#!/bin/sh

#

# netlabel	Start CIPSO labeled networking

#

# chkconfig: - 09 91

# description:	Starts and stops CIPSO labeled networking

#

# config: /etc/netlabel.rules

#

# Return values according to LSB for all commands but status:

# 0 - success

# 1 - generic or unspecified error

# 2 - invalid or excess argument(s)

# 3 - unimplemented feature (e.g. "reload")

# 4 - insufficient privilege

# 5 - program is not installed

# 6 - program is not configured

# 7 - program is not running

PATH=/sbin:/bin:/usr/bin:/usr/sbin

VAR_SUBSYS_NETLABEL=/var/lock/subsys/netlabel

RULES=/etc/netlabel.rules

# Source function library.

. /etc/init.d/functions

# Check that we are root ... so non-root users stop here

test `id -u` = 0  || exit 4

test -x /sbin/netlabelctl || exit 5

test -f $RULES || exit 6

start() {

    ret_val="0"

    # Loop through rules

    while read LINE

    do

	# Skip comments and blank lines

	if echo $LINE | egrep '^#|^$' >/dev/null ; then

		continue

	fi

	/sbin/netlabelctl $LINE >/dev/null 2>&1

	ret="$?"

	if [ "$ret" != "0" ] ; then

		ret_val="$ret"

	fi

    done < $RULES

    touch $VAR_SUBSYS_NETLABEL

    return $ret_val

}

stop() {

    rm -f $VAR_SUBSYS_NETLABEL

    # Delete rules

    list=`/sbin/netlabelctl cipsov4 list 2>/dev/null`

    ret="$?"

    if [ x"$list" != "x" ] ; then

	for line in "$list"

	do

		/sbin/netlabelctl cipsov4 del "doi:$line" 2>/dev/null

    		ret="$?"

	done

    fi

    return $ret

}

status() {

    # Do not print status if lockfile is missing 

    if [ ! -f "$VAR_SUBSYS_NETLABEL" ]; then

	echo $"Netlabel is stopped."

	return 3

    fi

    # List rules

    /sbin/netlabelctl -p cipsov4 list 2>/dev/null

    ret1="$?"

    /sbin/netlabelctl -p mgmt protocols 2>/dev/null

    ret2="$?"

    if [ "$ret1" != "0" -o "$ret2" != "0" ] ; then

	return 2

    fi

    return 0

}

restart() {

    stop

    start

}

case "$1" in

    start)

	stop

	start

	RETVAL="$?"

	;;

    stop)

	stop

	RETVAL="$?"

	;;

    restart)

	restart

	RETVAL="$?"

	;;

    condrestart)

	[ -e "$VAR_SUBSYS_NETLABEL" ] && restart

	;;

    status)

	status

	RETVAL="$?"

	;;

    *)

	echo $"Usage: $0 {start|stop|restart|condrestart|status}"

	exit 3

	;;

esac

exit $RETVAL