#!/usr/bin/env bash
# Sichert die durch 50-paw-install.yml relevante PAW-Netzwerkkonfiguration.
set -Eeuo pipefail
IFS=$'\n\t'
umask 077

DEST="${1:?Aufruf: sudo $0 /pfad/zum/backup/network}"
[[ $EUID -eq 0 ]] || { echo "FEHLER: Bitte als root ausführen." >&2; exit 1; }

mkdir -p "$DEST"/{rootfs,metadata,state}

copy_path() {
  local src="$1" rel
  [[ -e "$src" ]] || return 0
  rel="${src#/}"
  mkdir -p "$DEST/rootfs/$(dirname "$rel")"
  rsync -aHAX --numeric-ids "$src" "$DEST/rootfs/$rel"
  printf '%s\t%s\n' "$src" "rootfs/$rel" >> "$DEST/metadata/files.tsv"
}

: > "$DEST/metadata/files.tsv"

# Genau die Pfade, die 50-paw-install.yml installiert bzw. verwendet.
copy_path /etc/NetworkManager/system-connections
copy_path /etc/NetworkManager/dispatcher.d
copy_path /etc/libvirt/qemu/networks
copy_path /etc/sysctl.d
copy_path /usr/local/bin/ufw-paw.sh
copy_path /etc/default/ufw
copy_path /etc/ufw
copy_path /etc/iproute2/rt_tables
copy_path /hilden

# Laufzeit-Zustand dokumentieren.
ip -details link show > "$DEST/state/ip-link.txt"
ip -details address show > "$DEST/state/ip-address.txt"
ip route show table all > "$DEST/state/ip-routes-all.txt"
ip rule show > "$DEST/state/ip-rules.txt"
bridge link show > "$DEST/state/bridge-links.txt" 2>/dev/null || true
bridge vlan show > "$DEST/state/bridge-vlans.txt" 2>/dev/null || true
nmcli -f all connection show > "$DEST/state/nm-connections.txt" 2>/dev/null || true
nmcli -f all device status > "$DEST/state/nm-devices.txt" 2>/dev/null || true
nmcli --show-secrets connection show > "$DEST/state/nm-connections-with-secrets.txt" 2>/dev/null || true
nft list ruleset > "$DEST/state/nftables.txt" 2>/dev/null || true
ufw status verbose > "$DEST/state/ufw-status.txt" 2>/dev/null || true

# Bridge-MAC sichern. Diese ist für DHCP-Leases/Netzidentität relevant.
if [[ -e /sys/class/net/br-lan/address ]]; then
  cat /sys/class/net/br-lan/address > "$DEST/metadata/br-lan.mac"
fi

# Permanente MAC, aktuelle MAC und Hardwarepfad aller Interfaces erfassen.
printf 'interface\tcurrent_mac\tpermanent_mac\tifindex\tdriver\tdevice_path\tid_path\tid_net_name_path\tid_net_name_mac\n' \
  > "$DEST/metadata/interfaces.tsv"

for sysdev in /sys/class/net/*; do
  iface="${sysdev##*/}"
  current="$(cat "$sysdev/address" 2>/dev/null || true)"
  permanent="$(ethtool -P "$iface" 2>/dev/null | awk '{print $3}' || true)"
  [[ "$permanent" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || permanent="$current"
  ifindex="$(cat "$sysdev/ifindex" 2>/dev/null || true)"
  driver="$(basename "$(readlink -f "$sysdev/device/driver" 2>/dev/null)" 2>/dev/null || true)"
  device_path="$(readlink -f "$sysdev/device" 2>/dev/null || true)"
  props="$(udevadm info -q property -p "$sysdev" 2>/dev/null || true)"
  id_path="$(awk -F= '$1=="ID_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
  id_name_path="$(awk -F= '$1=="ID_NET_NAME_PATH"{print substr($0,index($0,"=")+1)}' <<<"$props")"
  id_name_mac="$(awk -F= '$1=="ID_NET_NAME_MAC"{print substr($0,index($0,"=")+1)}' <<<"$props")"
  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
    "$iface" "$current" "$permanent" "$ifindex" "$driver" "$device_path" \
    "$id_path" "$id_name_path" "$id_name_mac" >> "$DEST/metadata/interfaces.tsv"
done

# Die in den PAW-Keyfiles verwendeten Ports inklusive ihrer permanenten MAC sichern.
printf 'profile\tconnection_id\told_interface\tpermanent_mac\tmaster\n' \
  > "$DEST/metadata/paw-ports.tsv"
shopt -s nullglob
for profile in /etc/NetworkManager/system-connections/*.nmconnection; do
  type="$(awk -F= '$1=="type"{print $2; exit}' "$profile")"
  [[ "$type" == "ethernet" ]] || continue
  master="$(awk -F= '$1=="master"{print $2; exit}' "$profile")"
  [[ "$master" == "br-lan" ]] || continue
  con_id="$(awk -F= '$1=="id"{print $2; exit}' "$profile")"
  old_if="$(awk -F= '$1=="interface-name"{print $2; exit}' "$profile")"
  pmac=""
  if [[ -n "$old_if" && -e "/sys/class/net/$old_if" ]]; then
    pmac="$(ethtool -P "$old_if" 2>/dev/null | awk '{print $3}' || true)"
    [[ "$pmac" =~ ^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$ ]] || pmac="$(cat "/sys/class/net/$old_if/address")"
  fi
  printf '%s\t%s\t%s\t%s\t%s\n' "$(basename "$profile")" "$con_id" "$old_if" "$pmac" "$master" \
    >> "$DEST/metadata/paw-ports.tsv"
done

chmod -R go-rwx "$DEST"
echo "PAW-Netzwerk gesichert: $DEST"
[[ -f "$DEST/metadata/br-lan.mac" ]] && echo "br-lan MAC: $(cat "$DEST/metadata/br-lan.mac")"