#!/bin/sh -e

start() {
  /usr/sbin/nft -f /etc/nftables.conf
  [ -f /var/lib/nftables/ip-blocklist.nft ] && /usr/sbin/nft -f /var/lib/nftables/ip-blocklist.nft || :
  [ -f /var/lib/nftables/ip6-blocklist.nft ] && /usr/sbin/nft -f /var/lib/nftables/ip6-blocklist.nft || :
}

stop() {
  /usr/sbin/nft list set inet chef-filter ip-blocklist > /var/lib/nftables/ip-blocklist.nft
  /usr/sbin/nft list set inet chef-filter ip6-blocklist > /var/lib/nftables/ip6-blocklist.nft
  /usr/sbin/nft delete table inet chef-filter
<% if node[:roles].include?("gateway") -%>
  /usr/sbin/nft delete table ip chef-nat
<% end -%>
}

reload() {
  stop
  start
}

block() {
  for address in "$@"
  do
    case "$address" in
      *.*) /usr/sbin/nft add element inet chef-filter ip-blocklist "{ $address }";;
      *:*) /usr/sbin/nft add element inet chef-filter ip6-blocklist "{ $address }";;
    esac
  done
}

unblock() {
  for address in "$@"
  do
    case "$address" in
      *.*) /usr/sbin/nft delete element inet chef-filter ip-blocklist "{ $address }";;
      *:*) /usr/sbin/nft delete element inet chef-filter ip6-blocklist "{ $address }";;
    esac
  done
}

command=$1
shift

case "$command" in
  start) start;;
  stop) stop;;
  reload) reload;;
  block) block "$@";;
  unblock) unblock "$@";;
esac

exit 0