#!/usr/bin/env bash

# shellcheck shell=bash

# ``````````````````````````````````````````````````````````````````````````````
# Function name: DomainSslCheck()
#
# Description:
#   Check ssl configuration.
#
# Usage:
#   DomainSslCheck domain
#
# Examples:
#   DomainSslCheck example.com
#

function DomainSslCheck() {

  # shellcheck disable=SC2034
  local _FUNCTION_ID="DomainSslCheck"
  local _STATE=0

  # shellcheck disable=SC2034,SC2154
  _ssl_remote_socket="${_domain_ip}:${_domain_port}"
  # shellcheck disable=SC2154
  _ssl_domain_name="$_domain_name"

  # shellcheck disable=SC2086,SC2154
  _ssl_params_default=$(echo | \
                        $_openssl s_client $_ssl_version_openssl_curl $_ciphers_openssl_curl \
                        -servername "$_ssl_domain_name" \
                        -connect "$_ssl_remote_socket" -showcerts -tlsextdebug -debug -msg -status 2>/dev/null)

  _ssl_params_default_state="$?"

  # shellcheck disable=SC2034,SC2116
  _ssl_connect_debug=$(echo "$_ssl_params_default")

  _ssl_params_proto=$(echo "$_ssl_params_default" | \
                       grep "Protocol  :" | \
                       cut -d ":" -f2- | \
                       tr -d "[:space:]")

  _ssl_params_cipher=$(echo "$_ssl_params_default" | \
                       grep "Cipher    :" | \
                       cut -d ":" -f2- | \
                       tr -d "[:space:]")

  _ssl_params_proto_stack=$(echo "$_ssl_params_default" | \
                       grep "New, " | \
                       cut -d ":" -f2- | \
                       tr -d "[:space:]")

  if [[ -z "$_ssl_params_proto" ]] ; then

    # shellcheck disable=SC2034
    _ssl_params_proto=$(echo "$_ssl_params_proto_stack" | cut -d ',' -f2)

  fi

  if [[ -z "$_ssl_params_cipher" ]] ; then

    # shellcheck disable=SC2034
    _ssl_params_cipher=$(echo "$_ssl_params_proto_stack" | cut -d ',' -f3 | sed -e s/Cipheris//g)

  fi

  _ssl_params_temp_key=$(echo "$_ssl_params_default" | \
                       grep "Server Temp Key:" | \
                       cut -d ":" -f2- | \
                       tr -d "[:space:]")

  # This variable is used in InitTrace().
  # shellcheck disable=SC2034
  # _ssl_params_verify=$(echo "$_ssl_params_default" | \
  #                      grep "Verification: \\|Verification error: " | \
  #                      cut -d ":" -f2- | \
  #                      awk '{$1=$1};1')

  # if [[ -z "$_ssl_params_verify" ]] ; then

    _ssl_params_verify=$(echo "$_ssl_params_default" | \
                       grep "Verify return code:" | \
                       cut -d ":" -f2- | \
                       awk '{$1=$1};1')

  # fi

  if [[ "$_ssl_params_proto" = *"TLSv1.3"* ]] ; then

    # shellcheck disable=SC2154
    local _ssl_trgb="0;0;32"

  elif [[ "$_ssl_params_proto" = *"TLSv1.2"* ]] ; then

    # shellcheck disable=SC2154
    local _ssl_trgb="0;0;32"

  else

    # shellcheck disable=SC2154
    local _ssl_trgb="0;0;31"

  fi

  if [[ "$_ssl_params_temp_key" = *"DH,1024"* ]] ; then

    # shellcheck disable=SC2154
    local _temp_key_trgb="0;0;31"

  else

    # shellcheck disable=SC2154
    local _temp_key_trgb="0;0;32"

  fi

  # shellcheck disable=SC2154
  if [[ "$ssl_state" -eq 1 ]] ; then

    # shellcheck disable=SC2086
    printf '         ssl: \e['${trgb_3211}'m%s\e[m, ' "on"

    # shellcheck disable=SC2086,SC2154
    printf 'version(\e['${_ssl_trgb}'m%s\e[m), cipher(\e['${trgb_9420}'m%s\e[m), temp_key(\e['${_temp_key_trgb}'m%s\e[m)\n' \
           "$_ssl_params_proto" \
           "$_ssl_params_cipher" \
           "$_ssl_params_temp_key"

  fi

  if [[ "$_ssl_params_default" == *"no peer certificate available"* ]] ; then
   # [[ "$_ssl_params_default" == *"No client certificate CA names sent"* ]] ; then

    # shellcheck disable=SC2154
    if [[ "$debug_ssl_state" -eq 1 ]] && [[ "$_http_scheme" == "https" ]] ; then

      if [[ -n "$_ssl_connect_debug" ]] ; then

        echo

        echo "$_ssl_connect_debug" | sed -e 's/^[ \t]*/         › /' | \
        sed 's/\r//' | grep "› ." | fmt -w "$MAX_WIDTH" -s

      fi

    fi

    # shellcheck disable=SC2086,SC2154
    printf '\n    \e['${trgb_3111}'m%s\e[m:\n\n\t%s\n\n' \
           "SSL error" \
           "- no peer certificate available"
           # "- no client certificate CA names sent"

    _ssl_ext_tools_stop=1

    # shellcheck disable=2154
    if [[ "$ssl_test_state" -eq 1 ]] ; then

      _ssl_ext_tools_stop=0

    fi

    if [[ "$ssl_test_state" -eq 1 ]] ; then

      _ssl_ext_tools_stop=0

    fi

    if [[ "$_ssl_ext_tools_stop" -eq 1 ]] ; then

      _logger "stop" \
        "${_FUNCTION_ID}()" \
        "no peer certificate available"
        # "no peer certificate available/no client certificate CA names sent"

    fi

  elif [[ "$_ssl_params_default_state" -eq 1 ]] ; then

    # shellcheck disable=SC2154
    if [[ "$debug_ssl_state" -eq 1 ]] && [[ "$_http_scheme" == "https" ]] ; then

      if [[ -n "$_ssl_connect_debug" ]] ; then

        echo

        echo "$_ssl_connect_debug" | sed -e 's/^[ \t]*/         › /' | \
        sed 's/\r//' | grep "› ." | fmt -w "$MAX_WIDTH" -s

      fi

    fi

    # shellcheck disable=SC2086,SC2154
    printf '\n    \e['${trgb_3111}'m%s\e[m:\n\n\t%s\n\t%s\n\n' \
           "SSL error" \
           "- an error occurred" \
           "- run to debug: 'openssl s_client $_ciphers_openssl_curl -servername $_ssl_domain_name -connect $_ssl_remote_socket'"

    _ssl_ext_tools_stop=1

    # shellcheck disable=2154
    if [[ "$ssl_test_state" -eq 1 ]] ; then

      _ssl_ext_tools_stop=0

    fi

    if [[ "$ssl_test_state" -eq 1 ]] ; then

      _ssl_ext_tools_stop=0

    fi

    if [[ "$_ssl_ext_tools_stop" -eq 1 ]] ; then

      _logger "stop" \
        "${_FUNCTION_ID}()" \
        "no peer certificate available"
        # "no peer certificate available/no client certificate CA names sent"

    fi

  fi

  return $_STATE

}
