#!/usr/bin/env bash
#
# Alerts to Answers — Laboratory Reset  ·  Version 15
# (c) Dr. Furstenberg. All rights reserved.
#
# Resets the UB2604 network sensor to a clean state by truncating the Suricata
# log files. Suricata keeps running; only the accumulated records are cleared,
# so students begin an exercise with no traffic from previous work.
#
# LABORATORY USE ONLY. Do not run on any production system.
#
# Run order:  1) WIN11   2) UB2604   3) wait 60s   4) WAZUH-SRV
# Companion guide: Student Lab Reset Guide, Part 2
#
# Usage:  chmod +x reset-lab-ub2604_v18.sh
#         sudo ./reset-lab-ub2604_v18.sh

set -uo pipefail

GREEN='\033[0;32m'; YELLOW='\033[0;33m'; RED='\033[0;31m'; CYAN='\033[0;36m'; NC='\033[0m'
ok()   { echo -e "${GREEN}$*${NC}"; }
warn() { echo -e "${YELLOW}$*${NC}"; }
err()  { echo -e "${RED}$*${NC}"; }
head_() { echo; echo -e "${CYAN}$*${NC}"; }

# Files truncated by this script. Scope is fixed deliberately — the script will
# not accept a path argument, so it cannot be pointed at anything else.
SURICATA_LOGS=(
  "/var/log/suricata/eve.json"
  "/var/log/suricata/fast.log"
  "/var/log/suricata/stats.log"
  "/var/log/suricata/suricata.log"
)

# ------------------------------------------------------------------ privilege
if [[ $EUID -ne 0 ]]; then
  err "This script must be run with sudo."
  echo "Try:  sudo ./reset-lab-ub2604_v18.sh"
  exit 1
fi

head_ "Alerts to Answers - Reset UB2604"
echo "-------------------------------------"

# ------------------------------------------------------------------ pre-flight
if ! systemctl list-unit-files 2>/dev/null | grep -q '^suricata\.service'; then
  warn "Suricata service not found on this machine."
  echo "Confirm you are on UB2604 before continuing."
fi

echo
echo "This script will empty the following log files:"
present=0
for f in "${SURICATA_LOGS[@]}"; do
  if [[ -f "$f" ]]; then
    size=$(stat -c%s "$f" 2>/dev/null || echo 0)
    printf "  - %-38s (%s bytes)\n" "$f" "$size"
    present=$((present+1))
  fi
done
if [[ $present -eq 0 ]]; then
  warn "None of the expected Suricata log files were found."
  echo "Nothing to do. Confirm Suricata is installed and has run at least once."
  exit 0
fi

echo
echo "It will NOT:"
echo "  - Uninstall or reconfigure Suricata"
echo "  - Modify suricata.yaml, rule files, or the Wazuh agent configuration"
echo "  - Change the promiscuous setting on ens192"
echo "  - Delete the log files themselves (they are emptied, not removed)"
echo

# ------------------------------------------------------------------ confirm
read -r -p "Type RESET to continue (anything else cancels): " answer
if [[ "$answer" != "RESET" ]]; then
  warn "Cancelled. Nothing was changed."
  exit 0
fi

# ------------------------------------------------------------------ truncate
echo
for f in "${SURICATA_LOGS[@]}"; do
  if [[ -f "$f" ]]; then
    if : > "$f" 2>/dev/null; then
      echo "Emptied: $f"
    else
      err "Could not empty: $f"
    fi
  fi
done

# Suricata holds the files open; a reload makes it write to the truncated files
# cleanly rather than continuing at the previous offset.
if systemctl is-active --quiet suricata; then
  systemctl kill -s HUP suricata 2>/dev/null || systemctl restart suricata
  sleep 2
fi

# ------------------------------------------------------------------ verify
eve="/var/log/suricata/eve.json"
if [[ -f "$eve" ]]; then
  size=$(stat -c%s "$eve" 2>/dev/null || echo 0)
  if [[ "$size" -le 4096 ]]; then
    ok "SUCCESS: eve.json is now empty ($size bytes)."
  else
    warn "eve.json is $size bytes — Suricata is already writing new records. This is normal."
  fi
fi

# ------------------------------------------------------------------ health
echo
if systemctl is-active --quiet suricata; then
  ok "Suricata service: running"
else
  err "Suricata service: NOT running - start it before the next lab"
fi

if ip link show ens192 2>/dev/null | grep -q PROMISC; then
  ok "Capture interface ens192: PROMISC set"
else
  warn "Capture interface ens192: PROMISC flag NOT set"
  echo "  Fix with:  sudo ip link set ens192 promisc on"
fi

if systemctl is-active --quiet wazuh-agent; then
  ok "Wazuh agent: running"
else
  warn "Wazuh agent: not running - start it before the next lab"
fi

echo
ok "UB2604 reset complete."
echo "Next: wait 60 seconds, then run reset-lab-wazuh-srv_v18.sh on WAZUH-SRV."
exit 0