#!/bin/bash

RETVAL=0
. /etc/eole/bastion.conf
CACHEMOD='/etc/eole/bastion-modules'
rm -f $CACHEMOD
if [ ! "$type_amon" = "" ]; then
    . /usr/lib/eole/ihm.sh
    if [ -f /usr/share/era/modeles/${type_amon}.xml ]; then
        echo -n " (modèle \"${type_amon}\")"
        ## lancement du script de generation du firewall
        /usr/share/era/bastion.sh
        if [ ! $? -eq 0 ]; then
            echo -n "non appliquées !"
            MSG="Erreur à la génération des règles du modèle ${type_amon}"
            RETVAL=1
        else
            if [ -x /usr/share/eole/bastion/data/90-lxc_rules ]
            then
                /usr/share/eole/bastion/data/90-lxc_rules
                grep -h modprobe /usr/share/eole/bastion/data/90-lxc_rules >> $CACHEMOD
		grep -h "echo " /usr/share/eole/bastion/data/90-lxc_rules >> $CACHEMOD
            fi
        fi
        grep -h modprobe /sbin/lance.firewall >> $CACHEMOD
	grep -h "echo " /sbin/lance.firewall >> $CACHEMOD
    else
        echo -n ", modèle \"${type_amon}\" non trouvé !"
        MSG="Le modèle ${type_amon} n'existe pas"
        RETVAL=1
    fi
else
    if [ "$activer_firewall" = "oui" ]; then
        /bin/run-parts --exit-on-error /usr/share/eole/bastion/data
        RETVAL=$?
        if [ ! "$RETVAL" = "0" ]; then
            MSG="Erreur à l'exécution des scripts de firewall"
            echo -n $MSG
        fi
        grep -h modprobe /usr/share/eole/bastion/data/* >> $CACHEMOD
	grep -h "echo " /usr/share/eole/bastion/data/* >> $CACHEMOD
    else
        echo
        /usr/sbin/ouvre.firewall
        RETVAL=$?
        if [ ! "$RETVAL" = "0" ]; then
            MSG="Erreur à l'exécution du script ouvre.firewall"
            echo -n $MSG
        fi
    fi
fi
if [ "$RETVAL" = "0" ]; then
    if [ "$mode_conteneur_actif" = "oui" ]; then
        CreoleRun "/bin/run-parts --exit-on-error /usr/share/eole/bastion/data" all no yes
    fi
    if [ -f /usr/share/era/postes_interdits.py ]; then
        /usr/share/era/postes_interdits.py
    fi
    /sbin/iptables-save > /etc/eole/iptables
    [ $(command -v ipset) ] && ipset save > /etc/eole/ipset
    if [ "$mode_conteneur_actif" = "oui" ]; then
        CreoleRun "/sbin/iptables-save > /etc/eole/iptables" all no yes
        CreoleRun "[ \$(command -v ipset) ] && ipset save > /etc/eole/ipset" all no yes
    fi
    # rules outside bastion scope
    /bin/run-parts --exit-on-error /usr/share/eole/bastion/post_cache

fi

echo "# -*- coding: UTF-8 -*-
DATE=\"`date +%s`\"
STATUS=\"$RETVAL\"
MSG=\"$MSG\"" > /var/lib/eole/reports/bastion.log
return $RETVAL
