#!/bin/bash

## Copyright (C) 2021 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

#### meta start
#### project Whonix
#### category tor and usability
#### gateway_only yes
#### description
## Tor log parsing command line utility.
#### meta end

set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
shopt -s inherit_errexit
shopt -s shift_verbose

if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
  source /usr/libexec/helper-scripts/pre.bsh
fi

cmd1="journalctl --boot --no-pager --output cat -u tor.service"
log1="$(${cmd1})" || log1=""

cmd2="journalctl --boot --no-pager --output cat -u tor@default.service"
log2="$(${cmd2})" || log2=""

## Vanguards does not exist in Trixie any longer.
#cmd3="journalctl --boot --no-pager --output cat -u vanguards.service"
cmd3="false"
log3="$(${cmd3})" || log3=""

if [ -z "${log1}" ]; then
  log1="empty"
fi

if [ -z "${log2}" ]; then
  log2="empty"
fi

if [ -z "${log3}" ]; then
  log3="empty"
fi

if [ "${log2}" = "empty" ]; then
  printf '%s\n' "ERROR: Running command:

${cmd2}

failed! This program needs to be run as root:

sudo $0

or this user '$(whoami)' needs to be a member of group 'systemd-journal'.

sudo adduser $(whoami) systemd-journal

Exiting." >&2
   exit 1
fi

#log_full="\
#${bold}tor.service:${reset}
#
#$log1
#
#${bold}tor@default.service:${reset}
#
#$log2
#
#${bold}vanguards.service:${reset}
#
#$log3"

log_full="\
${bold}tor.service:${reset}

${log1}

${bold}tor@default.service:${reset}

${log2}"

## https://www.whonix.org/wiki/Tor#Non-Issues
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "New control connection opened.")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opening HTTP tunnel listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opened HTTP tunnel listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opened Socks listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opening Socks listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opening DNS listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opened DNS listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opening Transparent pf/netfilter listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opened Transparent pf/netfilter listener")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opening Control listener on /run/tor/control")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Opened Control listener on /run/tor/control")" || true

log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] You configured a non-loopback address")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "opening log file")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip.")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6.")" || true

log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] New control connection opened.")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[warn] Socks version 71 not recognized. (This port is not an HTTP proxy; did you want to use HTTPTunnelPort?)")" || true

## Use anon-verify instead.
## https://www.whonix.org/wiki/Tor#Configuration_Check
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Read configuration file")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Including configuration file")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Processing configuration path")" || true

log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[notice] Option 'DisableNetwork' used more than once; all but the last value will be ignored.")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[warn] Option 'ClientOnionAuthDir' used more than once; all but the last value will be ignored.")" || true
log_full="$(printf '%s\n' "${log_full}" | grep --invert-match --fixed-strings -- "[warn] Option 'DisableNetwork' used more than once; all but the last value will be ignored.")" || true

printf '%s\n' "${log_full}"
