## -*- mode: shell-script; -*-
##
## To be able to make changes to the part of configuration created
## from this configlet you need to copy this file to the directory
## fwbuilder/configlets/sveasoft/ in your home directory and modify it.
## Double "##" comments are removed during processing but single "#"
## comments are be retained and appear in the generated script. Empty
## lines are removed as well.
##
## Configlets support simple macro language with these constructs:
## {{$var}} is variable expansion
## {{if var}} is conditional operator.
##
## This configlet defines commands executed when iptables script is ran
## with command line argument "status". Exit codes are defined in
## http://refspecs.freestandards.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html
## Script should return with exit code 0 if iptables rules are loaded and
## 3 otherwise.
##
## The question can only be answered approximately: nothing in the kernel
## says which script installed the rules that are there.  So each branch
## below asks for something this script installs and nothing else does.
##
## Both address families are asked, because a firewall may have rules for
## only one of them, and a "status" that reads the wrong family answers
## about a table the script never fills.

status_action() {
{{if coexistence_v4}}
    # Coexistence mode: check for FirewallFabrik's own prefixed chains.
    # Counting all chains would give false positives when Docker,
    # CrowdSec or fail2ban create their own chains.
    $IPTABLES {{$opt_wait}} -S 2>/dev/null | grep -q -- "^-N {{$table_name}}_" && {
        echo "Firewall is active"
        return 0
    }
{{endif}}
{{if coexistence_v6}}
    $IP6TABLES {{$opt_wait}} -S 2>/dev/null | grep -q -- "^-N {{$table_name}}_" && {
        echo "Firewall is active"
        return 0
    }
{{endif}}
{{if flush_v4}}
    # Full-flush mode: the script owns the filter table, so any rule or
    # chain in it is one this script put there.  Counting user-defined
    # chains alone would call an active firewall inactive: a policy
    # without logging, negation or a branch needs no chain of its own,
    # which is the ordinary case rather than a rare one.
    $IPTABLES {{$opt_wait}} -S 2>/dev/null | grep -qE '^-(A|N) ' && {
        echo "Firewall is active"
        return 0
    }
{{endif}}
{{if flush_v6}}
    $IP6TABLES {{$opt_wait}} -S 2>/dev/null | grep -qE '^-(A|N) ' && {
        echo "Firewall is active"
        return 0
    }
{{endif}}
    echo "Firewall is not configured"
    exit 3
}
