#!/usr/bin/perl
# Make sure the user knows what we're doing
print "This script firewall adds rules to allow the services required by a web hosting server.\n";
print "Proceed? (y/n) ";
$input = <STDIN>; 
chop $input;
if ($input =~ /^y$/i ) { $install_p = 1; }
elsif ( $input =~ /^n$/i ) { exit 0; }
else { print "Unrecognized input.  Exiting.\n"; exit 0; };
# Setup Webmin environment
$no_acl_check++;
$ENV{'WEBMIN_CONFIG'} ||= "/etc/webmin";
$ENV{'WEBMIN_VAR'} ||= "/var/webmin";
$ENV{'MINISERV_CONFIG'} = $ENV{'WEBMIN_CONFIG'}."/miniserv.conf";
open(CONF, "$ENV{'WEBMIN_CONFIG'}/miniserv.conf") || die "Failed to open miniserv.conf";
while(<CONF>) {
	if (/^root=(.*)/) {
		$root = $1;
		}
	}
close(CONF);
$root ||= "/usr/libexec/webmin";
chdir($root);
$0 = "$root/virtualmin_base.pl";
require './web-lib.pl';
&init_config();

if ( $install_p == "1" ) {
@tcpports = qw(ssh smtp domain ftp ftp-data pop3 pop3s imap imaps http 10000 20000 1024:65535);
@udpports = qw(domain ftp ftp-data);
print "Configuring firewall rules\n";
# Do one thing for SUSE (Why, oh, why SUSE!?  Doing something oddball when there's 
# a good and standard solution that everyone else uses is just stupid.)
$fn="/etc/sysconfig/SuSEfirewall2";
if ( -e "$fn" ) {
  $susefirewall = read_file_lines($fn) or die "Failed to open $fn!";
  for($i=0; $i<@$susefirewall; $i++) {
    if ( $susefirewall->[$i] =~ m/^FW_SERVICES_EXT_TCP.*/ ) {
      foreach (@tcpports) {
        unless ( $susefirewall->[$i] =~ m/$_/ ) {
				  print "  Allowing TCP port: $_\n";
          if ( $susefirewall->[$i]=~m/^FW_SERVICES_EXT_TCP=""$/ ) {
            $susefirewall->[$i]="FW_SERVICES_EXT_TCP=\"$_\"";
          } else {
            $susefirewall->[$i]=~s/^FW_SERVICES_EXT_TCP="(.*)"$/FW_SERVICES_EXT_TCP="$1 $_"/;
          }
        }
      }
    } elsif ( $susefirewall->[$i] =~ m/^FW_SERVICES_EXT_UDP.*/ ) {
      foreach (@udpports) {
        unless ( $susefirewall->[$i] =~ m/$_/ ) {
          print "  Allowing UDP port: $_\n";
          if ( $susefirewall->[$i]=~m/^FW_SERVICES_EXT_UDP=""$/ ) {
            $susefirewall->[$i]="FW_SERVICES_EXT_UDP=\"$_\"";
          } else {
            $susefirewall->[$i]=~s/^FW_SERVICES_EXT_UDP="(.*)"$/FW_SERVICES_EXT_UDP="$1 $_"/;
          }
        }
      }
    }
  }
  flush_file_lines($fn);

# And another thing (the Right Thing) for RHEL/CentOS/Fedora/Mandriva/Debian/Ubuntu
} else {
  &foreign_require("firewall", "firewall-lib.pl");
  @tables = &firewall::get_iptables_save();
  ($filter) = grep { $_->{'name'} eq 'filter' } @tables;
  foreach ( @tcpports ) {
	  print "  Allowing traffic on TCP port: $_\n";
    $newrule = { 'chain' => 'INPUT',
               'm' => [ [ '', 'tcp' ] ],
               'p' => [ [ '', 'tcp' ] ],
               'dport' => [ [ '', $_ ] ],
               'j' => [ [ '', 'ACCEPT' ] ],
               };
    splice(@{$filter->{'rules'}}, 0, 0, $newrule);
  }
  foreach ( @udpports ) {
    print "  Allowing traffic on UDP port: $_\n";
    $newrule = { 'chain' => 'INPUT',
               'm' => [ [ '', 'udp' ] ],
               'p' => [ [ '', 'udp' ] ],
               'dport' => [ [ '', $_ ] ],
               'j' => [ [ '', 'ACCEPT' ] ],
               };
    splice(@{$filter->{'rules'}}, 0, 0, $newrule);
  }
  &firewall::save_table($filter);
  &firewall::apply_configuration();
}

}
