#! /bin/sh
# do random checks to see if IPsec was installed and started properly
#
# Copyright (C) 2001 Michael Richardson <mcr@freeswan.org>
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# RCSID $Id: verify.in,v 1.4 2002/07/25 19:44:42 mcr Exp $

LOGS=${LOGS-/var/log}
CONFS=${IPSEC_CONFS-/etc}
me="ipsec verify"

PATH=/sbin:/usr/bin:/usr/local/sbin:@IPSEC_SBINDIR@:$PATH export PATH

set -e

printmsg() {
    printf "%-60s" "$1"
}

# Check DNS Configuration based on a hostname
# $1 = Hostname (string)
# eg: checkdnshost oetest.freeswan.org
checkdnshost() { 

    printmsg "Looking for forward key for $1"  
    if host -t key $host |egrep  '(0x4200|16896)' >/dev/null
    then
        echo '[OK]'
    else
        echo '[FAILED]'
    fi
}

# Check DNS Configuration based on IP address
# $1 = IP Address (string) 
# eg: checkdnsip 127.0.0.2
checkdnsip() {
    echo $1|sed -e 's,\., ,g' | while read a b c d rest
    do
        printmsg "Looking for TXT in reverse map: $d.$c.$b.$a.in-addr.arpa"
        if host -t txt $d.$c.$b.$a.in-addr.arpa. | grep -v '$a.$b.$c.$d' > /dev/null
        then
	    echo '[OK]'
        else
	    echo '[FAILED]'
        fi

        ipsecgwip=`host -t txt $d.$c.$b.$a.in-addr.arpa. |grep X-IPsec-Server | sed s/.*X-IPsec-Server\([0-9].*\)=// | sed s/[\"\ ].*//`
	
    	if [ ! -z $ipsecgwip ] 
	then 
        echo $ipsecgwip|sed -e 's,\., ,g' | while read a b c d rest
        do
            printmsg "Looking for KEY in reverse map: $d.$c.$b.$a.in-addr.arpa"
            if host -t key $d.$c.$b.$a.in-addr.arpa. | grep -v '(0x4200|16896)' >/dev/null
            then
                echo '[OK]'
            else
		echo '[FAILED]'
            fi
        done
	fi
    done
}

# If no --host supplied, we assume we're talking about ourself
if [ -z $1 ]
then
	host=`hostname`
else
 	case "$1" in
 	--host) host="$2" ; shift	;;
         --)     shift ; break           ;;
         -*)     echo "$me: unknown option \`$1'" >&2 ; exit 2   ;;
         *)      shift ; break         ;;
        esac
 	ipaddr=`host -t A $host|grep address|sed -e 's,.*address\ ,,'`
 	if [ -z $ipaddr ]
 	then
 		echo "Host does not resolve, aborting tests..."
 		exit 1
 	else
 	checkdnshost $host
 	checkdnsip $ipaddr	
 	fi
	exit 0
fi
 

echo "Checking your system to see if IPsec got installed and started correctly"

printmsg "Version check and ipsec on-path"
if ipsec --version >/dev/null
then
    echo '[OK]'
else
    echo '[FAILED]'
fi

printmsg "Checking for KLIPS support in kernel"
if [ -f /proc/net/ipsec_eroute ] 
then
    echo '[OK]'
else
    echo '[FAILED]'
fi

printmsg "Checking for RSA private key (${CONFS}/ipsec.secrets)"
if [ -f ${CONFS}/ipsec.secrets ] && ipsec showhostkey >/dev/null
then
    echo '[OK]'
else
    echo '[FAILED]'
fi

printmsg "Checking that pluto is running"
if ipsec whack --status >/dev/null
then
    echo '[OK]'
else
    echo '[FAILED]'
fi
 
/bin/ls /proc/sys/net/ipv4/conf | while read net
do
    case $net in
	all) continue ;;
	default) continue ;;
	lo) continue ;;
    esac

    printmsg "Checking if IPchains has port 500 hole ($net)"
    if [ -f /etc/sysconfig/ipchains ]
    then
	if ipchains --check input -p udp --src 1.2.3.4 500 --dst 2.3.4.5 500 -i $net
	then
	    echo '[OK]'
	else
	    echo '[BLOCKED]'
	fi
    else
	echo '[N/A]'
    fi

#	if [ -f /etc/sysconfig/iptables ]
#	then
#	    printmsg "Checking if IPtables has port 500 hole ($net)"
#	    if ipchains --check input -p udp --src 1.2.3.4 500 --dst 2.3.4.5 500 -i $net
#	    then
#		echo '[OK]'
#	    else
#		echo '[BLOCKED]'
#	    fi
#	else
#	    echo '[NO-IPCHAINS]'
#	fi
done
    
echo "DNS checks. "

host=`hostname`

checkdnshost $host

pubfile=/tmp/fspub$$
privfile=/tmp/fspriv$$

echo false >$pubfile
echo false >$privfile

/sbin/ifconfig -a | grep 'inet addr' | while IFS=': ' read inet blurb addr rest
do
    case $addr in
	127.*) ;;
	10.*) echo true >$privfile;;
	172.1[6789].*.*) echo true >$privfile;;
	172.2?.*.*) echo true >$privfile;;
	172.3[01].*.*) echo true >$privfile;;
	192.168.*.*) echo true >$privfile;;
	*) echo $addr;;
    esac
done | sort -u | while read hostip
do
	checkdnsip $hostip
done

private=`cat $pubfile`
public=`cat $privfile`

printmsg "Does the machine have at least one non-private address"
if $private
then
    echo '[OK]'
else
    if $public
    then
	echo '[OK]'
    else
	echo '[FAILED]'
    fi
fi

#
# XXX - go look for subnet behind me's text records. 
#
