#!/bin/sh
#add_snat_chain() {
#  /sbin/iptables -t nat -N $1_post
#  /sbin/iptables -t nat -I POSTROUTING -j $1_post
#}

MOD_NAME=service_acl
MOD_DEFAULTS=/opt/$MOD_NAME/etc/defaults
MOD_SETTINGS=/opt/$MOD_NAME/etc/settings
MOD_TCP_SERVER_SETTINGS=/opt/tcp2rtu/etc/settings

IPT_LIST="/sbin/iptables /sbin/ip6tables"
CHAIN=mod_$MOD_NAME

SRV_LIST=`cat /opt/$MOD_NAME/etc/srv_list`
IF_LIST=`cat /opt/$MOD_NAME/etc/if_list`

[ -f "$MOD_SETTINGS" ] || cp $MOD_DEFAULTS $MOD_SETTINGS
. $MOD_SETTINGS

get_port() {
  case "$1" in
    FTP)
      P=21
      ;;
    HTTP)
      P=80
      ;;
    HTTPS)
      P=443
      ;;
    SNMP)
      P=161
      ;;
    SSH)
      P=22
      ;;
    TCP_SERVER)
      P=0
      if [ -f "$MOD_TCP_SERVER_SETTINGS" ]; then
        . $MOD_TCP_SERVER_SETTINGS
        [ -n "$2" ] && MOD_PAR_PREFIX=MOD_TCP2RTU2 || MOD_PAR_PREFIX=MOD_TCP2RTU
        eval MOD_TCP_SERVER_ENABLED='$'${MOD_PAR_PREFIX}_ENABLED
        eval MOD_TCP_SERVER_MODE='$'${MOD_PAR_PREFIX}_MODE
        if [ "$MOD_TCP_SERVER_ENABLED" = "1" -a "$MOD_TCP_SERVER_MODE" = "1" ]; then
          eval P='$'${MOD_PAR_PREFIX}_PORT
        fi
      fi
      ;;
    TELNET)
      P=23
      ;;
    *)
      P=0
  esac
  echo $P
}

get_protocol() {
  case "$1" in
    SNMP)
      P=udp
      ;;
    *)
      P=tcp
  esac
  echo $P
}

add_rules() {
  for IF in $IF_LIST; do
    INTERFACE=`echo $IF | awk '{print tolower($1)}'`
    eval GLOBAL_IF_ENABLED='$'MOD_SAL_GLOBAL_${IF}_ENABLED
    for SRV in $SRV_LIST; do
      PROTOCOL=`get_protocol $SRV`
      eval GLOBAL_SRV_ENABLED='$'MOD_SAL_${SRV}_GLOBAL_ENABLED
      eval SRV_IF_ENABLED='$'MOD_SAL_${SRV}_${IF}_ENABLED
      [ "$GLOBAL_IF_ENABLED" = "1" -a "$GLOBAL_SRV_ENABLED" = "1" -a "$SRV_IF_ENABLED" = "1" ] && TARGET_NAME=ACCEPT || TARGET_NAME=DROP
      PORT=`get_port $SRV`
      if [ $PORT -ne 0 ]; then
        $IPT -A $CHAIN -i $INTERFACE -p $PROTOCOL --dport $PORT -j $TARGET_NAME
      fi
      if [ "$SRV" = "TCP_SERVER" ]; then
        PORT2=`get_port $SRV 2`
        if [ $PORT2 -ne 0 ]; then
          $IPT -A $CHAIN -i $INTERFACE -p $PROTOCOL --dport $PORT2 -j $TARGET_NAME
        fi
      fi
    done
  done
}

case "$1" in
  start)
    echo -n "Starting module $MOD_NAME: "
    if [ "$MOD_SAL_ENABLED" != "1" ]; then
      echo "skipped"
      exit 0
    fi
    for IPT in $IPT_LIST; do
      [ -x $IPT ] || continue;
      $IPT -N $CHAIN
      add_rules
      $IPT -I INPUT -j $CHAIN
    done
    if [ $? -ne 0 ]; then
      echo "failed"
      exit 1
    fi
    echo "done"
    ;;
  stop)
    echo -n "Stopping module $MOD_NAME: "
    for IPT in $IPT_LIST; do
      [ -x $IPT ] || continue;
      $IPT -D INPUT -j $CHAIN
      $IPT -F $CHAIN
      $IPT -X $CHAIN
    done
    if [ $? -ne 0 ]; then
      echo "failed"
      exit 1
    fi
    echo "done"
    ;;
  restart)
    $0 stop
    $0 start
    ;;
  status)
    echo -n "Module $MOD_NAME is "
    if [ "$MOD_SAL_ENABLED" != "1" ]; then
      echo "disabled"
    else
      echo "enabled"
    fi
    ;;
  defaults)
    cp $MOD_DEFAULTS $MOD_SETTINGS 2>/dev/null
    ;;
  *)
    echo "Usage: $0 {start|stop|restart|status|defaults}"
    exit 1
esac
