#!/bin/bash
#
# This script will install bro master
# and set up ssh keys on workers and proxy's
#
# ! depends on salt
#
# params :
# $1 manager ip
# $2 salt key pattern to match bro workers and proxyes
# $3 proxyes ip list, sepatarated with comma
# $4 workers ip list, sepatarated with comma


if [ "$(id -u)" != "0" ]; then
   echo "ERROR - This script must be run as root" 1>&2
   exit 1
fi

echo "installing bro with:"
echo "manager: $1"
echo "pattern: $2"
echo "proxyes: $3"
echo "workers: $4"
echo "wait .."

MANAGER=$1
BROS=$2
PROXYS=$3
WORKERS=$4

# add bro repo and install
echo "deb http://download.opensuse.org/repositories/network:/bro/xUbuntu_14.04/ /" >> /etc/apt/sources.list.d/bro.list
wget -4 -q http://download.opensuse.org/repositories/network:bro/xUbuntu_14.04/Release.key
apt-key add - < Release.key  > /dev/null 2>&1
apt-get -qq update  > /dev/null 2>&1
apt-get -y install bro  > /dev/null 2>&1
#prepare master key and ssh conf
adduser --system --home /opt/bro --no-create-home --ingroup bro --disabled-password --shell /bin/false bro
mkdir /opt/bro/.ssh && chown -R bro:bro /opt/bro && chmod 750 /opt/bro/.ssh
su - bro -s /bin/bash -c 'echo -en "\n\n"|ssh-keygen -t rsa -f /opt/bro/.ssh/id_rsa'
echo "# auto generated by $0 @ $(date) " > /opt/bro/.ssh/config
echo "$PROXYS,$WORKERS" | sed 's/,/\n/g'|while read IP;
do
  echo "Host $IP" >> /opt/bro/.ssh/config
  echo "  Hostname $IP" >> /opt/bro/.ssh/config
  echo "  IdentityFile ~/.ssh/id_rsa" >> /opt/bro/.ssh/config
  echo "  StrictHostKeyChecking no" >> /opt/bro/.ssh/config
done

#distribute to nodes via salt
salt-key -A -y > /dev/null 2>&1
salt-key -L
sleep 1
salt "*$BROS*" test.ping > /dev/null 2>&1
salt "*$BROS*" cmd.run 'addgroup --system bro --quiet' > /dev/null 2>&1
salt "*$BROS*" cmd.run 'adduser --system --home /opt/bro --no-create-home --ingroup bro --disabled-password --shell /bin/bash bro' > /dev/null 2>&1
salt "*$BROS*" cmd.run 'mkdir -p /opt/bro/.ssh' > /dev/null 2>&1
salt-cp "*$BROS*" /opt/bro/.ssh/id_rsa.pub /opt/bro/.ssh/bro-manager.pub > /dev/null 2>&1
salt "*$BROS*" cmd.run 'cat /opt/bro/.ssh/bro-manager.pub >> /opt/bro/.ssh/authorized_keys' > /dev/null 2>&1
#salt "*$BROS*" cmd.run 'setcap cap_net_raw,cap_net_admin=eip /opt/bro/bin/bro'
#salt "*$BROS*" cmd.run 'setcap "CAP_NET_RAW+eip" /opt/bro/bin/bro'
cat /etc/hosts | grep -v 127| grep $(hostname) > /opt/bro/hosts
salt-cp "*$BROS*" /opt/bro/hosts /opt/bro/hosts > /dev/null 2>&1
salt "*$BROS*" cmd.run 'cat /opt/bro/hosts >> /etc/hosts' > /dev/null 2>&1
salt "*$BROS*" cmd.run 'chown -R bro:bro /opt/bro;' > /dev/null 2>&1

# create node.cfg
cat > /opt/bro/etc/node.cfg<<DELIM
[manager]
type=manager
host=$MANAGER
DELIM
echo "$PROXYS" | sed 's/,/\n/g'|while read IP;
do
  echo "[proxy-$IP]" >> /opt/bro/etc/node.cfg
  echo "type=proxy" >> /opt/bro/etc/node.cfg
  echo "host=$IP" >> /opt/bro/etc/node.cfg
done
echo "$WORKERS" | sed 's/,/\n/g'|while read IP;
do
  echo "[worker-$IP]" >> /opt/bro/etc/node.cfg
  echo "type=worker" >> /opt/bro/etc/node.cfg
  echo "host=$IP" >> /opt/bro/etc/node.cfg
  echo "interface=eth1" >> /opt/bro/etc/node.cfg
done
chown -R bro:bro /opt/bro
su - bro -s /bin/bash -c '/opt/bro/bin/broctl deploy' > /dev/null 2>&1
su - bro -s /bin/bash -c '/opt/bro/bin/broctl stop' > /dev/null 2>&1
salt "*$BROS*" cmd.run 'setcap "CAP_NET_RAW+eip" /opt/bro/bin/bro'
su - bro -s /bin/bash -c '/opt/bro/bin/broctl start' > /dev/null 2>&1
sleep 3
su - bro -s /bin/bash -c '/opt/bro/bin/broctl status'
echo "to start using bro use 'su - bro -s /bin/bash'"
# tell telegraf there is bro
cat > /etc/telegraf/telegraf.d/bro.conf <<DELIM
[[inputs.procstat]]
  exe = "bro"
DELIM
service telegraf restart > /dev/null 2>&1
salt-cp "*$BROS*" /etc/telegraf/telegraf.d/bro.conf /etc/telegraf/telegraf.d/bro.conf > /dev/null 2>&1
salt "*$BROS*" service.restart telegraf > /dev/null 2>&1

su - bro -s /bin/bash -c '/opt/bro/bin/broctl stop' > /dev/null 2>&1
