#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : bin/ifpreupd.firewall
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================

IFACE="${IFACE:-$1}"
[ -z "${IFACE}" ] && echo "if-pre-up.d/00_darkwall :exit no iface defined :${IFACE}" && exit 0

sh /etc/darkwall/bin/tryPipeMessage pre-start ${IFACE} &
#logger "ifpreupd.firewall IFACE:${IFACE} 1:$1 2:$2"

found=
maxTry=10
try=0
while [ -z "$found" ] && [ $try -lt $maxTry ];do
 try=$(( try + 1 ))
 for iface in $(ip link | grep "${IFACE}" | grep BROADCAST | cut -d':' -f2 | tr -d '[:blank:]' | cut -f 1 -d@ );do
  # echo iface:$iface
  [ "$iface" = "${IFACE}" ] && found=1 && break
 done
 [ -z "$found" ] && echo "if-pre-up.d/00_darkwall :try $try link not found for iface:${IFACE}"
 sleep 3
done

[ -z "$found" ] && echo "if-pre-up.d/00_darkwall :exit shunt link not found for iface:${IFACE}" && exit 0
#echo "${IFACE}" | grep -q "lo" && echo "if-pre-up.d/00_darkwall :exit shunt lo:${IFACE}" && exit 0

normalizeIface="$( echo ${IFACE} | tr -d ':' )"
ruleDhcp="${normalizeIface}"
if ! iptables -vnL i$ruleDhcp >/dev/null 2>&1;then
 iptables -w -N i$ruleDhcp
 iptables -w -I INPUT -i ${IFACE} -j i$ruleDhcp
 # dhcp server (bootps : 67, bootpc : 68)
 # Exception dhcp from unknow 'ip'
 iptables -w -I i$ruleDhcp -p udp --dport bootpc --sport bootps -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
 iptables -w -I i$ruleDhcp -p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
fi
if ! iptables -vnL o$ruleDhcp >/dev/null 2>&1;then
 iptables -w -N o$ruleDhcp
 iptables -w -I OUTPUT -o ${IFACE} -j o$ruleDhcp
 # dhcp (bootps : 67, bootpc : 68)
 iptables -w -I o$ruleDhcp -s 0.0.0.0/32	-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root -j ACCEPT
 iptables -w -I o$ruleDhcp -s 0.0.0.0					-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root -j ACCEPT
 iptables -w -I o$ruleDhcp -s 169.254.0.0/16	-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root -j ACCEPT
 iptables -w -I o$ruleDhcp -p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root -j ACCEPT
 iptables -w -I o$ruleDhcp -p udp --sport bootps --dport bootpc -m state --state ESTABLISHED		-m owner --uid-owner root --gid-owner root -j ACCEPT
fi

if ! ip6tables -vnL i$ruleDhcp >/dev/null 2>&1;then
 ip6tables -w -N i$ruleDhcp
 ip6tables -w -I INPUT -i ${IFACE} -j i$ruleDhcp
 # dhcpv6 client (546) / serveur ou relais (547)
 # Advertise/Reply renvoyé en multicast par certains relais (rare, mais prévu par la RFC 8415)
 ip6tables -w -I i$ruleDhcp -s fe80::/10 -d ff02::1:2/128 -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
fi
if ! ip6tables -vnL o$ruleDhcp >/dev/null 2>&1;then
 ip6tables -w -N o$ruleDhcp
 ip6tables -w -I OUTPUT -o ${IFACE} -j o$ruleDhcp
fi
for ll6 in $( ip -6 addr show dev  ${IFACE} scope link | grep "scope link" | rev | cut -f2 -d'/' | cut -f1 -d' ' | rev );do
 normalizeLl6="$( echo ${ll6} | tr -d ':' )"
 ruleDhcpLl6="${normalizeLl6}"
 if ! ip6tables -vnL i$ruleDhcpLl6 >/dev/null 2>&1;then
  ip6tables -w -N i$ruleDhcpLl6
  ip6tables -w -I i$ruleDhcp -d "${ll6}/128" -j i$ruleDhcpLl6
  # Réponse unicast du serveur/relais vers le client (cas que tu as capturé : SPT=547 DPT=546)
  ip6tables -w -I i$ruleDhcpLl6 -s fe80::/10 -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
 fi
 if ! ip6tables -vnL o$ruleDhcpLl6 >/dev/null 2>&1;then
  ip6tables -w -N o$ruleDhcpLl6
  ip6tables -w -I o$ruleDhcp -s "${ll6}/128" -j o$ruleDhcpLl6
  # Solicit/Request/Confirm/Rebind/Decline/Release envoyés en multicast (adresse serveur inconnue)
  ip6tables -w -I o$ruleDhcpLl6 -s "${ll6}/128"        -d ff02::1:2/128       -p udp -m udp --sport 546 --dport 547 -m state --state NEW -j ACCEPT
  # Renew/Release en unicast si le serveur a fourni son adresse (option "Server Unicast")
  ip6tables -w -I o$ruleDhcpLl6 -d fe80::/10           -p udp -m udp --sport 546 --dport 547 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
 fi
done