#!/bin/sh
#
#    Copyright (c) 2007-2008 Brocade Communications Systems, Inc.
#    All rights reserved.
#   
#    File name:   cipherutil
#    Module name: fabos/src/security/cipherutil.sh
#   
#    This script modifies the ssh cipher list and restarts the SSH deamon.
#   
    
export PATH=/fabos/sbin:/fabos/bin:/bin:/usr/bin:/sbin:/usr/sbin:/fabos/cliexec:/fabos/libexec:

#Absolute path for generic utilites
ECHO=/bin/echo
GREP=/bin/grep
CAT=/bin/cat
RM=/bin/rm
CP=/bin/cp
SYS_CONFIG=/fabos/cliexec/config

SSH_CIPHER_REPLACE=sshcipherreplace
SSH_KEX_REPLACE=sshkexreplace
SSH_MAC_REPLACE=sshmacreplace
WEB_RPC_KILL=webrpckill
CIPHER_VERIFICATION=verifycipher
KEX_VERIFICATION=verifykex
MAC_VERIFICATION=verifymac
#Validate
SSH_KEX_VALIDATE=validatekex
SSH_ENC_VALIDATE=validateenc
SSH_MAC_VALIDATE=validatemac

#Get Other host ip
GET_OTHERHOST=get_otherhost

# SSH Configuration Files

SSHD_CONFIG=/etc/sshd_config
SSH_CONFIG=/etc/ssh_config

# Temporary config file used for validation

TMP_SSHD_CONFIG=/etc/tmp_sshd_config

SSHD=/usr/sbin/sshd
HTTPD_PID_FILE=/tmp/webtools/httpd.pid.0
WEBDRESTART="webdcfghandler http.restart:1"
OPENSSL_CIPHER_CMD="/usr/bin/openssl ciphers"
TMPFILE="/tmp/tmpfile"
# convert option to all lower case
cmd_option=`echo $1 | tr "[:upper:]" "[:lower:]"`
swbd() {
    /bin/sed -n -e 's/^.*\(SWBD[[:digit:]]\{1,\}\).\+$/\1/gp'
}
cpid() {
    sed -n -e 's/^Control.\+No: \([[:digit:]]\{1,\}\)$/\1/gp'
}
SWBD=$(/sbin/sin | swbd 2> /dev/null)
CPID=$(/sbin/sin | cpid 2> /dev/null)
otherhost(){
    case ${SWBD##SWBD} in
    '62')
        printf 127.1.1.$((8 - CPID % 2))
        ;;
    '77')
        printf 127.1.1.$((6 - CPID % 2))
        ;;
    '141')
        printf 127.1.$((17 - CPID % 2)).$((17 - CPID % 2))
        ;;
    '142')
        printf 127.1.$((15 - CPID % 2)).$((15 - CPID % 2))
        ;;
    '165' | '166' | '179' | '180')
        printf 127.3.1.$((2 - CPID % 2))
        ;;
    *)
        printf 10.0.0.$((6 - CPID % 2))
        ;;
    esac
}

case "$cmd_option" in

"$SSH_CIPHER_REPLACE" )
    # Verify  the no of input arguments before processing
    if [ $# -ne 3 ]
    then
        exit 1
    fi

    # Modify ssh server configuration
    # Finds out whether Cipher filed exists or not.
    cipher=`cat $SSHD_CONFIG|grep -ce "^#*Ciphers"`
    if [ "$cipher" -eq 0 ]; then
        echo Ciphers $2 >> $SSHD_CONFIG
        config save $SSHD_CONFIG
    else
        cipherlist=`cat $SSHD_CONFIG|grep -ie "^#*Ciphers" | \
                    cut -d" " -f2-`

        sed "s/^#*Ciphers $cipherlist/Ciphers $2/" $SSHD_CONFIG > $TMPFILE
        cat $TMPFILE > $SSHD_CONFIG
        rm $TMPFILE
        config save $SSHD_CONFIG
    fi

    #Modify the ssh client configuration
    cipher=`cat $SSH_CONFIG|grep -ce "^#*Ciphers"`
    if [ "$cipher" -eq 0 ]; then
        echo Ciphers $2 >> $SSH_CONFIG
        config save $SSH_CONFIG
    else
        cipherlist=`cat $SSH_CONFIG|grep -ie "^#*Ciphers" | \
                    cut -d" " -f2-`

        sed "s/^#*Ciphers $cipherlist/Ciphers $2/" $SSH_CONFIG > $TMPFILE
        cat $TMPFILE > $SSH_CONFIG
        rm $TMPFILE
        config save $SSH_CONFIG
    fi

    if [ $3 -eq 0 ]; then
        # Restart sshd.
        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`
        if [ -n "$pid" ]; then
            kill $pid
        fi
        $SSHD >/dev/null 2>&1

        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`

        if [ -z "$pid" ]; then
            exit 1
        fi
    fi
;;

"$GET_OTHERHOST" )
        # Get otherhost ip.
    otherhost
;;

"$SSH_KEX_REPLACE" )
    # Verify  the no of input arguments before processing
    if [ $# -ne 3 ]
    then
        exit 1
    fi

    # Finds out whether Cipher filed exists or not.
    kex=`cat $SSHD_CONFIG|grep -ce "^#*KexAlgorithms"`
        if [ "$kex" -eq 0 ]; then
        echo KexAlgorithms $2 >> $SSHD_CONFIG
        config save $SSHD_CONFIG
    else
        kexlist=`cat $SSHD_CONFIG|grep -ie "^#*KexAlgorithms" | \
                    cut -d" " -f2-`
        sed "s/^#*KexAlgorithms $kexlist/KexAlgorithms $2/" $SSHD_CONFIG > $TMPFILE
        cat $TMPFILE > $SSHD_CONFIG
        rm $TMPFILE
        config save $SSHD_CONFIG
    fi
    #Modify the SSH client configuration
    kex=`cat $SSH_CONFIG|grep -ce "^#*KexAlgorithms"`
    if [ "$kex" -eq 0 ]; then
        echo KexAlgorithms $2 >> $SSH_CONFIG
        config save $SSH_CONFIG
    else
        kexlist=`cat $SSH_CONFIG|grep -ie "^#*KexAlgorithms" | \
                    cut -d" " -f2-`
        sed "s/^#*KexAlgorithms $kexlist/KexAlgorithms $2/" $SSH_CONFIG > $TMPFILE
        cat $TMPFILE > $SSH_CONFIG
        rm $TMPFILE
        config save $SSH_CONFIG
    fi

    if [ $3 -eq 0 ]; then
        # Restart sshd.
        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`
        if [ -n "$pid" ]; then
            kill $pid
        fi
        $SSHD >/dev/null 2>&1

        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`

        if [ -z "$pid" ]; then
            exit 1
        fi
    fi

;;

"$SSH_MAC_REPLACE" )
    # Verify  the no of input arguments before processing
    if [ $# -ne 3 ]
    then
        exit 1
    fi

    # Finds out whether Cipher filed exists or not.
    mac1=`cat $SSHD_CONFIG|grep -ce "^#*MACs"`
    mac2=`cat $SSHD_CONFIG|grep -ce "^#*Macs"`
    if [ "$mac1" -eq 0 ]; then
        if [ "$mac2" -eq 0 ]; then
            echo MACs $2 >> $SSHD_CONFIG
            config save $SSHD_CONFIG
        fi
    else
        if [ "$mac1" -eq 1 ] && [ "$mac2" -eq 1 ]; then

            maclist=`cat $SSHD_CONFIG|grep -e "^#*MACs" | \
                         cut -d" " -f2-`
            sed "s/^#*MACs $maclist/MACs $2/" $SSHD_CONFIG > $TMPFILE

            cat $TMPFILE > $SSHD_CONFIG
            rm $TMPFILE
            config save $SSHD_CONFIG

            maclist=`cat $SSHD_CONFIG|grep -e "^#*Macs" | \
                         cut -d" " -f2-`
            sed "s/^#*Macs $maclist/Macs $2/" $SSHD_CONFIG > $TMPFILE
        elif [ "$mac1" -eq 1 ]; then
            maclist=`cat $SSHD_CONFIG|grep -e "^#*MACs" | \
                         cut -d" " -f2-`
            sed "s/^#*MACs $maclist/MACs $2/" $SSHD_CONFIG > $TMPFILE

        else
            maclist=`cat $SSHD_CONFIG|grep -e "^#*Macs" | \
                         cut -d" " -f2-`
            sed "s/^#*Macs $maclist/Macs $2/" $SSHD_CONFIG > $TMPFILE

        fi

        cat $TMPFILE > $SSHD_CONFIG
        rm $TMPFILE
        config save $SSHD_CONFIG
    fi

    #Modify the SSH client configuration
    mac1=`cat $SSH_CONFIG|grep -ce "^#*MACs"`
    mac2=`cat $SSH_CONFIG|grep -ce "^#*Macs"`
    if [ "$mac1" -eq 0 ]; then
        if [ "$mac2" -eq 0 ]; then
            echo MACs $2 >> $SSH_CONFIG
            config save $SSH_CONFIG
        fi
    else
        if [ "$mac1" -eq 1 ] && [ "$mac2" -eq 1 ]; then
            maclist=`cat $SSH_CONFIG|grep -e "^#*MACs" | \
                         cut -d" " -f2-`
            sed "s/^#*MACs $maclist/MACs $2/" $SSH_CONFIG > $TMPFILE

            cat $TMPFILE > $SSH_CONFIG
            rm $TMPFILE
            config save $SSH_CONFIG

            maclist=`cat $SSH_CONFIG|grep -e "^#*Macs" | \
                         cut -d" " -f2-`
            sed "s/^#*Macs $maclist/Macs $2/" $SSH_CONFIG > $TMPFILE
        elif [ "$mac1" -eq 1 ]; then
            maclist=`cat $SSH_CONFIG|grep -e "^#*MACs" | \
                         cut -d" " -f2-`
            sed "s/^#*MACs $maclist/MACs $2/" $SSH_CONFIG > $TMPFILE

        else
            maclist=`cat $SSH_CONFIG|grep -e "^#*Macs" | \
                         cut -d" " -f2-`
            sed "s/^#*Macs $maclist/Macs $2/" $SSH_CONFIG > $TMPFILE

        fi

        cat $TMPFILE > $SSH_CONFIG
        rm $TMPFILE
        config save $SSH_CONFIG
    fi

    if [ $3 -eq 0 ]; then
        # Restart sshd.
        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`
        if [ -n "$pid" ]; then
            kill $pid
        fi
        $SSHD >/dev/null 2>&1

        pid=`ps -ef | grep "sshd" | grep -v "sshd:" | \
            grep -v "sshd_config" | grep -v grep|awk '{print $2}'`

        if [ -z "$pid" ]; then
            exit 1
        fi
    fi

;;


# SSH validate options

"$SSH_KEX_VALIDATE" )
    if [ -z "$2" ]; then
        exit 1
    fi
    $CP $SSHD_CONFIG $TMP_SSHD_CONFIG
    $ECHO KexAlgorithms $2 >> $TMP_SSHD_CONFIG
    $SSHD -T -f $TMP_SSHD_CONFIG  >/dev/null 2>&1

    if [ $? != 0 ]; then
        $RM $TMP_SSHD_CONFIG
        exit 1
    fi
    $RM $TMP_SSHD_CONFIG
;;

"$SSH_MAC_VALIDATE" )
    if [ -z "$2" ]; then
        exit 1
    fi
    $CP $SSHD_CONFIG $TMP_SSHD_CONFIG
    $ECHO Macs $2 >> $TMP_SSHD_CONFIG
    $SSHD -T -f $TMP_SSHD_CONFIG  >/dev/null 2>&1

    if [ $? != 0 ]; then
        $RM $TMP_SSHD_CONFIG
        exit 1
    fi
    $RM $TMP_SSHD_CONFIG
;;

"$SSH_ENC_VALIDATE" )
    if [ -z "$2" ]; then
        exit 1
    fi

    $CP $SSHD_CONFIG $TMP_SSHD_CONFIG
    $ECHO Ciphers $2 >> $TMP_SSHD_CONFIG
    $SSHD -T -f $TMP_SSHD_CONFIG  >/dev/null 2>&1

    if [ $? != 0 ]; then
        $RM $TMP_SSHD_CONFIG
        exit 1
    fi
    $RM $TMP_SSHD_CONFIG
;;

"$CIPHER_VERIFICATION" )
	if [ -z "$2" ]; then
		exit 1
	fi
	$OPENSSL_CIPHER_CMD $2 >/dev/null 2>$1
	if [ $? != 0 ]; then
		echo "Invalid cipher"
		exit 1
	fi
;;

"$WEB_RPC_KILL" )
    # Restart webd.
	$WEBDRESTART
	if [ ! -f $HTTPD_PID_FILE ]; then
		echo "Invalid cipher. Web server failed to restart."
		exit 1
	fi
;;  
* )
exit 1 
;;      
    
esac

exit 0
