#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/config
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd="grep"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

#shLog="firewall-config:"
#shDebugEnable="1"

#iptoolsWaitScriptName="firewallConfig"
#shStartStopScript ""$iptoolsWaitScriptName""

#requiresCmd="echo tr cut"
#shWhichCmd $requiresCmd >/dev/null
#shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

#optionalsCmd="trap"
#shWhichCmd $optionalsCmd >/dev/null
#shWarnOnMissing $( shWhichCmd $optionalsCmd | $cmdTr '_' ' ' )

#shDebug "$*"

# firewallConfigIface $ifacesConf $jsonDataPipe $iface
firewallConfigIface() {
 local ifacesConf="$1"
 local jsonDataPipe="$2"
 local log="firewallConfigIface:"
 local askIface="$3"
 shDebug 2 ""${log}" try config:$askIface include ifacesConf:${ifacesConf}"
 
 [ -z "$(shPipeReadTee $jsonDataPipe)" ] && shDebug 0 ""${log}" empty data pipe" && return ;
 local ifaces=""
 $(shIncludeET $ifacesConf)
 [ -z "$(shPipeReadTee $jsonDataPipe)" ] && shDebug 0 ""${log}" empty data pipe" && return ;
 if [ -z "$ifaces" ];then
  shDebug 0 ""$log" echec empty ifaces:"$ifaces""
 else
  shPipeInit "${log} myIfacesPipe"; local jsonConfIfacesPipe=$?
#  shDebug 0 ""${log}" ifaces:${ifaces}"
#  shDebug 0 ""${log}" ifaces2:$( $cmdEcho $ifaces | $cmdTr -d '[:space:]' | $cmdTr -s '|' ' ' )"
  jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
  if [ -z "$(shPipeReadTee $jsonConfIfacesPipe)" ];then
   shPipeFree $jsonConfIfacesPipe
   shPipeInit "${log} myIfacesPipe"; local jsonConfIfacesPipe=$?
   $cmdEcho "{}" | shPipeWrite $jsonConfIfacesPipe
   shDebug 0 ""${log}" empty ifaces json, init empty."
  fi
  for ifaceConf in $( $cmdEcho $ifaces | $cmdTr -d '[:space:]' | $cmdTr -s '|' ' ' );do
   shDebug 1 ""$log"  ifaceConf:${ifaceConf} " >&2
   local iface=""
   local mode=""
   local file=""
   for value in $( $cmdEcho $ifaceConf | $cmdTr -d '[:space:]' | $cmdTr -s ';' ' ' );do
    if [ -z "$iface" ];then
     local iface=""$value""
    elif [ -z "$mode" ];then
     local mode="$( $cmdEcho $value | $cmdCut -d'/' -f 1)"
     local modeValue="$( $cmdEcho $value | $cmdCut -d'/' -f 2- )"
    elif [ -z "$file" ];then
     local file="$value"
    else
     shDebug 0 ""$log" echec reading : unknow:$value in :$ifaceConf"
    fi
   done
   [ "$iface" != "$askIface" ] && continue;
   local log="firewallConfig[$iface]:"
   [ -n "$file" ] && [ -f "$rootDarkWall/$file" ] && file="$rootDarkWall/$file"
   if [ -f "$file" ];then
#   firewallJsonConf "$file"
    shDebug 1 ""$log"  firewallJsonConf $mode/$modeValue $file "
    if [ "$mode" = "bridge" ] || [ "$mode" = "bridge6" ] || [ "$mode" = "lo" ] || [ "$mode" = "lo6" ] || [ "$mode" = "ll6" ] || [ "$mode" = "ill6" ] \
     || [ "$mode" = "net" ]  || [ "$mode" = "inet" ] || [ "$mode" = "net6" ] || [ "$mode" = "inet6" ] \
     || [ "$mode" = "pnet" ]  || [ "$mode" = "pinet" ] || [ "$mode" = "pnet6" ] || [ "$mode" = "pinet6" ] \
     || [ "$mode" = "gw" ] || [ "$mode" = "igw" ] || [ "$mode" = "gw6" ] || [ "$mode" = "igw6" ];then
     # ===============================================================
     local regFile="$( $cmdEcho ${file} | $cmdBase64 -i | $cmdTr -d '[:blank:]' | $cmdTr -d '\n' );${mode};${modeValue}"
     shPipeInit "${log} myIfacePipe"; local jsonConfIfacePipe=$?
     jsonReadBig "${iface}" $jsonConfIfacesPipe $jsonConfIfacePipe
     if [ -z "$(shPipeReadTee $jsonConfIfacePipe)" ];then
      shDebug 2 ""$log" try init eth:$iface"
      shPipeFree $jsonConfIfacePipe
      shPipeInit "${log} myIfacePipe"; local jsonConfIfacePipe=$?
      $cmdEcho "{}" | json64InObjectWrite "eth" "${iface}" | json64InObjectWrite "files" "${regFile}" | shPipeWrite $jsonConfIfacePipe
#      shDebug 2 ""$log" init:$(shPipeReadTee $jsonConfIfacePipe)"
#      shPipeReadTee $jsonConfIfacePipe
     else
      local tiFiles="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead "files" )"
      for everRegFile in $( $cmdEcho ${tiFiles} | $cmdTr -s '|' ' ');do
       if [ "|${everRegFile}|" = "|${regFile}|" ];then
        shDebug 0 ""$log" echec file ever reg :${file}"
        local regFile=""
        break
#       else
#        shDebug 2 ""$log" ===== file ever reg :${everRegFile}"
       fi
      done
      if [ -n "${regFile}" ];then
       shPipeInit "${log} myBuffPipe"; local jsonBuffPipe=$?
       shPipeRead $jsonConfIfacePipe | json64InObjectWrite "files" "${tiFiles}|${regFile}" | shPipeWrite $jsonBuffPipe
       shPipeRead $jsonBuffPipe | shPipeWrite $jsonConfIfacePipe
       shPipeFree $jsonBuffPipe
      fi
     fi
     if [ -z "$(shPipeReadTee $jsonConfIfacePipe)" ];then
      shDebug 0 ""$log" not data to write !!!!!!!!!!!! $jsonConfIfacePipe"
     else
      jsonWriteBig "$iface" $jsonConfIfacesPipe $jsonConfIfacePipe "$log"
      shDebug 1 ""$log" $iface $mode $file "
     fi
     shPipeFree $jsonConfIfacePipe
    else
     shDebug 0 ""$log" firewallExecute [$iface] unknow mode:$mode/file:$file"
    fi
   else
    shDebug 0 ""$log" mode:$mode / not a file:$file ?"
   fi
  done
  jsonWriteBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe "$log"
  shPipeFree $jsonConfIfacesPipe
 fi
}
# firewallConfig $ifacesConf $jsonDataPipe
firewallConfig() {
 local ifacesConf="$1"
 local jsonDataPipe="$2"
 local log="firewallConfig:"
 local ifaces=""
 shDebug 2 ""${log}" try include ifacesConf:${ifacesConf}"
 
 [ -z "$(shPipeReadTee $jsonDataPipe)" ] && shDebug 0 ""${log}" empty data pipe" && return ;
 $(shIncludeET $ifacesConf)
 [ -z "$(shPipeReadTee $jsonDataPipe)" ] && shDebug 0 ""${log}" empty data pipe" && return ;
 if [ -z "$ifaces" ];then
  shDebug 0 ""$log" echec empty ifaces:"$ifaces""
 else
  shPipeInit "${log} myIfacesPipe"; local jsonConfIfacesPipe=$?
#  shDebug 0 ""${log}" ifaces:${ifaces}"
#  shDebug 0 ""${log}" ifaces2:$( $cmdEcho $ifaces | $cmdTr -d '[:space:]' | $cmdTr -s '|' ' ' )"
  
  jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
  if [ -z "$(shPipeReadTee $jsonConfIfacesPipe)" ];then
   shPipeFree $jsonConfIfacesPipe
   shPipeInit "${log} myIfacesPipe"; local jsonConfIfacesPipe=$?
   $cmdEcho "{}" | shPipeWrite $jsonConfIfacesPipe
   shDebug 0 ""${log}" empty ifaces json, init empty."
  fi
  for ifaceConf in $( $cmdEcho $ifaces | $cmdTr -d '[:space:]' | $cmdTr -s '|' ' ' );do
   shDebug 1 ""$log"  ifaceConf:${ifaceConf} " >&2
   local iface=""
   local mode=""
   local file=""
   for value in $( $cmdEcho $ifaceConf | $cmdTr -d '[:space:]' | $cmdTr -s ';' ' ' );do
    if [ -z "$iface" ];then
     local iface=""$value""
    elif [ -z "$mode" ];then
     local mode="$( $cmdEcho $value | $cmdCut -d'/' -f 1)"
     local modeValue="$( $cmdEcho $value | $cmdCut -d'/' -f 2- )"
    elif [ -z "$file" ];then
     local file="$value"
    else
     shDebug 0 ""$log" echec reading : unknow:$value in :$ifaceConf"
    fi
   done
   local log="firewallConfig[$iface]:"
   [ -n "$file" ] && [ -f "$rootDarkWall/$file" ] && file="$rootDarkWall/$file"
   if [ -f "$file" ];then
#   firewallJsonConf "$file"
    shDebug 1 ""$log"  firewallJsonConf $mode/$modeValue $file "
    if [ "$mode" = "bridge" ] || [ "$mode" = "bridge6" ] || [ "$mode" = "lo" ] || [ "$mode" = "lo6" ] || [ "$mode" = "ll6" ] || [ "$mode" = "ill6" ] \
     || [ "$mode" = "net" ]  || [ "$mode" = "inet" ] || [ "$mode" = "net6" ] || [ "$mode" = "inet6" ] \
     || [ "$mode" = "pnet" ]  || [ "$mode" = "pinet" ] || [ "$mode" = "pnet6" ] || [ "$mode" = "pinet6" ] \
     || [ "$mode" = "gw" ] || [ "$mode" = "igw" ] || [ "$mode" = "gw6" ] || [ "$mode" = "igw6" ];then
     # ===============================================================
     local regFile="$( $cmdEcho ${file} | $cmdBase64 -i | $cmdTr -d '[:blank:]' | $cmdTr -d '\n' );${mode};${modeValue}"
     shPipeInit "${log} myIfacePipe"; local jsonConfIfacePipe=$?
     jsonReadBig "${iface}" $jsonConfIfacesPipe $jsonConfIfacePipe
     if [ -z "$(shPipeReadTee $jsonConfIfacePipe)" ];then
      shDebug 2 ""$log" try init eth:$iface"
      shPipeFree $jsonConfIfacePipe
      shPipeInit "${log} myIfacePipe"; local jsonConfIfacePipe=$?
      $cmdEcho "{}" | json64InObjectWrite "eth" "${iface}" | json64InObjectWrite "files" "${regFile}" | shPipeWrite $jsonConfIfacePipe
#      shDebug 2 ""$log" init:$(shPipeReadTee $jsonConfIfacePipe)"
#      shPipeReadTee $jsonConfIfacePipe
     else
      local tiFiles="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead "files" )"
      for everRegFile in $( $cmdEcho ${tiFiles} | $cmdTr -s '|' ' ');do
       if [ "|${everRegFile}|" = "|${regFile}|" ];then
        shDebug 0 ""$log" echec file ever reg :${file}"
        local regFile=""
        break
#       else
#        shDebug 2 ""$log" ===== file ever reg :${everRegFile}"
       fi
      done
      if [ -n "${regFile}" ];then
       shPipeInit "${log} myBuffPipe"; local jsonBuffPipe=$?
       shPipeRead $jsonConfIfacePipe | json64InObjectWrite "files" "${tiFiles}|${regFile}" | shPipeWrite $jsonBuffPipe
       shPipeRead $jsonBuffPipe | shPipeWrite $jsonConfIfacePipe
       shPipeFree $jsonBuffPipe
      fi
     fi
     if [ -z "$(shPipeReadTee $jsonConfIfacePipe)" ];then
      shDebug 0 ""$log" not data to write !!!!!!!!!!!! $jsonConfIfacePipe"
     else
      jsonWriteBig "$iface" $jsonConfIfacesPipe $jsonConfIfacePipe "$log"
      shDebug 1 ""$log" $iface $mode $file "
     fi
     shPipeFree $jsonConfIfacePipe
    else
     shDebug 0 ""$log" firewallExecute [$iface] unknow mode:$mode/file:$file"
    fi
   else
    shDebug 0 ""$log" mode:$mode / not a file:$file ?"
   fi
  done
  jsonWriteBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe "$log"
  shPipeFree $jsonConfIfacesPipe
 fi
}
#firewallJsonConf "$file"
firewallJsonConf() {
 local log="firewallJsonConf:"
 local file=""$1""
 
 local jsonTemplate="{}"
 
 local clients=""
 local servers=""
 
 local dropIn=""
 local dropOut=""
 local ruleIn=""
 local ruleOut=""
 net="templateNET"
 ip="templateIP"
 gw="templateGW"
 $(shIncludeET $file)
 if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
  shDebug 0 ""$log" echec params empty: clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
 else
  shDebug 2 ""$log" "$eth" => clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "clients" "$clients" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "servers" "$servers" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "dropIn" "$dropIn" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "dropOut" "$dropOut" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "ruleIn" "$ruleIn" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "ruleOut" "$ruleOut" )"
  local jsonTemplate="$( $cmdEcho $jsonTemplate | json64InObjectWrite "ruleFwd" "$ruleFwd" )"
 fi
 $cmdEcho $jsonTemplate
}
# firewallConf "$eth" "$mode" "$file"
firewallConf() {
 local log="firewallExecuteIp:"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local mode=""$2""
 local file=""$3""
 
 shErrorOnMissing eth mode file
 
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 
 local clients=""
 local servers=""
 
 local dropIn=""
 local dropOut=""
 local ruleIn=""
 local ruleOut=""
 $(shIncludeET $file)
 if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
  shDebug 0 ""$log" echec params empty: clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
 else
  shDebug 2 ""$log" "$eth" => clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
  local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
  if [ -z "$clients" ];then
   shDebug 2 ""$log" no clients:$clients"
  else
   local clientsRulesName="$(firewallClientConf "$clients")"
   if [ -n "$clientsRulesName" ];then
    iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $clientsRulesName | cut -f1 -d '|')""
    iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $clientsRulesName | cut -f2 -d '|')""
   else
    shDebug 0 ""$log" no clientsRulesName for clients:$clients"
   fi
  fi
  
   local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
   if [ -z "$servers" ];then
    shDebug 0 ""$log" no servers:$servers"
   else
    local serversRulesName="$(firewallServerConf "$servers")"
    if [ -n "$serversRulesName" ];then
     iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $serversRulesName | cut -f1 -d '|')""
     iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $serversRulesName | cut -f2 -d '|')""
    else
     shDebug 0 ""$log" no serversRulesName for servers:$servers"
    fi
   fi
  fi
 #done
}
firewallClientConf() {
 local log="firewallClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$clientsMd5" ];then shDebugHidden 1 ""$log" no client MD5 for clients:$clients";return 1;fi
 local clientsRule=""$(iptoolsGetMd5Rule "filter" ""$clientsMd5"")""
 shDebugHidden 1 ""$log" clientsRule:"$clientsRule" clients:"$clients""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! iptoolsRuleExiste "filter" $clientsRuleIn;then
  if iptoolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$clientsRuleIn"
  iptoolsRuleCreate "filter" "$clientsRuleOut"
  # clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
  local cltCmdInput="$(firewallGenerate $clients	client INPUT)"
  local cltCmdOutput="$(firewallGenerate $clients	client OUTPUT)"
  shDebugHidden 1 ""$log" cltCmdInput:"$cltCmdInput" cltCmdOutput:"$cltCmdOutput""
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ACCEPT" >&2
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ACCEPT" >&2
 else
  shDebugHidden O ""$log" rule ever exist"
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewallServerConf() {
 local log="firewallServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then shDebugHidden 1 ""$log" no server MD5 for servers:$servers";return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 shDebugHidden 1 ""$log" serversRule:"$serversRule" servers:"$servers""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  # servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
  local srvCmdInput="$(firewallGenerate $servers	server INPUT)"
  local srvCmdOutput="$(firewallGenerate $servers	server OUTPUT)"
  shDebugHidden 1 ""$log" srvCmdInput:"$srvCmdInput" srvCmdOutput:"$srvCmdOutput""
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ACCEPT" >&2
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ACCEPT" >&2
 else
  shDebugHidden 0 ""$log" rule ever exist"
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
#firewallInitStateRule() {
#}
firewallGenerate() {
 local log="firewallGenerate:"
 local params="$1"
 local role="$(echo $2 | tr '[:upper:]' '[:lower:]')"
 local sens="$(echo $3 | tr '[:lower:]' '[:upper:]')"
 local cmd=""
 
 shDebugHidden 2 ""$log" $params"
 for param in $(echo $params | tr -s '|' ' ');do
  local proto=""
  local port=""
  for value in $(echo $param | tr ';' ' ');do
   if [ -z "$proto" ];then
    local proto="$(echo $value | tr '[:lower:]' '[:upper:]')"
   else if [ -z "$port" ];then
    local port="$value"
   else
    local uid=""
    local gid=""
    for uidgid in $(echo $value | tr '/' ' ');do
     if [ -z "$uid" ];then
      local uid="$uidgid"
     else if [ -z "$gid" ];then
      local gid="$uidgid"
     else
      shDebugHidden 0 ""$log" echec reading uid/gid: unknow $uidgid in : $value"
     fi fi
    done
    if shUserExist $uid 1>&2 && shGroupExist $gid 1>&2; then
     if [ "$sens" = "INPUT" ];then
      if [ "$role" = "client" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j inCltMState
        local cmd="$cmd;$port	|-p $proto --sport $port  -m state --state ESTABLISHED,RELATED"
        if [ "$proto" = "TCP" ];then
         # -j inCltTcpMState
         local cmd="$cmd;$port     |-p $proto --sport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j inCltMState
        local cmd="$cmd;$port	|-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED"
        if [ "$proto" = "TCP" ];then
         # -j inCltTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else if [ "$role" = "server" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j inSrvMState
        local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j inSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j inSrvMState
        local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j inSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else
       shDebugHidden 0 ""$log" echec reading role: unknow $role"
      fi fi # $role is "client" or "server"
     else if [ "$sens" = "OUTPUT" ];then
      if [ "$role" = "client" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -J outCltMState
        local cmd="$cmd;$port	|-p $proto --dport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -J outCltTcpMState
         local cmd="$cmd;$port     |-p $proto --dport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -J outCltMState
        local cmd="$cmd;$port	|-p $proto --match multiport --dports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -J outCltTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --dports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else if [ "$role" = "server" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j outSrvMState
        local cmd="$cmd;$port     |-p $proto --sport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j outSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --sport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j outSrvMState
        local cmd="$cmd;$port     |-p $proto --match multiport --sports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j outSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --sports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else
       shDebugHidden "[ ERROR ]"$log" echec reading role: unknow $role"
      fi fi # $role is "client" or "server"
     else
      shDebugHidden "[ ERROR ]"$log" echec reading sens: unknow $sens"
     fi fi # $sens "INPUT" or "OUTPUT"
    else
      shDebugHidden 0 ""$log" no user $uid or no group $gid"
    fi # if shUserExist $uid && shGroupExist $gid
   fi fi # $value is proto or port or user n...
  done
 done
 shDebugHidden 2 ""$log" $cmd"
 echo "$cmd"
}

#firewallConfig "$*"

#shStartStopScript ""$iptoolsWaitScriptName""