#! /bin/sh

set -e

# install app update on system restart (uptime lower than 5 min) and app update is downloaded in $APP_UPDATE_PATH
if [ `cut -d '.' -f1 /proc/uptime` -lt 300 -a -f "/var/opt/eset/efs/updated/app/efs.bin" ]; then
	/opt/eset/efs/lib/install_scripts/perform_app_update.sh && \
		systemctl stop efs 2>/dev/null || service efs stop 2>/dev/null
	exit
fi

EWAP_PRESENT=1
if [ -f "/opt/eset/efs/etc/NFTABLES_DISABLED" ]; then
	EWAP_PRESENT=0
fi

KVERSION="$(uname -r)"
MOD_DIR="/lib/modules/$KVERSION/eset/efs"
MODULES="eset_rtp"
if [ $EWAP_PRESENT -eq 1 ]; then
	MODULES="$MODULES eset_wap"
fi
SECUREBOOT_ENABLED="$( (hexdump /sys/firmware/efi/efivars/SecureBoot-* 2>/dev/null || echo "0 0 0 0") | head -n 1 | cut -d" " -f 4)"
SYSTEMD_CAT="$(which systemd-cat 2>/dev/null || true)"

print_error() {
	errorstr="ESET Server Security Error: $1"

	if [ -n "$SYSTEMD_CAT" ]; then
		echo -n "$errorstr" | $SYSTEMD_CAT -t "efs" -p err
	else
		echo "$errorstr" 1>&2
	fi
}

print_secure_boot_alert() {
	print_error "Secure Boot requires signed kernel modules. Please run \"/opt/eset/efs/lib/install_scripts/sign_modules.sh\" to sign our modules."
}

check_compiler_present() {
	if [ -n "$1" ]; then
		if ! which "$1" 1>/dev/null 2>/dev/null; then
			print_error "Error compiling kernel modules. Please install ${1} which is needed for compilation."
		fi
	fi
}

n_found=0
for m in $MODULES; do
	m_path="$(modinfo -n "$m" 2>/dev/null || true)"
	if [ -f "$m_path" ]; then
		m_dir="$(dirname "$m_path")"
		if [ "$m_dir" != "$MOD_DIR" ]; then
			print_error "found another installation of $m module, exiting"
			exit
		fi
		if [ "$SECUREBOOT_ENABLED" -eq 1 ] && [ -z "$(modinfo --field=sig_key "$m" 2>/dev/null)" ]; then
			# found module is not signed
			print_secure_boot_alert
		fi

		n_found=$((n_found + 1))
	fi
done

if [ $n_found -eq "$(echo "$MODULES" | wc -w)" ]; then
	exit
fi

if [ ! -d "$MOD_DIR" ]; then
	mkdir -p "$MOD_DIR" || { print_error "cannot create modules directory: $MOD_DIR"; exit 1; }
fi

# check if compiler needed for kernel module compilation is installed
KDIR="/lib/modules/$KVERSION/build"
KMAKEFILE_PATH="/lib/modules/${KVERSION}/build/Makefile"
if [ ! -f "$KMAKEFILE_PATH" ]; then
	KDIR="/usr/src/kernels/${KVERSION}"
	KMAKEFILE_PATH="/usr/src/kernels/${KVERSION}/Makefile"
	if [ ! -f "$KMAKEFILE_PATH" ]; then
		print_error "cannot find kernel sources directory for kernel version ${KVERSION}"
		print_error "please check if kernel-devel (or linux-headers) package version matches the current kernel version"
		exit
	fi
fi

# get needed compiler version from kernel Makefiles
if [ -n "$KMAKEFILE_PATH" ]; then
	MAKEFILE_CC="$(grep -Po '^CC\s*=.*\Kgcc\S*' "${KMAKEFILE_PATH}" || true)"
	if [ -z "$MAKEFILE_CC" ]; then
		KMAKEFILE_PATH="$(grep -Po '^include\s+\K/.*/Makefile' "${KMAKEFILE_PATH}" || true)"
		if [ -f "$KMAKEFILE_PATH" ]; then
			MAKEFILE_CC="$(grep -Po '^CC\s*=.*\Kgcc\S*' "${KMAKEFILE_PATH}" || true)"
		fi
	fi
fi

# compile eset_rtp
( \
	# make -B does not work on Red Hat 6, so we need call "make clean" explicitly to remove old modules build (in the case of upgrade)
	cd "/var/opt/eset/efs/ertp" && \
	make clean >/dev/null && \
	KDIR="$KDIR" make modules >/dev/null && \
	cp eset_rtp/eset_rtp.ko "$MOD_DIR" \
)
ERTP_RET_CODE=$?
if [ $ERTP_RET_CODE -ne 0 ]; then
	print_error 'Error compiling on-access kernel module'
	check_compiler_present "$MAKEFILE_CC"
	exit
fi

# compile eset_wap
if [ $EWAP_PRESENT -eq 1 ]; then
	( \
		cd "/var/opt/eset/efs/ewap" && \
		make clean >/dev/null && \
		KDIR="$KDIR" make modules >/dev/null && \
		cp eset_wap/eset_wap.ko "$MOD_DIR" \
	)
	EWAP_RET_CODE=$?
	if [ $EWAP_RET_CODE -ne 0 ]; then
		print_error 'Error compiling web protection kernel module'
		check_compiler_present "$MAKEFILE_CC"
		exit
	fi
fi

if [ $ERTP_RET_CODE -eq 0 ] || [ $EWAP_RET_CODE -eq 0 ]; then
	if [ "$SECUREBOOT_ENABLED" -eq 1 ]; then
		print_secure_boot_alert
	fi
	depmod
fi

exit