# -----------------------------------------------------------------------------
# This file is part of opt_onco. For contact and licensing information, see
#   (fli4lroot)/config/onco.txt
# File version: $Id: rc509.onco 22 2006-03-12 18:45:59Z sirprize $
# -----------------------------------------------------------------------------

if [ "$OPT_ONCO" = "yes" ]
then
	begin_script ONCO "OnCo: preparing onco ..."
	
	#----------------------------------------------------------------------------
	# OnCo-Verzeichnis löschen (falls vorhanden) und neu anlegen 
	#----------------------------------------------------------------------------	
	rm -Rf /tmp/onco
	mkdir /tmp/onco
	
	#----------------------------------------------------------------------------
	# Hostliste entweder kopieren oder neu generieren?
	# Format: eine Zeile pro Rechner, Inhalt der Zeile:
	# IP-Adresse Hostname
	#----------------------------------------------------------------------------
	case "$ONCO_HOSTLIST" in
		file)
		# Liste filtern und kopieren
		grep -v "^$" /usr/local/onco_hostlist.txt | grep -v "^#" | grep "^[^[:space:]]*[[:space:]][[:space:]]*[^[:space:]]*[[:space:]]*$" >/tmp/onco/hosts 2>/dev/null
		;;
		base)
		# Liste generieren
		{
			[ 0$HOSTS_N -eq 0 ] || for i in `seq 1 $HOSTS_N`
			do
				eval hostname='$HOST_'$i'_NAME'
				eval ipaddr='$HOST_'$i'_IP'
				echo "$ipaddr $hostname "
			done
		} >/tmp/onco/hosts
		;;
	esac

	#----------------------------------------------------------------------------
	# Die localhost-IP soll natürlich nie geblockt werden!
	#----------------------------------------------------------------------------
	>/tmp/onco/127.0.0.1.neverblock

	#----------------------------------------------------------------------------
	# Die Fli4L-eigenen IPs sollen natürlich
	# auch nicht geblockt werden
	#----------------------------------------------------------------------------
	[ 0$IP_NET_N -eq 0 ] || for i in `seq 1 $IP_NET_N`
	do
		eval net='$IP_NET_'$i''
		ip=`echo $net | sed "s/\/[0-3]\?[0-9]//"`
		>/tmp/onco/$ip.neverblock
	done

	#----------------------------------------------------------------------------
	# Hier noch die persönlich eingetragen
	# nicht zu blockenden IPs
	#----------------------------------------------------------------------------
	[ 0$ONCO_NEVERBLOCK_N -eq 0 ] || for i in `seq 1 $ONCO_NEVERBLOCK_N`
	do
		eval ip='$ONCO_NEVERBLOCK_'$i
		>/tmp/onco/$ip.neverblock
	done

	#----------------------------------------------------------------------------
	# iptables vorbereiten
	#----------------------------------------------------------------------------
	get_count FORWARD
	forward_def=$res
	get_count INPUT
	input_def=$res
	add_chain ONCO_blocklist

	case "$ONCO_BLOCK_UDP" in
		yes) ins_rule filter FORWARD "prot:udp ONCO_blocklist" $forward_def ;;
	esac
	case "$ONCO_BLOCK_ICMP" in
		yes) ins_rule filter FORWARD "prot:icmp ONCO_blocklist" $forward_def ;;
	esac
	ins_rule filter FORWARD "prot:tcp ONCO_blocklist" $forward_def

	#------------------------------
	# Soll DNS geblockt werden?
	#------------------------------
	case "$ONCO_BLOCK_DNS" in
		yes) ins_rule filter INPUT "prot:udp 53 ONCO_blocklist" $input_def ;;
	esac
	
	#-----------------------------------------
	# TCP-Ports in INPUT sperren (z.B. Proxy)
	#-----------------------------------------
	[ 0$ONCO_PORTBLOCK_N -eq 0 ] || for i in `seq 1 $ONCO_PORTBLOCK_N`
	do
		eval port='$ONCO_PORTBLOCK_'$i
		# Bugfix: privoxy hat seine eigene "Whitelist", daher muss der Port in
		# jedem Fall vorher geblockt werden - das funktioniert deshalb nicht mit
		# ins_rule. Wenn jemand ne bessere Lösung hat: her damit!
		# - Michael Mattes <sirprize@sodge.org>
		# ins_rule filter INPUT "prot:tcp $port ONCO_blocklist" $input_def
		/sbin/iptables -I INPUT 1 -p tcp --dport $port -j ONCO_blocklist
	done

	#--------------------------------------
	# Alle Hosts zu Beginn sperren?
	#--------------------------------------
	case "$ONCO_BLOCKALL_HOSTS" in
		yes)
		{
			while read ip host
 			do
				/usr/local/bin/onco_blockip.sh $ip
			done
		} < /tmp/onco/hosts
		;;
	esac

	#------------------------------
	# Soll fping benutzt werden?
	#------------------------------
	case "$OPT_FPING" in
		yes)
		#-------------------------------------------------
		# onco_updatehost.sh alle $ONCO_HOSTUPDATE_DELAY
		# Minuten ausführen...
		#-------------------------------------------------
		add_crontab_entry "*/$ONCO_HOSTUPDATE_DELAY * * * *" "/usr/local/bin/onco_updatehosts.sh"
		
		# beim Booten einmal ausführen
		/usr/local/bin/onco_updatehosts.sh
		;;
		*)		
		>/tmp/onco/nofping
		;;
	esac

	#------------------------------------------------------
	# Eintrag in crontab, onco_countdown läuft jede Minute
	#------------------------------------------------------
	add_crontab_entry "* * * * *" "/usr/local/bin/onco_countdown.sh"

	#-------------------------------------------------
	# Zeitsteuerungseinträge in die crontab eintragen
	#-------------------------------------------------
	[ 0$ONCO_TIMECTL_N -eq 0 ] || for i in `seq 1 $ONCO_TIMECTL_N`
	do
		eval tcl_ip='$ONCO_TIMECTL_'$i'_IP'
		eval tcl_start='$ONCO_TIMECTL_'$i'_START'
		eval tcl_time='$ONCO_TIMECTL_'$i'_TIME'
		add_crontab_entry "$tcl_start" "/usr/local/bin/onco_addtime.sh $tcl_ip $tcl_time"
	done

	#-------------------------------------------------
	# httpd-Menüeinträge erstellen
	#-------------------------------------------------
	/usr/local/bin/httpd-menu.sh add "main_onco.cgi" "Hostliste" "OnCo"
	case "$OPT_FPING" in
		yes) /usr/local/bin/httpd-menu.sh add "onco_updatehosts.cgi" "Hoststatus aktualisieren" "OnCo" ;;
	esac
	/usr/local/bin/httpd-menu.sh add "main_onco.cgi?all=unblock" "Alle freischalten" "OnCo"
	/usr/local/bin/httpd-menu.sh add "main_onco.cgi?all=block" "Alle sperren" "OnCo"
	
	end_script
fi
