#!/sbin/sh
#
# ident	"@(#)ipfilter	1.8	07/03/20 SMI"
#
# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

. /lib/svc/share/smf_include.sh

PATH=${PATH}:/usr/sbin:/usr/lib/ipf
PIDFILE=/var/run/ipmon.pid
IPFILCONF=/etc/ipf/ipf.conf
IP6FILCONF=/etc/ipf/ipf6.conf
IPNATCONF=/etc/ipf/ipnat.conf
IPPOOLCONF=/etc/ipf/ippool.conf
PFILCHECKED=no

zone=`/sbin/zonename`
ipfid=`/usr/sbin/modinfo 2>&1 | awk '/ipf/ { print $1 } ' - 2>/dev/null`
if [ -f $PIDFILE ] ; then
	pid=`cat $PIDFILE 2>/dev/null`
else
	pid=`pgrep -z $zone ipmon`
fi

logmsg()
{
	logger -p daemon.warning -t ipfilter "$1"
	echo "$1" >&2
}

load_ipf() {
	bad=0
	if [ -r ${IPFILCONF} ]; then
		ipf -IFa -f ${IPFILCONF} >/dev/null
		if [ $? != 0 ]; then
			echo "$0: load of ${IPFILCONF} into alternate set failed"
			bad=1
		fi
	fi
	if [ -r ${IP6FILCONF} ]; then
		ipf -6IFa -f ${IP6FILCONF} >/dev/null
		if [ $? != 0 ]; then
			echo "$0: load of ${IP6FILCONF} into alternate set failed"
			bad=1
		fi
	fi
	if [ $bad -eq 0 ] ; then
		ipf -s -y >/dev/null
		return 0
	else
		echo "Not switching config due to load error."
		return 1
	fi
}


load_ipnat() {
	if [ -r ${IPNATCONF} ]; then
		ipnat -CF -f ${IPNATCONF} >/dev/null
		if [ $? != 0 ]; then
			echo "$0: load of ${IPNATCONF} failed"
			return 1
		else
			ipf -y >/dev/null
			return 0
		fi
	else
		return 0
	fi
}


load_ippool() {
	if [ -r ${IPPOOLCONF} ]; then
		ippool -F >/dev/null
		ippool -f ${IPPOOLCONF} >/dev/null
		if [ $? != 0 ]; then
			echo "$0: load of ${IPPOOLCONF} failed"
			return 1
		else
			return 0
		fi
	else
		return 0	
	fi
}


case "$1" in
	start)
		[ ! -f ${IPFILCONF} ] && exit 0
		ipf -E
		[ -n "$pid" ] && kill -TERM $pid 2>/dev/null
		if load_ippool && load_ipf && load_ipnat ; then
			/usr/sbin/ipmon -Ds
		else
			exit $SMF_EXIT_ERR_CONFIG
		fi
		;;

	stop)
		ipf -D;
		[ -n "$pid" ] && kill -TERM $pid
		[ -n "$ipfid" ] && modunload -i $ipfid
		;;

	pause)
		ipfs -l
		ipfs -NS -w
		ipf -D
		if [ -f $PIDFILE ] ; then
			if kill -0 $pid; then
				kill -TERM $pid
			else    
				cp /dev/null $PIDFILE
			fi
		fi      
		;;

	resume)
		ipf -E
		ipfs -R
		load_ippool
		load_ipf
		load_ipnat
		if [ -f $PIDFILE -a -n "$pid" ] ; then
			/usr/sbin/ipmon -Ds
		fi
		;;

	reload)
		load_ippool
		load_ipf
		load_ipnat
		;;

	reipf)
		load_ipf
		;;

	reipnat)
		load_ipnat
		;;

	*)
		echo "Usage: $0 \c" >&2
		echo "(start|stop|reload|reipf|reipnat|pause|resume)" >&2
		exit 1
		;;

esac
exit $SMF_EXIT_OK
