#!/bin/bash

rotate=86400	# seconds

usage() {
	echo "$0 <windowsclient-name>"
	exit 1
}

winclient="$1"
if [ -z "$winclient" ]; then
	usage
fi

if ! [ -x /usr/sbin/tcpdump ]; then
	univention-install -y tcpdump
fi
if ! [ -x /usr/sbin/tcpdump ]; then
	echo "ERROR: tcpdump not available"
fi

date -R

eval "$(ucr shell)"

win7s4ldif=$(univention-s4search \
  sAMAccountName="$winclient\$" \
  userPrincipalName)

userPrincipalName=$(sed -n 's/^userPrincipalName: //p' <<<"$win7s4ldif")

winclientfqdn="$winclient.$domainname"
export winclientfqdn
export winclient
export userPrincipalName

logdir=$(mktemp --tmpdir=. -d)

tcpdump -p -s 0 -w "${logdir}/${winclient}+%Y%m%d%H%M%S.pcap" -G "$rotate" \
	"host $winclientfqdn and host $hostname" &
tdpid=$!

cleanup() {
	pkill -f tcpdump >/dev/null 2>&1
	timestamp=$(date +%Y%m%d%H%M%S)
	cp /etc/krb5.keytab "$logdir/$hostname.keytab-$timestamp"
	samba-tool domain exportkeytab "$logdir/$winclient.keytab-$timestamp" --principal="$userPrincipalName"

	archive="tcpdump-$winclient-vs-$hostname-$timestamp.tar.bz2"
	tar cjvf "$archive" "$logdir" && rm -rf "$logdir"

	if ! [ -d "$HOME/.gnupg" ]; then
		mkdir "$HOME/.gnupg"
	fi

	tfk=$(mktemp --tmpdir=.gnupg)

	rmtfk() {
		if [ -n "$tfk" ]; then
			rm -f "$tfk"*
		fi
	}
	trap rmtfk EXIT

	if wget -q http://download.univention.de/download/univention-support.asc -O - 2>/dev/null| gpg --primary-keyring "$tfk" --import >/dev/null 2>&1; then
		gpg --primary-keyring "$tfk" --compress-algo none --encrypt --trust-model always -a -r support@univention.de "$archive"
		echo
		echo "####################################################################################################"
		echo "# The log results can be found in the archive file: $archive"
		echo "# The encrypted archive has been created: $archive.asc"
		echo "# Please send the gpg encrypted archive ($archive.asc) to support@univention.de"
		echo "####################################################################################################"
	else
		echo
		echo "####################################################################################################"
		echo "# Please encrypt and send the follwing file to support@univention.de: $archive"
		echo "# As described in http://sdb.univention.de/1344 :"
		echo "#"
		echo "# 1. Import Univention support public key (this needs to be done only once):"
		echo "#	   wget -q http://download.univention.de/download/univention-support.asc -O - | gpg --import"
		echo "#"
		echo "# 2. Next encrypt the file:"
		echo "#    gpg --encrypt --trust-model always -a -r support@univention.de $archive"
		echo "#"
		echo "# 3. The resulting encrypted file is stored as: $archive.asc"
		echo "#    Please send that file to support@univention.de"
		echo "####################################################################################################"
	fi
	rmtfk
	trap - EXIT
}

trap cleanup EXIT

while true; do
	echo "Saving current Kerberos Keys for $hostname and $winclient"
	timestamp=$(date +%Y%m%d%H%M%S)
	cp /etc/krb5.keytab "$logdir/$hostname.keytab-$timestamp"
	samba-tool domain exportkeytab "$logdir/$winclient.keytab-$timestamp" --principal="$userPrincipalName"

	win7s4ldif=$(ldbsearch \
	  -H ldapi:///var/lib/samba/private/ldap_priv/ldapi \
	  sAMAccountName="$winclient\$" \
	  '*' supplementalcredentials unicodepwd replPropertyMetaData \
	  ntsecuritydescriptor msds-keyversionnumber)
	echo "$win7s4ldif" > "$logdir/$winclient-$timestamp.s4ldif"

	echo "Sleeping for $rotate seconds"
	sleep "$rotate"
done
