#!/usr/bin/env bash
# capture-net-diag.sh — write a snapshot of network / OVN / OVS / IPsec
# state into $1 (a directory the caller already created on the local host).
# Designed to run on a spinifex node after an E2E suite, before tofu destroy
# pulls the rug out. Every command is independent — `|| true` so a missing
# binary on one path doesn't abort the rest of the capture.
#
# Output layout (under $1/net-diag/):
#   openvswitch-ipsec.status         systemctl status (output-only)
#   openvswitch-ipsec.journal        last 200 journal lines
#   ipsec.openvswitch_conf           ovs-vsctl get Open_vSwitch . other_config
#   ipsec.xfrm_state                 ip xfrm state list
#   ipsec.xfrm_policy                ip xfrm policy list
#   ovn.sb_show                      ovn-sbctl show
#   ovn.nb_show                      ovn-nbctl show
#   ovs.show                         ovs-vsctl show
#   ovs.flows_br_int                 ovs-ofctl dump-flows br-int
#   ovs.tunnels                      ovs-appctl ofproto/list-tunnels br-int
#   net.links                        ip -s link show
#   net.routes                       ip route show table all
#   net.addrs                        ip -br addr show
#   systemd.failed_units             systemctl list-units --state=failed
set +e
OUT="${1:?usage: capture-net-diag.sh <output-dir>}"
mkdir -p "$OUT"

run() {
    local label="$1"; shift
    {
        echo "# $*"
        "$@" 2>&1
    } > "$OUT/$label" || true
}

run openvswitch-ipsec.status            sudo systemctl status openvswitch-ipsec.service --no-pager --full --lines=50
run openvswitch-ipsec.journal           sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso -n 200
run ipsec.openvswitch_conf              sudo ovs-vsctl get Open_vSwitch . other_config
run ipsec.xfrm_state                    sudo ip xfrm state list
run ipsec.xfrm_policy                   sudo ip xfrm policy list

run ovn.sb_show                         sudo ovn-sbctl show
run ovn.nb_show                         sudo ovn-nbctl show
run ovn.sb_chassis                      sudo ovn-sbctl list chassis

run_per_lr() {
    local label="$1"; shift
    local subcmd="$1"; shift
    {
        echo "# ovn-nbctl $subcmd <each-logical-router>"
        local lrs
        lrs="$(sudo ovn-nbctl --bare --columns=name list Logical_Router 2>/dev/null)"
        for lr in $lrs; do
            echo
            echo "=== $lr ==="
            sudo ovn-nbctl "$subcmd" "$lr" 2>&1
        done
    } > "$OUT/$label" || true
}

run_per_lr ovn.lr_routes                lr-route-list
run_per_lr ovn.lr_policies              lr-policy-list
run_per_lr ovn.lr_nat                   lr-nat-list

run ovs.show                            sudo ovs-vsctl show
run ovs.flows_br_int                    sudo ovs-ofctl dump-flows br-int
run ovs.tunnels                         sudo ovs-appctl ofproto/list-tunnels br-int

run net.links                           ip -s link show
run net.routes                          ip route show table all
run net.addrs                           ip -br addr show
run net.neigh                           ip neigh show
run net.bridge_fdb                      bridge fdb show
run net.conntrack                       sudo conntrack -L

run systemd.failed_units                sudo systemctl list-units --state=failed --no-pager

# Background pcap (started by start-net-capture.sh, if present).
if [ -f /tmp/spinifex-e2e-tcpdump.pid ]; then
    PID="$(cat /tmp/spinifex-e2e-tcpdump.pid 2>/dev/null)"
    sudo kill -INT "$PID" 2>/dev/null || true
    sleep 1
    if [ -f /tmp/spinifex-e2e-wan.pcap ]; then
        sudo cp /tmp/spinifex-e2e-wan.pcap "$OUT/wan.pcap" 2>/dev/null || true
        sudo chmod 0644 "$OUT/wan.pcap" 2>/dev/null || true
    fi
fi

exit 0