collect all internal addresses/networks
	declare -A internal_networks
	get_internal_networks
	# debug_log "Internal networks found for reverse NAT validation:"
	# for _i_n_name in "${!internal_networks[@]}"; do
	# 	debug_log "  - $_i_n_name:\t${internal_networks[$_i_n_name]}"
	# done

	error_in_parsing=""
	rn_protocol="tcp+udp"
	if [[ "$item" =~ "tcp:"* ]]; then
		rn_protocol="tcp"
		item="${item/tcp:/}"
	fi

	if [[ "$item" =~ "udp:"* ]]; then
		rn_protocol="udp"
		item="${item/udp:/}"
	fi

	# Split string into variables
	IFS=":" read rn_extern_port rn_host_address rn_host_port <<< $(echo "$item")

	# external port is mandatory and must be a number.
	if [[ -z "$rn_extern_port" ]] || ! [[ "$rn_extern_port" =~ ^[0-9]+$ ]]; then
		error_in_parsing="invalid_extern_port";
		warning_log "Failed to parse reverse NAT config: '$1' is a invalid external port."
		return
	fi

	# must be a valid address.
	if ! is_address_v4 $rn_host_address; then
		error_in_parsing="invalid_host_address";
		warning_log "Failed to parse reverse NAT config: '$1' is a invalid host address."
		return
	fi

	# host port is optional but must be a number.
	if [[ -n "$rn_host_port" ]]; then
		if ! [[ "$rn_host_port" =~ ^[0-9]+$ ]]; then
			error_in_parsing="invalid_host_port";
			warning_log "Failed to parse reverse NAT config: '$1' is a invalid host port."
			return
		fi
	else
		# debug_log "rn_host_port=\$rn_extern_port"
		rn_host_port="$rn_extern_port"
	fi

	rn_matching_internal_network=""
	# For-loop in a for-loop is often not a good idea
	# but we don't have that many supported internal networks.
	for _i_n_name in "${!internal_networks[@]}"; do
		_internal_network="${internal_networks[$_i_n_name]}"

		if is_valid_ipconfig_v4 "$_internal_network"; then
			if is_ip4config_in_network "$rn_host_address" "$_internal_network"; then
				debug_log "IPv4 address $rn_host_address is in" \
						  "network '$_i_n_name' ($_internal_network)!"

				# Check if _internal_network is configured to be hidden behind a NAT.
				if [[ "${service_firewall_networks_nat,,}" == *"${_i_n_name,,}"* ]]; then
					debug_log "And network '$_i_n_name' is using NAT."
				else
					debug_log "But network '$_i_n_name' is not using NAT!" \
							  "Continue searching for matching network…"
					continue
				fi

				rn_matching_internal_network="$_i_n_name"
				return
			fi
		elif ! is_address_v6 "$_internal_network"; then
			# Oh, this should definitely not happen...
			warning_log "Internal network '$_internal_network' is not a valid" \
						"IP address! This happened while validating" \
						"reverse NAT config '$1'."
		fi
	done

	if [[ -z "$rn_matching_internal_network" ]]; then
		warning_log "Address '${rn_host_address}' is not part of any configured"\
					"internal networks. This happened while validating reverse" \
					"NAT config '$1'. The reverse NAT configuration is faulty."
		error_in_parsing="no_matching_internal_network"
	fi
}