#! /bin/bash
#     The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
#
#     This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
#     (c) 2012 - Tom Eastep (teastep@shorewall.net)
#
#       On most distributions, this file should be called /etc/init.d/shorewall.
#
#       Complete documentation is available at http://shorewall.net
#
#       This program is free software; you can redistribute it and/or modify
#       it under the terms of Version 2 of the GNU General Public License
#       as published by the Free Software Foundation.
#
#       This program is distributed in the hope that it will be useful,
#       but WITHOUT ANY WARRANTY; without even the implied warranty of
#       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#       GNU General Public License for more details.
#
#       You should have received a copy of the GNU General Public License
#       along with this program; if not, write to the Free Software
#       Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#########################################################################################
if [ -f ./.shorewallrc ]; then
    . ./.shorewallrc || exit 1
elif [ -f ~/.shorewallrc ]; then
    . ~/.shorewallrc || exit 1
elif [ -r /root/.shorewallrc ]; then
    . /root/.shorewallrc || exit 1
elif [ -r /.shorewallrc ]; then
    . /root/.shorewallrc || exit 1
elif - -f ${SHOREWALLRC_HOME}/.shorewallrc; then
    . ${SHOREWALLRC_HOME}/.shorewallrc || exit 1
else
    VARDIR=/var/lib
    LIBEXECDIR=/usr/share
    SYSCONFDIR=/etc/sysconfig
fi

# check if shorewall-init is configured or not
if [ -f "$SYSCONFDIR/shorewall-init" ]; then
    . $SYSCONFDIR/shorewall-init
    if [ -z "$PRODUCTS" ]; then
        echo "ERROR: No products configured" >&2
	exit 1
    fi
else
    echo "ERROR: /etc/sysconfig/shorewall-init not found" >&2
    exit 1
fi

# Initialize the firewall
shorewall_start () {
  local PRODUCT
  local VARDIR

  echo -n "Initializing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      if [ -x ${VARDIR}/firewall ]; then
	  if ! /sbin/$PRODUCT status > /dev/null 2>&1; then
	      ${VARDIR}/firewall stop || exit 1
	  fi
      fi
  done

  if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
      ipset -R < "$SAVE_IPSETS"
  fi

  return 0
}

# Clear the firewall
shorewall_stop () {
  local PRODUCT
  local VARDIR

  echo -n "Clearing \"Shorewall-based firewalls\": "
  for PRODUCT in $PRODUCTS; do
      VARDIR=/var/lib/$PRODUCT
      [ -f /etc/$PRODUCT/vardir ] && . /etc/$PRODUCT/vardir 
      if [ -x ${VARDIR}/firewall ]; then
	  ${VARDIR}/firewall clear || exit 1
      fi
  done

  if [ -n "$SAVE_IPSETS" ]; then
      mkdir -p $(dirname "$SAVE_IPSETS")
      if ipset -S > "${SAVE_IPSETS}.tmp"; then
	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
      fi
  fi

  return 0
}

case "$1" in
  start)
     shorewall_start
     ;;
  stop)
     shorewall_stop
     ;;
  *)
     echo "Usage: $0 {start|stop}"
     exit 1
esac

exit 0