#!/bin/bash

PATH=/usr/sbin:/sbin:/bin:/usr/bin:/root/bin

logger -t firewall "running firewall block script for $*"

if [ -f /etc/default/firewall ]; then
   source /etc/default/firewall
fi

if [ -z "$TRAVELCOUNTRIES" ]; then TRAVELCOUNTRIES="AT|DE|NO|SE"; fi
if [ -z "$EXCEPTIONS" ]; then EXCEPTIONS="192.168.1|192.168.9"; fi


usage () {
   echo "blockip [ -f ] IP"
   echo "blockip -h"
   echo "     blocks IP; -f for no exceptions"
#    echo "unblockip IP"
#    echo "unblockip -h"
#    echo "     unblocks IP"
}

########### START SCRIPT ###########################################################
#

if [ "$1" = "" ]; then 
    usage
    exit 0
fi

if [ "$1" = "-f" ]; then
  FORCE=yes
  shift
else
  FORCE=no
fi

echo "`basename $0 not yet implemented`"
exit 0
############################################################################################
############################################################################################

IP=$1

if [ -d /run ]; then 
  FWLOCK=/run/firewall.lock
  SYNCD=/run
else
  FWLOCK=/tmp/firewall.lock
  SYNCD=/tmp
fi

sync $SYNCD
while [ -f $FWLOCK ]; do
   echo "firewall locked with $FWLOCK; sleeping..."
   sleep 1
   sync $FWLOCK
done
touch $FWLOCK

    echo "======== Blocking $IP"
    if [ "`iptables -L -n -v | grep DROP | egrep "\b$IP\b" | grep 999@ | wc -l`" != "0" ]; then
       echo "$1 already blocked. Done nothing. "
       iptables -L -n -v | egrep "\b$IP\b|Chain|pkts"
       # iptables -L INPUT -n -v | grep $1
    elif [ "$FORCE" = "yes" ]; then
       _realblock $IP
    elif [ `echo $IP | egrep "$EXCEPTIONS" | wc -l` != 0 ]; then
       echo "$IP contained in exceptions; not blocking"
       # ipdiag $IP
#     elif [ `geoiplookup $IP | egrep "$TRAVELCOUNTRIES" | wc -l` != 0 ]; then
#        echo "$IP is from a travelcountry $TRAVELCOUNTRIES ; not blocking"
#        echo "$IP: `geoiplookup $IP`"
#        ipdiag $IP
    else

       _realblock $IP

       # IPG="`echo $IP | sed '1,$ s/\./\\\./g'`"
       # echo "Checking whether $IP was used for tor..."
       # # N=`zzcat /home/lx/rlog/root/var/log/kern.info* | pv | grep $IPG | grep rtor | wc -l`
       # N=`zzcat /home/lx/rtor/root/var/log/tor/log* | pv | grep -v 'TLS error while handshaking' | grep $IPG | wc -l`
       # if [ $N != 0 ]; then
       # echo "$IP used for tor entry $N times; unblocking"
       echo "OK. $IP was blocked"
   fi

rm $FWLOCK 2> /dev/null
