#!/bin/sh
#============================================================================
# /etc/xen/vif-bridge
#
# Script for configuring a vif in bridged mode.
# The hotplugging system will call this script if it is specified either in
# the device configuration given to Xend, or the default Xend configuration
# in /etc/xen/xend-config.sxp.  If the script is specified in neither of those
# places, then this script is the default.
#
# Usage:
# vif-bridge (add|remove|online|offline)
#
# Environment vars:
# vif         vif interface name (required).
# XENBUS_PATH path to this device's details in the XenStore (required).
#
# Read from the store:
# bridge  bridge to add the vif to (optional).  Defaults to searching for the
#         bridge itself.
# ip      list of IP networks for the vif, space-separated (optional).
#
# up:
# Enslaves the vif interface to the bridge and adds iptables rules
# for its ip addresses (if any).
#
# down:
# Removes the vif interface from the bridge and removes the iptables
# rules for its ip addresses (if any).
#============================================================================

dir=$(dirname "$0")
. "$dir/vif-common.sh"

bridge=${bridge:-}
bridge=$(xenstore_read_default "$XENBUS_PATH/bridge" "$bridge")

if [ -z "$bridge" ]
then
  bridge=$(brctl show | cut -d "
" -f 2 | cut -f 1)

  if [ -z "$bridge" ]
  then
     fatal "Could not find bridge, and none was specified"
  fi
fi

RET=0
ip link show $bridge 1>/dev/null 2>&1 || RET=1
if [ "$RET" -eq 1 ]
then
    fatal "Could not find bridge device $bridge"
fi

case "$command" in
    online)
	setup_bridge_port "$vif"
	add_to_bridge "$bridge" "$vif"
	ebtables -N $vif
              ebtables -P $vif DROP
              ebtables -A INPUT -i $vif -j $vif
              ebtables -A FORWARD -i $vif -j $vif
              ebtables -A $vif -p ARP --arp-opcode 1 -j ACCEPT

             if [ ! -z "$ip" ]
             then
               for oneip in $ip
               do
                 ebtables -A $vif -p IPv4 --ip-src $oneip -j ACCEPT
                 ebtables -A $vif -p IPv4 --ip-dst $oneip -j ACCEPT
                 ebtables -A $vif -p ARP --arp-opcode 2 --arp-ip-src $oneip -j ACCEPT
               done
                ebtables -A $vif --log-prefix="arp-drop" --log-arp -j DROP
              fi
       	;;

    offline)
        do_without_error brctl delif "$bridge" "$vif"
        do_without_error ifconfig "$vif" down
        do_without_error ebtables -D INPUT -i $vif -j $vif
        do_without_error ebtables -D FORWARD -i $vif -j $vif
        do_without_error ebtables -F $vif
        do_without_error ebtables -X $vif
        ;;
esac

#handle_iptable

log debug "Successful vif-bridge $command for $vif, bridge $bridge."
if [ "$command" == "online" ]
then
  success
fi