#!/bin/bash
#A library of functions and subroutines for Mason
#Copyright 1999, William Stearns <wstearns@pobox.com>
#See the main Mason script for license and copyright information.


flushfirewall () {
#Flush the existing rules so we start with a clean slate.
	if [ -f /proc/net/ip_fwchains ]; then
		echo -n Flushing... >/dev/stderr
		FLUSHEDPOLICY=`echo $FLUSHEDPOLICY | tr a-z A-Z`
		/sbin/ipchains -P output $FLUSHEDPOLICY
	    /sbin/ipchains -F output
		/sbin/ipchains -P forward $FLUSHEDPOLICY
		/sbin/ipchains -F forward
		/sbin/ipchains -P input $FLUSHEDPOLICY
	    /sbin/ipchains -F input
		echo Done!
	elif [ -f /proc/net/ip_input ]; then
		echo -n Flushing... >/dev/stderr
		FLUSHEDPOLICY=`echo $FLUSHEDPOLICY | tr A-Z a-z`
		/sbin/ipfwadm -O -p $FLUSHEDPOLICY
		/sbin/ipfwadm -O -f
		/sbin/ipfwadm -F -p $FLUSHEDPOLICY
		/sbin/ipfwadm -F -f
		/sbin/ipfwadm -I -p $FLUSHEDPOLICY
		/sbin/ipfwadm -I -f
		echo Done!
	else
		echo This kernel supports neither ipchains nor ipfwadm! >/dev/stderr
	fi
}

runstandardfirewall () {
	if [ -f /proc/net/ip_fwchains ]; then
		DEFAULTPOLICY=`echo $DEFAULTPOLICY | tr a-z A-Z`
		if [ "`cat /proc/sys/net/ipv4/ip_forward`" = "0" ]; then
			/sbin/ipchains -A forward -j DENY
		fi

		echo -n Fixed rules...
		. $BASERULEFILE

		echo -n Incoming blocks...
		for OUTSIDEIF in `/sbin/route -n | grep '^0\.0\.0\.0[ \t]' | awk '{print $8}'` ; do
			for BLOCKPROTO in $NOINCOMING ; do
				/sbin/ipchains -A input -i $OUTSIDEIF -p ${BLOCKPROTO##*/} -d 0/0 ${BLOCKPROTO%%/*}   -j DENY $LOG
			done
		done

		#ALLCHAINS=`ipchains -L -n | grep '^Chain' | awk '{print $2}'`
		ALLCHAINS="input output forward"

		for ACHAIN in $ALLCHAINS ; do
			/sbin/ipchains -P $ACHAIN $DEFAULTPOLICY
		done
		echo Done!
	elif [ -f /proc/net/ip_input ]; then
		echo -n To be implemented... >/dev/stderr
		DEFAULTPOLICY=`echo $DEFAULTPOLICY | tr A-Z a-z`
	else
		echo This kernel supports neither ipchains nor ipfwadm! >/dev/stderr
	fi
}


runlearnfirewall () {
	if [ -f /proc/net/ip_fwchains ]; then
		DEFAULTPOLICY=`echo $DEFAULTPOLICY | tr a-z A-Z`
		if [ "`cat /proc/sys/net/ipv4/ip_forward`" = "0" ]; then
			/sbin/ipchains -A forward -j DENY
		fi

		echo -n Fixed rules...
		. $BASERULEFILE

		echo -n Incoming blocks...
		for OUTSIDEIF in `/sbin/route -n | grep '^0\.0\.0\.0[ \t]' | awk '{print $8}'` ; do
			for BLOCKPROTO in $NOINCOMING ; do
				/sbin/ipchains -A input -i $OUTSIDEIF -p ${BLOCKPROTO##*/} -d 0/0 ${BLOCKPROTO%%/*}   -j DENY $LOG
			done
		done

		echo -n New rules...
		. $NEWRULEFILE

		#ALLCHAINS=`ipchains -L -n | grep '^Chain' | awk '{print $2}'`
		ALLCHAINS="input output forward"

#Finally, create a "nolog' chain for each of the existing chains, have each existing 
#chain jump to it, then log everything else.
		echo -n Adding logging rules...
		for ACHAIN in $ALLCHAINS ; do
			/sbin/ipchains -F ${ACHAIN}${NOLOGSUFFIX} >/dev/null 2>/dev/null				#Flush it as it might have existed before.
		    if ! /sbin/ipchains -L ${ACHAIN}${NOLOGSUFFIX} >/dev/null 2>/dev/null ; then	#If nolog chain does not exist
				/sbin/ipchains -N ${ACHAIN}${NOLOGSUFFIX}					#Create it
	    	fi
			/sbin/ipchains -A $ACHAIN -j ${ACHAIN}${NOLOGSUFFIX}
		    /sbin/ipchains -A $ACHAIN -l
			/sbin/ipchains -P $ACHAIN $DEFAULTPOLICY
		done
		echo Done!
	elif [ -f /proc/net/ip_input ]; then
		echo -n To be implemented... >/dev/stderr
		DEFAULTPOLICY=`echo $DEFAULTPOLICY | tr A-Z a-z`
	else
		echo This kernel supports neither ipchains nor ipfwadm! >/dev/stderr
	fi
}



checksys () {
	if [ ! -d /proc/1 ]; then
		echo WARNING! Proc filesystem not supported or not mounted.  Please fix and 
		echo restart.
		exit
	fi
}

checkconf () {
#FIXME - double check all vars have default values.
	echo -n "Check vars..." >/dev/stderr

	MASONDIR=${MASONDIR:-"/var/lib/mason/"} ;					if [ ! -d $MASONDIR ]; then touch $MASONDIR ; fi
	MASONCONF=${MASONCONF:-"/var/lib/mason/masonrc"} ;			if [ ! -f $MASONCONF ]; then touch $MASONCONF ; fi
	NAMECACHE=${NAMECACHE:-"/var/lib/mason/morehosts"} ;		if [ ! -f $NAMECACHE ]; then touch $NAMECACHE ; fi
	NETCACHE=${NETCACHE:-"/var/lib/mason/netconvert"} ;			if [ ! -f $NETCACHE ]; then touch $NETCACHE ; fi
	BASERULEFILE=${BASERULEFILE:-"/var/lib/mason/baserules"} ;	if [ ! -f $BASERULEFILE ]; then touch $BASERULEFILE ; fi
	NEWRULEFILE=${NEWRULEFILE:-"/var/lib/mason/newrules"} ;		if [ ! -f $NEWRULEFILE ]; then touch $NEWRULEFILE ; fi
	MASONLOG=${MASONLOG:-"/var/lib/mason/mason.log"} ;			if [ ! -f $NEWRULEFILE ]; then touch $NEWRULEFILE ; fi
	PACKETLOGFILE=${PACKETLOGFILE:-"/var/log/messages"}
	MASONEXE=${MASONEXE:-"/usr/bin/mason"}

	NOLOGSUFFIX=${NOLOGSUFFIX:-"N"}	#If you change this, change it in ruleshell too.
	DEBUG=${DEBUG:-"NO"}
	DYNIF=${DYNIF:-""}

	case $NEWRULEPOLICY in			#Set LCPOLICY (lower case) and UCPOLICY...
	accept|ACCEPT)		LCPOLICY="accept" ;	UCPOLICY="ACCEPT"	;;
	reject|REJECT)		LCPOLICY="reject" ;	UCPOLICY="REJECT"	;;
	deny|DENY)			LCPOLICY="deny  " ;	UCPOLICY="DENY  "	;;
	*)	echo WARNING! NEWRULEPOLICY is neither accept, reject, nor deny >/dev/stderr
		echo in ${MASONCONF}.  It is being reset to \"accept\".  Please fix! >/dev/stderr
		LCPOLICY="accept" ;	UCPOLICY="ACCEPT"					;;
	esac

	case $DEFAULTPOLICY in
	accept|ACCEPT)		DEFAULTPOLICY="accept" ;				;;
	reject|REJECT)		DEFAULTPOLICY="reject" ;				;;
	deny|DENY)			DEFAULTPOLICY="deny  " ;				;;
	*)	echo WARNING! DEFAULTPOLICY is neither accept, reject, nor deny >/dev/stderr
		echo in ${MASONCONF}.  It is being reset to \"accept\".  Please fix! >/dev/stderr
		DEFAULTPOLICY="accept"									;;
	esac

	case $LOGGINGPOLICY in
	accept|ACCEPT)		LOGGINGPOLICY="accept" ;				;;
	reject|REJECT)		LOGGINGPOLICY="reject" ;				;;
	deny|DENY)			LOGGINGPOLICY="deny  " ;				;;
	*)	LOGGINGPOLICY=$NEWRULEPOLICY							;;
	esac

	case $FLUSHEDPOLICY in
	accept|ACCEPT)		FLUSHEDPOLICY="accept" ;				;;
	reject|REJECT)		FLUSHEDPOLICY="reject" ;				;;
	deny|DENY)			FLUSHEDPOLICY="deny  " ;				;;
	*)	FLUSHEDPOLICY=accept									;;
	esac

	case $ECHOCOMMAND in
	ipfwadm|IPFWADM)	ECHOCOMMAND="ipfwadm"					;;
	ipchains|IPCHAINS)	ECHOCOMMAND="ipchains"					;;
	no|NO|none|NONE)	ECHOCOMMAND="none"						;;
	*)	if [ -f /proc/net/ip_fwchains ]; then		ECHOCOMMAND="ipchains"
		elif [ -f /proc/net/ip_input ]; then		ECHOCOMMAND="ipfwadm"
		else										ECHOCOMMAND="ipchains"			#Set default here
		fi														;;
	esac

	case $DOCOMMAND in
	ipfwadm|IPFWADM)
		DOCOMMAND="ipfwadm"
		if [ ! -f /proc/net/ip_input ]; then
			echo WARNING! User has requested ipfwadm, but it appears to be >/dev/stderr
			echo unavailable.  Proceeding, but this is not likely to work. >/dev/stderr
		fi
		if [ ! -x /sbin/ipfwadm ]; then
			echo WARNING! User has requested ipfwadm, but /sbin/ipfwadm is not >/dev/stderr
			echo executable.  Proceeding, but this is not likely to work. >/dev/stderr
		fi														;;
	ipchains|IPCHAINS)
		DOCOMMAND="ipchains"
		if [ ! -f /proc/net/ip_fwchains ]; then
			echo WARNING! User has requested ipchains, but it appears to be >/dev/stderr
			echo unavailable.  Proceeding, but this is not likely to work. >/dev/stderr
		fi
		if [ ! -x /sbin/ipchains ]; then
			echo WARNING! User has requested ipchains, but /sbin/ipchains is not >/dev/stderr
			echo executable.  Proceeding, but this is not likely to work. >/dev/stderr
		fi														;;
	no|NO|none|NONE)	DOCOMMAND="none"						;;
	*)
		if [ -f /proc/net/ip_fwchains ]; then
			DOCOMMAND="ipchains"
			if [ ! -x /sbin/ipchains ]; then
				echo WARNING! This kernel uses ipchains, but /sbin/ipchains is not >/dev/stderr
				echo executable.  Proceeding, but this is not likely to work. >/dev/stderr
				echo Please get a copy of the ipchains binary and place it in /sbin . >/dev/stderr
			fi
		elif [ -f /proc/net/ip_input ]; then
			DOCOMMAND="ipfwadm"
			if [ ! -x /sbin/ipfwadm ]; then
				echo WARNING! This kernel uses ipfwadm, but /sbin/ipfwadm is not >/dev/stderr
				echo executable.  Proceeding, but this is not likely to work. >/dev/stderr
				echo Please get a copy of the ipfwadm binary and place it in /sbin . >/dev/stderr
			fi
		else
			DOCOMMAND="none"				#Well, we can't _do_ either!
			echo WARNING! Neither ipchains nor ipfwadm appears to be >/dev/stderr
			echo unavailable.  Proceeding anyways. >/dev/stderr
		fi														;;
	esac

	case $HEARTBEAT in
	YES|yes|TRUE|true)					HEARTBEAT="YES"			;;
	NO|no|NONE|none|FALSE|false)		HEARTBEAT="NO"			;;
	*)									HEARTBEAT="YES"			;;
	esac

	case $IPCONV in
	HOSTNAME|hostname|HOST|host)		IPCONV="HOST"			;;
	NETWORK|network|NET|net)			IPCONV="NETWORK"		;;
	NO|no|NONE|none)					IPCONV="NONE"			;;
	#CUSTOM|custom)						IPCONV="CUSTOM"			;;
	*)									IPCONV="NETWORK"		;;
	esac

	case $HOSTLOOKUP in
	NO|no|NONE|none)					HOSTLOOKUP="NONE"		;;
	FILES|files|FILESONLY|filesonly)	HOSTLOOKUP="FILESONLY"	;;
	FULL|full|YES|yes)					HOSTLOOKUP="FULL"		;;
	*)									HOSTLOOKUP="FULL"		;;
	esac

	DOBEEP=${DOBEEP:-"YES"}	# "YES" = beep at user with new rule, "NO" = dont

	PORT_MASQ_BEGIN=${PORT_MASQ_BEGIN:-61000}
	PORT_MASQ_END=${PORT_MASQ_END:-65096}
	TRACEROUTE_BEGIN=${TRACEROUTE_BEGIN:-33434}
	TRACEROUTE_END=${TRACEROUTE_END:-33524}
	IRC_BEGIN=${IRC_BEGIN:-6666}
	IRC_END=${IRC_END:-6671}

	MAXDISPLAYS=${MAXDISPLAYS:-6}

	X_BEGIN=${X_BEGIN:-6000}
	X_END=${X_END:-$[ $X_BEGIN + $MAXDISPLAYS -1 ]}
	OPENWIN_BEGIN=${OPENWIN_BEGIN:-2000}
	OPENWIN_END=${OPENWIN_END:-$[ $OPENWIN_BEGIN + $MAXDISPLAYS -1 ]}
	VNCJAVA_BEGIN=${VNCJAVA_BEGIN:-5800}
	VNCJAVA_END=${VNCJAVA_END:-$[ $VNCJAVA_BEGIN + $MAXDISPLAYS -1 ]}
	VNC_BEGIN=${VNC_BEGIN:-5900}
	VNC_END=${VNC_END:-$[ $VNC_BEGIN + $MAXDISPLAYS -1 ]}

	SSP=${SSP:-""}
	SCP=${SCP:-""}

	LOWSSHPORT=${LOWSSHPORT:-"1010"}
}


