#!/bin/bash
# R-972 Part 4 — the LAN sharing checks, run ON DOOPLEX against demo-hp 9201's felhom-samba. Usage: sambacheck.sh <label>
# The household SMB password is read from $SC/.smbpw (0600) into a 0600 smbclient auth file; it is never printed.
# smbclient runs from our own felhom-samba image as a throwaway client container (--rm, host network, nothing
# installed on DooPlex); nmblookup is DooPlex's own; the mDNS and WS-Discovery probes are plain python sockets.
set -u
LABEL=${1:?label}; IP=192.168.0.155; NAME=FELHOMHP; SHARE=r1105; USERNAME=felhom
IMG=gitea.dooplex.hu/admin/felhom-samba:1.2.0
A=$(mktemp -p "$SC"); chmod 600 "$A"; printf 'username=%s\npassword=%s\n' "$USERNAME" "$(cat "$SC/.smbpw")" > "$A"
B=$(mktemp -p "$SC"); chmod 600 "$B"; printf 'username=%s\npassword=%s\n' "$USERNAME" "not-the-password" > "$B"
echo "== $LABEL — $(date -u +%FT%TZ)"
echo "-- 1. smbclient with the household password: write, list, read back, delete"
docker run --rm --network host -v "$A":/auth:ro --entrypoint sh "$IMG" -c \
  "echo r1105-$LABEL > /tmp/probe.txt && smbclient //$IP/$SHARE -A /auth -m SMB3 -c 'put /tmp/probe.txt probe-$LABEL.txt; ls probe-*; get probe-$LABEL.txt /tmp/back.txt; rm probe-$LABEL.txt' 2>&1 | grep -vE '^\s*$|blocks of size'; echo \"read back: \$(cat /tmp/back.txt 2>/dev/null || echo NOTHING)\""
echo "-- 2. negative control: a wrong password"
docker run --rm --network host -v "$B":/auth:ro --entrypoint smbclient "$IMG" //$IP/$SHARE -A /auth -m SMB3 -c 'ls' 2>&1 | tail -1
rm -f "$A" "$B"
echo "-- 3. nmbd: NetBIOS name query from DooPlex"
nmblookup -U $IP "$NAME" 2>&1 | tail -1
echo "-- 4. avahi: mDNS A query for $NAME.local"
python3 - "$NAME" <<'EOF'
import socket, struct, sys, time
name = sys.argv[1].lower() + ".local"
q = struct.pack(">HHHHHH", 0, 0, 1, 0, 0, 0) + b"".join(bytes([len(p)]) + p.encode() for p in name.split(".")) + b"\0" + struct.pack(">HH", 1, 0x8001)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
s.sendto(q, ("224.0.0.251", 5353))
try:
    while True:
        d, a = s.recvfrom(4096)
        if d[-4:] and len(d) > 12 and struct.unpack(">H", d[6:8])[0] > 0:
            print(f"answer from {a[0]}: {socket.inet_ntoa(d[-4:])} for {name}"); break
except socket.timeout:
    print(f"NO mDNS answer for {name}")
EOF
echo "-- 5. wsdd: WS-Discovery Probe"
python3 - <<'EOF'
import socket, uuid
probe = f'''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/discovery" xmlns:wsdp="http://schemas.xmlsoap.org/ws/2006/02/devprof"><soap:Header><wsa:To>urn:schemas-xmlsoap-org:ws:2005:04:discovery</wsa:To><wsa:Action>http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</wsa:Action><wsa:MessageID>urn:uuid:{uuid.uuid4()}</wsa:MessageID></soap:Header><soap:Body><wsd:Probe><wsd:Types>wsdp:Device</wsd:Types></wsd:Probe></soap:Body></soap:Envelope>'''
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
s.sendto(probe.encode(), ("239.255.255.250", 3702))
seen = []
try:
    while True:
        d, a = s.recvfrom(65535)
        if b"ProbeMatches" in d:
            seen.append(a[0])
except socket.timeout:
    pass
print("ProbeMatches from:", sorted(set(seen)) or "NOBODY", "— the box (192.168.0.155) answered" if "192.168.0.155" in seen else "— the box did NOT answer")
EOF
echo "-- 6. processes in the samba container, and its image"
ssh -o BatchMode=yes demo-hp "LC_ALL=C pct exec 9201 -- sh -c 'docker inspect felhom-samba --format \"{{.Config.Image}} created {{.Created}}\"; docker exec felhom-samba ps -o pid,comm,args | grep -E \"smbd|nmbd|wsdd|avahi|dbus|tini\" | grep -v grep | cut -c1-90; docker volume ls -q | grep -i samba'" 2>/dev/null