#!/bin/sh
#------------------------------------------------------------------------------
# /etc/rc.d/rc360.fwrules - rewrite old packet filter rules to new format
#
# Creation:         jw5
# Last Update:      $Id: rc360.fwrules 10853 2006-01-20 21:43:47Z jw5 $
#------------------------------------------------------------------------------

case $ORIG_FW_CONFIG in
yes)
    begin_script FWRULES "rewriting packet filter rules to new format ..."

    convert_action ()
    {
        act=$1
        action=$2
        prot=

        set `echo $1 | sed -e 's/-/ /'`
        case $1 in
             ACCEPT | REJECT | DROP)
	     	 action=$1
                 case "$2" in
		     '')  ;;
                     TCP) prot='prot:tcp ' ;;
                     UDP) prot='prot:udp ' ;;
                     GRE) prot='prot:gre ' ;;
		     *)   log_error "unknown protocoll '$2'" ;;
                 esac
                 ;;
             TCP) prot='prot:tcp ' ;;
             UDP) prot='prot:udp ' ;;
             *)
                     log_error "unknown action format: $act"
                     prot=
                     action=REJECT
                     ;;
        esac
    }

    #----------------------------------------------------------------------------
    # input rules
    #----------------------------------------------------------------------------
    idx=1
    # INPUT_POLICY already set
    INPUT_ACCEPT_DEF='yes'              # use default rule set
    INPUT_LOG=$PACKETFILTER_LOG

    unique $ROUTE_NETWORK $MASQ_NETWORK $TRUSTED_NETS
    for j in $list
    do
        eval "INPUT_LIST_$idx='$j ACCEPT'"
        idx=`expr $idx + 1`
    done

    [ 0$INPUT_ACCEPT_PORT_N -eq 0 ] || for j in `seq 1 $INPUT_ACCEPT_PORT_N`
    do
        eval port=\$INPUT_ACCEPT_PORT_$j
        set $port
        port=$1
        action=$2

        convert_action $action ACCEPT

        eval "INPUT_LIST_$idx='$prot$port $action'"
        idx=`expr $idx + 1`
    done
    INPUT_LIST_N=`expr $idx - 1`

    #----------------------------------------------------------------------------
    # forward rules
    #----------------------------------------------------------------------------
    idx=1
    FORWARD_POLICY='REJECT'             # be nice and use reject as policy
    FORWARD_ACCEPT_DEF='yes'            # use default rule set
    FORWARD_LOG=$PACKETFILTER_LOG

    for j in $TRUSTED_NETS
    do
        for i in $TRUSTED_NETS
        do
             if [ "$j" != "$i" ]
             then
                 eval "FORWARD_LIST_$idx='$j $i ACCEPT'"
                 idx=`expr $idx + 1`
             fi
        done
    done

    fwd_idx=$idx
    [ 0$FORWARD_DENY_PORT_N -eq 0 ] || for j in `seq 1 $FORWARD_DENY_PORT_N`
    do
        eval port=\$FORWARD_DENY_PORT_$j
        set $port
        port=$1
        action=$2
        convert_action $action REJECT
        eval "FORWARD_LIST_$fwd_idx='$prot$port $action'"
        fwd_idx=`expr $fwd_idx + 1`
    done

    case $FORWARD_HOST_WHITE in
        yes)
             USER_LIST_1='chain:white'
             action=ACCEPT
             list_name=USER
             idx=2
             ;;
        *)
             action=REJECT
             list_name=FORWARD
             idx=$fwd_idx
             ;;
    esac

    [ 0$FORWARD_HOST_N -eq 0 ] || for j in `seq 1 $FORWARD_HOST_N`
    do
        eval host='$FORWARD_HOST_'$j
        eval "${list_name}_LIST_$idx='$host $action'"
        idx=`expr $idx + 1`
    done

    case $FORWARD_HOST_WHITE in
        yes)
             eval "USER_LIST_$idx='REJECT'"
             USER_LIST_N=$idx
             action=white
             ;;
        *)
             fwd_idx=$idx
             action=ACCEPT
             ;;
    esac

    unique $MASQ_NETWORK $ROUTE_NETWORK
    for j in $list
    do
        eval "FORWARD_LIST_$fwd_idx='$j $action'"
        fwd_idx=`expr $fwd_idx + 1`
    done

    FORWARD_LIST_N=`expr $fwd_idx - 1`

    #----------------------------------------------------------------------------
    # nat rules
    #----------------------------------------------------------------------------
    case x$MASQ_NETWORK in
        x) ;;
        *)
             idx=1
             for j in $TRUSTED_NETS
             do
                 for i in $TRUSTED_NETS
                 do
                     if [ "$j" != "$i" ]
                     then
                         eval "POSTROUTING_LIST_$idx='$j $i ACCEPT'"
                         idx=`expr $idx + 1`
                     fi
                 done
             done

             for j in $ROUTE_NETWORK
             do
                 eval "POSTROUTING_LIST_$idx='any $j ACCEPT'"
                 idx=`expr $idx + 1`
             done

             for j in $MASQ_NETWORK
             do
                 eval "POSTROUTING_LIST_$idx='$j MASQUERADE'"
                 idx=`expr $idx + 1`
             done
             POSTROUTING_LIST_N=`expr $idx - 1`
    esac

    {
    echo "Original configuration:"
    for i in ROUTE_NETWORK MASQ_NETWORK TRUSTED_NETS PACKETFILTER_LOG \
              INPUT_POLICY INPUT_ACCEPT_PORT_N \
              INPUT_ACCEPT_PORT_[1-9]= INPUT_ACCEPT_PORT_[1-9][0-9] \
              FORWARD_DENY_PORT_N FORWARD_DENY_PORT_[1-9]= \
              FORWARD_DENY_PORT_[1-9][0-9] \
              FORWARD_HOST_WHITE FORWARD_HOST_N \
              FORWARD_HOST_[1-9]= FORWARD_HOST_[1-9][0-9]
    do
        set | grep -e "^$i"
    done

    echo "New configuration:"
    for i in INPUT_POLICY INPUT_ACCEPT_DEF INPUT_LOG \
              INPUT_LIST_N INPUT_LIST_[1-9]= INPUT_LIST_[1-9][0-9] \
              FORWARD_POLICY FORWARD_ACCEPT_DEF FORWARD_LOG \
              FORWARD_LIST_N FORWARD_LIST_[1-9]= FORWARD_LIST_[1-9][0-9]\
              USER_LIST_N USER_LIST_[1-9]= USER_LIST_[1-9][0-9]\
              POSTROUTING_LIST_N POSTROUTING_LIST_[1-9]= POSTROUTING_LIST_[1-9][0-9]
    do
        set | grep "^$i"
    done
    } | log_error

    end_script
;;
esac
