#!/bin/sh
#
# Startup script to implement /etc/sysconfig/ip6tables pre-defined rules.
#
# chkconfig: 2345 03 92
#
# description: Automates a packet filtering firewall with ip6tables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author:	Joshua Jensen <joshua@redhat.com>
#   -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#   -- changed to ip6tables by Ben Reser <ben@reser.org>
#
# config: /etc/sysconfig/ip6tables

# Source 'em up
. /etc/init.d/functions

IPTABLES_CONFIG=/etc/sysconfig/ip6tables

if [ ! -x /sbin/ip6tables ]; then
	exit 0
fi

KERNELMAJ=`uname -r | sed                   -e 's,\..*,,'`
KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'`

if [ "$KERNELMAJ" -lt 2 ] ; then
	exit 0
fi
if [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then
	exit 0
fi



if  /sbin/lsmod 2>/dev/null |grep -q ipchains ; then
	# Don't do both
	exit 0
fi

start() {
	# don't do squat if we don't have the config file
	if [ -f $IPTABLES_CONFIG ]; then
	    # We do not need to flush/clear anything if using ip6tarbles-restore
	    echo $"Applying ip6tables firewall rules: "
	    grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' | /sbin/ip6tables-restore -c && \
		    success $"Applying ip6tables firewall rules" || \
		    failure $"Applying ip6tables firewall rules"
	    echo
	    touch /var/lock/subsys/ip6tables
	fi
}

stop() {
	chains=`cat /proc/net/ip6_tables_names 2>/dev/null`
        for i in $chains; do ip6tables -t $i -F; done && \
                success $"Flushing all chains:" || \
                failure $"Flushing all chains:"
        for i in $chains; do ip6tables -t $i -X; done && \
                success $"Removing user defined chains:" || \
                failure $"Removing user defined chains:"
        echo -n $"Resetting built-in chains to the default ACCEPT policy:"
	ip6tables -P INPUT ACCEPT && \
	   ip6tables -P OUTPUT ACCEPT && \
	   ip6tables -P FORWARD ACCEPT && \
	   success $"Resetting built-in chains to the default ACCEPT policy" || \
	   failure $"Resetting built-in chains to the default ACCEPT policy"
	echo
	rm -f /var/lock/subsys/ip6tables
}

case "$1" in
  start)
	start
	;;

  stop)
	stop
	;;

  restart|reload)
	# "restart" is really just "start" as this isn't a daemon,
	#  and "start" clears any pre-defined rules anyway.
	#  This is really only here to make those who expect it happy
	start
	;;

  condrestart)
	[ -e /var/lock/subsys/ip6tables ] && start
	;;

  status)
	chains=`cat /proc/net/ip6_tables_names 2>/dev/null`
        for i in $chains; do 
	    echo $"Table: $i"
	    ip6tables -t $i --list
	done
	;;

  panic)
	echo -n $"Changing target policies to DROP: "	
	ip6tables -P INPUT DROP && \
	    ip6tables -P FORWARD DROP && \
	    ip6tables -P OUTPUT DROP && \
	    success $"Changing target policies to DROP" || \
	    failure $"Changing target policies to DROP"
	echo
	action $"Flushing all chains:" ip6tables -F INPUT && ip6tables -F FORWARD && ip6tables -F OUTPUT
	action $"Removing user defined chains:" ip6tables -X
	;;

  save)
	echo -n "Saving current rules to $IPTABLES_CONFIG: "
	touch $IPTABLES_CONFIG
	chmod 600 $IPTABLES_CONFIG
	/sbin/ip6tables-save -c > $IPTABLES_CONFIG  2>/dev/null && \
	  success $"Saving current rules to $IPTABLES_CONFIG" || \
	  failure $"Saving current rules to $IPTABLES_CONFIG"
	echo
	;;

  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
	exit 1
esac

exit 0