#!/bin/sh

[ -x /usr/sbin/ebtables-legacy ] || exit 1

EBTABLES_DUMPFILE_STEM=/etc/ebtables/dump

RETVAL=0
prog="ebtables"
desc="Ethernet bridge filtering"
umask 0077

#default configuration
EBTABLES_MODULES_UNLOAD="yes"
EBTABLES_LOAD_ON_START="no"
EBTABLES_SAVE_ON_STOP="no"
EBTABLES_SAVE_ON_RESTART="no"
EBTABLES_SAVE_COUNTER="no"
EBTABLES_BACKUP_SUFFIX="~"

config=/etc/default/$prog
[ -f "$config" ] && . "$config"

get_supported_tables() {
	EBTABLES_SUPPORTED_TABLES=
	/usr/sbin/ebtables-legacy -t filter -L 2>&1 1>/dev/null | grep -q permission
	if [ $? -eq 0 ]; then
		echo "Error: insufficient privileges to access the ebtables rulesets."
		exit 1
	fi
	for table in filter nat broute; do
		/usr/sbin/ebtables-legacy -t $table -L &> /dev/null
		if [ $? -eq 0 ]; then
			EBTABLES_SUPPORTED_TABLES="${EBTABLES_SUPPORTED_TABLES} $table"
		fi
	done
}

load() {
	RETVAL=0
	get_supported_tables
	echo -n "Restoring ebtables rulesets: "
	for table in $EBTABLES_SUPPORTED_TABLES; do
		echo -n "$table "
		if [ -s ${EBTABLES_DUMPFILE_STEM}.$table ]; then
			/usr/sbin/ebtables-legacy -t $table --atomic-file ${EBTABLES_DUMPFILE_STEM}.$table --atomic-commit
			RET=$?
			if [ $RET -ne 0 ]; then
				echo -n "(failed) "
				RETVAL=$RET
			fi
		else
			echo -n "(no saved state) "
		fi
	done
	if [ -z "$EBTABLES_SUPPORTED_TABLES" ]; then
		echo -n "no kernel support. "
	else
		echo -n "done. "
	fi
	if [ $RETVAL -eq 0 ]; then
		echo "ok"
	else
		echo "fail"
	fi
}

clear_rules() {
	RETVAL=0
	get_supported_tables
	echo -n "Clearing ebtables rulesets: "
	for table in $EBTABLES_SUPPORTED_TABLES; do
		echo -n "$table "
		/usr/sbin/ebtables-legacy -t $table --init-table
	done

	if [ "$EBTABLES_MODULES_UNLOAD" = "yes" ]; then
		for mod in $(grep -E '^(ebt|ebtable)_' /proc/modules | cut -d' ' -f1) ebtables; do
			rmmod $mod 2> /dev/null
		done
	fi
	if [ -z "$EBTABLES_SUPPORTED_TABLES" ]; then
		echo -n "no kernel support. "
	else
		echo -n "done. "
	fi
	if [ $RETVAL -eq 0 ]; then
		echo "ok"
	else
		echo "fail"
	fi
}

save() {
	RETVAL=0
	get_supported_tables
	echo -n "Saving ebtables rulesets: "
	for table in $EBTABLES_SUPPORTED_TABLES; do
		echo -n "$table "
		[ -n "$EBTABLES_BACKUP_SUFFIX" ] && [ -s ${EBTABLES_DUMPFILE_STEM}.$table ] && \
			mv ${EBTABLES_DUMPFILE_STEM}.$table ${EBTABLES_DUMPFILE_STEM}.$table$EBTABLES_BACKUP_SUFFIX
		/usr/sbin/ebtables-legacy -t $table --atomic-file ${EBTABLES_DUMPFILE_STEM}.$table --atomic-save
		RET=$?
		if [ $RET -ne 0 ]; then
			echo -n "(failed) "
			RETVAL=$RET
		else
			if [ "$EBTABLES_SAVE_COUNTER" = "no" ]; then
				/usr/sbin/ebtables-legacy -t $table --atomic-file ${EBTABLES_DUMPFILE_STEM}.$table -Z
			fi
		fi
	done
	if [ -z "$EBTABLES_SUPPORTED_TABLES" ]; then
		echo -n "no kernel support. "
	else
		echo -n "done. "
	fi
	if [ $RETVAL -eq 0 ]; then
		echo "ok"
	else
		echo "fail"
	fi
}

case "$1" in
	start)
		[ "$EBTABLES_LOAD_ON_START" = "yes" ] && load
		;;
	stop)
		[ "$EBTABLES_SAVE_ON_STOP" = "yes" ] && save
		clear_rules
		;;
	restart|reload|force-reload)
		[ "$EBTABLES_SAVE_ON_RESTART" = "yes" ] && save
		clear_rules
		[ "$EBTABLES_LOAD_ON_START" = "yes" ] && load
		;;
	load)
		load
		;;
	save)
		save
		;;
	status)
		get_supported_tables
		if [ -z "$EBTABLES_SUPPORTED_TABLES" ]; then
			echo "No kernel support for ebtables."
			RETVAL=1
		else
			echo -n "Ebtables support available, number of installed rules: "
			for table in $EBTABLES_SUPPORTED_TABLES; do
				COUNT=$(( $(/usr/sbin/ebtables-legacy -t $table -L | sed -e "/^Bridge chain/! d" -e "s/^.*entries: //" -e "s/,.*$/ +/") 0 ))
				echo -n "$table($COUNT) "
			done
			echo ok
			RETVAL=0
		fi
		;;
	*)
		echo "Usage: $0 {start|stop|restart|reload|force-reload|load|save|status}" >&2
		RETVAL=1
esac

exit $RETVAL