#!/bin/bash

usage() {
	echo "$0 <windowsclient-name>"
	exit 1
}

winclient="$1"
if [ -z "$winclient" ]; then
	usage
fi
winclientuid="$winclient\$"

timestamp=$(date +%Y%m%d%H%M%S)
logfile="$winclient-$timestamp.log"
exec &> >(tee "$logfile")

date -R

windowsclientips=()
while read ip; do
	windowsclientips+=("$ip")
done < <(host "$winclient" | sed -n 's/.* has address //p')

if [ -z "${windowsclientips}" ]; then
	echo "ERROR: IP Lookup failed"
else
	ucr set repository/online/unmaintained='yes'
	univention-install -y arping
	ucr set repository/online/unmaintained='no'
fi

for ip in "${windowsclientips[@]}"; do
	echo "## IP: $ip"
	if ! arping -q -d -c 2 "$ip"; then
		echo "ERROR: IP duplication detected for $ip"
	fi
done

win7olldif=$(univention-ldapsearch \
  uid="$winclientuid" \
  "*" +)

echo "## univention-ldapsearch"
printf '=%.0s' {1..78}
printf '\n'
echo "$win7olldif"
printf '=%.0s' {1..78}
printf '\n'

win7s4ldif=$(ldbsearch \
  -H ldapi:///var/lib/samba/private/ldap_priv/ldapi \
  sAMAccountName="$winclientuid" \
  '*' supplementalcredentials unicodepwd replPropertyMetaData \
  ntsecuritydescriptor msds-keyversionnumber)

echo "## univention-s4search"
printf '=%.0s' {1..78}
printf '\n'
echo "$win7s4ldif"
printf '=%.0s' {1..78}
printf '\n'

windowsclientuidnumber=$(sed -n 's/^uidNumber: //p' <<<"$win7olldif")

echo "## univention-s4search --show-binary"
printf '=%.0s' {1..78}
printf '\n'
ldbsearch -H ldapi:///var/lib/samba/private/ldap_priv/ldapi \
  sAMAccountName="$winclientuid" \
  '*' supplementalcredentials unicodepwd replPropertyMetaData \
  ntsecuritydescriptor msds-keyversionnumber \
  --show-binary
printf '=%.0s' {1..78}
printf '\n'

echo "## connector-s4.log"
printf '=%.0s' {1..78}
printf '\n'
zgrep -i "\<$winclient\>" /var/log/univention/connector-s4.log*
printf '=%.0s' {1..78}
printf '\n'

echo "## S4-Connector rejects:"
printf '=%.0s' {1..78}
printf '\n'
univention-s4connector-list-rejected
printf '=%.0s' {1..78}
printf '\n'

windowsclientsid=$(sed -n 's/^objectSid: //p' <<<"$win7s4ldif")

join_by() { local IFS="$1"; shift; echo "$*"; }

s1=$(join_by '|' "${windowsclientips[@]}")
winclient_greppattern="\<($winclient|$s1|$windowsclientsid)\>"
winclient_greppattern2="\<($winclient|$s1|$windowsclientsid|$windowsclientuidnumber)\>"

echo "## Samba Logs:"
printf '=%.0s' {1..78}
printf '\n'
zgrep -Ei -C20 "$winclient_greppattern2" /var/log/samba/*
printf '=%.0s' {1..78}
printf '\n'

echo "## auth.log:"
printf '=%.0s' {1..78}
printf '\n'
zgrep -i "\<$winclient\>" /var/log/auth.log*
printf '=%.0s' {1..78}
printf '\n'

echo "## Syslog:"
printf '=%.0s' {1..78}
printf '\n'
zgrep -Ei "$winclient_greppattern" /var/log/syslog*
printf '=%.0s' {1..78}
printf '\n'

idmap1=$(ldbsearch -H /var/lib/samba/private/idmap.ldb \
	"(objectSid=$windowsclientsid)")

echo "## idmap.ldb:"
printf '=%.0s' {1..78}
printf '\n'
echo "$idmap1"

idmap2=$(ldbsearch -H /var/lib/samba/private/idmap.ldb \
	"(xidNumber=$windowsclientuidnumber)")
if [ "$idmap1" != "$idmap2" ]; then
	echo "$idmap2"
fi
printf '=%.0s' {1..78}
printf '\n'

echo "## Essential DNS records:"
printf '=%.0s' {1..78}
printf '\n'
/usr/share/univention-samba4/scripts/check_essential_samba4_dns_records.sh
printf '=%.0s' {1..78}
printf '\n'

echo "## DRS showrepl:"
printf '=%.0s' {1..78}
printf '\n'
samba-tool drs showrepl
printf '=%.0s' {1..78}
printf '\n'

if ! [ -d "$HOME/.gnupg" ]; then
	mkdir "$HOME/.gnupg"
fi

tfk=$(mktemp --tmpdir=.gnupg)

rmtfk() {
	if [ -n "$tfk" ] && [ -f "$tfk" ]; then
		rm -f "$tfk"*
	fi
}
trap rmtfk EXIT

if wget -q http://download.univention.de/download/univention-support.asc -O - 2>/dev/null| gpg --primary-keyring "$tfk" --import >/dev/null 2>&1; then
	gpg --primary-keyring "$tfk" --encrypt --trust-model always -a -r support@univention.de "$logfile"
	echo
	echo "####################################################################################################"
	echo "# The log results can be found in the log file: $logfile"
	echo "# The encrypted log has been created: $logfile.asc"
	echo "# Please send the gpg encrypted log ($logfile.asc) to support@univention.de"
	echo "####################################################################################################"
else
	echo
	echo "####################################################################################################"
	echo "# Please encrypt and send the follwing file to support@univention.de: $logfile"
	echo "# As described in http://sdb.univention.de/1344 :"
	echo "#"
	echo "# 1. Import Univention support public key (this needs to be done only once)"
	echo "#    wget -q http://download.univention.de/download/univention-support.asc -O - | gpg --import"
	echo "#"
	echo "# 2. Next encrypt the file:"
	echo "#    gpg --encrypt --trust-model always -a -r support@univention.de $logfile"
	echo "#"
	echo "# 3. The resulting encrypted file is stored as: $logfile.asc"
	echo "#    Please send that file to support@univention.de"
	echo "####################################################################################################"
fi
