#
# Setup Firewall
#

# Load utility functions
. ./functions.sh

if [ "$ENABLE_IPTABLES" = true ] ; then
  # Create iptables configuration directory
  mkdir -p "${ETC_DIR}/iptables"
  
  if [ "$KERNEL_NF" = false ] ; then
    # iptables-save and -restore are slaves of iptables and thus are set accordingly
    chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy    
  fi
  
  # Install iptables systemd service
  install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"

  # Install flush-table script called by iptables service
  install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"

  # Install iptables rule file
  install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"

  # Reload systemd configuration and enable iptables service
  chroot_exec systemctl daemon-reload
  chroot_exec systemctl enable iptables.service

  if [ "$ENABLE_IPV6" = true ] ; then
    if [ "$KERNEL_NF" = false ] ; then
      # iptables-save and -restore are slaves of iptables and thus are set accordingly
      chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy 
	fi

    # Install ip6tables systemd service
    install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"

    # Install ip6tables file
    install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"

    install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"

    # Reload systemd configuration and enable iptables service
    chroot_exec systemctl daemon-reload
    chroot_exec systemctl enable ip6tables.service
  fi
  
  if [ "$ENABLE_SSHD" = false ] ; then
   # Remove SSHD related iptables rules
   sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
   sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
  fi
fi