#!/bin/bash
set -e

PIDFILE=/var/run/qubes/qubes_firewall.pid
XENSTORE_IPTABLES=qubes_iptables
XENSTORE_IPTABLES_HEADER=qubes_iptables_header
XENSTORE_ERROR=qubes_iptables_error
OLD_RULES=""
# PIDfile handling
[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
echo $$ >$PIDFILE

trap 'exit 0' SIGTERM

while true; do

	echo "1" > /proc/sys/net/ipv4/ip_forward

	# Wait for changes in xenstore file
	/usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES
	TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)

	if ! [ "$TRIGGER" = "reload" ]; then continue ; fi

	# Disable forarding to prevent potential "leaks" that might
	# be bypassing the firewall or some proxy service (e.g. tor)
	# during the time when the rules are being (re)applied
	echo "0" > /proc/sys/net/ipv4/ip_forward

	RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER)
	IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
	OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || true`

	for i in $(xenstore-list qubes_iptables_domainrules) ; do 
		RULES=$(/usr/bin/xenstore-read qubes_iptables_domainrules/"$i")
		ERRS=`echo -e "$RULES" | /sbin/iptables-restore -n 2>&1 || true`
		OUT="$OUT$ERRS"
	done		
	/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
	if [ "$OUT" ]; then
		DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
	fi

	# Check if user didn't define some custom rules to be applied as well...
	[ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script
done