#!/bin/sh

MOD_NAME=secure_syslog
MOD_DEFAULTS=/opt/$MOD_NAME/etc/defaults
MOD_SETTINGS=/opt/$MOD_NAME/etc/settings

DAEMON_NAME=rsyslogd
DAEMON_BIN=/opt/$MOD_NAME/bin
DAEMON_TMP=/var/tmp/$MOD_NAME
DAEMON_CONFIG=$DAEMON_TMP/$DAEMON_NAME.conf

[ -f "$MOD_SETTINGS" ] || cp $MOD_DEFAULTS $MOD_SETTINGS
. $MOD_SETTINGS

case "$1" in
  start|restart)
    if [ "$1" = "restart" ]; then
      echo -n "Restarting module $MOD_NAME: "
      killall $DAEMON_NAME 2> /dev/null
      rm -rf $DAEMON_TMP
    else
      echo -n "Starting module $MOD_NAME: "
    fi
    if [ "$MOD_SECSYSLOG_ENABLED" != "1" ]; then
      echo "skipped"
      exit 0
    fi

    mkdir -p $DAEMON_TMP

    echo "global("                                          > $DAEMON_CONFIG
    if [ ! -z "$MOD_SECSYSLOG_CA_CERT" ]; then
      decode $MOD_SECSYSLOG_CA_CERT > $DAEMON_TMP/ca.pem
      echo " DefaultNetstreamDriverCAFile=\"$DAEMON_TMP/ca.pem\"" >> $DAEMON_CONFIG
    fi
    if [ ! -z "$MOD_SECSYSLOG_LOCAL_CERT" ]; then
      decode $MOD_SECSYSLOG_LOCAL_CERT > $DAEMON_TMP/cert.pem
      echo " DefaultNetstreamDriverCertFile=\"$DAEMON_TMP/cert.pem\"" >> $DAEMON_CONFIG
    fi
    if [ ! -z "$MOD_SECSYSLOG_LOCAL_KEY" ]; then
      decode $MOD_SECSYSLOG_LOCAL_KEY > $DAEMON_TMP/key.pem
      echo " DefaultNetstreamDriverKeyFile=\"$DAEMON_TMP/key.pem\"" >> $DAEMON_CONFIG
    fi
    echo ")"                                                >> $DAEMON_CONFIG

    if [ "$MOD_SECSYSLOG_READ_KLOG" == "1" ]; then
      echo "module(load=\"imklog\")"                        >> $DAEMON_CONFIG
    fi

    if [ "$MOD_SECSYSLOG_LISTEN_UDP" == "1" ]; then
      echo "module(load=\"imudp\")"                         >> $DAEMON_CONFIG
      echo "input(type=\"imudp\""                           >> $DAEMON_CONFIG
      if [ ! -z "$MOD_SECSYSLOG_LISTEN_PORT" ]; then
        echo " port=\"$MOD_SECSYSLOG_LISTEN_PORT\""         >> $DAEMON_CONFIG
      fi
      echo ")"                                              >> $DAEMON_CONFIG
    fi

    if [ ! -z "$MOD_SECSYSLOG_FORWARD_ADDRESS" ]; then
      echo "action(type=\"omfwd\""                          >> $DAEMON_CONFIG
      echo " Target=\"$MOD_SECSYSLOG_FORWARD_ADDRESS\""     >> $DAEMON_CONFIG
      if [ ! -z "$MOD_SECSYSLOG_FORWARD_PORT" ]; then
        echo " Port=\"$MOD_SECSYSLOG_FORWARD_PORT\""        >> $DAEMON_CONFIG
      fi
      if [ "$MOD_SECSYSLOG_FORWARD_PROTOCOL" == "udp" ]; then
        echo " Protocol=\"udp\""                            >> $DAEMON_CONFIG
      elif [ "$MOD_SECSYSLOG_FORWARD_PROTOCOL" == "tcp" ]; then
        echo " Protocol=\"tcp\""                            >> $DAEMON_CONFIG
      else
        echo " Protocol=\"tcp\" StreamDriver=\"ossl\""      >> $DAEMON_CONFIG
        echo " StreamDriverMode=\"1\" StreamDriverAuthMode=\"$MOD_SECSYSLOG_FORWARD_AUTH\"" >> $DAEMON_CONFIG
        if [ ! -z "$MOD_SECSYSLOG_FORWARD_PEERS" ]; then
          echo " StreamDriverPermittedPeers=\"$MOD_SECSYSLOG_FORWARD_PEERS\"" >> $DAEMON_CONFIG
        fi
      fi
      echo ")"                                              >> $DAEMON_CONFIG
    fi

    export RSYSLOG_MODDIR="/opt/$MOD_NAME/lib"
    $DAEMON_BIN/$DAEMON_NAME -f $DAEMON_CONFIG 2>/dev/null
    RETVAL=$?
    if [ $RETVAL = 0 ]; then echo "done"; else echo "failed"; fi
    exit $RETVAL
    ;;
  stop)
    echo -n "Stopping module $MOD_NAME: "
    killall $DAEMON_NAME 2> /dev/null
    RETVAL=$?
    if [ $RETVAL = 0 ]; then echo "done"; else echo "failed"; fi
    rm -rf $DAEMON_TMP
    exit $RETVAL
    ;;
  status)
    echo -n "Module $MOD_NAME is "
    killall -0 $DAEMON_NAME 2> /dev/null
    RETVAL=$?
    if [ $RETVAL = 0 ]; then
      echo "running"
    else
      if [ "$MOD_SECSYSLOG_ENABLED" != "1" ]; then
        echo "disabled"
      else
        echo "stopped"
      fi
    fi
    exit $RETVAL
    ;;
  defaults)
    cp /opt/$MOD_NAME/etc/defaults /opt/$MOD_NAME/etc/settings 2> /dev/null
    ;;
  *)
    echo "Usage: $0 {start|stop|restart|status|defaults}"
    exit 1
esac
