#!/bin/bash
# masoara-haproxy2-rpc2.sh (PE rpc2): a doua masurare a retetei `haproxy`, dupa ce prima (masoara-apache-haproxy-rpc2.sh) a aratat doua
# lucruri despre PROBA, nu despre reteta: (1) `http-request return` genereaza raspunsul in HAProxy si regulile `http-response` NU se
# aplica unui raspuns generat intern (numai `http-after-response`), deci HSTS-ul retetei nu avea cum sa apara; (2) `haproxy -c -f`
# tace la succes si grep-ul pe `-vv` nu a prins randurile bibliotecii SSL. Aici: un backend HTTP simplu FARA HSTS (httpd:alpine pe
# 127.0.0.1:8449, control: curl direct pe el nu are antetul), HAProxy cu reteaua gazdei legat NUMAI pe 127.0.0.1:8448 (ssl) si cu
# backend-ul acela, deci raspunsul trece prin calea de raspuns si `http-response set-header` al retetei se vede sau nu; `haproxy -c -f`
# cu codul tiparit; `haproxy -vv` cu toate randurile despre SSL/OpenSSL si grupurile ML-KEM. Fragmentele retetei NESCHIMBATE.
set -u
D=/root/reteta-hp; rm -rf "$D"; mkdir -p "$D/certs" "$D/haproxy"; cd "$D" || exit 2
N=/opt/node24/bin/node; S=/root/reteta-sonda.mjs
[ -x "$N" ] || { echo "NEMASURAT: node 24 lipseste"; exit 2; }; [ -f "$S" ] || { echo "NEMASURAT: sonda lipseste"; exit 2; }
rpc() { local t0=$(date +%s%N); curl -s -m 5 -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' http://127.0.0.1:8545 | grep -o '"result":"0x[0-9a-f]*"' | head -1; echo " ($(( ($(date +%s%N) - t0) / 1000000 )) ms)"; }
echo "== RPC inainte: $(rpc)"
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -keyout certs/privkey.pem -out certs/fullchain.pem -days 2 -subj '/CN=proba.local' > /dev/null 2>&1 && cat certs/privkey.pem certs/fullchain.pem > certs/proba.pem && chmod 644 certs/*.pem && echo "cert ok"
rele=0
cere() { local nume="$1" ast="$2"; shift 2; out=$("$@" 2>&1); c=$?; if [ "$c" = "$ast" ]; then echo "  OK   $nume -> cod $c: $(printf '%s' "$out" | cut -c1-170)"; else echo "  RAU  $nume -> cod $c (asteptat $ast): $(printf '%s' "$out" | cut -c1-170)"; rele=$((rele + 1)); fi; }
docker pull -q httpd:alpine > /dev/null 2>&1; docker pull -q haproxy:alpine > /dev/null 2>&1
echo "== haproxy -vv: versiunea, biblioteca SSL, grupurile"; docker run --rm haproxy:alpine haproxy -vv 2>&1 | grep -iE 'HAProxy version|SSL|TLS|QUIC' | cut -c1-140 | sed 's/^/  /'
echo "== backend-ul simplu (httpd:alpine implicit, fara HSTS) pe 127.0.0.1:8449"
docker rm -f backend-reteta haproxy-reteta > /dev/null 2>&1
docker run -d --name backend-reteta -p 127.0.0.1:8449:80 httpd:alpine > /dev/null; sleep 2
echo "  control: curl direct pe backend (fara HAProxy) -> antetele:"; curl -s -m 10 -D - -o /dev/null http://127.0.0.1:8449/ | grep -iE '^(strict-transport-security|HTTP)' | tr -d '\r' | sed 's/^/     /'
cat > haproxy/haproxy.cfg <<'EOF'
global
    # EXACT fragmentul retetei (sectiunea global):
    ssl-default-bind-curves X25519MLKEM768:X25519
    ssl-default-bind-options ssl-min-ver TLSv1.3

defaults
    mode http
    timeout connect 5s
    timeout client 10s
    timeout server 10s

frontend proba
    bind 127.0.0.1:8448 ssl crt /usr/local/etc/haproxy/certs/proba.pem
    # EXACT fragmentul retetei (frontend-ul HTTPS):
    http-response set-header Strict-Transport-Security "max-age=31536000"
    default_backend simplu

backend simplu
    server s1 127.0.0.1:8449
EOF
echo "== verificarea retetei: haproxy -c -f"; docker run --rm --network host -v "$D/haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro" -v "$D/certs:/usr/local/etc/haproxy/certs:ro" haproxy:alpine haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg > "$D/hc.txt" 2>&1; hc=$?; echo "  cod $hc: $(tr '\n' ' ' < "$D/hc.txt" | cut -c1-160)"
docker run -d --name haproxy-reteta --network host -v "$D/haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro" -v "$D/certs:/usr/local/etc/haproxy/certs:ro" haproxy:alpine > /dev/null; sleep 3
docker ps --filter name=haproxy-reteta --format '  container: {{.Status}}'
cere "haproxy: hibrid singur (X25519MLKEM768)" 0 $N $S 127.0.0.1 8448 X25519MLKEM768
cere "haproxy: clasic singur (X25519, rezerva din reteta)" 0 $N $S 127.0.0.1 8448 X25519
cere "haproxy: hibrid + clasic (preferinta)" 0 $N $S 127.0.0.1 8448 X25519MLKEM768:X25519
cere "haproxy: client TLS 1.2 (refuz)" 1 $N $S 127.0.0.1 8448 X25519 TLSv1.2
echo "  -- HSTS prin HAProxy (raspuns venit de la backend-ul fara HSTS, curl -k):"; curl -sk -m 10 -D - -o /dev/null https://127.0.0.1:8448/ > "$D/h.txt"; grep -iE '^(strict-transport-security|HTTP)' "$D/h.txt" | tr -d '\r' | sed 's/^/     /'
if grep -qi '^strict-transport-security: max-age=31536000' "$D/h.txt"; then echo "  OK   HSTS pus de HAProxy (backend-ul nu il are)"; else echo "  RAU  HSTS lipseste prin HAProxy"; rele=$((rele + 1)); fi
docker logs haproxy-reteta 2>&1 | grep -iE 'alert|error|emerg' | head -3 | sed 's/^/     jurnal: /'
echo "== curatenie"; docker rm -f backend-reteta haproxy-reteta > /dev/null 2>&1; docker rmi httpd:alpine haproxy:alpine > /dev/null 2>&1 && echo "  imaginile sterse"
cd /root && rm -rf "$D"; docker ps -a --format '{{.Names}}' | grep -cE 'backend-reteta|haproxy-reteta' | sed 's/^/  containere ramase: /'
echo "== RPC dupa: $(rpc)"
echo "reteta haproxy (a doua masurare): $((5 - rele)) din 5 cum trebuie (4 sonde + HSTS)"
[ "$rele" = 0 ] && [ "$hc" = 0 ] && exit 0 || exit 1