#!/usr/local/bin/php-cgi -q
<?php
/*
 * easyrule
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2010-2013 BSD Perimeter
 * Copyright (c) 2013-2016 Electric Sheep Fencing
 * Copyright (c) 2014-2026 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

require_once("pfsense-utils.inc");
require_once("easyrule.inc");
require_once("filter.inc");
require_once("shaper.inc");

if (($argc > 1) && !empty($argv[1])) {
	$ret_code = 0;
	switch (strtolower($argv[1])) {
		case 'block':
			$message = easyrule_parse_block($argv[2], $argv[3]);
			break;
		case 'unblock':
			$message = easyrule_parse_unblock($argv[2], $argv[3]);
			break;
		case 'showblock':
			$message = easyrule_parse_getblock($argv[2]);
			break;
		case 'pass':
			$message = easyrule_parse_pass($argv[2], $argv[3], $argv[4], $argv[5], $argv[6]);
			break;
		default:
			// Catch footgun and warn the user...
			easyrule_print_usage();
			$ret_code = 1;
			break;
	}
} else {
	// Show usage overview
	easyrule_print_usage();
}

print("{$message}\n");
exit($ret_code);

function easyrule_print_usage() {
	global $argv;
	$easyrule_nettype_flags = [SPECIALNET_ANY, SPECIALNET_SELF, SPECIALNET_CLIENTS];
	$script = basename($argv[0]);
	foreach (array(
		"Usage:\n",
		" Blocking only requires an interface and source to block. Block rules can be shown with showblock and revoked using unblock\n",
		"     {$script} block <interface> <source>\n\n",
		" Passing requires more detail, as it must be as specific as possible. The destination port is optional if you're using a protocol without a port (e.g. ICMP, OSPF, etc).\n",
		"     {$script} pass <interface> <protocol> <source> <destination> [destination port]\n\n",
		" Interfaces can be passed as assigned internal names, descriptive names, group names, or OS names.\n",
		" Protocol can be a protocol name, protocol number, or 'any'.\n",
		" Sources and destinations can be IP addresses, subnets, aliase names, or special networks ['" . implode("', '", array_keys(get_specialnet('', $easyrule_nettype_flags))) . "']\n\n",
		" Block example:\n",
		"     {$script} block wan 1.2.3.4\n\n",
		" Show active blocks example:\n",
		"     {$script} showblock wan\n\n",
		" Unblock example:\n",
		"     {$script} unblock wan 1.2.3.4\n\n",
		" Pass example (protocol with port):\n",
		"     {$script} pass wan tcp 1.2.3.4 192.168.0.4 80\n\n",
		" Pass example (protocol with port to This Firewall):\n",
		"     {$script} pass wan tcp 1.2.3.4 '(self)' 80\n\n",
		" Pass example (protocol without port):\n",
		"     {$script} pass wan icmp 1.2.3.4 192.168.0.4\n\n",
	) as $line) { print($line); }
}

?>
