# vim: set filetype=sh :
#  ================================================== DATEIUEBERSICHT ===  
#
#  THEMA	      : Secure Virtual Private Network
#
#  WARNUNGEN!	      :
#  
#  ANWENDUNGSBEISPIEL :
#
#  ABHAENGIGKEITEN    :	
#
#  DATEIEN	      : 
#
#  SIEHE AUCH         : secvpn secvpnmon
#
#  AUTOR              :	
#  Bernd Schumacher, HP Consulting, HEWLETT-PACKARD GmbH, Bad Homburg, 2000
#
#  GESCHICHTE         :
#  06.10.2005 UM - Checked for reentrant code - keep it this way
#  03.08.2000 BS - Added this Header
#
#  =====================================================================
 
# --------------------------------------------------------- SYNOPSIS ---
#  KURZBESCHREIBUNG      : secvpn.lib - Functions used by secvpn
#
#  AUFRUF                : . /usr/share/secvpn/secvpn.lib
#  
#  RUECKGABEWERT         : 
#  
#  GLOBALE VARIABLE	 :
#
# --------------------------------------------------------- REFERENZ ---
#  FUNKTIONSBESCHREIBUNG : 
#  
#  ABLAUFBESCHREIBUNG    : 
#  			
#  BEMERKUNGEN           : 
#
# ---------------------------------------------------------------------
#
#set -x

_err()
{
  echo "ERROR - $@" >&2
  exit 1
}

b2d() { echo "ibase=2; `cat`" | bc
}
d2b() { echo "obase=2; $1" | bc
}
or() { echo "`d2b $1` + `d2b $2`" | bc | sed "s/2/1/g" | b2d
}
and() { echo "`d2b $1` + `d2b $2`" | bc | sed "s/1/0/g;s/2/1/g" | b2d
}
not8() { d2b `expr $1 + 256` | bc | sed "s/1/e/g;s/0/1/g;s/e/0/g" | b2d
}
nr() { echo $1 | cut -d. -f$2
}

# _get_vpn <ROLE> <OTHER_IS>
_get_vpn()
{
  ROLE=$1
  OTHER_IS=$2

  if [ "$ROLE" = "PASSIVE" ]; then
    H_THIS_IS=$THIS_IS
    THIS_IS=$OTHER_IS
    OTHER_IS=$H_THIS_IS
  elif [ "$ROLE" != "ACTIVE" ]; then
    _err "ROLE=<$ROLE> not ACTIVE / PASSIVE"
  fi

  unset GOOD_ONES GOOD_DEV GOOD_IP
  eval "$THIS_IS" || _err "bad function <$THIS_IS>"
  _T_GOOD_ONES=$GOOD_ONES
  T_GOOD_DEV=$GOOD_DEV
  T_GOOD_IP=$GOOD_IP

  unset GOOD_ONES GOOD_DEV GOOD_IP
  eval "$OTHER_IS" || _err "bad function <$OTHER_IS>"
  _O_GOOD_ONES=$GOOD_ONES
  O_GOOD_DEV=$GOOD_DEV
  O_GOOD_IP=$GOOD_IP
    
  unset T_BAD_DEV T_BAD_IP T_CRYPT_IP O_BAD_DEV O_BAD_IP O_CRYPT_IP
  unset T_GOOD_ONES O_GOOD_ONES
  eval "vpn_${THIS_IS}_${OTHER_IS}" || 
    _err "bad function <vpn_${THIS_IS}_${OTHER_IS}>"

  # add the GOOD_ONES of each party to the set of T/O_GOOD_ONES (if set)
  T_GOOD_ONES="$_T_GOOD_ONES $T_GOOD_ONES"
  O_GOOD_ONES="$_O_GOOD_ONES $O_GOOD_ONES"

  if [ "$ROLE" = "PASSIVE" ]; then
    H_THIS_IS=$THIS_IS
    THIS_IS=$OTHER_IS
    OTHER_IS=$H_THIS_IS

    H_BAD_DEV="$T_BAD_DEV"
    H_BAD_IP="$T_BAD_IP"
    H_CRYPT_IP="$T_CRYPT_IP"
    H_GOOD_ONES=$T_GOOD_ONES
    H_GOOD_DEV=$T_GOOD_DEV
    H_GOOD_IP=$T_GOOD_IP

    T_BAD_DEV="$O_BAD_DEV"
    T_BAD_IP="$O_BAD_IP"
    T_CRYPT_IP="$O_CRYPT_IP"
    T_GOOD_ONES=$O_GOOD_ONES
    T_GOOD_DEV=$O_GOOD_DEV
    T_GOOD_IP=$O_GOOD_IP

    O_CRYPT_IP="$H_CRYPT_IP"
    O_BAD_DEV="$H_BAD_DEV"
    O_BAD_IP="$H_BAD_IP"
    O_GOOD_ONES=$H_GOOD_ONES
    O_GOOD_DEV=$H_GOOD_DEV
    O_GOOD_IP=$H_GOOD_IP
  fi

  # Virtual Device to Device
  # example: eth0:1 -> eth0
  T_GOOD_DEV=`echo "$T_GOOD_DEV" | sed "s/:.*//"`
  T_BAD_DEV=`echo "$T_BAD_DEV" | sed "s/:.*//"`
  O_GOOD_DEV=`echo "$O_GOOD_DEV" | sed "s/:.*//"`
  O_BAD_DEV=`echo "$O_BAD_DEV" | sed "s/:.*//"`
}

_vpns()
{
  echo "$VPNS" | awk '{gsub(" ","\n");print}'
}

# for_all_vpns <COMMAND>
for_all_vpns()
{
  for i in `_vpns | grep "^${THIS_IS}->" | sed "s/.*->//"`; do
    _get_vpn ACTIVE $i
    eval "$@" || _err "bad function <$@>"
  done

  for i in `_vpns | grep -e "->${THIS_IS}$" | sed "s/->.*//"`; do
    _get_vpn PASSIVE $i
    eval "$@" || _err "bad function <$@>"
  done
}

# for_all_active_vpns <COMMAND>
for_all_active_vpns()
{
  for i in `_vpns | grep "^${THIS_IS}->" | sed "s/.*->//"`; do
    _get_vpn ACTIVE $i
    eval "$@" || _err "bad function <$@>"
  done
}

# use_vpn <OTHER_IS> <COMMAND>
use_vpn()
{
  if [ "`_vpns | grep \"^${THIS_IS}->$1$\" | sed 's/.*->//'`" ]; then
    _get_vpn ACTIVE $1
    shift
    eval "$@" || _err "bad function <$@>"
  elif [ "`_vpns | grep -e \"^$1->${THIS_IS}$\" | sed 's/->.*//'`" ]; then
    _get_vpn PASSIVE $1
    shift
    eval "$@" || _err "bad function <$@>"
  else
    _err "no connection to <$1>"
  fi
}

# use_this <COMMAND>
use_this()
{
  unset GOOD_ONES GOOD_DEV GOOD_IP
  eval "$THIS_IS" || _err "bad function <$THIS_IS>"
  T_GOOD_ONES=$GOOD_ONES
  T_GOOD_DEV=$GOOD_DEV
  T_GOOD_IP=$GOOD_IP
  eval "$@" || _err "bad function <$@>"
}

print_conf()
{
  echo "THIS_IS=<$THIS_IS> ROLE=<$ROLE> OTHER_IS=<$OTHER_IS>"
  echo "T_GOOD_IP=<$T_GOOD_IP> T_BAD_IP=<$T_BAD_IP> T_CRYPT_IP=<$T_CRYPT_IP>"
  echo "O_GOOD_IP=<$O_GOOD_IP> O_BAD_IP=<$O_BAD_IP> O_CRYPT_IP=<$O_CRYPT_IP>"
}

#
# INPUT="192.168.4.0/24" -> OUTPUT="-net 192.168.4.0 netmask 255.255.255.0"
# INPUT="192.168.4.0/32" -> OUTPUT="-host 192.168.4.0"
# INPUT="192.168.4.0" -> OUTPUT="-host 192.168.4.0"
#
route_area()
{
  A=`echo "$1" | awk -F/ '{print $1}'`
  B=`echo "$1" | awk -F/ '{print $2}'`

  if [ "$B" = "" -o "$B" = "32" ]; then
    echo "-host $A"
  else
    F=`echo "$B / 8" | bc` 
    N=`echo "3 - $F" | bc`
    R=`echo "256 - 2^(8-($B % 8))" | bc`
    echo -n "-net $A netmask "
    while [ $F -gt 0 ]; do echo -n "255."; F=`echo "$F - 1" | bc`; done
    echo -n "$R"
    while [ $N -gt 0 ]; do echo -n ".0"; N=`echo "$N - 1" | bc`; done
    echo
  fi
}
#i=0; while [ $i -lt 32 ]
#do 
#  T="1.2.3.4/$i"; echo "$T: `route_area $T`"; i=`echo "$i + 1" | bc`
#done; exit 0

# USAGE: is_useful_route <dest> <mask> <testip>
# OUTPUT: 1 is useful
#         0 is no useful
#
is_useful_route()
{
  for i in 1 2 3 4
  do
    ia=`nr $1 $i`
    im=`nr $2 $i`
    ib=`nr $3 $i`
    if [ "$ia" != "$ib" ]; then
      if [ `and $ia $im` != `and $ib $im` ]; then
        echo "0"
        return
      fi
    fi
  done
  echo "1"
}

#echo "is_useful_route 192.168.2.0 255.255.255.0 192.168.2.1=
#`is_useful_route 192.168.2.0 255.255.255.0 192.168.2.1`"
#echo "is_useful_route 192.168.2.0 255.255.255.0 192.168.3.1=
#`is_useful_route 192.168.2.0 255.255.255.0 192.168.3.1`"
#exit 0

# INPUT: all|mask|iface <testip>
# OUTPUT: "<all>|<mask>|<iface>|<gw>"
get_route_entry()
{
  if [ $# != 2 ]; then
    echo "get_route_entry: wrong args: <$*>" >&2
    exit 1
  fi

  /sbin/route -n | grep "^[0-9]" |
  while read _dest _gw _mask _flag _metric _ref _use _iface; do
    if [ "`is_useful_route $_dest $_mask $2`" = "1" ]; then
      case "$1" in
        "all") 
          echo "$_dest $_gw $_mask $_flag $_metric $_ref $_use $_iface"
          ;;
        "iface") 
          echo $_iface
          ;;
        "dest") 
          echo $_dest
          ;;
        "mask")
          echo $_mask
          ;;
        "gw")
          echo $_gw
          ;;
        *) 
          echo "get_route_entry: wrong \$1 args: <$*>" >&2
          exit 1
          ;;
      esac
      break
    fi
  done
}
#echo "get_route_entry all 192.168.2.99=<`get_route_entry all 192.168.2.99`>"
#exit 0

# getpppif: get the interface (ppp?) of ppp conection <ip1> to <ip2>, if any
# USAGE: getpppif <ip1> <ip2>
getpppif()
{
  found=""
  /sbin/ifconfig | sed "s/.*addr:$1\>.*P-t-P:$2\>.*/ok/" | grep -e "^\w" |
    #eth0      Link encap:Ethernet  HWaddr 00:50:56:9E:1A:7C  
    #lo        Link encap:Local Loopback  
    #ppp0      Link encap:Point-to-Point Protocol  
    #ok
    #ppp1      Link encap:Point-to-Point Protocol 

  while read first rest; do
    if [ "$first" = "ok" ]; then
      echo $found
      break
    else
      found=$first
    fi
  done
}

# If local hosts has more than ipaddresses to reach remoteip, this function
# can determine which one is used, if a connection is established.
# USAGE: local_ip_connected_to <remoteip> 
# Output localip
local_ip_connected_to()
{
  netstat -tn | grep "$1" | head -1 | cut -d: -f1 | awk '{print $NF}'
}
# echo "local_ip_connected_to 194.0.0.66 is <`local_ip_connected_to 194.0.0.66`>"