#!/bin/bash

NETSECDIR="/current/vpn/"
DownItemName="vpn.tar.gz"

_do_() {
	$1
	if [ $? -ne 0 ];then
		echo "[VPN_INI] \"$1\" FAILED, aborting VPN install"
		exit 0
	fi
}

Clink() {
	# Remove $NETSECDIR from path to get link location
	linkname=`echo $1 | sed "s:$NETSECDIR::"`
	_do_ "ln -s $1 $linkname"
}

Clink_content() {
	for i in `ls $1`
	do
		Clink $1/$i
	done
}

ChangeRights() {
	for i in `ls -R | grep ":" | sed s/://`;do
		chmod 755 $i
		chown root.root $i
	done
	# default to root.root, then do a finer tuning if necessary
	chown root.root * ./usr/sbin/* ./usr/bin/* ./usr/lib/* ./usr/iked/* ./etc/iked/*
	chown root.webadmin ./usr/iked/PKI*
	chmod 500 ./usr/sbin/* ./usr/bin/* ./usr/lib/*
	chmod 500 ./usr/iked/*
	chmod 550 ./usr/iked/PKI*
	chmod 664 ./usr/iked/*.o
	chmod 640 ./etc/iked/*
	chmod 500 ./pptp* ./l2tpd ./mimencode
	chown root.webadmin ./auth-* ./spdReload
	chmod 550 ./auth-* ./spdReload
	chown root.root ./IkedFailure
	chmod 550 ./IkedFailure
}

# Move to vpn directory
cd $NETSECDIR

# Detect first install or swap
if [ -f $DownItemName ];then
	# Clean directory
	echo "[VPN_INI] Detected new software, installing..."
	thisFile=`basename $0`
	rm -rf `ls --ignore=$DownItemName --ignore=conf.rc --ignore=$thisFile $NETSECDIR/`
	# Install new version
	_do_ "tar xzf $DownItemName"
	# Put modules at the right place
	_do_ "mv *.o $NETSECDIR/usr/iked"
	_do_ "mv systest $NETSECDIR/usr/iked"
	# Remove tar.gz to skip this phase at next startup
	_do_ "rm -f $DownItemName"
	ChangeRights
else
	echo "[VPN_INI] No new software detected"
fi

# The following operation have to be done at every startup

# Create some required directories
# connections, secdesc files must lie on disk to avoid inode limitation pb
# To maintain compatibility with perl code, a link is made from ramdisk
rm -rf /mnt/shared/vpn_items 2>/dev/null
mkdir -p /mnt/shared/vpn_items	# on disk
mkdir -p /etc/iked		# on ramdisk
ln -s /mnt/shared/vpn_items /etc/iked/current
#mkdir -p /etc/iked
for i in connections secdesc localids acls;do
	mkdir -p /etc/iked/current/$i
done
mkdir -p /etc/l2tp
mkdir -p /etc/ppp/l2tp
# don't bother creating two synchronized files, soft link instead
ln -fs /etc/ppp/pptp/chap-secrets /etc/ppp/l2tp/chap-secrets

# create links as required by the IPsec package
Clink $NETSECDIR/usr/iked
Clink_content $NETSECDIR/usr/sbin
Clink_content $NETSECDIR/usr/lib
Clink_content $NETSECDIR/usr/bin

# copy config files to a RW location
_do_ "cp $NETSECDIR/etc/iked/* /etc/iked/"

# handle libipt_IPSEC.so shared lib
_do_ "ln -s $NETSECDIR/libipt_IPSEC.so /lib/iptables/libipt_IPSEC.so"

# link "additional" daemons
_do_ "ln -s $NETSECDIR/pptpd /usr/sbin/pptpd"
_do_ "ln -s $NETSECDIR/pptpctrl /usr/sbin/pptpctrl"
_do_ "ln -s $NETSECDIR/l2tpd /usr/sbin/l2tpd"
_do_ "ln -s $NETSECDIR/mimencode /usr/sbin/mimencode"
# and scripts
for i in auth-failure auth-up;do
 _do_ "ln -s $NETSECDIR/$i /etc/ppp/pptp/$i"
 _do_ "ln -s $NETSECDIR/$i /etc/ppp/l2tp/$i"
done
_do_ "ln -s $NETSECDIR/spdReload /usr/sbin/spdReload"
_do_ "ln -s $NETSECDIR/IkedFailure /etc/iked/IkedFailure"


# the addspdrules bin looks for iptables in /usr/sbin
_do_ "ln -s /sbin/iptables /usr/sbin/iptables"

# xauth through PAM requires the config file to lie in the pam config dir
_do_ "ln -s $NETSECDIR/isakmp-xauth /etc/pam.d/isakmp-xauth"

# leave a trace that installation was successful
_do_ "touch /etc/iked/vpn_installed"
echo "[VPN_INI] VPN install completed successfully"