#!/bin/sh
# Copyright (c) 1997-now, NeoNova BV, The Netherlands. All rights Reserved.
#
# This software is the copyrighted work of NeoNova BV.
# Use of the software is subject to the general business terms and conditions of NeoNova BV
# and its related transaction documents like license sheets or other written notices.#
# Any reproduction or redistribution of the software not in accordance with the license terms
# is expressly prohibited by law, and may result in severe civil and criminally penalties.
# Violators will be prosecuted to the maximum extent possible.


#set -x

#------------------------------------------------------------------------------
# tmp files.
#------------------------------------------------------------------------------
IFCONFIG=/tmp/setup_firewall-ifconfig.$$
ROUTE=/tmp/setup_firewall-route.$$
TMPROUTE=/tmp/setup_firewall-route.tmp.$$

#------------------------------------------------------------------------------
# Locations of files setup by create.config
#------------------------------------------------------------------------------
MXHOSTSFILE=/usr/local/astium/etc/firewall/allowed_mx_hosts
INTERNALMAILSERVERFILE=/usr/local/astium/etc/firewall/internal_mail_server
DEMILITARIZEDZONEFILE=/usr/local/astium/etc/firewall/demilitarized_zone
NEONOVAFIREWALL="217.170.32.40 174.143.242.224 173.230.141.160"				# EXPORTED
NEONOVANET="192.168.170.0/255.255.255.0"						# EXPORTED
NEONOVADMZ="217.170.32.96/255.255.255.224"						# EXPORTED
NEONOVABB="217.170.32.99/255.255.255.255"						# EXPORTED

#------------------------------------------------------------------------------
# save ifconfig and route-n output for later reuse
#------------------------------------------------------------------------------
/sbin/ifconfig > $IFCONFIG
/sbin/route -n > $ROUTE

#------------------------------------------------------------------------------
# All interfaces without aliases and without lo
#------------------------------------------------------------------------------
INTERFACES=`cat $IFCONFIG|grep Link|grep -v inet6|awk '{ print $1; }'|grep -v lo|grep -v :`  # EXPORTED

#------------------------------------------------------------------------------
# Extract the ipaliases.
#------------------------------------------------------------------------------
IP_ALIASES=`/usr/local/astium/sbin/ipaliases | grep : | cut -f2 -d'#'|sort` # EXPORTED

#------------------------------------------------------------------------------
# EXPORTED: external interface name
#------------------------------------------------------------------------------
INTF_EXTERNAL=`grep ^0.0.0.0 $ROUTE | head -1 | awk '{ print $8; }'`			# EXPORTED
if [ -z "$INTF_EXTERNAL" ]
then
  INTF_EXTERNAL="none"
fi
IP_INTF_EXTERNAL=`/sbin/ifconfig $INTF_EXTERNAL|grep addr:|sed -e s/.*addr:// -e 's/ .*//'`
NET_EXTERNAL=`grep $INTF_EXTERNAL $ROUTE | grep -v ^0.0.0.0 | awk '{ printf("%s/%s\n", $1, $3); }'| sort -u`	# EXPORTED

#------------------------------------------------------------------------------
# determine the MX hosts we accept mail from
#------------------------------------------------------------------------------
if [ -f $MXHOSTSFILE ]
then
  ALLOWEDMXHOSTS=`grep -v '^#' $MXHOSTSFILE`
else
  ALLOWEDMXHOSTS=""
fi

#------------------------------------------------------------------------------
# Determine if we have a DMZ
#------------------------------------------------------------------------------
if [ -f $DEMILITARIZEDZONEFILE ]
then
  HAVE_DMZ=yes										# EXPORTED
  NET_DMZ=`grep -v '^#' $DEMILITARIZEDZONEFILE`
  if [ "$NET_DMZ" != "" ]
  then 
    TMP=`echo $NET_DMZ | cut -d/ -f1`
    INTF_DMZ=`grep $TMP $ROUTE | head -1 | awk '{ print $8; }'`				# EXPORTED
    if [ "$INTF_DMZ" != "" ]
    then 
      IP_INTF_DMZ=`/sbin/ifconfig $INTF_DMZ|grep addr:|sed -e s/.*addr:// -e 's/ .*//'`
      if [ "$IP_INTF_DMZ" != "" ]
      then 
        NET_DMZ=`route -n | grep $INTF_DMZ | awk '{ printf("%s/%s\n", $1, $3); }'| sort -u`	# EXPORTED
      else
        echo "can't find network for $INTF_DMZ"
      fi
    else
      echo "can't find interface for $NET_DMZ"
    fi
  else
    echo "nothing found in $DEMILITARIZEDZONEFILE"
  fi
fi
if [ "$NET_DMZ" != "" ]
then
  HAVE_DMZ=yes										# EXPORTED
else
  HAVE_DMZ=no										# EXPORTED
fi

#------------------------------------------------------------------------------
# All interfaces without aliases and without lo
#------------------------------------------------------------------------------
if [ "$HAVE_DMZ" = "yes" ]
then
  INTF_INTERNAL=`cat $IFCONFIG|grep Link|grep -v inet6|awk '{ print $1 }'|grep -v lo|grep -v :| grep -v ipsec | grep -v $INTF_EXTERNAL | grep -v $INTF_DMZ`
else
  INTF_INTERNAL=`cat $IFCONFIG|grep Link|grep -v inet6|awk '{ print $1 }'|grep -v lo|grep -v :| grep -v ipsec | grep -v $INTF_EXTERNAL`
fi

#------------------------------------------------------------------------------
# Create list of the ip addresses of all internal interfaces
#------------------------------------------------------------------------------
TMP=""
for intf in $INTF_INTERNAL
do
  TMP=`/sbin/ifconfig $intf|grep addr:|sed -e s/.*addr:// -e 's/ .*//'`
  IP_INTF_INTERNAL="$TMP $IP_INTF_INTERNAL"						# EXPORTED
done

#------------------------------------------------------------------------------
# Create list of all networks on all the internal interfaces
#------------------------------------------------------------------------------
TMP=""
for intf in $INTF_INTERNAL ipsec0
do
  TMP=`grep $intf $ROUTE | awk '{ printf("%s/%s\n", $1, $3); }'| sort -u`
  for net in $TMP
  do
    if [ "$net" = "$NET_EXTERNAL" ]
    then
      continue
    fi
    NET_INTERNAL="$net $NET_INTERNAL"							# EXPORTED
  done
done

#------------------------------------------------------------------------------
# Remove our tmp file.
#------------------------------------------------------------------------------
rm -f $ROUTE $IFCONFIG

#------------------------------------------------------------------------------
# Display information.
#------------------------------------------------------------------------------
if [ "$INFOONLY" = "1" -o "$VERBOSE" = "1" ]
then
  # report findings
  echo All interfaces: $INTERFACES

  echo INTF_INTERNAL=$INTF_INTERNAL
  echo IP_INTF_INTERNAL=$IP_INTF_INTERNAL
  echo NET_INTERNAL=$NET_INTERNAL

  echo INTF_EXTERNAL=$INTF_EXTERNAL
  echo IP_INTF_EXTERNAL=$IP_INTF_EXTERNAL
  echo NET_EXTERNAL=$NET_EXTERNAL

  echo HAVE_DMZ=$HAVE_DMZ
  if [ $HAVE_DMZ = "yes" ]
  then
    echo INTF_DMZ=$INTF_DMZ
    echo IP_INTF_DMZ=$IP_INTF_DMZ
    echo NET_DMZ=$NET_DMZ
  fi
  echo IP_ALIASES=$IP_ALIASES
fi


