#!/bin/bash
#
# bkctld is a shell script to create and manage a backup server which will
# handle the backup of many servers (clients).
#
# Author: Victor Laborie <vlaborie@evolix.fr>
# Contributor: Benoît Série <bserie@evolix.fr>, Gregory Colpart <reg@evolix.fr>, Romain Dessort <rdessort@evolix.fr>, Tristan Pilat <tpilat@evolix.fr>
# Licence: AGPLv3
#

usage(){
    echo "Usage: $0 <subcommand> [options]"
    echo "Subcommands:"
    echo "	init		<jailname>					Init jail <jailname>"
    echo "	update		<jailname>|all					Update jail <jailname> or all"
    echo "	remove		<jailname>|all					Remove jail <jailname> or all"
    echo "	start		<jailname>|all					Start jail <jailname> or all"
    echo "	stop		<jailname>|all					Stop jail <jailname> or all"
    echo "	reload		<jailname>|all					Reload jail <jailname> or all"
    echo "	restart		<jailname>|all					Restart jail <jailname> or all"
    echo "	sync		<jailname>|all					Sync jail <jailname> or all to another node"
    echo "	status		[<jailname>]					Print status of <jailname> (default all jail)"
    echo "	key		<jailname>		[<keyfile>]		Set or get ssh pubic key of <jailname>"
    echo "	port		<jailname>		[<ssh_port>|auto]	Set or get ssh port of <jailname>"
    echo "	ip		<jailname>		[<ip>|all]		Set or get allowed(s) ip(s) of <jailname>"
    echo "	inc								Make incremental inc of all jails"
    echo "	rm								Remove old incremtal inc of all jails"
    echo ""
}

## check functions

check_jail() {
	jail=$1
	if [ -d ${JAILDIR}/${jail} ]; then
		exit 0
	else
		exit 1
	fi
}

check_jail_on() {
	jail=$1
        if [ -f ${JAILDIR}/${jail}/${SSHD_PID} ]; then
                pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
                ps -p $pid > /dev/null
                if [ $? == 0 ]; then
                        exit 0
                else
			rm ${JAILDIR}/${jail}/${SSHD_PID}
	                umount -R ${JAILDIR}/${jail}/dev
			umount ${JAILDIR}/${jail}/proc/
			exit 1
		fi
        else
		exit 1
	fi
	echo $status
}

check_btrfs() {
	grep $(dirname $JAILDIR) /etc/fstab|grep -q btrfs
	if [[ $? -eq 0 ]]; then
                exit 0
        fi
	grep $JAILDIR /etc/fstab|grep -q btrfs
	if [[ $? -ne 0 ]]; then
		exit 1
	fi
	grep $INCDIR /etc/fstab|grep -q btrfs
	if [[ $? -ne 0 ]]; then
		exit 1
	fi
	exit 0
}

## get functions : get info on jail

get_port() {
	jail=$1
	port=$(grep -E "Port [0-9]+" ${JAILDIR}/${jail}/${SSHD_CONFIG}|grep -oE "[0-9]+")
	echo $port
}

get_key() {
	jail=$1
	if [ -f ${JAILDIR}/${jail}/${AUTHORIZED_KEYS} ]; then
		cat ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	fi
}

get_ip() {
	jail=$1
	for allow in $(grep -E "^AllowUsers" ${JAILDIR}/$jail/${SSHD_CONFIG}|grep -Eo "root@[^ ]+"); do
		echo $allow|cut -d'@' -f2
	done
}

get_inc() {
	jail=$1
	inc="0"
        if [ -f ${CONFDIR}/${jail} ]; then
                day=$(grep -c "day" ${CONFDIR}/${jail})
                month=$(grep -c "month" ${CONFDIR}/${jail})
                inc="${day}/${month}"
        fi
	echo $inc
}

## set functions : set info on jail

set_port() {
	jail=$1
	port=$2
	if [ "$port" = "auto" ]; then
		port=$(grep -h Port ${JAILDIR}/*/${SSHD_CONFIG} 2>/dev/null | grep -Eo [0-9]+ | sort -n | tail -1)
	        port=$((port+1))
        	if [ ! $port -gt 1 ]; then
			port=2222
	        fi
	fi
        sed -i "s/^Port .*/Port ${port}/" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

set_key() {
	jail=$1
	keyfile=$2
	if [ -f $keyfile ]; then
		cat $keyfile > ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
		chmod 600 ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	else
		echo "Keyfile $keyfile dosen't exist !" >&2
		exit 1
	fi
}

set_ip() {
	jail=$1
	ip=$2
	if [[ $ip = "all" || $ip = "0.0.0.0/0" ]]; then
		ips="0.0.0.0/0"
	else
		ips=$(get_ip $jail)
		ips=$(echo $ips $ip|xargs -n1|grep -v "0.0.0.0/0"|sort|uniq)
	fi
	allow="AllowUsers"
	for ip in $ips; do
		allow="$allow root@${ip}"
	done
	sed -i "s~^AllowUsers .*~${allow}~" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

set_firewall() {
	jail=$1
	if [ -n "${FIREWALL_RULES}" ]; then
		if [ -f $FIREWALL_RULES ]; then
			sed -i "/#${jail}$/d" $FIREWALL_RULES
		fi
		port=$(get_port $jail)
		for ip in $(get_ip $jail); do
			echo "/sbin/iptables -A INPUT -p tcp --sport 1024: --dport $port -s $ip -j ACCEPT #$jail" >> $FIREWALL_RULES
		done
		if [ -f /etc/init.d/minifirewall ]; then
			/etc/init.d/minifirewall restart >/dev/null
		fi
	fi
}

## mk_jail function : create or update a jail

mk_jail() {
	jail=$1
	passwd="${TPLDIR}/passwd"
	shadow="${TPLDIR}/shadow"
	group="${TPLDIR}/group"
	[ -f "${LOCALTPLDIR}/passwd" ] && passwd="${LOCALTPLDIR}/passwd"
	[ -f "${LOCALTPLDIR}/shadow" ] && shadow="${LOCALTPLDIR}/shadow"
	[ -f "${LOCALTPLDIR}/group" ] && group="${LOCALTPLDIR}/group"
	umask 022

	echo -n "1 - Creating the chroot..."
	mkdir -p ${JAILDIR}/${jail}/{bin,dev,etc/ssh,lib,lib64,proc}
	mkdir -p ${JAILDIR}/${jail}/lib/{x86_64-linux-gnu,tls/i686/cmov,i686/cmov}
	mkdir -p ${JAILDIR}/${jail}/usr/{bin,lib,sbin}
	mkdir -p ${JAILDIR}/${jail}/usr/lib/{x86_64-linux-gnu,openssh,i686/cmov}
	mkdir -p ${JAILDIR}/${jail}/root/.ssh && chmod 700 ${JAILDIR}/${jail}/root/.ssh
	mkdir -p ${JAILDIR}/${jail}/var/{log,run/sshd}
	touch ${JAILDIR}/${jail}/var/log/{authlog,lastlog,messages,syslog}
	touch ${JAILDIR}/${jail}/etc/fstab
	echo "...OK"

	echo -n "2 - Copying essential files..."
	cp /proc/devices ${JAILDIR}/${jail}/proc
	cp /etc/ssh/{ssh_host_rsa_key,ssh_host_dsa_key} ${JAILDIR}/${jail}/etc/ssh/
	cp $passwd ${JAILDIR}/${jail}/etc/
	cp $shadow ${JAILDIR}/${jail}/etc/
	cp $group ${JAILDIR}/${jail}/etc/
	echo "...OK"

	echo -n "3 - Copying binaries..."
	cp -f /lib/ld-linux.so.2 ${JAILDIR}/${jail}/lib/ 2>/dev/null || cp -f /lib64/ld-linux-x86-64.so.2 ${JAILDIR}/${jail}/lib64/
	cp /lib/x86_64-linux-gnu/libnss* ${JAILDIR}/${jail}/lib/x86_64-linux-gnu/

	for dbin in /bin/bash /bin/cat /bin/chown /bin/mknod /bin/rm /bin/ls /bin/sed /bin/sh /bin/uname /bin/mount /usr/bin/rsync /usr/sbin/sshd /usr/lib/openssh/sftp-server; do
		cp -f $dbin ${JAILDIR}/${jail}/$dbin;
		for lib in $(ldd $dbin | grep -Eo "/.*so.[0-9\.]+"); do
			cp -p $lib ${JAILDIR}/${jail}/$lib
		done
	done
	echo "...OK"
}

## sub functions : functions call by subcommand
  
sub_init() {
	jail=$1
	sshd_config="${TPLDIR}/sshd_config"
	inctpl="${TPLDIR}/inc.tpl"
	[ -f "${LOCALTPLDIR}/sshd_config" ] && sshd_config="${LOCALTPLDIR}/sshd_config"
	[ -f "${LOCALTPLDIR}/inc.tpl" ] && inctpl="${LOCALTPLDIR}/inc.tpl"
	if ( check_jail $jail ); then
		echo "Jail $jail already exist ! Use '$0 update $jail' for update it" >&2
                exit 1		
	fi

	echo "Create jail $jail :"	
	if ( check_btrfs); then
		/sbin/btrfs subvolume create ${JAILDIR}/${jail}
	else
		mkdir -p ${JAILDIR}/${jail}
	fi
	mk_jail $jail
	echo -n "4 - Copie default sshd_config..."
	install -m 0640 $sshd_config ${JAILDIR}/$jail/${SSHD_CONFIG}
	echo "...OK"
	echo -n "5 - Set usable sshd port..."
	set_port $jail auto
	echo "...OK"
	echo -n "6 - Copie default inc configuration..."
	install -m 0640 $inctpl ${CONFDIR}/$jail
	echo "...OK"
}

sub_update() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist ! Use '$0 init $jail' for create it !" >&2
                exit 1
	fi
	
	status=$(check_jail_on $jail)
	if ( $status ); then
		log stop $jail
	fi
	echo "Update jail $jail :"
	mk_jail $jail
	if ( $status ); then
	        log start $jail
	fi
}

sub_remove() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist !" >&2
                exit 1
	fi

	if ( check_jail_on $jail ); then
	        log stop $jail
	fi
	echo "Delete jail $jail ..."
	if ( check_btrfs ); then
		rm -f ${CONFDIR}/${jail}
		if [ -d  ${INCDIR}/${jail} ]; then
			/sbin/btrfs subvolume delete ${INCDIR}/${jail}/*
			rmdir ${INCDIR}/${jail}
		fi
		/sbin/btrfs subvolume delete ${JAILDIR}/${jail}
	else
		rm -f ${CONFDIR}/${jail}
		rm -rf ${INCDIR}/${jail}
		rm -rf ${JAILDIR}/${jail}
	fi
	echo "...OK"
}

sub_start() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist ! Create it with '$0 init $jail'" >&2
                exit 1
        fi
	if ( check_jail_on $jail ); then
		echo "Jail $jail already running !" >&2
		exit 1
	fi

	echo -n "Start jail $jail ..."
	mount -t proc proc-${jail} ${JAILDIR}/${jail}/proc/
	mount -nt tmpfs dev-${jail} ${JAILDIR}/${jail}/dev
	mknod -m 622 ${JAILDIR}/${jail}/dev/console c 5 1
	mknod -m 666 ${JAILDIR}/${jail}/dev/null c 1 3
	mknod -m 666 ${JAILDIR}/${jail}/dev/zero c 1 5
	mknod -m 666 ${JAILDIR}/${jail}/dev/ptmx c 5 2
	mknod -m 666 ${JAILDIR}/${jail}/dev/tty c 5 0
	mknod -m 444 ${JAILDIR}/${jail}/dev/random c 1 8
	mknod -m 444 ${JAILDIR}/${jail}/dev/urandom c 1 9
	chown root:tty ${JAILDIR}/${jail}/dev/{console,ptmx,tty}
	ln -s ${JAILDIR}/${jail}/proc/self/fd ${JAILDIR}/${jail}/dev/fd
	ln -s ${JAILDIR}/${jail}/proc/self/fd/0 ${JAILDIR}/${jail}/dev/stdin
	ln -s ${JAILDIR}/${jail}/proc/self/fd/1 ${JAILDIR}/${jail}/dev/stdout
	ln -s ${JAILDIR}/${jail}/proc/self/fd/2 ${JAILDIR}/${jail}/dev/stderr
	ln -s ${JAILDIR}/${jail}/proc/kcore ${JAILDIR}/${jail}/dev/core
	mkdir ${JAILDIR}/${jail}/dev/pts
	mkdir ${JAILDIR}/${jail}/dev/shm
	mount -t devpts -o gid=4,mode=620 none ${JAILDIR}/${jail}/dev/pts
	mount -t tmpfs none ${JAILDIR}/${jail}/dev/shm
        chroot ${JAILDIR}/${jail} /usr/sbin/sshd
	echo "...OK"
}

sub_stop() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi
	if ! ( check_jail_on $jail ); then
		echo "Jail $jail doesnt't run !" >&2
		exit 1
	fi

	echo -n "Stop jail $jail ..."
	pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
	for conn in $(ps --ppid $pid -o pid=); do
		kill $conn
	done
	kill $pid
	umount -R ${JAILDIR}/${jail}/dev
	umount ${JAILDIR}/${jail}/proc/
	echo "...OK"
}

sub_reload() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi
	if ! ( check_jail_on $jail ); then
		echo "Jail $jail doesnt't run !" >&2
		exit 1
	fi

	echo -n "Reload jail $jail ..."
	pkill -HUP -F ${JAILDIR}/${jail}/${SSHD_PID}
	echo "...OK"
}

sub_status() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist ! Use '$0 status' for list all" >&2
                exit 1
	fi

	inc=$(get_inc $jail)
	if ( check_jail_on $jail ); then
		status="ON "
	else
		status="OFF"
	fi
	port=$(get_port $jail)
	ip=$(get_ip $jail|xargs|tr -s ' ' ',')
	echo "$jail $status $port $inc $ip" | awk '{ printf("%- 30s %- 10s %- 10s %- 10s %- 40s\n", $1, $2, $3, $4, $5); }'
}

sub_params() {
	jail=$1
	params=$2
	option=$3
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist ! Create it with '$0 init $jail'" >&2
                exit 1
        fi

	if [ -z "${option}" ]; then
	        get_${params} $jail
	else
	        set_${params} $jail $option
		echo "Update $jail : $params = $option"
	fi
}

sub_sync() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi

	if [ -z "${NODE}" ]; then
		echo "You must define \$NODE in /etc/default/bkctld !" >&2
		exit 1
	fi
	jail=$1
	ssh $NODE bkctld init $jail >/dev/null
	rsync -a ${JAILDIR}/${jail}/ ${NODE}:${JAILDIR}/${jail}/ --exclude proc/* --exclude sys/* --exclude dev/* --exclude var/run/*.pid --exclude var/backup/*
	rsync -a ${CONFDIR}/$jail ${NODE}:${CONFDIR}/$jail
	if ( check_jail_on $jail ); then
		ssh $NODE bkctld start $jail >/dev/null
	fi
	if [ -n "${FIREWALL_RULES}" ]; then
		rsync -a ${FIREWALL_RULES} ${NODE}:${FIREWALL_RULES}
		ssh $NODE /etc/init.d/minifirewall restart >/dev/null
	fi
}

sub_inc() {
	date=$(date +"%Y-%m-%d-%H")
	incs_logs=""
	for jail in $(ls -1 $JAILDIR); do
		inc="${INCDIR}/${jail}/${date}"
		mkdir -p ${INCDIR}/${jail}
		if [ ! -d "${inc}" ]; then
			start=$(date +"%H:%M:%S")
			if ( check_btrfs ); then
				/sbin/btrfs subvolume snapshot ${JAILDIR}/$jail $inc > /dev/null
			else
				cp -alx ${JAILDIR}/${jail}/ $inc
			fi
			end=$(date +"%H:%M:%S")
			inc_log=$(echo "Create $date inc of $jail (Start at $start / End at $end)")
			echo "${inc_log}"
			incs_logs=$(echo "${incs_logs}"; echo "${inc_log}")
		else
			echo "Inc $date of $jail already exist !" >&2
		fi
	done
	if [ -n "${NOTIF_MAIL}" ]; then
		if [ -n "${incs_logs}" ]; then
			echo "${incs_logs}" | mail -s "[info] EvoBackup - create incs" $NOTIF_MAIL
		fi
	fi
}

sub_rm() {
	empty="/tmp/bkctld-$$-$RANDOM/"
	mkdir $empty
	pidfile="/var/run/bkctld-rm.pid"
	if [ -f "${pidfile}" ]; then
		pid=$(cat $pidfile)
		ps -u $pid >/dev/null
		if [ $? -eq 0 ]; then
			echo "$0 rm always run (PID $pid) !" >&2
			kill -9 $pid
			rm $pidfile
			if [ -n "${NOTIF_MAIL}" ]; then
			        echo "$0 rm $pid was killed by $$ !" | mail -s "[warn] EvoBackup - purge incs interrupted" $NOTIF_MAIL
			fi
		else
			rm $pidfile
		fi
        fi
	echo $$ > $pidfile
	rms_logs=""
	for jail in $( ls -1 $JAILDIR ); do
		incs=$(ls -1 ${INCDIR}/$jail)
		if [ -f ${CONFDIR}/$jail ]; then
		        keep=$(
				while read j; do
		        	        date=$( echo $j | cut -d. -f1 )
		                	before=$( echo $j | cut -d. -f2 )
			                date -d "$(date $date) $before" "+%Y-%m-%d"
		        	done < ${CONFDIR}/$jail
			)
		fi
	        #for j in $( ls ${INCDIR}/$jail ); do
	        for j in $( grep -v -f <(echo "${keep}") <(echo "${incs}") ); do
			start=$(date +"%H:%M:%S")
			if ( check_btrfs ); then
				/sbin/btrfs subvolume delete ${INCDIR}/$jail/$j >/dev/null
			else
				cd ${INCDIR}/$jail
			        rsync -a --delete $empty $j*
			        rmdir $j*
			fi
			end=$(date +"%H:%M:%S")
			rm_log=$(echo "Delete $j inc of $jail (Start at $start / End at $end)")
			echo "${rm_log}"
			rms_logs=$(echo "${rms_logs}"; echo "${rm_log}")
	        done
	done
	rmdir $empty
	rm $pidfile
	if [ -n "${NOTIF_MAIL}" ]; then
		if [ -n "${rms_logs}" ]; then
	                echo "${rms_logs}" | mail -s "[info] EvoBackup - purge incs" $NOTIF_MAIL
		fi
        fi
}

## log function

log() {
	subcommand=$1
	logfile="${LOG_DIR}/bkctld.log"
        shift
        tty -s
        if [ $? -eq 0 ]; then
                sub_${subcommand} $@ 2>&1 | tee -a $logfile
        else
                sub_${subcommand} $@ 2>&1 >> $logfile
        fi	
}

## main function : check usage and valid params

main() {
	if [ $(id -u) != 0 ]; then
	    echo "Error, you need to be root to run $0 !" >&2
	    exit 1
	fi
	if [ -f /etc/default/bkctld ]; then
		source /etc/default/bkctld
	fi
	[ -z "${CONFDIR}" ] && CONFDIR='/etc/evobackup'
	[ -z "${JAILDIR}" ] && JAILDIR='/backup/jails'
	[ -z "${INCDIR}" ] && INCDIR='/backup/incs'
	[ -z "${TPLDIR}" ] && TPLDIR='/usr/share/bkctld'
	[ -z "${LOCALTPLDIR}" ] && LOCALTPLDIR='/usr/local/share/bkctld'
	[ -z "${LOG_DIR}" ] && LOG_DIR='/var/log'
	[ -z "${SSHD_PID}" ] && SSHD_PID='/var/run/sshd.pid'
	[ -z "${SSHD_CONFIG}" ] && SSHD_CONFIG='/etc/ssh/sshd_config'
	[ -z "${AUTHORIZED_KEYS}" ] && AUTHORIZED_KEYS='/root/.ssh/authorized_keys'
	mkdir -p $CONFDIR $JAILDIR $INCDIR
	subcommand=$1
	jail=$2
	option=$3
	case $subcommand in
	    "" | "-h" | "--help")
	        usage
	        ;;
	    "inc" | "rm")
		log $subcommand
		;;
            "init")
		if [[ -n "${jail}" ]]; then
			log $subcommand $jail
		else
			usage
		fi
		;;
	    "key" | "port" | "ip")
		if [[ -n "${jail}" ]]; then
			log params $jail $subcommand $option
		else
			usage
		fi
		;;
	    "start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove")
		if [[ -n "${jail}" ]]; then
			if [[ "${jail}" = "all" ]]; then
				for jail in $(ls $JAILDIR); do
					case $subcommand in
					    "start")
						if ! ( check_jail_on $jail ); then
							log $subcommand $jail
						fi
						;;
					    "stop" | "reload")
						if ( check_jail_on $jail ); then
							log $subcommand $jail
						fi
						;;
					    "restart")
						if ( check_jail_on $jail ); then
							log stop $jail
	                                        fi
						log start $jail
						;;
					    *)
							log $subcommand $jail
						;;
					esac
		                done
			else
				if [ "${subcommand}" != "restart" ]; then
					log $subcommand $jail
				else
					if ( check_jail_on $jail ); then
						log stop $jail
					fi
					log start $jail
				fi
			fi
		else
			usage
		fi
		;;
	    "status")
		if [[ -z "${jail}" ]]; then
			for jail in $(ls $JAILDIR); do
	                        sub_$subcommand $jail
	                done
		else
				sub_$subcommand $jail
		fi
		;;
	    *)
	        shift
	        echo "Error: '${subcommand}' is not a known subcommand." >&2
		usage
	       	exit 1
	        ;;
	esac
}

main "$@"