#!/bin/bash
# -*- mode: sh; fill-column: 75; tab-width: 8; coding: utf-8-unix -*-

ROLE=proxy
prog=$( basename $0 .bash )

. /usr/local/bin/usr_local_tput.bash || exit 2
PREFIX=/usr/local

USAGE="[to_tor|from_tor|test_to|test_from|verify]"

. /usr/local/sbin/proxy_whonix_lib.bash || \
    { ERROR loading /usr/local/sbin/proxy_whonix_lib.bash ; exit 2; }
. /usr/local/bin/usr_local_base.bash || exit 2
. /usr/local/sbin/proxy_tor_lib.bash || \
    { ERROR loading /usr/local/sbin/proxy_tor_lib.bash ; exit 3; }
. /usr/local/bin/usr_local_base.bash || exit 2

[ -f $PREFIX/etc/testforge/testforge.bash ] && . /usr/local/etc/testforge/testforge.bash
[ -z "$PRIV_TOR_OWNER" ] && grep -q ^debian-tor /etc/passwd && PRIV_TOR_OWNER=debian-tor
[ -z "$PRIV_TOR_OWNER" ] && grep -q ^tor /etc/passwd && PRIV_TOR_OWNER=tor
PRIV_TOR_GID=$( grep ^$PRIV_TOR_OWNER /etc/passwd|cut -d: -f 4 )
[ -z "$PRIV_BIN_OWNER" ] && PRIV_BIN_OWNER=bin
PRIV_BIN_GID=$( grep ^$PRIV_BIN_OWNER /etc/passwd|cut -d: -f 4 )

#ps ax | grep 'usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/network.conf' && \
#  ps ax | grep 'usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/network.conf' | sed -e 's/ .*//' \
#  | xargs kill

[ $USER != root ] || proxy_iptables_save | grep -qi reject || \
  proxy_ping_firewall_restart || exit 2$?
# bash /usr/local/sbin/base_firewall_start.bash

## proxy_whonix_or_tor
proxy_whonix_or_tor () { DBUG proxy_whonix_or_tor $* ;
    local a dire debian file
    dire=$1
    file=/etc/tor/torrc

    [ -n "$PROXY_WLAN" ] || PROXY_WLAN=$( proxy_get_if ) || return 1$?
    [ -n "$PROXY_WLAN" ] || return 2$?
    DBUG proxy_whonix_to_tor PROXY_WLAN=$PROXY_WLAN $*

    true || \
    proxy_ping_online || {
        wlan7=$PROXY_WLAN
	base_wlan_modules_unload $PROXY_WLAN
	proxy_base_wlan_modules_load $PROXY_WLAN
	ERROR not online ret=$? ;  return 3 ;
    }
    proxy_whonix_copy_files $dire
## proxy_whonix_to_tor
}

proxy_whonix_to_selektor () { DBUG proxy_whonix_to_selektor $* ;
    local a dire file
    dire=selektor
    file=
    proxy_whonix_or_tor $dire
    if ps ax | grep -v grep | grep -q 'tor -f /var/lib/tor/.SelekTOR/3xx' ; then
	:
    elif ! proxy_route_check ; then
	return $?
    elif tty >/dev/null ; then
	/var/local/bin/selektor.bash &
    fi

}

proxy_whonix_to_tor () { DBUG proxy_whonix_to_tor $* ;
    local a dire debian file
    dire=tor
    file=/etc/tor/torrc

    proxy_whonix_or_tor $dire || return 2$?
    DBUG proxy_whonix_to_tor PROXY_WLAN=$PROXY_WLAN $*

    proxy_tor_torrc_update /etc/tor/torrc 127.0.0.1
    proxy_tor_torrc_exclude /etc/tor/torrc
    # proxy_rc_service tor status >/dev/null || proxy_rc_service tor start
    # weaker - includes running from cmdline
    debian=$PRIV_TOR_OWNER
    ps ax -g $debian | grep -v grep | grep -q ' tor ' || \
	proxy_rc_service tor start || \
	{ ERROR not service start ret=$? ;  return 3 ; }


    proxy_whonix_privoxy_start tor || {
	echo WARN: $prog privoxy NOT running ret=$?
	# return 4 ;
    }

    proxy_whonix_dnsmasq_start tor || {
	echo WARN: proxy_whonix_to_tor dnsmasq NOT started retval=$?
	# return 5$? ;
    }

    # proxy_whonix_start_wget

    proxy_iptables_save | grep -q 'udp --dport 53 -j DNAT --to-destination 127.0.0.1:9053' || \
	proxy_rc_service dnsmasq status >/dev/null || \
	    { ERROR $prog dnsmasq not running ; return 6 ; }

    netstat -nlp4 | grep 127.0.0.1:9 || return 9
    return 0
}

## proxy_tor_clean
proxy_tor_clean () {
    [ -n "$MODE" ] || MODE="$( proxy_ping_mode )"
    if [ "$MODE" = whonix ] ; then
	proxy_whonix_get_gateway_dom || exit 8
	if [ -z "$GATEW_DOM" ] ; then
	    proxy_virsh list | grep -q $GATEW_DOM && \
		proxy_libvirt_clean_virbr1_rules
	fi
    fi
    return 0
}

## proxy_tor_test
proxy_tor_test () {
    local dire
    [ $# -eq 1 ] && dire=$1
    [ -z "$dire" ] && dire="$( proxy_ping_mode )"

    if [ $dire = tor -o $dire = whonix  -o $dire = host ] ; then
        # is vda a host?
	proxy_tor_test_ntp || return 2$?
        proxy_tor_test_anondate # || return 3$?
      fi

    proxy_whonix_test $dire || return 1$?

    return 0
}

starbucks_torrc () { proxy_whonix_host_tor_install $* ; }
## proxy_whonix_host_install
proxy_whonix_host_tor_install () { DBUG proxy_whonix_host_tor_install $* ;
    [ -n "$PROXY_WLAN" ] || PROXY_WLAN=$( proxy_get_if ) || return 1$?
    [ -n "$PROXY_WLAN_IP" ] || PROXY_WLAN_IP=$( proxy_get_wlan_ip ) || \
	{ ERROR proxy_whonix_host_tor_install ifconfig $PROXY_WLAN ; return 7 ; }
    [ -z "$PROXY_WLAN_IP" ] && return 0

    for file in /etc/tor/torrc /etc/tor/torrc-defaults ; do
	[ -f $file ] || continue
	grep -q "SocksPolicy accept " /etc/tor/torrc || continue
	grep -q "SocksPolicy accept $PROXY_WLAN_IP" /etc/tor/torrc || continue
	sed  -e "s@^SocksPolicy accept [^/]*\$@SocksPolicy accept $PROXY_WLAN_IP@" \
             -i $file
    done

    return 0
}

proxy_whonix_host_whonix () { proxy_whonix_from_tor $* ; }
## proxy_whonix_from_tor
proxy_whonix_from_tor () {
    local dire=whonix
    local ret
    DBUG proxy_whonix_from_tor $*

    proxy_rc_service tor status >/dev/null && proxy_rc_service tor stop

    [ -n "$PROXY_WLAN" ] || PROXY_WLAN=$( proxy_get_if ) || return 1$?
    #  ; return 2$ret
    proxy_whonix_config $dire || { ret=$? ; ERROR proxy_whonix_from_tor failed proxy_whonix_config ret=$ret ; return 2$ret ; }

    proxy_whonix_libvirt_start  || {
	ret=$? ;
	ERROR proxy_whonix_from_tor failed proxy_whonix_libvirt_start  ret=$ret ;
	return 3$ret
    }

    a=$( proxy_iptables_save | grep -e '-A OUTPUT -o .* -m tcp -p tcp -m owner --gid-owner $PRIV_TOR_GID  -j ACCEPT' | grep -c -v grep )
    [ $? -eq 0 ] && [ -n "$a" ] && [ "$a" -gt 0 ] && \
	WARN proxy_iptables -D OUTPUT -o $PROXY_WLAN -m tcp -p tcp -m owner --gid-owner $PRIV_TOR_GID -j ACCEPT

    proxy_whonix_copy_files $dire

    # netstat -nlp4e | grep 127.0.0.1:53 && { ERROR dns still running ; return 3;}
    if false; then
	proxy_rc_service pdnsd status >/dev/null && proxy_rc_service pdnsd stop
	[ -f /etc/pdnsd/pdnsd.conf.whonix ] && \
	  cp -p /etc/pdnsd/pdnsd.conf.whonix /etc/pdnsd/pdnsd.conf

	# proxy_whonix_start_wget
	proxy_whonix_dnsmasq_start $dire || \
  	    { ret=$? ; echo WARN: proxy_whonix_from_tor dnsmasq NOT started $ret ; }
    fi

    proxy_whonix_privoxy_start $dire || \
	{ ret=$?; echo WARN: proxy_privoxy_from_tor polipo not started $ret ; }

    proxy_whonix_host_tor_install

    return 0
}

if [ "$#" -eq 0 ] ; then
    echo USAGE: $prog $USAGE

  elif [ "$1" = '-h'  ] || [ "$1" = 'help' ] || [ "$1" = '--help' ] ; then
    echo USAGE: $prog $USAGE or:
    grep '^## ' $0 | sed -e 's/^## //'

  elif [ "$1" = to  -o "$1" = 'to_tor' -o "$1" = 'tor' ] ; then
    [ $( id -u ) -eq 0 ] || { ERROR $prog must be root ; exit 1 ; }
    proxy_whonix_to_tor || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 1$ret ; }

  elif [ "$1" = 'selektor' ] ; then
    [ $( id -u ) -eq 0 ] || { ERROR $prog must be root ; exit 1 ; }
    proxy_whonix_to_selektor || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 1$ret ; }

  elif [ "$1" = 'from' -o "$1" = 'from_tor' -o "$1" = 'whonix' ] ; then
    [ $( id -u ) -eq 0 ] || { ERROR $prog must be root ; exit 1 ; }
    proxy_whonix_from_tor || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 2$ret ; }

  elif [ "$1" = 'gateway' ] ; then
    [ $( id -u ) -eq 0 ] || { ERROR $prog must be root ; exit 1 ; }
    proxy_whonix_gateway || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 2$ret ; }
    proxy_whonix_test gateway || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 4$ret ; }

  elif [ "$1" = 'test_from' -o "$1" = 'test_whonix' ] ; then
    [ $( id -u ) -eq 0 ] || { ERROR $prog must be root ; exit 1 ; }
    proxy_tor_test whonix || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 6$ret ; }
    /usr/local/bin/proxy_ping_test.bash panic || exit 7

  elif [ "$1" = 'test_gateway' -o "$1" = 'test_gateway' ] ; then
    proxy_tor_test gateway || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 6$ret ; }
    /usr/local/bin/proxy_ping_test.bash panic || exit 7

  elif [ "$1" = 'test_to' -o "$1" = 'test_tor' ] ; then
    proxy_tor_test tor || { ret=$? ; ERROR $prog $prog $1 retval=$ret ; exit 7$ret ; }
    /usr/local/bin/proxy_ping_test.bash panic || exit 7

  elif [ "$1" = 'direct' -o "$1" = 'test_direct' ] ; then
    /usr/local/bin/proxy_ping_test.bash direct

  elif [ "$1" = 'verify' ] ; then
    /usr/local/bin/proxy_ping_test.bash panic || exit 7
    [ -n "$MODE" ] || MODE="$( proxy_ping_mode )"
    proxy_whonix_test $MODE || \
	{ ret=$? ; ERROR "$prog host='$GATEW_DOM' retval=$ret" ; exit 8$ret ; }

  elif [ "$1" = 'clean' -o "$1" = 'stop' ] ; then
    proxy_whonix_$1
    /usr/local/bin/proxy_ping_test.bash panic || exit 8

  elif [ "$1" = 'config' ] ; then
    ERROR $prog not implemented $1;exit 1

  else
	eval "$@"
	exit $?
  fi
