#!/bin/bash
#Copyright 2003 William Stearns <wstearns@pobox.com>
#Released under the GPL.

Me='macchk'
MyVersion='0.4.0'
DefaultActions='LOG'

[ -r /etc/modwall/modwall.conf ] &&			. /etc/modwall/modwall.conf
[ -r /etc/modwall/$Me.conf ] &&				. /etc/modwall/$Me.conf
[ -r ${MWLibDir:-'/usr/lib/modwall/'}/modwalllib ] &&	. ${MWLibDir:-'/usr/lib/modwall/'}/modwalllib
if [ -z "$MWLibVer" ]; then
	echo 'It looks like modwalllib was not loaded, why?  Exiting' >&2
	exit 1
fi

for OneTask in $Tasks ; do
	case "$OneTask" in
	link)
		$IptablesBin -N $Me >/dev/null 2>&1
		$IptablesBin $AppIn INPUT -i \! lo						-j $Me
		$IptablesBin $AppIn FORWARD							-j $Me
		#$IptablesBin $AppIn OUTPUT							-j $Me
		;;
	unlink)
		$IptablesBin -D INPUT -i \! lo							-j $Me
		$IptablesBin -D FORWARD								-j $Me
		#$IptablesBin -D OUTPUT								-j $Me
		$IptablesBin -X $Me >/dev/null 2>&1
		;;
	create)
		echo "Starting $Me" >&2
		FlushOrNewChain $Me

		if [ -z "${LegalMacs[0]}" ]; then
			echo 'No legal mac addresses have been configured.  Please populate' >&2
			echo 'the LegalMacs array in /etc/modwall/modwall.conf .' >&2
		else
			#Avoid problems with DHCP requests.
			$IptablesBin -A $Me -s 0.0.0.0/32					-j RETURN

			MacIndex=0
			while [ -n "${NeverCheckMac[$MacIndex]}" ]; do
				$IptablesBin -A $Me ${NeverCheckMac[$MacIndex]}			-j RETURN
				MacIndex=$[$MacIndex + 1]				
			done

			MacIndex=0
			while [ -n "${LegalMacs[$MacIndex]}" ]; do
				set -- ${LegalMacs[$MacIndex]}
				#Now IP is in $1, Mac is in $2, Interface in $3
				$IptablesBin -A $Me -s $1 -m mac --mac-source $2 -i $3		-j RETURN
				MacIndex=$[$MacIndex + 1]
			done

			MacIndex=0
			while [ -n "${LegalMacs[$MacIndex]}" ]; do
				set -- ${LegalMacs[$MacIndex]}
				LogAs="BadMacOrIf_$1"	$Ipt -A $Me -s $1			$Tail
				MacIndex=$[$MacIndex + 1]
			done

			MacIndex=0
			while [ -n "${LegalMacs[$MacIndex]}" ]; do
				set -- ${LegalMacs[$MacIndex]}
				LogAs='BadIPFromMac'	$Ipt -A $Me -m mac --mac-source $2	$Tail
				MacIndex=$[$MacIndex + 1]
			done

			LogAs='UnknownIPInMacchk' $Ipt -A $Me					$Tail
		fi
		;;
	destroy)
		echo "Stopping $Me" >&2
		DestroyChain $Me
		;;
	renamechain)
		TempChain="$Me-$RANDOM"
		echo "Replacing existing rules in $Me with new rules" >&2
		$IptablesBin -E $Me $TempChain
		;;
	replacelinks)
		if [ -z "$TempChain" ]; then
			echo "No temporary chain to relink in $Me replacelinks, replace operation incomplete." >&2
		elif ! $IptablesBin -L $Me -n >/dev/null 2>&1 ; then
			echo "No $Me chain in $Me, replace operation incomplete." >&2
		elif ! $IptablesBin -L $TempChain -n >/dev/null 2>&1 ; then
			echo "No $TempChain chain in $Me, replace operation incomplete." >&2
		elif [ "`$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
			echo "Too few/many references to $TempChain in INPUT in $Me replacelinks, replace operation incomplete." >&2
		elif [ "`$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
			echo "Too few/many references to $TempChain in FORWARD in $Me replacelinks, replace operation incomplete." >&2
		#elif [ "`$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | wc -l`" -ne 1 ]; then
		#	echo "Too few/many references to $TempChain in OUTPUT in $Me replacelinks, replace operation incomplete." >&2
		else
			$IptablesBin -R INPUT `$IptablesBin -L INPUT -n --line-numbers | grep $TempChain | awk '{print $1}'` -i \! lo		-j $Me
			$IptablesBin -R FORWARD `$IptablesBin -L FORWARD -n --line-numbers | grep $TempChain | awk '{print $1}'`		-j $Me
			#$IptablesBin -R OUTPUT `$IptablesBin -L OUTPUT -n --line-numbers | grep $TempChain | awk '{print $1}'`			-j $Me
			DestroyChain $TempChain
			unset TempChain
		fi
		;;
	status)
		if $IptablesBin -L $Me -n >/dev/null 2>&1 ; then
			echo "$Me created" >&2
		else
			echo "$Me destroyed" >&2
		fi
		;;
	version)
		echo "$Me $MyVersion, modwalllib $MWLibVer" >&2
		;;
	help)
		DefaultHelp
		cat <<EOTEXT >&2
	The $Me module checks for valid IP address/Mac address/Interface
triplets.  You will need to fill in the LegalMacs and NeverCheckMac
arrays in /etc/modwall/modwall.conf for this to be functional.
	Not good for DHCP environments where IP addresses change (where
there are too few addresses for the machines that need them).
EOTEXT
		;;
	*)
		echo "Unknown action $Action in $Me, no action taken." >&2
		;;
	esac
done