#!/bin/sh 

# -------------------------------------------------------
# file   : secure8k.sh
# purpose: Create a pictorial layout of 8k security setup.
# author : Vittal.S
#
# usage  : secure8k.sh
#
# modifications:
# 04-01-07  Initial Creation .
# -------------------------------------------------------

fcfgread( )
{
    cfgvarkey=$1
    cfgvarvalue=""
    cfgvarln="`cat $CFGFILE|  grep -e \"^[ \t]*${cfgvarkey}:\"`"
    cfgvarvalue="`echo ${cfgvarln} | sed -e 's/'${cfgvarkey}:'//g' | sed -e 's/^[ ]*//g'`"
}

# ----------------------------------------------------------------
# function: setmeup
# args    : none
# description:
#   given any string it will format it to required length.
# ----------------------------------------------------------------

setmeup( )
{
   varvaluetmp=$1
   length=$2
   varlength=$3
   length=${#varvaluetmp}
   if [ $length -ge 0 -a $length -lt $varlength ];
   then
      spaces=`expr $varlength - $length`
      while [ $spaces -gt 0 ];
      do
         varvaluetmp="${varvaluetmp}!"
         spaces=`expr $spaces - 1`
      done
   fi
   eval cfgvarres="${varvaluetmp:0:${varlength}}"
}

# ----------------------------------------------------------------
# function: getbondingdev
# args    : none
# description:
#   comoutes bonding dev association
# ----------------------------------------------------------------

getbondingdev( )
{
   devname=$1
   devtype=$2
   if [ "$testbed" = "cluster" ];
   then
      fcfgread $devtype
      dev=${cfgvarvalue}
      dev1tmp="`echo $dev | awk '{ print $1 }'`"
      dev2tmp="`echo $dev | awk '{ print $2 }'`"
   else
      fcfgread $devtype
      dev1tmp="`echo ${cfgvarvalue} | awk '{ print $2 }'`"
      dev2tmp="`echo ${cfgvarvalue} | awk '{ print $3 }'`"
   fi
 
   lspeeddev1tmp="`ethtool $dev1tmp | grep "Speed:" | awk '{ print$2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lspeeddev1tmp 12 12
   lspeeddev1tmp=$cfgvarres

   lspeeddev2tmp="`ethtool $dev2tmp | grep "Speed:" | awk '{ print$2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lspeeddev2tmp 12 12
   lspeeddev2tmp=$cfgvarres

   lstatdev1tmp="`ethtool $dev1tmp  | grep "Link detected:" | awk '{ print$3 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lstatdev1tmp 12 12
   lstatdev1tmp=$cfgvarres

   lstatdev2tmp="`ethtool $dev2tmp  | grep "Link detected:" | awk '{ print$3 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lstatdev2tmp 12 12
   lstatdev2tmp=$cfgvarres

   lerrdev1Rx="`ifconfig $dev1tmp   | grep "RX packets" | awk '{ print $3 }' | awk -F':' '{ print $2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lerrdev1Rx 12 12
   lerrdev1Rx=$cfgvarres

   lerrdev1Tx="`ifconfig $dev1tmp   | grep "TX packets" | awk '{ print $3 }' | awk -F':' '{ print $2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lerrdev1Tx 12 12
   lerrdev1Tx=$cfgvarres

   lerrdev2Rx="`ifconfig $dev2tmp   | grep "RX packets" | awk '{ print $3 }' | awk -F':' '{ print $2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lerrdev2Rx 12 12
   lerrdev2Rx=$cfgvarres

   lerrdev2Tx="`ifconfig $dev2tmp   | grep "TX packets" | awk '{ print $3 }' | awk -F':' '{ print $2 }' | sed  -e 's/[:\/:]/-/g'`"
   setmeup $lerrdev2Tx 12 12
   lerrdev2Tx=$cfgvarres

   lerrdev1tmp="${lerrdev1Rx:0:6}:${lerrdev1Tx:0:6}"
   setmeup $lerrdev1tmp 12 12
   lerrdev1tmp=$cfgvarres

   lerrdev2tmp="${lerrdev2Rx:0:6}:${lerrdev2Tx:0:6}"
   setmeup $lerrdev2tmp 12 12
   lerrdev2tmp=$cfgvarres

   ldrvdev1tmp="`ethtool -i $dev1tmp | grep "^driver:" | awk -F':' '{ print $2 }'`"
   setmeup $ldrvdev1tmp 12 12
   ldrvdev1tmp=$cfgvarres

   ldrvdev2tmp="`ethtool -i $dev2tmp | grep "^driver:" | awk -F':' '{ print $2 }'`"
   setmeup $ldrvdev2tmp 12 12
   ldrvdev2tmp=$cfgvarres

   lbusdev1tmp="`ethtool -i $dev1tmp | grep "^bus" | grep "^bus" | awk  '{ print $2 }'`"
   setmeup $lbusdev1tmp 12 12
   lbusdev1tmp=$cfgvarres

   lbusdev2tmp="`ethtool -i $dev2tmp | grep "^bus" | grep "^bus" | awk  '{ print $2 }'`"
   setmeup $lbusdev2tmp 12 12
   lbusdev2tmp=$cfgvarres

   eval ${devname}1=${dev1tmp:0:4}
   eval ${devname}2=${dev2tmp:0:4}
   eval ${devname}1stat=${lstatdev1tmp:0:12}
   eval ${devname}2stat=${lstatdev2tmp:0:12}
   eval ${devname}1err=${lerrdev1tmp:0:12}
   eval ${devname}2err=${lerrdev2tmp:0:12}
   eval ${devname}1speed=${lspeeddev1tmp:0:12}
   eval ${devname}2speed=${lspeeddev2tmp:0:12}
   eval ${devname}1drv=${ldrvdev1tmp:0:12}
   eval ${devname}2drv=${ldrvdev2tmp:0:12}
   eval ${devname}1bus=${lbusdev1tmp:0:12}
   eval ${devname}2bus=${lbusdev2tmp:0:12}
   if [ "${dev1tmp:0:4}" = "" ];
   then
      eval ${devname}1="!!!!"
   fi
   if [ "${dev2tmp:0:4}" = "" ];
   then
      eval ${devname}2="!!!!"
   fi
} 2>/dev/null

# ----------------------------------------------------------------
# function: getnafodev
# args    : none
# description:
#   computes devices used for admin,billing,signalling in simplex
# ----------------------------------------------------------------

getnafodev( ) {
   getbondingdev $*
}


# ----------------------------------------------------------------
# function: getbonding
# args    : none
# description:
#   computes bonding dev association for all networks.
# ----------------------------------------------------------------


getbonding( )
{

   if [ "$testbed" = "cluster" ];
   then
      getbondingdev cdev cluster_dev  16
      getbondingdev adev bonding_dev0 16
      getbondingdev sdev bonding_dev1 16
      getbondingdev bdev bonding_dev2 16
   else
      getnafodev adev nafo0
      getnafodev sdev nafo1
      getnafodev bdev nafo2
   fi
}



computeroutes( )
{
   network=`route -n | grep -v "^[a-zA-Z]" | awk '{print $1}'`
   gateway=`route -n | grep -v "^[a-zA-Z]" | awk '{print $2}'`
   interface=`route -n | grep -v "^[a-zA-Z]" | awk '{print $8}'`

   #<ComputeNet>
      count=0
      for idx in $network
      do
         setmeup $idx 24 24
         networkcfg[$count]=$cfgvarres
         count=`expr $count + 1`
      done
      networkcfg[$count]=""

      count=0
      for idx in $gateway
      do
         setmeup $idx 24 24
         gatewaycfg[$count]=$cfgvarres
         count=`expr $count + 1`
      done
      gatewaycfg[$count]=""

      count=0
      for idx in $interface
      do
         setmeup $idx 12 12
         interfacecfg[$count]=$cfgvarres
         count=`expr $count + 1`
      done
      interfacecfg[$count]=""

   #</ComputeNet>
}

computechain( )
{
   chaintype=$1
   chainres="`iptables -nL $chaintype | awk '{ print $1 }' | grep -v '^[a-zA-Z]' | sort | uniq`"
   chainout=""
   for idx in $chainres
   do
     chainout="${chainout}${idx},"
   done
}

acceptchain( )
{
   chaintype=$1
   chaininfo="`cat $TEMPLATEFILE | grep '<3a>'`"
   chainrule="`cat $TEMPLATEFILE | grep '<3b>'`"
   chainres="`iptables -nL $chaintype | awk '{ print $1 }' | grep -v '^[a-zA-Z]' | sort | uniq`"
   chainout=""
   echo "   ---------------------------------------------------------------------------------------------------"
   echo "   $chaintype"
   
   for idx in $chainres
   do
     setmeup $idx 16 16
     chainout="`echo \"$chaininfo\" | sed -e s/'<3a>            '/$cfgvarres/g`"
     echo "   -------------------------------------------------------------------------------------------------"
     echo "$chainout"
     count=0
     for elem in `iptables -nL $idx | egrep '(^ACCEPT)' | awk '{ print $2 }'`
     do
        setmeup $elem 8 8
        protcfg[$count]=$cfgvarres
        count=`expr $count + 1`
     done
     count=0
     iptables -nL $idx | egrep '(^ACCEPT)' | awk '{ print $6, $7, $8, $9, $10 }' \
                       | sed -e s/ESTABLISHED/EST/g -e s/'state '//g -e s/' '/'!'/g >/tmp/iptables.res
     for elem in `cat /tmp/iptables.res`
     do
        setmeup $elem 24 24
        auxcfg[$count]=$cfgvarres
        count=`expr $count + 1`
     done
     rm -f /tmp/iptables.res
     count=0
     for elem in `iptables -nL $idx | egrep '(^ACCEPT)' | awk '{ print $4 }'`
     do
        setmeup $elem 24 24
        srccfg[$count]=$cfgvarres
        count=`expr $count + 1`
     done
     count=0
     for elem in `iptables -nL $idx | egrep '(^ACCEPT)' | awk '{ print $5 }'`
     do
        setmeup $elem 24 24
        destcfg[$count]=$cfgvarres
        count=`expr $count + 1`
     done
     protcfg[$count]=""
     srccfg[$count]=""
     destcfg[$count]=""

     count=0
     while [ "${srccfg[$count]}" != "" ];
     do
        echo "                      ${srccfg[$count]} ${destcfg[$count]} ${protcfg[$count]} ${auxcfg[$count]}"
        count=`expr $count + 1`
     done
      
   done
} >> $CHAINOUT

pictureit( )
{
   routeinfo="`cat $TEMPLATEFILE | grep '<1a>'`"
   routestr=""
   count=0
   while [ "${networkcfg[$count]}" != "" ];
   do
      routestr="${routestr}`echo \"$routeinfo\"                        \
                 | sed -e 's/<1a>[ ]*/  \| '${networkcfg[$count]}'/g'  \
                 | sed -e 's/<1b>[ ]*/'${gatewaycfg[$count]}'/g'       \
                 | sed -e 's/<1c>[ ]*/'${interfacecfg[$count]}'/g'     \
                 | sed -e 's/!/ /g' `"
      count=`expr $count + 1`
   done
   
   CHAINFILE=/tmp/chain.res
   CHAINOUT=/tmp/chain.out
   rm -f $CHAINFILE $CHAINOUT
   {
      cat $TEMPLATEFILE | grep -B 1024 routebegin | grep -v routebegin 
      echo "$routestr"  | sed -e s/\?/'\n'/g  
      cat $TEMPLATEFILE | grep -A 1024 routeend | grep -v routeend 
   } >> $CHAINFILE

   computechain INPUT
   inpchain=${chainout:-none}
   computechain OUTPUT
   outchain=${chainout:-none}
   computechain FORWARD
   fowchain=${chainout:-none}
   cat $CHAINFILE | sed -e s/'<2a>'/$inpchain/g \
                  | sed -e s/'<2b>'/$outchain/g \
                  | sed -e s/'<2c>'/$fowchain/g \
                  | sed -e s/,$//g > ${CHAINFILE}.tmp
   mv -f ${CHAINFILE}.tmp $CHAINFILE

   acceptchain INPUT
   acceptchain OUTPUT
   acceptchain FORWARD
   
   {
      cat $CHAINFILE  | grep -B 1024 chainbegin | grep -v chainbegin
      cat $CHAINOUT   | sed -e 's/!/ /g'
      cat $CHAINFILE  | grep -A 1024 chainend | grep -v chainend 
      cat ${DEVICEOUT}.all
   } | egrep -v '(^\+)'
   rm -f $CHAINFILE $CHAINOUT  ${DEVICEOUT} ${DEVICEOUT}.all
}

computedevices( )
{
   rm -f $DEVICEOUT
   cat $TEMPLATEFILE | egrep '(^\+)' | egrep -v '(^\+link)' > $DEVICEOUT
   
   if [ "$testbed" = "cluster" ];
   then
      adminbonddev="bond0"
      sigbonddev="bond1"
      billbonddev="bond2"
      clusterbonddev="bondcf"
   else
      adminbonddev=""
      sigbonddev=""
      billbonddev=""
      clusterbonddev=""
   fi
   cat $DEVICEOUT    | sed -e s/'<0a> '/Admin/g                         \
                           -e s/'<0b>'/$adev1/g                         \
                           -e s/'<0c>'/$adev2/g                         \
                           -e s/'<0d>        '/$adev1stat/g             \
                           -e s/'<0e>        '/$adev1speed/g            \
                           -e s/'<0f>        '/$adev1err/g              \
                           -e s/'<0j>        '/$adev1drv/g              \
                           -e s/'<0k>        '/$adev1bus/g              \
                           -e s/'<0g>        '/$adev2stat/g             \
                           -e s/'<0h>        '/$adev2speed/g            \
                           -e s/'<0i>        '/$adev2err/g              \
                           -e s/'<0l>        '/$adev2drv/g              \
                           -e s/'<0m>        '/$adev2bus/g              \
                           -e s/'<0n>        '/$adminbonddev'       '/g  

   cat $DEVICEOUT    | sed -e s/'<0a>      '/Signalling/g               \
                           -e s/'<0b>'/$sdev1/g                         \
                           -e s/'<0c>'/$sdev2/g                         \
                           -e s/'<0d>        '/$sdev1stat/g             \
                           -e s/'<0e>        '/$sdev1speed/g            \
                           -e s/'<0f>        '/$sdev1err/g              \
                           -e s/'<0j>        '/$sdev1drv/g              \
                           -e s/'<0k>        '/$sdev1bus/g              \
                           -e s/'<0g>        '/$sdev2stat/g             \
                           -e s/'<0h>        '/$sdev2speed/g            \
                           -e s/'<0i>        '/$sdev2err/g              \
                           -e s/'<0l>        '/$sdev2drv/g              \
                           -e s/'<0m>        '/$sdev2bus/g              \
                           -e s/'<0n>        '/$sigbonddev'       '/g  

   cat $DEVICEOUT    | sed -e s/'<0a>   '/Billing/g                     \
                           -e s/'<0b>'/$bdev1/g                         \
                           -e s/'<0c>'/$bdev2/g                         \
                           -e s/'<0d>        '/$bdev1stat/g             \
                           -e s/'<0e>        '/$bdev1speed/g            \
                           -e s/'<0f>        '/$bdev1err/g              \
                           -e s/'<0j>        '/$bdev1drv/g              \
                           -e s/'<0k>        '/$bdev1bus/g              \
                           -e s/'<0g>        '/$bdev2stat/g             \
                           -e s/'<0h>        '/$bdev2speed/g            \
                           -e s/'<0i>        '/$bdev2err/g              \
                           -e s/'<0l>        '/$bdev2drv/g              \
                           -e s/'<0m>        '/$bdev2bus/g              \
                           -e s/'<0n>        '/$billbonddev'       '/g  

   if [ "$testbed" = "cluster" ];
   then

   cat $DEVICEOUT    | sed -e s/'<0a>   '/Cluster/g                     \
                           -e s/'<0b>'/$cdev1/g                         \
                           -e s/'<0c>'/$cdev2/g                         \
                           -e s/'<0d>        '/$cdev1stat/g             \
                           -e s/'<0e>        '/$cdev1speed/g            \
                           -e s/'<0f>        '/$cdev1err/g              \
                           -e s/'<0j>        '/$cdev1drv/g              \
                           -e s/'<0k>        '/$cdev1bus/g              \
                           -e s/'<0g>        '/$cdev2stat/g             \
                           -e s/'<0h>        '/$cdev2speed/g            \
                           -e s/'<0i>        '/$cdev2err/g              \
                           -e s/'<0l>        '/$cdev2drv/g              \
                           -e s/'<0m>        '/$cdev2bus/g              \
                           -e s/'<0n>        '/$clusterbonddev'       '/g  

   fi
} 

initvars( )
{
   CFGFILE=${1:-/etc/hiq8000/node.cfg}
   TEMPLATEFILE=${2:-"/var/opt/image/secure8k.template"}
   DEVICEOUT=/tmp/devices.out
   stty intr undef
   testbed=`cat $CFGFILE| grep test_bed | awk -F':' '{ print $2 }' | sed -e 's/[ \t]*//g'`
}

initvars $*
getbonding
if [ "$EthDevices8kOnly" != "true" ];
then
   computeroutes
   computedevices | sed -e 's/^\+//g' -e 's/\!/ /g' > ${DEVICEOUT}.all
   pictureit
else
   computedevices | sed -e 's/^\+//g' -e 's/\!/ /g' > ${DEVICEOUT}.all
   cat ${DEVICEOUT}.all
   rm -f ${DEVICEOUT}.all
fi 
