#!/usr/bin/bash
#
# HENCSAT Management LAN Firewall
# Copyright (C) 2018-2024 by Thomas Dreibholz
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
# Contact: dreibh@simula.no
#

CONFIGURATION="/etc/hencsat/management-lan.conf"


# ###### Activate firewall ##################################################
activate ()
{
   local iptables="$1"
   local management_network="$2"
   local icmp="$3"

   $iptables -F INPUT
   $iptables -F OUTPUT
   $iptables -P INPUT  ACCEPT
   $iptables -P OUTPUT ACCEPT

   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p $icmp           -j ACCEPT   # Allow ICMP
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p udp             -j ACCEPT   # Allow UDP
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p sctp            -j ACCEPT   # Allow SCTP
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p tcp \
      --match multiport --dport 22,4000:4499 -j ACCEPT                        # Allow TCP to port 22,4000-4499
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p tcp \
      --match multiport --sport 22,4000:4499 -j ACCEPT                        # Allow TCP from port 22,4000-4499
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE -p tcp \
      ! --source $management_network                              -j ACCEPT   # Allow TCP from the Internet
   $iptables -A INPUT -i $MANAGEMENT_INTERFACE                    -j REJECT   # Reject all other traffic over management interface

   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p $icmp          -j ACCEPT   # Allow ICMP
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p udp            -j ACCEPT   # Allow UDP
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p sctp           -j ACCEPT   # Allow SCTP
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p tcp \
      --match multiport --dport 22,4000:4499 -j ACCEPT                        # Allow TCP to port 22,4000-4499
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p tcp \
      --match multiport --sport 22,4000:4499 -j ACCEPT                        # Allow TCP from port 22,4000-4499
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE -p tcp \
      ! --destination $management_network                         -j ACCEPT   # Allow TCP to the Internet
   $iptables -A OUTPUT -o $MANAGEMENT_INTERFACE                   -j REJECT   # Reject all other traffic over management interface
}


# ###### Deactivate firewall ################################################
deactivate ()
{
   local iptables="$1"

   $iptables -F INPUT
   $iptables -F OUTPUT
   $iptables -P INPUT  ACCEPT
   $iptables -P OUTPUT ACCEPT
}



# ###### Main program #######################################################

# ====== Read configuration =================================================
if [ ! -e $CONFIGURATION ] ; then
   echo >&2 "ERROR: Configuration file $CONFIGURATION not found!"
   exit 1
fi

MANAGEMENT_INTERFACE=""
MANAGEMENT_NETWORK_IPv4=""
MANAGEMENT_NETWORK_IPv6=""
. /etc/hencsat/management-lan.conf

if [ "$MANAGEMENT_INTERFACE" == "" ] ; then
   echo >&2 "ERROR: MANAGEMENT_INTERFACE not set!"
   exit 1
fi
if [ "$MANAGEMENT_NETWORK_IPv4" == "" ] ; then
   echo >&2 "ERROR: MANAGEMENT_NETWORK_IPv4 not set!"
   exit 1
fi

# ====== Activate firewall ==================================================
if [ "$1" == "on" ] ; then
   echo "Activating Management LAN firewall ($MANAGEMENT_INTERFACE, $MANAGEMENT_NETWORK_IPv4) ..."

   activate iptables  $MANAGEMENT_NETWORK_IPv4 icmp
   if [ "$MANAGEMENT_NETWORK_IPv6" != "" ] ; then
      activate ip6tables $MANAGEMENT_NETWORK_IPv6 icmpv6
   fi

# ====== Deactivate firewall ================================================
elif [ "$1" == "off" ] ; then
   echo "Deactivating Management LAN firewall ..."

   deactivate iptables
   if [ "$MANAGEMENT_NETWORK_IPv6" != "" ] ; then
      deactivate ip6tables
   fi

# ====== Error ==============================================================
else
   echo >&2 "Usage: $0 on|off"
   exit 1
fi
