#!/bin/sh

set -e

CONFFILE="/etc/nslcd.conf"
OCONFFILE="/etc/nss-ldapd.conf"

# fall back to old configfile if new one isn't present but old one is
[ ! -f "$CONFFILE" ] && [ -f "$OCONFFILE" ] && CONFFILE="$OCONFFILE"

# source debconf library.
. /usr/share/debconf/confmodule
db_version 2.0
db_capb backup

#
# This is the fist part of the script. In this part an attempt
# is made to get or guess the current configuration. This information
# is used later on to prompt the user and to provide a sensible
# default.
#

# check the system (non-LDAP configuration files) for some
# reasonable defaults
parsesys()
{
  # guess domain based on system information
  db_get nslcd/ldap-base
  if [ -z "$RET" ]
  then
    domain=`hostname --domain` || true
    [ -z "$domain" ] && domain=`hostname --nis | grep '\.'` || true
    [ -z "$domain" ] && domain=`hostname --fqdn | sed -n 's/^[^.]*\.//p'` || true
    [ -z "$domain" ] && domain=`sed -n 's/^ *\(domain\|search\) *\([^ ]*\) *$/\2/p' /etc/resolv.conf | head -n 1` || true
    db_get nslcd/ldap-base
    searchbase="$RET"
    # if the ldap-base value doesn't seem to be preseeded, try to use the
    # domain name to build the default base
    if [ -n "$domain" ]
    then
      searchbase=`echo "$domain" | sed 's/^/dc=/;s/\./,dc=/'` || true
      db_set nslcd/ldap-base "$searchbase"
    fi
  fi
  # guess ldap server
  db_get nslcd/ldap-uris
  if [ -z "$RET" ]
  then
    server=`getent hosts ldap` || true
    [ -z "$server" ] && server=`getent hosts dirhost` || true
    if [ -n "$domain" ] && [ -z "$server" ]
    then
      server=`getent hosts ldap."$domain"` || true
      [ -z "$server" ] && server=`getent hosts dirhost."$domain"` || true
    fi
    if [ -n "$server" ]
    then
      # extract ip address from host entry and quote ipv6 address
      ip=`echo $server | sed 's/[[:space:]].*//;s/^\(.*:.*\)$/[\1]/'`
      db_set nslcd/ldap-uris "ldap://$ip/"
    fi
  fi
  # we're done
  return 0
}

# parse a LDAP-like configuration file
parsecfg()
{
  cfgfile="$1"
  # check existance
  [ -f "$cfgfile" ] || return 0
  # find uri/host/port combo
  db_get nslcd/ldap-uris
  if [ -z "$RET" ]
  then
    uris=`sed -n 's/^uri[[:space:]]*//ip' "$cfgfile" | tr '\n' ' '`
    if [ -z "$uris" ]
    then
      hosts=`sed -n 's/^host[[:space:]]*//ip' "$cfgfile"`
      port=`sed -n 's/^port[[:space:]]*//ip' "$cfgfile" | tail -n 1`
      for host in $hosts
      do
        if [ -z "$port" ] || (echo "$host" | grep -q ':' )
        then
          uris="$uris ldap://$host/"
        else
          uris="$uris ldap://$host:$port/"
        fi
      done
    fi
    [ -n "$uris" ] && db_set nslcd/ldap-uris "$uris"
  fi
  # find base config
  db_get nslcd/ldap-base
  if [ -z "$RET" ]
  then
    searchbase=`sed -n 's/^base[[:space:]]*\([^[:space:]]*\)[[:space:]]*$/\1/ip' "$cfgfile" | tail -n 1`
    [ -n "$searchbase" ] && db_set nslcd/ldap-base "$searchbase"
  fi
  # find binddn
  db_get nslcd/ldap-binddn
  if [ -z "$RET" ]
  then
    binddn=`sed -n 's/^binddn[[:space:]]*//ip' "$cfgfile" | tail -n 1`
    db_set nslcd/ldap-binddn "$binddn"
  fi
  # find bindpw
  db_get nslcd/ldap-bindpw
  if [ -z "$RET" ]
  then
    bindpw=`sed -n 's/^bindpw[[:space:]]*//ip' "$cfgfile" | tail -n 1`
    db_set nslcd/ldap-bindpw "$bindpw"
  fi
  # check ssl option
  db_get nslcd/ldap-starttls
  if [ -z "$RET" ]
  then
    if grep -qi '^ssl[[:space:]]*start_*tls' "$cfgfile"
    then
      db_set nslcd/ldap-starttls "true"
    elif grep -qi '^ssl[[:space:]]' "$cfgfile"
    then
      db_set nslcd/ldap-starttls "false"
    fi
  fi
  # check reqcert option
  db_get nslcd/ldap-reqcert
  if [ -z "$RET" ]
  then
    reqcert=`sed -n 's/^tls_\(reqcert\|checkpeer\)[[:space:]]*\([^[:space:]]*\)[[:space:]]*$/\2/ip' "$cfgfile" | tail -n 1`
    # normalise value
    reqcert=`echo "$reqcert" | tr 'A-Z' 'a-z' | sed 's/^no$/never/;s/^yes$/demand/'`
    [ -n "$reqcert" ] && db_set nslcd/ldap-reqcert "$reqcert"
  fi
  # we're done
  return 0
}

# fill our defaults with the current configuration if available
# and fall back to guessing the config from some other system files
if [ -f "$CONFFILE" ]
then
  # clear settings to pick up valus from configfile
  db_set nslcd/ldap-uris ""
  db_set nslcd/ldap-base ""
  db_set nslcd/ldap-binddn ""
  db_set nslcd/ldap-bindpw ""
  db_set nslcd/ldap-starttls ""
  # parse current configuration
  parsecfg "$CONFFILE"
else
  # first match wins
  parsecfg /etc/libnss-ldap.conf
  parsecfg /etc/pam_ldap.conf
  parsecfg /etc/ldap/ldap.conf
  parsecfg /etc/ldap.conf
  parsesys
  # fallback default values
  db_get nslcd/ldap-uris
  [ -z "$RET" ] && db_set nslcd/ldap-uris "ldap://127.0.0.1/"
  db_get nslcd/ldap-base
  [ -z "$RET" ] && db_set nslcd/ldap-base "dc=example,dc=net/"
fi

# fallback for starttls option
db_get nslcd/ldap-starttls
[ -z "$RET" ] && db_set nslcd/ldap-starttls "false"

#
# This is the second part of the script. In this part the configurable
# settings will be presented to the user for approval. The postinst
# will finaly perform the actual modifications.
#

state="server"
while [ "$state" != "done" ]
do
  case "$state" in
  server)
    # ask about server configuration
    db_input high nslcd/ldap-uris || true
    db_input high nslcd/ldap-base || true
    # ask the questions, go to the next question or exit
    state="binddn"
    db_go || exit 1
    # TODO: add error checking on options
    ;;
  binddn)
    # ask for login information
    db_input medium nslcd/ldap-binddn || true
    # ask the question, go to the next question or back
    state="bindpw"
    db_go || state="server"
    ;;
  bindpw)
    # only ask question if we have a binddn
    db_get nslcd/ldap-binddn
    if [ -n "$RET" ]
    then
      # ask for login information
      db_input medium nslcd/ldap-bindpw || true
    else
      # clear password
      db_set nslcd/ldap-bindpw ""
    fi
    # ask the question, go to the next question or back
    state="starttls"
    db_go || state="binddn"
    ;;
  starttls)
    # check if ldaps:// URL's are used
    db_get nslcd/ldap-uris
    uris="$RET"
    if (echo "$uris" | grep -q 'ldaps://')
    then
      # ldaps: URI defined, don't ask about StartTLS
      db_set nslcd/ldap-starttls "false"
    else
      # ask whether to use StartTLS
      db_input medium nslcd/ldap-starttls || true
    fi
    # ask the question, go to the next question or back
    state="reqcert"
    db_go || state="bindpw"
    ;;
  reqcert)
    # check if ldaps:// URL's are used
    db_get nslcd/ldap-uris
    uris="$RET"
    # check if StartTLS is used
    db_get nslcd/ldap-starttls
    starttls="$RET"
    if (echo "$uris" | grep -q 'ldaps://') || [ "$starttls" = "true" ]
    then
      # ask whether to do certificate validation
      db_input high nslcd/ldap-reqcert || true
    fi
    # ask the question, go to the next question or back
    state="done"
    db_go || state="starttls"
    ;;
  esac
done

exit 0