#!/bin/sh
#
# *********************************************************************
#                              N O T I C E
#
#  This script has NEVER BEEN TESTED.    If you use it, and find that
#  it is incorrect, please, -PLEASE- email bward2@users.sourceforge.net
#  with a corrected version.
#
# *********************************************************************
#
#  file "ipf_add"
#  netBSD-style 'ipf' firewall-add script, called by "doormand". 
#  This adds a "pass in quick" rule to the firewall.
#
#  Called with five arguments:
#
# $1 : name of the interface (e.g. ne0)
# $2 : source IP; i.e. dotted-decimal address of the 'knock' client
# $3 : source port; when this script is called for the first time
#      for a connection (man 8 doormand), this argument will be set
#      to a single "0" (0x30) character.  This means that the source
#      port is not yet known, and a broad rule allowing any source
#      port is required.
# $4 : destination IP; that is, the IP address of the interface 
#      in argument 1.
# $5 : The port number of the requested service (e.g. 22 for ssh, etc.)
#
#
if [ $3 = 0 ]
then
    ret=`echo "pass in quick on $1 proto TCP from $2         to $4 port=$5" | ipf -P -f - 2>&1`
else
    ret=`echo "pass in quick on $1 proto TCP from $2 port=$3 to $4 port=$5" | ipf -P -f - 2>&1`
fi

if [ -z "$ret" ]
then
    echo 0
else
    echo -1 3 $ret
fi