#!/bin/sh

# -------------------------------------------------------
# file   : split8k.sh
# purpose: Installation script to setup firewall.
# author : Vittal.S
#
# usage  : split8k
#
# modifications:
# 09-05-08  Initial Creation .
# -------------------------------------------------------

### Constants
_SELF_="$(basename "$(readlink -e "${BASH_SOURCE[0]}")" && echo X)" && \
readonly _SELF_="${_SELF_%$'\nX'}"
_SELFDIR_="$(dirname "$(readlink -e "${BASH_SOURCE[0]}")" && echo X)" && \
readonly _SELFDIR_="${_SELFDIR_%$'\nX'}"
readonly COMMONINC="${_SELFDIR_}/common8k"

if [ -e /usr/sbin/iptables ]
then
IPTABLESPATH=/usr/sbin/
fi

### Include files
source ${COMMONINC} || exit 1
#Check if osv_version is available
OSV_VERSION=$(whereis -b osv_version.sh | awk '{ print $2 }')
if [ ! -f "$OSV_VERSION" ]; then
   logger --id $$ --priority user.warning "$0: osv_version.sh not found in \$PATH ($PATH), exiting!" >/dev/null 2>&1
   exit 1
fi

# ----------------------------------------------------------
# function: textncolor
# description:
#   sets up text in color.
# ----------------------------------------------------------

textncolor( )
{
   echo -e "${1}$2${Norm}"
}

setmode( )
{
   echo -e $1
}

# ----------------------------------------------------------
# function: logstr
# description:
#   logs string to logfile.
# ----------------------------------------------------------

logstr( )
{
   str="$*"

   if [ "$LOG8k4TOOLKIT" != "" -a -w "$LOG8k4TOOLKIT" ];
   then
      echo "`date`: $str" 1>>$LOGFILE 2>/dev/null
   else
      echo "`date`: $str"
   fi
}

# ----------------------------------------------------------------
# function: mapnafodev
# args    : none
# description:
#   In V6 or higher we have a new mapping( BO3621 ).
# ----------------------------------------------------------------

mapnafodev( ) {
   case $2 in
      bond0)
         eval ${1}=bonding_dev0
         ;;
      bond1)
         eval ${1}=bonding_dev1
         ;;
      bond2)
         eval ${1}=bonding_dev2
         ;;
      bond3)
         eval ${1}=cluster_dev
         ;;
      *)
         eval ${1}=$2
         ;;
   esac
}

#---------------------------------------------------------------
# function: xiptables
# args    : None
# description:
#   sets up security rule with check.
#---------------------------------------------------------------

xiptables( )
{
   if [ "$1" = "-D" ];
   then
      ${IPTABLESPATH}iptables $* 
      return
   fi 2>/dev/null
   ${IPTABLESPATH}iptables $*
   EXIT_CODE=$?
   if [ ${EXIT_CODE} -ne 0 ];
   then
      textncolor $BoldRed "upgrade8k : iptables command failed <iptables $*>, EXIT_CODE=${EXIT_CODE}"
      exit $FAIL
   fi
} 1>>$LOGFILE 2>&1

#---------------------------------------------------------------
# function: xip6tables
# args    : None
# description:
#   sets up IPv6 security rule with check.
#---------------------------------------------------------------

xip6tables( )
{
   if [ "$1" = "-D" ];
   then
      ${IPTABLESPATH}ip6tables $*
      return
   fi 2>/dev/null
   ${IPTABLESPATH}ip6tables $*
   if [ $? -ne 0 ];
   then
      textncolor $BoldRed "upgrade8k : ip6tables command failed <ip6tables $*>"
      exit $FAIL
   fi
} 1>>$LOGFILE 2>&1


#---------------------------------------------------------------
# function: ommstate
# args    : None
# description:
#   sets up omm state for pcm to read.
#---------------------------------------------------------------

ommstate( )
{
   if [ "$testbed" != "cluster" -o "$mynode" != "$primhost" ];
   then
      return
   fi

   omnode=$1
   omstate=$2
   chmod a+rwx /srx_share

   textncolor $BoldPurple "upgrade8k : Setting OMM state : $omstate"
   OmFile="/srx_share/OperationMode.txt"
   echo $omstate > ${OmFile}.tmp
   chown srx.$srxgroup ${OmFile}.tmp
   if [ "$omnode" = "remote" ];
   then
      scp ${OmFile}.tmp $othernode:/tmp
      ssh $othernode "mv $OmFile{.tmp,}"
      if [ $? -ne 0 ];
      then
         textncolor $BoldRed "Cannot set omm state."
         exit $FAIL
      fi
   else
      mv $OmFile{.tmp,}
   fi
}


# ---------------------------------------------------------------
# function: splitsys
# args    : None
# description:
#   splits the system in a way the two nodes cannot x-connect.
# ---------------------------------------------------------------

splitsys( )
{
   if "$OSV_VERSION" --major compare "$buildid" lt V5;
   then
      textncolor $BoldCyan "Detected shutdown managed by primecluster on $mynode."
      sdagentcmd="sdtool -e 1>/dev/null 2>&1"
   else
      if "$OSV_VERSION" --major compare "$buildid" lt V7;
      then
         textncolor $BoldCyan "Detected shutdown managed by heartbeat on $mynode."
         sdagentcmd="/etc/init.d/heartbeat stop 1>/dev/null 2>&1"
      else
         textncolor $BoldCyan "Detected shutdown managed by xcm on $mynode."
         sdagentcmd="/unisphere/srx3000/callp/bin/xcm_snd_stop 1>/dev/null 2>&1"
      fi
   fi
   echo "   - Turning off shutdown agent."
   $sdagentcmd 1>/dev/null 2>&1
   if [ $? -ne 0 ];
   then
      textncolor $BoldRed "upgrade8k: Failed to turn off shutdown agent on $mynode"
      exit $SASTOPFAILED
   fi
}

# ---------------------------------------------------------------
# function: setupfw
# args    : None
# description:
#   set up fire wall so that no one can talk to us in any interface
#   except billing.
# ---------------------------------------------------------------

setupfw( )
{
   FWMODE=$1
   ChainName=firewall
   ExtendedChainName=xchcom
   ExtendedStrictChain=allcom
   #<GetNodeSpecificDev>
      if [ "$primary" = "true" ];
      then
         nafosig="`cfgread nafo1| awk '{ print $2 }'`"
         nafoadmin="`cfgread nafo0| awk '{ print $2 }'`"
         local nafoxchan="`cfgread nafo3| awk '{ print $2 }'`"
         local nafoadmin_ip="`cfgread nafo0| awk '{ print $4 }'`"
         local nafoxchan_ip="`cfgread nafo3| awk '{ print $4 }'`"
      else
         nafosig="`cfgread nafo1| awk '{ print $3 }'`"
         nafoadmin="`cfgread nafo0| awk '{ print $3 }'`"
         local nafoxchan="`cfgread nafo3| awk '{ print $3 }'`"
         local nafoadmin_ip="`cfgread nafo0| awk '{ print $5 }'`"
         local nafoxchan_ip="`cfgread nafo3| awk '{ print $5 }'`"
      fi
      if [ "$nafosig" = "" ];
      then
         textncolor $BoldCyan "split8k:Wow. What is this system?"
         exit $FAIL
      fi
   #</GetNodeSpecificDev>

   mapnafodev nafosigtag $nafosig
   sigbondset="$nafosig `cfgread $nafosigtag`"
   #<SetupFw>
      textncolor $BoldCyan "split8k:Checking if chain for $ChainName already exist."
      ${IPTABLESPATH}iptables -L $ChainName 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
        logstr "split8k:Chain for $ChainName already exist."
        xiptables -D INPUT   -p all -j $ChainName
        xiptables -D OUTPUT  -p all -j $ChainName
        xiptables -D FORWARD -p all -j $ChainName
        xiptables -F $ChainName
        xiptables --delete-chain $ChainName
      fi
      ${IPTABLESPATH}iptables -L $ExtendedChainName 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
         logstr "split8k:Chain for $ExtendedChainName already exist."
         xiptables -D $ChainName -p all -j $ExtendedChainName
         xiptables -F $ExtendedChainName
         xiptables --delete-chain $ExtendedChainName
      fi 
      ${IPTABLESPATH}iptables -L $ExtendedStrictChain 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
         logstr "split8k:Chain for $ExtendedStrictChain already exist."
         xiptables -D INPUT   -p all -j $ExtendedStrictChain
         xiptables -D OUTPUT  -p all -j $ExtendedStrictChain
         xiptables -D FORWARD -p all -j $ExtendedStrictChain
         xiptables -F $ExtendedStrictChain
         xiptables --delete-chain $ExtendedStrictChain
      fi
      
      xiptables -N $ChainName
      xiptables -N $ExtendedChainName
      xiptables -N $ExtendedStrictChain

      xiptables -A $ExtendedChainName -s 127.0.0.1 -j ACCEPT
      xiptables -A $ExtendedChainName -s $seccip  -d $primcip -p tcp --sport 512:65535 --dport 512:65535 -j DROP
      xiptables -A $ExtendedChainName -s $primcip -d $seccip  -p tcp --sport 512:65535 --dport 512:65535 -j DROP
      xiptables -A $ExtendedChainName -s $seccip  -d $primcip -p udp --sport 512:65535 --dport 512:65535 -j DROP
      xiptables -A $ExtendedChainName -s $primcip -d $seccip  -p udp --sport 512:65535 --dport 512:65535 -j DROP
      xiptables -A $ExtendedChainName -s 0/0 -d 0/0 -p esp -j ACCEPT
      xiptables -A $ExtendedChainName -s 0/0 -d 0/0 -p ah  -j ACCEPT
      if [ "$XCHACTION" = "DROP" -a "$nafosig" = "$nafoadmin" ];
      then
         echo "split8k : Shared interface. Skipping ssh block." 1>>$LOGFILE 2>&1
      elif [ "$XCHACTION" = "DROP" -a "${nafoadmin}" = "${nafoxchan}" -a "${nafoadmin_ip}" = "${nafoxchan_ip}" ];
      then
         echo "split8k : Shared interface and same IP address (${nafoadmin_ip}) between XChannel and Admin. Skipping ssh block." 1>>$LOGFILE 2>&1
      else
         xiptables -A $ExtendedChainName -s $seccip  -d $primcip -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j $XCHACTION
         xiptables -A $ExtendedChainName -s $primcip -d $seccip  -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j $XCHACTION
         xiptables -A $ExtendedChainName -s $seccip  -d $primcip -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j $XCHACTION
         xiptables -A $ExtendedChainName -s $primcip -d $seccip  -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j $XCHACTION
      fi
      xiptables -A $ExtendedChainName -m state --state RELATED,ESTABLISHED -j ACCEPT

      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 1040      -j DROP
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p udp --dport 1040      -j DROP
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 5060:5062 -j DROP
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p udp --dport 5060:5062 -j DROP
      xiptables -A $ExtendedStrictChain -s 127.0.0.1 -j ACCEPT
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p esp -j ACCEPT
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p ah  -j ACCEPT
      xiptables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j DROP

      sshclientip=`echo $SSH_CONNECTION | awk '{ print $1 }'`
      sshserverip=`echo $SSH_CONNECTION | awk '{ print $3 }'`
      sshclientport=`echo $SSH_CONNECTION | awk '{ print $2 }'`
      sshserverport=`echo $SSH_CONNECTION | awk '{ print $4 }'`
      if [ "$sshserverport" != "" -a "$sshclientport" != "" ];
      then
         xiptables -A $ChainName -s $sshclientip -d $sshserverip -p tcp --sport $sshclientport --dport $sshserverport -j ACCEPT
         xiptables -A $ChainName -s $sshserverip -d $sshclientip -p tcp --sport $sshserverport --dport $sshclientport -j ACCEPT 
      fi

      xiptables -A $ChainName -s 127.0.0.1 -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d 0/0 -p esp -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d 0/0 -p ah  -j ACCEPT
      xiptables -A $ChainName -s $primcip -d $primcip -j ACCEPT
      xiptables -A $ChainName -s $seccip  -d $seccip  -j ACCEPT
      xiptables -A $ChainName -m state --state RELATED,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $primip  -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $secip   -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $primip  -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $secip   -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $primcip -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $seccip  -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $primcip -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
      xiptables -A $ChainName -s 0/0 -d $seccip  -p tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

      xiptables -A $ChainName -s 0/0 -d $primip  -p tcp --dport 8766:8769 -j DROP
      xiptables -A $ChainName -s 0/0 -d $primip  -p udp --dport 8766:8769 -j DROP
      xiptables -A $ChainName -s 0/0 -d $secip   -p tcp --dport 8766:8769 -j DROP
      xiptables -A $ChainName -s 0/0 -d $secip   -p udp --dport 8766:8769 -j DROP

      xiptables -I $ChainName -p all -j $ExtendedChainName
      xiptables -I INPUT   -p all -j $ChainName
      xiptables -I OUTPUT  -p all -j $ChainName
      xiptables -I FORWARD -p all -j $ChainName
      if [ "$FWMODE" = "strict" ];
      then
         ip rule show > /tmp/iprules
         #<SaveRtTables>
            rttables="`cat /etc/iproute2/rt_tables |  egrep -v '^$|#' | cut -f2`"
            ROUTEINFO=/repository/rttables
            mkdir -p $ROUTEINFO
            for cmdidx in `find $ROUTEINFO -type f`
            do
               echo $cmdidx | grep -q "$buildid"
               if [ $? -ne 0 ];
               then
                  rm -f $cmdidx
               fi
            done
            {
               echo "Routing tables."
               ls $ROUTEINFO 
            } 1>>$LOGFILE 2>/dev/null
            for rtidx in $rttables
            do
               ip route show table ${rtidx} | grep "dev $nafosig" > ${ROUTEINFO}/${rtidx} 
               if [ -s ${ROUTEINFO}/${rtidx} -a ! -f ${ROUTEINFO}/${rtidx}.${buildid}.cmd ];
               then
                  {
                     echo '#!/bin/sh -x'
                     cat ${ROUTEINFO}/${rtidx} | sed -e "s/^$rtidx / /g"               \
                                            | sed -e "s/^/ip route add table $rtidx /g" 
                  } > ${ROUTEINFO}/${rtidx}.${buildid}.cmd
                  {
                     echo "Info: $rtidx table"
                     cat ${ROUTEINFO}/${rtidx}.${buildid}.cmd 
                  }  1>>$LOGFILE 2>/dev/null
               fi
               rm -f ${ROUTEINFO}/${rtidx}
               chmod 755 ${ROUTEINFO}/${rtidx}.${buildid}.cmd
            done 2>/dev/null
         #</SaveRtTables>
         xiptables -A $ChainName -p all -j DROP
         if [ "$nafosig" != "$nafoadmin" ];
         then
            for devidx in $sigbondset
            do
               logstr "   - Disabling interface $devidx"
               ifconfig  $devidx down
               if [ $? -ne 0 ];
               then
                  logstr "split8k:Sorry, cant bring $devidx down."
                  exit $FAIL
               fi
            done
         fi
      else
         if [ "$mynode" = "$primhost" ];
         then
            xiptables -A $ChainName -s $seccip -d $primcip -p all -j DROP
         else
            xiptables -A $ChainName -s $primcip -d $seccip -p all -j DROP
         fi
         return
      fi

   #</SetupFw>

   if [ "$nafosig" != "$nafoadmin" ];
   then

   #<DisableArps>
   for devidx in $sigbondset $nafosig
   do
      ifconfig $devidx 1>/dev/null 2>&1
      if [ $? -eq 0 ];
      then
         logstr "   - Disabling arp for $devidx"
         ifconfig $devidx -arp
         if [ $? -ne 0 ];
         then
           logstr "split8k:Sorry, Cannot disable arp for $devidx."
           exit $ARPDISABLEFAILED
         fi
      fi
   done
   #</DisableArps>

   #<DisableIpFw>
#      ipfwlist="                                                                  \
#         /proc/sys/net/ipv4/conf/all/accept_redirects:/tmp/ipv4_accept_redirects  \
#         /proc/sys/net/ipv4/conf/all/send_redirects:/tmp/ipv4_send_redirects      \
#         /proc/sys/net/ipv6/conf/all/accept_redirects:/tmp/ipv6_accept_redirects  \
#         /proc/sys/net/ipv6/conf/all/send_redirects:/tmp/ipv6_send_redirects      \
#      "
      ipfwlist="                                                                  \
         /proc/sys/net/ipv4/conf/all/accept_redirects:/tmp/ipv4_accept_redirects  \
         /proc/sys/net/ipv4/conf/all/send_redirects:/tmp/ipv4_send_redirects      \
      "

      for ipfwlistidx in $ipfwlist
      do
         sysparm=`echo $ipfwlistidx | awk -F':' '{ print $1 }'`
         sysfile=`echo $ipfwlistidx | awk -F':' '{ print $2 }'`
         if [ -f $sysparm -a ! -f $sysfile ];
         then
            cat $sysparm > $sysfile
            echo 0 > $sysparm
         fi
      done
   #</DisableIpFw>

   else

      xiptables -A $ChainName -s 0/0 -d 0/0  -p tcp --dport 5060:5061 -j DROP
      xiptables -A $ChainName -s 0/0 -d 0/0  -p udp --dport 5060:5061 -j DROP
      xiptables -A $ChainName -s 0/0 -d 0/0  -p tcp --dport 1040 -j DROP
      xiptables -A $ChainName -s 0/0 -d 0/0  -p udp --dport 1040 -j DROP

   fi

   #<DisableSnort>
     logstr "   - Disabling snort."
     systemctl stop IDS.service 1>/dev/null 2>&1
   #</DisableSnort>

}


# ---------------------------------------------------------------
# function: setupfw6
# args    : None
# description:
#   set up fire wall so that no one can talk to us in any interface 
#   except billing for IPv6.
# ---------------------------------------------------------------

setupfw6( )
{
   FWMODE=$1
   ChainName=firewall
   ExtendedChainName=xchcom
   ExtendedStrictChain=allcom
   #<GetNodeSpecificDev>
      if [ "$primary" = "true" ];
      then
         nafosig="`cfgread nafo1| awk '{ print $2 }'`"
         nafoadmin="`cfgread nafo0| awk '{ print $2 }'`"
      else
         nafosig="`cfgread nafo1| awk '{ print $3 }'`"
         nafoadmin="`cfgread nafo0| awk '{ print $3 }'`"
      fi
      if [ "$nafosig" = "" ];
      then
         textncolor $BoldCyan "split8k:Wow. What is this system?"
         exit $FAIL
      fi
   #</GetNodeSpecificDev>

   mapnafodev nafosigtag $nafosig
   sigbondset="$nafosig `cfgread $nafosigtag`"
   #<SetupFw>
      textncolor $BoldCyan "split8k:Checking if chain for $ChainName already exist in IPv6 tables."
      ${IPTABLESPATH}ip6tables -L $ChainName 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
        logstr "split8k:Chain for $ChainName already exist."
        xip6tables -D INPUT   -p all -j $ChainName
        xip6tables -D OUTPUT  -p all -j $ChainName
        xip6tables -D FORWARD -p all -j $ChainName
        xip6tables -F $ChainName
        xip6tables --delete-chain $ChainName
      fi 2>/dev/null
      ${IPTABLESPATH}ip6tables -L $ExtendedChainName 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
         logstr "split8k:Chain for $ExtendedChainName in IPv6 tables already exist."
         xip6tables -D $ChainName -p all -j $ExtendedChainName
         xip6tables -F $ExtendedChainName
         xip6tables --delete-chain $ExtendedChainName
      fi 2>/dev/null
      ${IPTABLESPATH}ip6tables -L $ExtendedStrictChain 1>/dev/null 2>/dev/null
      if [ $? -eq 0 ];
      then
         logstr "split8k:Chain for $ExtendedStrictChain IPv6 already exist."
         xip6tables -D INPUT   -p all -j $ExtendedStrictChain
         xip6tables -D OUTPUT  -p all -j $ExtendedStrictChain
         xip6tables -D FORWARD -p all -j $ExtendedStrictChain
         xip6tables -F $ExtendedStrictChain
         xip6tables --delete-chain $ExtendedStrictChain
      fi
      
      xip6tables -N $ChainName
      xip6tables -N $ExtendedChainName
      xip6tables -N $ExtendedStrictChain

      xip6tables -A $ExtendedChainName -s ::1 -j ACCEPT
      xip6tables -A $ExtendedChainName -s 0/0 -d 0/0 -p esp -j ACCEPT
      xip6tables -A $ExtendedChainName -s 0/0 -d 0/0 -p ah  -j ACCEPT
      xip6tables -A $ExtendedChainName -m state --state RELATED,ESTABLISHED -j ACCEPT

      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 1040      -j DROP
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p udp --dport 1040      -j DROP
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 5060:5062 -j DROP
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p udp --dport 5060:5062 -j DROP
      xip6tables -A $ExtendedStrictChain -s ::1 -j ACCEPT
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p esp -j ACCEPT
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p ah  -j ACCEPT
      xip6tables -A $ExtendedStrictChain -s 0/0 -d 0/0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j DROP

      xip6tables -A $ChainName -s 0/0 -d 0/0 -p esp -j ACCEPT
      xip6tables -A $ChainName -s 0/0 -d 0/0 -p ah  -j ACCEPT
      xip6tables -A $ChainName -m state --state RELATED,ESTABLISHED -j ACCEPT

      xip6tables -I $ChainName -p all -j $ExtendedChainName
      xip6tables -I INPUT   -p all -j $ChainName
      xip6tables -I OUTPUT  -p all -j $ChainName
      xip6tables -I FORWARD -p all -j $ChainName
      if [ "$FWMODE" = "strict" ];
      then
         ip rule show > /tmp/iprules
         xip6tables -A $ChainName -p all -j DROP
      else
         return
      fi

   #</SetupFw>

   if [ "$nafosig" == "$nafoadmin" ];
   then
      xip6tables -A $ChainName -s 0/0 -d 0/0  -p tcp --dport 5060:5061 -j DROP
      xip6tables -A $ChainName -s 0/0 -d 0/0  -p udp --dport 5060:5061 -j DROP
      xip6tables -A $ChainName -s 0/0 -d 0/0  -p tcp --dport 1040 -j DROP
      xip6tables -A $ChainName -s 0/0 -d 0/0  -p udp --dport 1040 -j DROP

   fi

}
# ---------------------------------------------------------------
# function: initvars
# args    : None
# description:
#   just initialize one variables.
# ---------------------------------------------------------------

initvars( )
{
   SUCCESS=0
   FAIL=2
   MISSINGCFGDIR=8

   BoldGreen="\033[1;32m"
   BoldBlue="\033[1;34m"
   BoldCyan="\033[1;36m"
   BoldWhite="\033[1;37m"
   UnderLine="\033[4m"
   Yellow="\033[1;33m"
   Norm="\033[0m"

   RSPLIT=false
   CFG8k=/etc/hiq8000/node.cfg
   LOGFILE=/log/prepare8k.log
   mynode="`uname -n`"
   getcfgvar $CFG8k srx_build_id buildid
   getcfgvar $CFG8k test_bed testbed
   getcfgvar $CFG8k node_1_name primhost
   getcfgvar $CFG8k node_2_name sechost
   getcfgvar $CFG8k node_1_ip   primip
   getcfgvar $CFG8k node_2_ip   secip
   getcfgvar $CFG8k mgmt_ipv6_node1   primipv6
   getcfgvar $CFG8k mgmt_ipv6_node2   secipv6


   nafoxch="`cfgread nafo3`"
   if "$OSV_VERSION" --major compare "$buildid" lt V5 || [ "$nafoxch" = "" ];
   then
      getcfgvar $CFG8k node_1_cip_logical primcip
      getcfgvar $CFG8k node_2_cip_logical seccip
   else
      export primcip="`echo $nafoxch   | awk '{ print $4 }'`"
      export seccip="`echo $nafoxch    | awk '{ print $5 }'`"
   fi

   #<CheckTestBed>
   if [ "$testbed" != "cluster" ];
   then
      echo "split8k: This interface is valid only on a cluster."
      exit $FAIL
   fi
   if [ "$mynode" = "$primhost" ];
   then
      XCHACTION="DROP"
      primary=true
   else
      XCHACTION="ACCEPT"
      primary=false
   fi
   #</CheckTestBed>
  
   #<GroupFlip>
      grep -q "^rtpgrp" /etc/group
      if [ $? -eq 0 ];
      then
         srxgroup=rtpgrp
      else
         srxgroup=other
      fi

   #</GroupFlip>

}

ARGLIST="$*"
FIREWALL=no
initvars
{
   echo "split8k: Firewall before split8k $ARGLIST."
   ${IPTABLESPATH}iptables -nL
   echo "split8k: Firewall for IPv6 before split8k $ARGLIST."
   ${IPTABLESPATH}ip6tables -nL
} 1>>$LOGFILE 2>&1
while [ "$#" -gt "0" ];
do
   case $1 in
      -fwxch)
          textncolor $BoldCyan "The current 8k(${mynode}) will be firewalled."
          setupfw "xch"
          ;;
      -fwstrict)
          textncolor $BoldCyan "The current 8k(${mynode}) will be firewalled."
          setupfw "strict"
          #setupfw6 "strict"
          ;;
      -split)
         splitsys
         ;;
         *)
           textncolor $BoldCyan "Sorry, Unknown option."
           echo "Usage: split8k [-fw]"
           exit $FAIL
           ;;
   esac
   shift
done
{
   echo "split8k: Firewall after split8k $ARGLIST."
   ${IPTABLESPATH}iptables -nL
   echo "split8k: Firewall for IPv6 after split8k $ARGLIST."
   ${IPTABLESPATH}ip6tables -nL

} 1>>$LOGFILE 2>&1
echo "Done."
exit $SUCCESS
