. /etc/functions.sh
include /lib/network
scan_interfaces

upnp_ipt() {
	iptables "$@" 2>/dev/null
}

upnp_firewall_addif() {
	local intif
	local intip
	local coldplug="$1"

	config_load upnpd
	config_get intif config internal_iface

	config_load network

	for iface in ${intif:-lan}; do
		if [ -n "$coldplug" -o "$iface" == "$INTERFACE" ]; then
			config_get intip "$iface" ipaddr
			config_get intif "$iface" ifname

			[ -n "$intif" -a -n "$intip" ] && {
				logger -t "upnp firewall" "adding interface $iface($intip)"

				upnp_ipt -t nat -N MINIUPNPD
				upnp_ipt -t nat -N miniupnpd_${iface}_rule
				upnp_ipt -t nat -A miniupnpd_${iface}_rule -i $intif -d $intip -j MINIUPNPD 
				upnp_ipt -t nat -A prerouting_rule -j miniupnpd_${iface}_rule

				upnp_ipt -t filter -N MINIUPNPD
				upnp_ipt -t filter -N miniupnpd_${iface}_rule
				upnp_ipt -t filter -A miniupnpd_${iface}_rule -i $intif -o ! $intif -j MINIUPNPD
				upnp_ipt -t filter -A forwarding_rule -j miniupnpd_${iface}_rule
			}
		fi
	done
}

upnp_firewall_delif() {
	local iface="${1:-$INTERFACE}"

	if [ -n "$iface" ]; then
		logger -t "upnp firewall" "removing interface $iface"

		upnp_ipt -t nat -D prerouting_rule -j miniupnpd_${iface}_rule
		upnp_ipt -t nat -F miniupnpd_${iface}_rule
		upnp_ipt -t nat -X miniupnpd_${iface}_rule

		upnp_ipt -t filter -D forwarding_rule -j miniupnpd_${iface}_rule
		upnp_ipt -t filter -F miniupnpd_${iface}_rule
		upnp_ipt -t filter -X miniupnpd_${iface}_rule
	fi
}

upnp_firewall_start() {
	logger -t "upnp firewall" "starting ..."
	upnp_firewall_addif coldplug
}

upnp_firewall_stop() {
	local intif
	config_load upnpd
	config_get intif config internal_iface

	logger -t "upnp firewall" "stopping ..."

	for iface in ${intif:-lan}; do
		upnp_firewall_delif "$iface"
	done

	upnp_ipt -t nat -F MINIUPNPD
	upnp_ipt -t nat -X MINIUPNPD
	upnp_ipt -t filter -F MINIUPNPD
	upnp_ipt -t filter -X MINIUPNPD
}