#!/bin/rc
# fwstart [cfg] - start a firewall for each card named in /lib/ndb/fw.
#
# Run this after the network is configured and before anything dials.
# fw reads each card's address from the card itself, so the addresses
# have to be there already; and a program that connects before fw is up
# is a program that was never filtered.
rfork e

cfg=/lib/ndb/fw
if(! ~ $#* 0)
	cfg=$1
if(! test -f $cfg){
	echo fwstart: no $cfg, nothing to do >[1=2]
	exit
}

# the cards named in the config
fn cards {
	awk '
		/^[ \t]*#/ { next }
		{ for(i = 1; i <= NF; i++) if($i ~ /^fw=/) print substr($i, 4) }
	' $cfg
}

# the rule file for one card
fn rulesfor {
	awk -v 'want='^$1 '
		/^[ \t]*#/ { next }
		{
			dev = ""; rules = ""
			for(i = 1; i <= NF; i++){
				if($i ~ /^fw=/) dev = substr($i, 4)
				if($i ~ /^rules=/) rules = substr($i, 7)
			}
			if(dev == want && rules != ""){ print rules; exit }
		}
	' $cfg
}

# each card gets its own control directory; mntgen makes them appear
if(! test -d /mnt/fw)
	mntgen /mnt/fw

for(name in `{cards}){
	dev=/net/$name
	rules=`{rulesfor $name}
	if(! test -e $dev)
		echo fwstart: no $dev, skipped >[1=2]
	if not if(~ $#rules 0)
		echo fwstart: no rules given for $name, skipped >[1=2]
	if not if(! test -f $rules)
		echo fwstart: $rules missing, $name skipped >[1=2]
	if not {
		fw -m /mnt/fw/$name -e $dev $rules
		if(~ $status '')
			echo fwstart: $name filtered by $rules
		if not
			echo fwstart: $name failed to start >[1=2]
	}
}