#!/bin/sh

# Note: your PATH is inherited from the gateway process
#

strip_rule_prefix() {
    RULES=$( print "$RULES" | sed -e 's/^@[^ ]* //' );
}

permit_nat() {
	NAT=$(pfctl -sn)
	NAT="no rdr on $InternalDevice proto tcp from $IP to any port 80\nno rdr on $InternalDevice proto tcp from $IP to any port 443\n$NAT"
	#print "$NAT"
	print "$NAT" | pfctl -N -
}

deny_nat() {
	NAT=$( pfctl -sn | grep -v $IP );
	#print "$NAT"
	print "$NAT" | pfctl -N -
}

permit_fw () {
	RULES=$( pfctl -sr )
	strip_rule_prefix
	RULES="$RULES\npass in on $InternalDevice from $IP to any\n"
	#print "$RULES"
	print "$RULES" | pfctl -R -
}

deny_fw () {
	RULES=$( pfctl -sr | grep -v $IP)
	strip_rule_prefix
	#print "$RULES"
	print "$RULES" | pfctl -R -
}

ACTION=$1
MAC=$2
IP=$3
CLASS=$4

if [ -z "$ACTION" -o -z "$MAC" -o -z "$IP" -o -z "$CLASS" ]; then
    echo Usage: $0 [permit\|deny] [MAC] [IP] [Class]
	echo Example: $0 permit 00:02:2d:aa:bb:cc 10.0.0.105 member
	exit 1
fi

if [ "$ACTION" = 'permit' ]; then
	permit_nat
	permit_fw
elif [ "$ACTION" = 'deny' ]; then
	deny_nat
	deny_fw
fi

