#!/bin/sh

set -e

# summary of how this script can be called:
#
#   * <postinst> `configure' <most-recently-configured-version>
#   * <old-postinst> `abort-upgrade' <new-version>
#   * <conflictor's-postinst> `abort-remove' `in-favour' <package> <new-version>
#   * <postinst> `abort-remove'
#   * <deconfigured's-postinst> `abort-deconfigure' `in-favour' <failed-install-package>
#     <version> `removing' <conflicting-package> <version>
#
# for details, see https://www.debian.org/doc/debian-policy/ or
# the debian-policy package

create_config_from_template() {
    local config="$1"
    local template="$2"
    local firstver="$3"

    if [ "$4" != "--" ]; then
        echo "create_config_from_template called with the wrong number of arguments" >&2
        return 1
    fi
    for _ in $(seq 1 4); do
        shift
    done

    if [ -n "$2" ] && dpkg --compare-versions -- "$2" gt "$firstver"; then
        # The package is already configured, and the version that's been
        # configured is new enough to contain the config file
        if [ -e "$config.dpkg-backup" ]; then
            # The package had been configured in the past and has
            # subsequently been removed without purging, so a backup of
            # the config file is still present on the disk. Restore it
            mv -f "$config.dpkg-backup" "$config"
            return 0
        else
            # We're doing a regular upgrade. Don't change anything
            return 0
        fi
    else
        # We're either installing from scratch, or upgrading from a version
        # that didn't have the config file yet. Make a copy of the template
        # in the appropriate location and with the expected permissions
        install -o root -g root -m 0600 "$template" "$config"
        return 0
    fi
}

NWFILTERS="
    allow-arp
    allow-dhcp
    allow-dhcp-server
    allow-incoming-ipv4
    allow-ipv4
    clean-traffic
    clean-traffic-gateway
    no-arp-ip-spoofing
    no-arp-mac-spoofing
    no-arp-spoofing
    no-ip-multicast
    no-ip-spoofing
    no-mac-broadcast
    no-mac-spoofing
    no-other-l2-traffic
    no-other-rarp-traffic
    qemu-announce-self
    qemu-announce-self-rarp
"
NWFILTERS_7_0_0="
    allow-dhcpv6
    allow-dhcpv6-server
    allow-incoming-ipv6
    allow-ipv6
    no-ipv6-multicast
    no-ipv6-spoofing
"

case "$1" in
    configure)
        for nwfilter in $NWFILTERS; do
            create_config_from_template \
                "/etc/libvirt/nwfilter/$nwfilter.xml" \
                "/usr/share/libvirt/nwfilter/$nwfilter.xml" \
                "6.9.0-2~" \
                -- \
                "$@"
        done
        for nwfilter in $NWFILTERS_7_0_0; do
            create_config_from_template \
                "/etc/libvirt/nwfilter/$nwfilter.xml" \
                "/usr/share/libvirt/nwfilter/$nwfilter.xml" \
                "7.0.0-1~" \
                -- \
                "$@"
        done

        # Trigger daemon restart after installing configuration files
        dpkg-trigger libvirt-restart-libvirtd
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# Automatically added by dh_installdeb/13.24.2
dpkg-maintscript-helper dir_to_symlink /usr/share/doc/libvirt-daemon-config-nwfilter libvirt-common 10.6.0-2\~ -- "$@"
# End automatically added section


exit 0