<NME> launch_tcpcryptd.sh
<BEF> #!/bin/sh

OSNAME=`uname -s`
ENCRYPT_PORT=80

TCPCRYPTD=`dirname $0`/tcpcrypt/tcpcryptd
TCPCRYPTD_DIVERT_PORT=666
DIVERT_PORT=666
PIDFILE=/var/run/tcpcrypt.pid

start_tcpcryptd() {
    LD_LIBRARY_PATH=lib/ $TCPCRYPTD $OPTS -p $DIVERT_PORT &
    echo $! > $PIDFILE
    wait $!
}


linux_set_iptables() {
    echo Tcpcrypting port 80 and all local traffic...
    ee iptables -I INPUT -p tcp --sport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    ee iptables -I OUTPUT -p tcp --dport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    ee iptables -I INPUT -p tcp -i lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    ee iptables -I OUTPUT -p tcp -o lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
}

linux_unset_iptables() {
    echo Removing iptables rules and quitting tcpcryptd...
    iptables -D INPUT -p tcp --sport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    iptables -D OUTPUT -p tcp --dport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    iptables -D INPUT -p tcp -i lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    iptables -D OUTPUT -p tcp -o lo $ENCRYPT_PORT2 -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
    exit
}

if [ `whoami` != "root" ]
then
    echo "must be root"
    ipfw 03 add divert $DIVERT_PORT tcp from any $PORT to any
    ipfw 04 add divert $DIVERT_PORT tcp from any to any $PORT2
    ipfw 05 add divert $DIVERT_PORT tcp from any $PORT2 to any
}

bsd_unset_ipfw() {
        trap linux_unset_iptables 2 # trap SIGINT to remove iptables rules before exit
        start_tcpcryptd
        linux_unset_iptables
esac

    wait $!    
}

check_root() {
    if [ `whoami` != "root" ]
    then
        echo "must be root"
        exit 1
    fi
}

check_ssh() {
    if [ -n "$SSH_CONNECTION" ]
    then
        read -p 'Command may disrupt existing ssh connections. Proceed? [y/N] ' C
        if [ "$C" != "y" ]
        then
            exit 1
        fi
    fi
}

check_existing_tcpcryptd() {
    P=`ps axo pid,comm | grep tcpcryptd`
    if [ $? -eq 0 ]
    then
        read -p "tcpcryptd already running with pid $P. Proceed? [y/N] " C
        if [ "$C" != "y" ]
        then
            exit 1
        fi
    fi
}


#check_ssh

case "$OSNAME" in
    Linux)
        check_existing_tcpcryptd
        check_root
        linux_set_iptables
        trap linux_unset_iptables 2 # trap SIGINT to remove iptables rules before exit
        start_tcpcryptd
        linux_unset_iptables
        ;;
    FreeBSD|Darwin)
        check_existing_tcpcryptd
        check_root
        bsd_set_ipfw
        trap bsd_unset_ipfw 2
        start_tcpcryptd
        bsd_unset_ipfw
        ;;
    [Cc][Yy][Gg][Ww][Ii][Nn]*)
        win_start_tcpcryptd
        ;;
esac


<MSG> bsd stubs and formatting

<DFF> @@ -1,7 +1,7 @@
 #!/bin/sh
 
 OSNAME=`uname -s`
-ENCRYPT_PORT=80
+PORT=${1:-80}
 
 TCPCRYPTD=`dirname $0`/tcpcrypt/tcpcryptd
 TCPCRYPTD_DIVERT_PORT=666
@@ -17,21 +17,29 @@ ee() {
 
 linux_set_iptables() {
     echo Tcpcrypting port 80 and all local traffic...
-    ee iptables -I INPUT -p tcp --sport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    ee iptables -I OUTPUT -p tcp --dport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    ee iptables -I INPUT -p tcp -i lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    ee iptables -I OUTPUT -p tcp -o lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    ee iptables -I INPUT  -p tcp --sport $PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    ee iptables -I OUTPUT -p tcp --dport $PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    ee iptables -I INPUT  -p tcp -i lo         -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    ee iptables -I OUTPUT -p tcp -o lo         -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
 }
 
 linux_unset_iptables() {
     echo Removing iptables rules and quitting tcpcryptd...
-    iptables -D INPUT -p tcp --sport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    iptables -D OUTPUT -p tcp --dport $ENCRYPT_PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    iptables -D INPUT -p tcp -i lo -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
-    iptables -D OUTPUT -p tcp -o lo $ENCRYPT_PORT2 -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    iptables -D INPUT  -p tcp --sport $PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    iptables -D OUTPUT -p tcp --dport $PORT -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    iptables -D INPUT  -p tcp -i lo         -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
+    iptables -D OUTPUT -p tcp -o lo         -j NFQUEUE --queue-num $TCPCRYPTD_DIVERT_PORT
     exit
 }
 
+bsd_set_ipfw() {
+    echo Tcpcrypting port 80 and all local traffic...
+}
+
+bsd_unset_ipfw() {
+    echo Removing ipfw rules and quitting tcpcryptd...
+}
+
 if [ `whoami` != "root" ]
 then
     echo "must be root"
@@ -44,5 +52,10 @@ case "$OSNAME" in
         trap linux_unset_iptables 2 # trap SIGINT to remove iptables rules before exit
         start_tcpcryptd
         linux_unset_iptables
+    FreeBSD|Darwin)
+        bsd_set_ipfw
+        trap bsd_unset_ipfw 2
+        start_tcpcryptd
+        bsd_unset_iptables
 esac
 

bsd stubs and formatting