1 files changed, 61 insertions, 0 deletions
diff --git a/fw/lib/fwstart b/fw/lib/fwstart
new file mode 100755
index 0000000..00b4d3a
--- /dev/null
+++ b/fw/lib/fwstart
@@ -0,0 +1,61 @@
+#!/bin/rc
+# fwstart [cfg] - start a firewall for each card named in /lib/ndb/fw.
+#
+# Run this after the network is configured and before anything dials.
+# fw reads each card's address from the card itself, so the addresses
+# have to be there already; and a program that connects before fw is up
+# is a program that was never filtered.
+rfork e
+
+cfg=/lib/ndb/fw
+if(! ~ $#* 0)
+	cfg=$1
+if(! test -f $cfg){
+	echo fwstart: no $cfg, nothing to do >[1=2]
+	exit
+}
+
+# the cards named in the config
+fn cards {
+	awk '
+		/^[ \t]*#/ { next }
+		{ for(i = 1; i <= NF; i++) if($i ~ /^fw=/) print substr($i, 4) }
+	' $cfg
+}
+
+# the rule file for one card
+fn rulesfor {
+	awk -v 'want='^$1 '
+		/^[ \t]*#/ { next }
+		{
+			dev = ""; rules = ""
+			for(i = 1; i <= NF; i++){
+				if($i ~ /^fw=/) dev = substr($i, 4)
+				if($i ~ /^rules=/) rules = substr($i, 7)
+			}
+			if(dev == want && rules != ""){ print rules; exit }
+		}
+	' $cfg
+}
+
+# each card gets its own control directory; mntgen makes them appear
+if(! test -d /mnt/fw)
+	mntgen /mnt/fw
+
+for(name in `{cards}){
+	dev=/net/$name
+	rules=`{rulesfor $name}
+	if(! test -e $dev)
+		echo fwstart: no $dev, skipped >[1=2]
+	if not if(~ $#rules 0)
+		echo fwstart: no rules given for $name, skipped >[1=2]
+	if not if(! test -f $rules)
+		echo fwstart: $rules missing, $name skipped >[1=2]
+	if not {
+		fw -m /mnt/fw/$name -e $dev $rules
+		if(~ $status '')
+			echo fwstart: $name filtered by $rules
+		if not
+			echo fwstart: $name failed to start >[1=2]
+	}
+}