#!/bin/rc
# fwstart [cfg] - start a firewall for each card named in /lib/ndb/fw.
#
# Run this after the network is configured and before anything dials.
# fw reads each card's address from the card itself, so the addresses
# have to be there already; and a program that connects before fw is up
# is a program that was never filtered.
rfork e

cfg=/lib/ndb/fw
if(! ~ $#* 0)
	cfg=$1
if(! test -f $cfg){
	echo fwstart: no $cfg, nothing to do >[1=2]
	exit
}

# the cards named in the config
fn cards {
	awk '
		/^[ \t]*#/ { next }
		{ for(i = 1; i <= NF; i++) if($i ~ /^fw=/) print substr($i, 4) }
	' $cfg
}

# the rule file for one card
fn rulesfor {
	awk -v 'want='^$1 '
		/^[ \t]*#/ { next }
		{
			dev = ""; rules = ""
			for(i = 1; i <= NF; i++){
				if($i ~ /^fw=/) dev = substr($i, 4)
				if($i ~ /^rules=/) rules = substr($i, 7)
			}
			if(dev == want && rules != ""){ print rules; exit }
		}
	' $cfg
}

# Each card gets its own control directory; mntgen makes them appear.
#
# mount(2) needs the mount point to exist, so mntgen cannot make /mnt/fw
# and this used to run it only when /mnt/fw was missing - which is the
# one case where it fails.  So the directory first, and then mntgen only
# if it is not already there: under mntgen every name exists, which is
# the test.
#
# mntgen and fw both leave a server behind, and a server started from a
# shell keeps that shell's file descriptors.  Started from the console -
# or from a serial shell, which is where this gets tried first - that
# means a daemon sitting on the console's input, which looks exactly
# like a wedged terminal.  Give them nothing to hold.
if(! test -d /mnt/fw)
	mkdir -p /mnt/fw
if(! test -d /mnt/fw/is-mntgen-here)
	mntgen /mnt/fw </dev/null >/dev/null >[2]/dev/null

for(name in `{cards}){
	dev=/net/$name
	rules=`{rulesfor $name}
	if(! test -e $dev)
		echo fwstart: no $dev, skipped >[1=2]
	if not if(~ $#rules 0)
		echo fwstart: no rules given for $name, skipped >[1=2]
	if not if(! test -f $rules)
		echo fwstart: $rules missing, $name skipped >[1=2]
	if not {
		fw -m /mnt/fw/$name -e $dev $rules </dev/null >/dev/null
		if(~ $status '')
			echo fwstart: $name filtered by $rules
		if not
			echo fwstart: $name failed to start >[1=2]
	}
}