#!/bin/sh
#------------------------------------------------------------------------------
# /etc/rc.d/rc360.fwrules.new - configure firewall
#
# Creation:         jw5
# Last Update:      $Id: rc360.fwrules.new 10512 2005-12-04 13:50:13Z hh $
#------------------------------------------------------------------------------

case ${NEW_FW_CONFIG}${ORIG_FW_CONFIG} in
*yes*)
    begin_script FWRULES "configuring firewall ..."

    # get helper functions
    . /etc/rc.d/fwrules-helper

    $I -F FORWARD
    $I -F INPUT
    $I -F OUTPUT
    $I -t nat -F POSTROUTING
    $I -t nat -F PREROUTING

    $I -P FORWARD DROP          # forward policy is drop
    $I -P INPUT   DROP          # REJECT is not possible here :-(
    $I -P OUTPUT  ACCEPT        # output policy is accept

    [ "$MASQ_MODULE_N" -eq 0 ] || for idx in `seq 1 $MASQ_MODULE_N`
    do
        eval drv='$MASQ_MODULE_'$idx
        eval options='$MASQ_MODULE_'$idx'_OPTION'
        do_insmod ip_conntrack_$drv $options
        do_insmod ip_nat_$drv $options
    done
    # check if there are match modules to load
    if ls /lib/modules/$kversion/kernel/net/ipv4/netfilter/ip*.o >/dev/null 2>&1
    then
        # Load all available match modules. Please note that the code
        # assumes that there are no dependencies!
        for m in /lib/modules/$kversion/kernel/net/ipv4/netfilter/ip*.o
        do
            m=`basename $m | sed -e "s/\.o$/\1/"`
            do_insmod_once $m
        done
    fi

    # setup logging
    : ${INPUT_REJ_LIMIT:="1/second 5"}
    : ${INPUT_UDP_REJ_LIMIT:="1/second 5"}
    : ${FORWARD_REJ_LIMIT:="1/second 5"}
    : ${FORWARD_UDP_REJ_LIMIT:="1/second 5"}
    setup_logging "$INPUT_LOG" INPUT fw-input "$INPUT_LOG_LIMIT" "$INPUT_REJ_LIMIT" "$INPUT_UDP_REJ_LIMIT"
    setup_logging "$FORWARD_LOG" FORWARD fw-forward "$FORWARD_LOG_LIMIT" "$FORWARD_REJ_LIMIT" "$FORWARD_UDP_REJ_LIMIT"

    #----------------------------------------------------------------------------
    # running chain commands from additional packages
    # these rules comes first in the chain - so beware of bloated rulesets which
    # are used uncommonly
    #----------------------------------------------------------------------------

    for ext in /etc/rc.d/fwrules.pre.*
    do
        if [ -f "$ext" ]
        then
             . $ext
        fi
    done

    # create user defined chains
    user_chain=
    [ 0$USER_LIST_N -eq 0 ] || for idx in `seq 1 $USER_LIST_N`
    do
        eval rule='$USER_LIST_'$idx
        case "$rule" in
             chain:*)
                 user_chain=`echo $rule | sed -e 's/chain://'`
                 add_chain $user_chain
                 ;;
             *)
                 case x$user_chain in
                     x) log_error "missing chain: directive in USER_LIST_$idx" ;;
                     *) add_rule filter $user_chain "$rule" "USER_LIST_$idx='$rule'";;
                 esac
                 ;;
        esac
    done


    # input chain
    get_defaults INPUT
    if [ "$INPUT_ACCEPT_DEF" = 'yes' ]
    then
        add_chain in-icmp
        add_rule filter in-icmp "prot:icmp:8 length:0-100 limit:1/second:5 ACCEPT" INPUT_ACCEPT_DEF
        add_rule filter INPUT "state:ESTABLISHED,RELATED ACCEPT" INPUT_ACCEPT_DEF
        add_rule filter INPUT "prot:icmp in-icmp" INPUT_ACCEPT_DEF
        add_rule filter INPUT "if:lo:any ACCEPT" INPUT_ACCEPT_DEF
        add_rule filter INPUT "state:NEW 127.0.0.1 DROP BIDIRECTIONAL" INPUT_ACCEPT_DEF
    fi
    if lsmod | grep ipt_REDIRECT > /dev/null
    then
        add_chain PORTREDIRACCESS # add chain if not already there
        add_rule filter INPUT "state:NEW PORTREDIRACCESS"
    fi
    set_count INPUT

    [ 0$INPUT_LIST_N -eq 0 ] || for idx in `seq 1 $INPUT_LIST_N`
    do
        eval rule='$INPUT_LIST_'$idx
        add_rule filter INPUT "$rule" "INPUT_LIST_$idx='$rule'"
    done

    # forward chain
    get_defaults FORWARD
    if [ "$FORWARD_ACCEPT_DEF" = 'yes' ]
    then
        add_rule filter FORWARD "state:ESTABLISHED,RELATED ACCEPT" FORWARD_ACCEPT_DEF
        add_rule filter FORWARD "state:NEW 127.0.0.1 DROP BIDIRECTIONAL" FORWARD_ACCEPT_DEF
    fi

    if [ 0$PORTFW_N -ne 0 -o -f /etc/rc.d/rc425.portfw.new ]
    then
        iptables -L | grep -q PORTFWACCESS || add_chain PORTFWACCESS # add chain if not already there
        add_rule filter FORWARD "state:NEW PORTFWACCESS"
    fi
    set_count FORWARD

    [ 0$FORWARD_LIST_N -eq 0 ] || for idx in `seq 1 $FORWARD_LIST_N`
    do
        eval rule='$FORWARD_LIST_'$idx
        add_rule filter FORWARD "$rule" "FORWARD_LIST_$idx='$rule'"
    done

    [ 0$POSTROUTING_LIST_N -eq 0 ] || for idx in `seq 1 $POSTROUTING_LIST_N`
    do
        eval rule='$POSTROUTING_LIST_'$idx
        add_rule nat POSTROUTING "$rule" "POSTROUTING_LIST_$idx='$rule'"
    done

    [ 0$PREROUTING_LIST_N -eq 0 ] || for idx in `seq 1 $PREROUTING_LIST_N`
    do
        eval rule='$PREROUTING_LIST_'$idx
        echo "$rule" >> /etc/portfw-new.conf
    done

    #----------------------------------------------------------------------------
    # running chain commands from additional packages
    # these rules are added in the end of the ACCEPT rules
    # put uncommon rulesets here
    #----------------------------------------------------------------------------

    for ext in /etc/rc.d/fwrules.post.*
    do
        if [ -f "$ext" ]
        then
             . $ext
        fi
    done

    # close input chain and forward chain
    # default policy of input and forward is DROP
    close_chain INPUT $INPUT_POLICY
    close_chain FORWARD $FORWARD_POLICY

    #----------------------------------------------------------------------------
    # enable forwarding and setup anti-spoofing measures
    #----------------------------------------------------------------------------
    for j in /proc/sys/net/ipv4/conf/*
    do
        echo 1 > $j/rp_filter                    # anti-spoofing
    done
    echo 1 > /proc/sys/net/ipv4/route/flush
    echo 1 > /proc/sys/net/ipv4/ip_forward

    set | grep -e IP_NET -e IP_ROUTE > /var/run/ip_net.conf

    end_script
;;
esac
