#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewall
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum ps rev"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$( shInclude $rootDarkWall/lib/ipTools )
$( shInclude $rootDarkWall/lib/route )

# firewallPreStart $jsonIfacePipe
firewallPreStart() {
 local log="firewallPreStart:"
 local jsonIfacePipe="$1"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"
 if [ -z "${eth}" ];then
  shDebug 0 ""$log" bad params empty eth:${eth}"
 else
  local log="${log}[${eth}]:"
  shPipeInit "${log} jsonBuffer-start-write-ips"; local jsonBufferPipe=$?
  shPipeRead ${jsonIfacePipe} | routeAddEth | shPipeWrite $jsonBufferPipe
  if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
   $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
   shDebug 0 ""$log" lost pipe for:${eth}"
  else
   shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
  fi
  shPipeFree $jsonBufferPipe
#  local jsonEth="$( $cmdEcho ${jsonEth} | routeAddEth )"
#  local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route )"
  local jsonEthRoute="$(  shPipeReadTee ${jsonIfacePipe} | json64InObjectRead route )"
  local ruleEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
  local ruleEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
  if [ -z "${jsonEthRoute}" ] || [ -z "${ruleEthIn}" ] || [ -z "${ruleEthOut}" ];then
   shDebug 0 ""$log" bad params empty ruleEthIn:${ruleEthIn} ruleEthOut:${ruleEthOut} jsonEthRoute:${jsonEthRoute}"
#  else
#   local log="${log}[${ruleEthIn}/${ruleEthOut}]:"
#   # dhclient is alive
#   if [ -n "$( $cmdPs ax | $cmdGrep dhclient | $cmdGrep "${eth}" )" ];then
#    iptoolsRuleAdd "filter" "${ruleEthIn}	-j InDhcpClient"
#    iptoolsRuleAdd "filter" "${ruleEthOut}	-j OutDhcpClient"
#    shDebug 2 ""$log" enable dhcp for ${eth}."
#   else
#    shDebug 2 ""$log" not enable dhcp for ${eth}."
#   fi
  fi
 fi
}

# firewallCheckIps $jsonIfacePipe $jsonConfIfacePipe
firewallCheckIps() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local log="firewallCheckIps:"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"

 if [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth}"
 else
  local log="${log}["${eth}"]:"
  if [ "$eth" = "lo" ];then
   local ips="$( iptoolsGetIps )"
  else
   local ips="$( iptoolsGetIps "$eth" )"
  fi
  
  local jsonIps="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead ips )"
  if [ -z "${jsonIps}" ];then local jsonIps="{}";fi
  for ip in ${ips};do
   if [ -z "${ip}" ];then continue;fi
   local log="${log}["${eth}"/"${ip}"]:"
   local jsonIp="$( $cmdEcho ${jsonIps} | json64InObjectRead "${ip}" )"
   if [ -n "${jsonIp}" ];then
    shDebug 1 ""${log}" ip:$ip ever inside jsonIps"
   else
    firewallStart $jsonIfacePipe $jsonConfIfacePipe "${ip}"
#    if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
#     shDebug 0 ""${log}" echec firewallStartFile lost json iface"
#    fi
   fi
  done
 fi
}
# firewallStart $jsonIfacePipe $jsonConfIfacePipe $ip
firewallStart() {
 local log="firewallStart:"
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip="$3"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"
 
 if [ -z "${eth}" ] || [ -z "${ip}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth} ip:${ip}"
 else
  local log="${log}["${eth}"/"${ip}"]:"
  shPipeInit "${log} jsonBuffer-start-write-route"; local jsonBufferPipe=$?
  shPipeRead ${jsonIfacePipe} | routeAddIp "${ip}" "$(iptoolsGetNet "${eth}" "${ip}" )" | shPipeWrite $jsonBufferPipe
  if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
   $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
   shDebug 0 ""$log" echec update routeAddIp for ip:$ip"
  else
   shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
  fi
  shPipeFree $jsonBufferPipe
  firewallStartFiles $jsonIfacePipe $jsonConfIfacePipe "${ip}"
  if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
   shDebug 0 ""${log}" echec firewallStartFile lost json iface"
  fi
 fi
}
# firewallStartFiles $jsonIfacePipe $jsonConfIfacePipe "$ip"
firewallStartFiles() {
 local log="firewallStartFiles:"
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip="$3"
 
 local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
 if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
 for fileMode in $( $cmdEcho ${files} | $cmdTr '|' ' ' );do
  if [ -z "${fileMode}" ];then continue;fi
  local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 )"
  local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
  if ( [ "$mode" != "net" ] && [ "$mode" != "lo" ] ) ;then
#   shDebugHidden 2 ""$log" skipe ${mode} " >&2;
   continue;
  fi
  shPipeReadTee $jsonIfacePipe | firewallStartFile "${ip}" "${mode}" "${file}"
 done
}
# firewallStartFiles "$ip" "$mode" "$file"
firewallStartFile() {
 local log="firewallStartFile:"
 local ip="${1}"
 local mode="${2}"
 local file="$( $cmdEcho ${3} | $cmdBase64 -d -i 2>>/dev/null )"
 
 local jsonEth="$( $cmdCat <&0 )"
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead eth )"
 
 if [ -z "${ip}" ] || [ -z "${jsonEth}" ] || [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty ip:${ip} eth:${eth} jsonEth:${jsonEth}"
 else
  local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route )"
  local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
  local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"

  local jsonIps="$( $cmdEcho ${jsonEth} | json64InObjectRead ips )"
  local jsonIp="$( $cmdEcho ${jsonIps} | json64InObjectRead "$ip" )"
  local net="$( $cmdEcho ${jsonIp} | json64InObjectRead net )"
  local broadcast="$( $cmdEcho ${jsonIp} | json64InObjectRead broadcast )"

  local jsonIpRoute="$( $cmdEcho ${jsonIp} | json64InObjectRead route )"
  local markNetIn="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markIn" )"
  local markNetOut="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markOut" )"

  if [ -z "${net}" ] || [ -z "${markNetIn}" ] || [ -z "${markNetOut}" ];then
   shDebug 0 ""${log}" bad params empty net:${net} markNetIn:${markNetIn} markNetOut:${markNetOut} "
  else
   # ==================================================================================================
   local clients="";local servers=""
   local dropIn="";local dropOut="";local ruleIn="";local ruleOut="";local icmpIn="";local icmpOut=""
   local dropEthIn="";local dropEthOut="";local ruleEthIn="";local ruleEthOut="";local icmpEthIn="";local icmpEthOut=""
   local network="${net}";local markExtraIn="";local markExtraOut="";
   if [ ! -f "${file}" ];then
    shDebug 0 ""$log" echec not file:${file}"
    continue
   else
    local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
    shDebug 2 ""$log" fileName:"$fileName" "
   fi
   $(shIncludeET $file )
   if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$icmpIn" ] && [ -z "$icmpOut" ] \
   && [ -z "$dropEthIn" ] && [ -z "$dropEthOut" ] && [ -z "$ruleEthIn" ] && [ -z "$ruleEthOut" ] && [ -z "$icmpEthIn" ] && [ -z "$icmpEthOut" ] \
   && [ -z "$clients" ] && [ -z "$servers" ];then
    shDebug 0 ""$log" echec params empty (ip:"${ip}"):clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" icmpIO:"$icmpIn"/"$icmpOut" dropEthIO:"$dropEthIn"/"$dropEthOut" ruleEthIO:"$ruleEthIn"/"$ruleEthOut" icmpEthIO:"$icmpEthIn"/"$icmpEthOut""
   else
    local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
    shDebug 2 ""$log" "$eth"/ file:"$file" ip:"$ip" net:"$net" broadcast:"$broadcast""
    for subNet in $( $cmdEcho ${network} | $cmdTr ';' ' ' );do
#     if [ -n "${subNet}" ] && [ "${subNet}" != "${net}" ];then
     if [ -n "${subNet}" ];then
      local anMarkExtraIn="$( iptoolsGetMd5Rule "filter" "i${eth}${subNet}" )"
      local anMarkExtraOut="$( iptoolsGetMd5Rule "filter" "o${eth}${subNet}" )"
      iptoolsRuleAdd "filter" "$markEthIn -s "${subNet}" -d "${ip}" -j "${anMarkExtraIn}"" >&2
      iptoolsRuleAdd "filter" "$markEthOut -d "${subNet}" -s "${ip}" -j "${anMarkExtraOut}"" >&2
      local markExtraIn="${anMarkExtraIn};${markExtraIn}"
      local markExtraOut="${anMarkExtraOut};${markExtraOut}"
     fi
    done
    
    if [ -n "$dropEthIn" ] || [ -n "$dropEthOut" ] || [ -n "$ruleEthIn" ] || [ -n "$ruleEthOut" ] || [ -n "$icmpEthIn" ] || [ -n "$icmpEthOut" ];then
     local pFileEthIn="$(firewallCreateRule i"${fileName}")"
     local pFileEthOut="$(firewallCreateRule o"${fileName}")"
     iptoolsRuleAdd "filter" "${markEthIn}"	"-j ${pFileEthIn}"
     iptoolsRuleAdd "filter" "${markEthOut}"	"-j ${pFileEthOut}"
     if [ -n "$dropEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthIn"	"$dropEthIn"	"-j DROP";fi
     if [ -n "$dropEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthOut"	"$dropEthOut"	"-j DROP";fi
     if [ -n "$ruleEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthIn"	"$ruleEthIn"	"-j ACCEPT";fi
     if [ -n "$ruleEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthOut"	"$ruleEthOut"	"-j ACCEPT";fi
     
     if [ -n "${icmpEthIn}" ];then
      local ruleIcmpEthIn="$(firewallCreateRule i"${fileName}")"
      iptoolsRuleAdd "filter" "$pFileEthIn -p icmp  -j ${ruleIcmpEthIn}"
      iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthIn""	"$icmpEthIn"	"-j ACCEPT"
     fi
     if [ -n "${icmpEthOut}" ];then
      local ruleIcmpEthOut="$(firewallCreateRule o"${fileName}")"
      iptoolsRuleAdd "filter" "$pFileEthOut -p icmp  -j ${ruleIcmpEthOut}"
      iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthOut""	"$icmpEthOut"	"-j ACCEPT"
     fi
    fi
    # / if dropEthIn dropEthOut ruleEthIn ruleEthOut icmpEthIn icmpEthOut
    if [ -n "$dropIn" ] || [ -n "$dropOut" ] || [ -n "$ruleIn" ] || [ -n "$ruleOut" ] || [ -n "$icmpIn" ] || [ -n "$icmpOut" ] || [ -n "${clients}" ] || [ -n "${servers}" ];then
     local pFileIn="$(firewallCreateRule i"${fileName}")"
     local pFileOut="$(firewallCreateRule o"${fileName}")"
     for anMark in $( $cmdEcho ${markExtraIn} | $cmdTr ';' ' ' );do
      iptoolsRuleAdd "filter" "${anMark}"	"-j ${pFileIn}"
     done
     for anMark in $( $cmdEcho ${markExtraOut} | $cmdTr ';' ' ' );do
      iptoolsRuleAdd "filter" "${anMark}"	"-j ${pFileOut}"
     done
#     iptoolsRuleAdd "filter" "${markNetIn}"	"-j ${pFileIn}"
#     iptoolsRuleAdd "filter" "${markNetOut}"	"-j ${pFileOut}"
     if [ -n "$dropIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileIn"	"$dropIn"	"-j DROP";fi
     if [ -n "$dropOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileOut"	"$dropOut"	"-j DROP";fi
     if [ -n "$ruleIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileIn"	"$ruleIn"	"-j ACCEPT";fi
     if [ -n "$ruleOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileOut"	"$ruleOut"	"-j ACCEPT";fi
     
     if [ -n "${icmpIn}" ] || [ -n "${icmpOut}" ] || [ -n "${clients}" ] || [ -n "${servers}" ];then
      # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
      local ruleNetworkIn="$(firewallCreateRule i"${fileName}")"
      local ruleNetworkOut="$(firewallCreateRule o"${fileName}")"
      iptoolsRuleAdd "filter" "${pFileIn}"	"-j ${ruleNetworkIn}"
      iptoolsRuleAdd "filter" "${pFileOut}"	"-j ${ruleNetworkOut}"
#      iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pFileIn"	"-s" "${markExtraIn}"	"-j "$ruleNetworkIn""
#      iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pFileOut"	"-d" "${markExtraOut}"	"-j "$ruleNetworkOut""
      
      if [ -n "${icmpIn}" ];then
       local ruleIcmpIn="$(firewallCreateRule i"${fileName}")"
       iptoolsRuleAdd "filter" "${ruleNetworkIn} -p icmp  -j ${ruleIcmpIn}"
       iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
      fi
      if [ -n "${icmpOut}" ];then
       local ruleIcmpOut="$(firewallCreateRule o"${fileName}")"
       iptoolsRuleAdd "filter" "${ruleNetworkOut} -p icmp  -j ${ruleIcmpOut}"
       iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
      fi
      
      local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
      if [ -n "$clients" ];then
       local clientsRulesName="$(firewallClientConf "$clients")"
       if [ -n "$clientsRulesName" ];then
        iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
        iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
       else
        shDebug 0 ""$log" no clientsRulesName for clients:$clients"
       fi
      fi
      
      local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
      if [ -n "$servers" ];then
       local serversRulesName="$(firewallServerConf "$servers")"
       if [ -n "$serversRulesName" ];then
        iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
        iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
       else
        shDebug 0 ""$log" no serversRulesName for servers:$servers"
       fi
      fi
     fi
     #  / if icmpIn icmpOut clients servers
    fi
    # / if dropIn dropOut ruleIn ruleOut icmpIn icmpOut
   fi
   # / if file params
  fi
  # / no marks defined
 fi
 # / if good params
# $cmdEcho ${jsonEth}
}

firewallStop() {
 local log="firewallStop:"
# local eth=""$(iptoolsGetHostEth ""$1"")""
 local eth=""$1""
 if [ -n "$eth" ];then
  for sens in "INPUT" "OUTPUT" "FORWARD";do
   for rule in $($cmdIptables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
    firewallDeleteRule $rule $sens
   done
   for rule in $($cmdIp6tables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
    firewall6DeleteRule $rule $sens
   done
  done
 fi
}
# firewallClean "ruleName"
firewallClean() {
 local log="firewallClean:"
 local table="${*}"
 for rule in $( $cmdIptables -w -nL "$table" | $cmdGrep "/\*" | $cmdCut -f1 -d' ');do
  firewallDeleteRule "${rule}" "${table}"
 done
# for rule in $($cmdIp6tables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
#  firewall6DeleteRule $rule $sens
# done
}
# firewallDeleteRule
firewallDeleteRule() {
 local log="firewallDeleteRule:"
 local rule="$1"
 local from="$2"
 if [ "$rule" = "ACCEPT" ] || [ "$rule" = "DROP" ] || [ "$rule" = "Chain" ] || [ "$rule" = "target" ] || [ -z "$rule" ] || [ -z "$from" ];then
  return
 fi
 
 local subRules="$($cmdIptables -w -nL $rule 2>&1 | $cmdTr -s '\n' '¤')"
 if [ -n "$( $cmdEcho $subRules | $cmdGrep "is incompatible" 2>&1)" ];then
  return
 fi
 if [ -z "$( $cmdEcho $subRules | $cmdGrep "iptables: No chain/target/match by that name.")" ] ;then
  for subRule in $( $cmdEcho "$subRules" | $cmdTr -s '¤' '\n'| $cmdCut -f1 -d' ');do
   if [ -n "$subRule" ];then firewallDeleteRule "$subRule" "$rule";fi
  done
  iptoolsRuleDelete "filter" ""$from""     ""$rule""
 fi
}
firewall6DeleteRule() {
 local log="firewall6DeleteRule:"
 local rule="$1"
 local from="$2"
 if [ "$rule" = "ACCEPT" ] || [ "$rule" = "DROP" ] || [ "$rule" = "Chain" ] || [ "$rule" = "target" ] || [ -z "$rule" ] || [ -z "$from" ];then
  return
 fi
 
 local subRules="$($cmdIp6tables -w -nL $rule 2>&1 | tr -s '\n' '¤')"
 if [ -n "$(echo $subRules | grep "is incompatible" 2>&1)" ];then
  return
 fi
 if [ -z "$(echo $subRules | grep "ip6tables: No chain/target/match by that name.")" ];then
  for subRule in $(echo "$subRules" | tr -s '¤' '\n'| cut -f1 -d' ');do
   if [ -n "$subRule" ];then firewall6DeleteRule $subRule $rule;fi
  done
  ip6toolsRuleDelete "filter" ""$from""     ""$rule""
 fi
}
firewallBridge() {
 local log="firewallBridge:"
 local eth=""$1""
 local file=""$2""
 
 shDebug "[ INFO ]"$log" eth:"$eth" mode:"$mode" file:"$file""
 
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 local dropIn=""
 local dropFw=""
 local dropOut=""
 local ruleIn=""
 local ruleFwd=""
 local ruleOut=""
 $(shIncludeET $file)
 if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug 0 ""$log" echec params empty: dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
 else
  shDebug "[ INFO ]"$log" "$eth" "$file""
  local fwdEth=""$eth""
  firewallGwCreateInterface ""$eth"" ""$fwdEth""
  local ruleIfaceGIn="Gw"$eth"-"$fwdEth"I"
  local ruleIfaceGOut="Gw"$eth"-"$fwdEth"O"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$ruleOut"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
 fi
}
firewallInitIface() {
 local log="firewallInitIface:"
 local iface=""$1""
# local eth=""$(iptoolsGetHostEth ""$iface"")""
 local eth=""$iface""
 
 shDebug 2 ""$log" eth:"$eth""
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 if [ "$eth" = "lo" ];then
  local ips="$(iptoolsGetIps)"
 else
  local ips="$(iptoolsGetIps "$eth")"
 fi
 shDebug 2 ""$log" ip:$ips"
 for ip in $ips;do
  if [ -z "$($echo -e "$ip" | tr -d '[[:space:]]')" ];then continue;fi
  local net=""$(iptoolsGetNet ""$eth"" ""$ip"")""
  local gw=""$(iptoolsGetGw ""$eth"" ""$ip"")""
  local broadcast=""$(iptoolsGetBroadcast ""$eth"" ""$ip"")""
  
  #local ruleCltIn="$(firewallCreateRule In"$eth"Ip)"
  #local ruleCltOut="$(firewallCreateRule Out"$eth"Ip)"
  #local ruleCltIn="In"$eth"Ip"
  #local ruleCltOut="Out"$eth"Ip"
  #iptoolsRuleCreate "filter" "$ruleMd5CltIn"
  #iptoolsRuleCreate "filter" "$ruleCltOut"
  local ruleCltIn="In"$eth"Ip"$ip""
  local ruleCltOut="Out"$eth"Ip"$ip""
  local ruleMd5CltIn=""$(echo "${ruleCltIn}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltIn=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltIn"")""
  local ruleMd5CltOut=""$(echo "${ruleCltOut}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltOut=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltOut"")""
  if [ -z "$ruleCltIn" ] || [ -z "$ruleCltOut" ];then
   shDebug 0 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 0 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
  else
   shDebug 2 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 2 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   if [ "$eth" = "lo" ];then
    iptoolsRuleAdd "filter" "$ruleIfaceIn -d "$ip" -s "$ip" -j "$ruleCltIn""
    iptoolsRuleAdd "filter" "$ruleIfaceOut -d "$ip" -s "$ip" -j "$ruleCltOut""
   else
    iptoolsRuleAdd "filter" "$ruleIfaceIn -d "$ip" -j "$ruleCltIn""
    iptoolsRuleAdd "filter" "$ruleIfaceOut -s "$ip" -j "$ruleCltOut""
   fi
  fi
 done
}
# firewallExecuteIp "$eth" "$ip" "$mode" "$file"
firewallExecuteIp() {
 local log="firewallExecuteIp:"
# local eth=""$(iptoolsGetHostEth ""$1"")""
 local eth=""$1""
 local ip=""$2""
 local mode=""$3""
 local file=""$4""
 local net=""$(iptoolsGetNet ""$eth"" ""$ip"")""
 local broadcast=""$(iptoolsGetBroadcast ""$eth"" ""$ip"")""
 local gw=""$(iptoolsGetGw ""$eth"" ""$ip"")""

 shErrorOnMissing eth ip net mode file
 
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 
 local ruleCltIn="In"$eth"Ip"$ip""
 local ruleCltOut="Out"$eth"Ip"$ip""
 local ruleMd5CltIn=""$($cmdEcho "${ruleCltIn}" | $cmdMd5sum | $cmdCut -f1 -d' ')""
 local ruleCltIn=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltIn"")""
 local ruleMd5CltOut=""$($cmdEcho "${ruleCltOut}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltOut=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltOut"")""
  if [ -z "$ruleCltIn" ] || [ -z "$ruleCltOut" ];then
   shDebug 0 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 0 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   return 0
  else
   shDebug 2 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 2 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   iptoolsRuleAdd "filter" "$ruleIfaceIn -j "$ruleCltIn""
   iptoolsRuleAdd "filter" "$ruleIfaceOut -j "$ruleCltOut""
  fi
  
  local clients=""
  local servers=""
  
  local dropIn=""
  local dropOut=""
  local ruleIn=""
  local ruleOut=""
  $(shIncludeET $file)
  if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug 0 ""$log" echec params empty (ip:"$ip"): clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
  else
   shDebug 2 ""$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw" broadcast:"$broadcast""
   
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
   
   # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
   local ruleNetworkIn="$(firewallCreateRule In"$eth"N)"
   local ruleNetworkOut="$(firewallCreateRule Out"$eth"N)"
   iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleCltIn""	"-s" "$network"	"-j "$ruleNetworkIn""
   iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleCltOut""	"-d" "$network"	"-j "$ruleNetworkOut""
   if [ "$mode" = "lo" ];then
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""   "-d" "$network" "-j "$ruleCltIn""
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""  "-s" "$network" "-j "$ruleCltOut""
   fi
   
   local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
   if [ -z "$clients" ];then
    shDebug 2 ""$log" no clients:$clients"
   else
    local clientsRulesName="$(firewallClientConf "$clients")"
    if [ -n "$clientsRulesName" ];then
     iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $clientsRulesName | cut -f1 -d '|')""
     iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $clientsRulesName | cut -f2 -d '|')""
    else
     shDebug 0 ""$log" no clientsRulesName for clients:$clients"
    fi
   fi
   
   local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
   if [ -z "$servers" ];then
    shDebug 0 ""$log" no servers:$servers"
   else
    local serversRulesName="$(firewallServerConf "$servers")"
    if [ -n "$serversRulesName" ];then
     iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $serversRulesName | cut -f1 -d '|')""
     iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $serversRulesName | cut -f2 -d '|')""
    else
     shDebug 0 ""$log" no serversRulesName for servers:$servers"
    fi
   fi
  fi
 #done
}
firewallClientConf() {
 local log="firewallClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$clientsMd5" ];then shDebugHidden 1 ""$log" no client MD5 for clients:$clients";return 1;fi
 local clientsRule=""$(iptoolsGetMd5Rule "filter" ""$clientsMd5"")""
 shDebugHidden 1 ""$log" clientsRule:"$clientsRule" clients:"$clients""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! iptoolsRuleExiste "filter" $clientsRuleIn;then
  if iptoolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$clientsRuleIn"
  iptoolsRuleCreate "filter" "$clientsRuleOut"
  # clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
#  local cltCmdInput="$(firewallGenerate $clients	client INPUT)"
#  local cltCmdOutput="$(firewallGenerate $clients	client OUTPUT)"
#  shDebugHidden 1 ""$log" cltCmdInput:"$cltCmdInput" cltCmdOutput:"$cltCmdOutput""
#  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ACCEPT" >&2
#  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ACCEPT" >&2
  for myProto in TCP UDP;do
   local ruleInCltMState="inCltMState${myProto}"
   local cltCmdInput="$(firewallCmdGenerate "${myProto}" client INPUT $clients)"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ${ruleInCltMState}" >&2
   
   local ruleOutCltMState="outCltMState${myProto}"
   local cltCmdOutput="$(firewallCmdGenerate "${myProto}" client OUTPUT $clients)"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ${ruleOutCltMState}" >&2
  done
 else
  shDebugHidden O ""$log" rule ever exist"
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewallServerConf() {
 local log="firewallServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then shDebugHidden 1 ""$log" no server MD5 for servers:$servers";return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 shDebugHidden 1 ""$log" serversRule:"$serversRule" servers:"$servers""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  # servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
#  local srvCmdInput="$(firewallGenerate $servers	server INPUT)"
#  local srvCmdOutput="$(firewallGenerate $servers	server OUTPUT)"
#  shDebugHidden 1 ""$log" srvCmdInput:"$srvCmdInput" srvCmdOutput:"$srvCmdOutput""
#  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ACCEPT" >&2
#  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ACCEPT" >&2
  for myProto in TCP UDP;do
   local ruleInSrvMState="inSrvMState${myProto}"
   local srvCmdInput="$(firewallCmdGenerate "${myProto}" server INPUT $servers)"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ${ruleInSrvMState}" >&2
   local ruleOutSrvMState="outSrvMState${myProto}"
   local srvCmdOutput="$(firewallCmdGenerate "${myProto}" server OUTPUT $servers)"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ${ruleOutSrvMState}" >&2
  done
 else
  shDebugHidden 0 ""$log" rule ever exist"
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
#firewallInitStateRule() {
#}
# for myProto in TCP UDP;do
#  local ruleInCltMState="inCltMState${myProto}"
#  local ruleOutCltMState="outCltMState${myProto}"
#  local ruleInSrvMState="inSrvMState${myProto}"
#  local ruleOutSrvMState="outSrvMState${myProto}"
#  firewallCmdGenerate "${myProto}" server OUTPUT $servers
# done
#
firewallCmdGenerate() {
 local log="firewallCmdGenerate:"
 local askProto="$(echo $1 | tr '[:lower:]' '[:upper:]')"
 local role="$(echo $2 | tr '[:upper:]' '[:lower:]')"
 local sens="$(echo $3 | tr '[:lower:]' '[:upper:]')"
 local params="$4"
 local cmd=""
 
 shDebugHidden 2 ""$log" $params"
 for param in $(echo $params | tr -s '|' ' ');do
  local haveUidGid=0
  local proto=""
  local port=""
  local data_ugid=""
  for value in $(echo $param | tr ';' ' ');do
   if [ -z "$proto" ];then
    local proto="$(echo $value | tr '[:lower:]' '[:upper:]')"
    if [ "${proto}" != "${askProto}" ];then break;fi
   else if [ -z "$port" ];then
    local port="$value"
   else
    local uid=""
    local gid=""
    for uidgid in $(echo $value | tr '/' ' ');do
     if [ -z "$uid" ];then
      local uid="$uidgid"
     else if [ -z "$gid" ];then
      local gid="$uidgid"
      if shUserExist $uid 1>&2 && shGroupExist $gid 1>&2;then
       local haveUidGid=1
       local cmdOwner="$(echo "-m owner --uid-owner $uid --gid-owner $gid" | tr ' ' '¤')"
       if [ -z "$data_ugid" ];then local data_ugid="$cmdOwner"
       else local data_ugid="$data_ugid $cmdOwner"
       fi
      else
       shDebugHidden 0 ""$log" no user $uid or no group $gid exists"
      fi
     else
      shDebugHidden 0 ""$log" echec reading uid/gid: unknow $uidgid in : $value"
     fi fi
    done
   fi fi # $value is proto or port or user n...
  done
  if [ "${proto}" != "${askProto}" ];then continue;fi
  if [ "$haveUidGid" -eq 0 ];then
   local cmdOwner=" "
  fi
  shDebugHidden 1 ""$log" try proto:$proto port:$port sens:$sens role:$role"
  if [ -n "$proto" ] && [ -n "$port" ] && [ -n "$sens" ] && [ -n "$role" ];then
   local port="$( iptoolsServicesGetPort "${proto}" "${port}" )"
   shDebugHidden 1 ""$log" try port:$port"
   if [ "$sens" = "INPUT" ];then
    if [ "$role" = "client" ];then
     if [ -z "$(echo $port | grep :)" ];then
      # -j inCltMState
      local cmd="$cmd;$port	|-p $proto --sport $port"
     else
      # -j inCltMState
      local cmd="$cmd;$port	|-p $proto --match multiport --sports $port"
     fi
    else if [ "$role" = "server" ];then
     if [ -z "$(echo $port | grep :)" ];then
      # -j inSrvMState
      local cmd="$cmd;$port     |-p $proto --dport $port"
     else
      # -j inSrvMState
      local cmd="$cmd;$port     |-p $proto --match multiport --dports $port"
     fi
    else
     shDebugHidden 0 ""$log" echec reading role: unknow $role"
    fi fi # $role is "client" or "server"
   else if [ "$sens" = "OUTPUT" ];then
    for cmdDataUIDGID in ${data_ugid};do
     local cmdUIDGID="$(echo $cmdDataUIDGID | tr '¤' ' ')"
     if [ "$role" = "client" ];then
      if [ -z "$(echo $port | grep :)" ];then
       # -J outCltMState
       local cmd="$cmd;$port	|-p $proto --dport $port ${cmdUIDGID}"
      else
       # -J outCltMState
       local cmd="$cmd;$port	|-p $proto --match multiport --dports $port ${cmdUIDGID}"
      fi
     else if [ "$role" = "server" ];then
      if [ -z "$(echo $port | grep :)" ];then
       # -j outSrvMState
       local cmd="$cmd;$port     |-p $proto --sport $port ${cmdUIDGID}"
      else
       # -j outSrvMState
       local cmd="$cmd;$port     |-p $proto --match multiport --sports $port ${cmdUIDGID}"
      fi
     else
      shDebugHidden "[ ERROR ]"$log" echec reading role: unknow $role"
     fi fi # $role is "client" or "server"
    done
   else
    shDebugHidden "[ ERROR ]"$log" echec reading sens: unknow $sens"
   fi fi # $sens "INPUT" or "OUTPUT"
  else
   shDebugHidden 0 ""$log" echec no proto:$proto or no port:$port or no sens:$sens or no role:$role"
  fi # not enought params
 done
 shDebugHidden 2 ""$log" $cmd"
 echo "$cmd"
}

firewallGenerate() {
 local log="firewallGenerate:"
 local params="$1"
 local role="$(echo $2 | tr '[:upper:]' '[:lower:]')"
 local sens="$(echo $3 | tr '[:lower:]' '[:upper:]')"
 local cmd=""
 
 shDebugHidden 2 ""$log" $params"
 for param in $(echo $params | tr -s '|' ' ');do
  local haveUidGid=0
  local proto=""
  local port=""
  for value in $(echo $param | tr ';' ' ');do
   if [ -z "$proto" ];then
    local proto="$(echo $value | tr '[:lower:]' '[:upper:]')"
   else if [ -z "$port" ];then
    local port="$value"
   else
    local uid=""
    local gid=""
    for uidgid in $(echo $value | tr '/' ' ');do
     if [ -z "$uid" ];then
      local uid="$uidgid"
     else if [ -z "$gid" ];then
      local gid="$uidgid"
      if shUserExist $uid 1>&2 && shGroupExist $gid 1>&2;then
       local haveUidGid=1
       local cmdOwner="$(echo "-m owner --uid-owner $uid --gid-owner $gid" | tr ' ' '¤')"
       if [ -z "$data_ugid" ];then local data_ugid="$cmdOwner"
       else local data_ugid="$data_ugid $cmdOwner"
       fi
      else
       shDebugHidden 0 ""$log" no user $uid or no group $gid exists"
      fi # if shUserExist $uid && shGroupExist $gid
     else
      shDebugHidden 0 ""$log" echec reading uid/gid: unknow $uidgid in : $value"
     fi fi
    done
   fi fi # $value is proto or port or user n...
  done
  if [ "$haveUidGid" -eq 0 ];then
   local cmdOwner=" "
  fi
  if [ -n "$proto" ] && [ -n "$port" ] & [ -n "$sens" ] && [ -n "$role" ];then
   local port="$( iptoolsServicesGetPort "${proto}" "${port}" )"
   if [ "$sens" = "INPUT" ];then
    if [ "$role" = "client" ];then
     if [ -z "$(echo $port | grep :)" ];then
      # -j inCltMState
      local cmd="$cmd;$port	|-p $proto --sport $port  -m state --state ESTABLISHED,RELATED"
      if [ "$proto" = "TCP" ];then
       # -j inCltTcpMState
       local cmd="$cmd;$port     |-p $proto --sport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
       local cmd="$cmd;$port     |-p $proto --sport $port  -m state --state NEW --syn"
      fi
     else
      # -j inCltMState
      local cmd="$cmd;$port	|-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED"
      if [ "$proto" = "TCP" ];then
       # -j inCltTcpMState
       local cmd="$cmd;$port     |-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
       local cmd="$cmd;$port     |-p $proto --match multiport --sports $port  -m state --state NEW --syn"
      fi
     fi
    else if [ "$role" = "server" ];then
     if [ -z "$(echo $port | grep :)" ];then
      # -j inSrvMState
      local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW"
      if [ "$proto" = "TCP" ];then
       # -j inSrvTcpMState
       local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
       local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state NEW --syn"
      fi
     else
      # -j inSrvMState
      local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW"
      if [ "$proto" = "TCP" ];then
       # -j inSrvTcpMState
       local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
       local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state NEW --syn"
      fi
     fi
    else
     shDebugHidden 0 ""$log" echec reading role: unknow $role"
    fi fi # $role is "client" or "server"
   # =========== OUTPUT
   else if [ "$sens" = "OUTPUT" ];then
    for cmdDataUIDGID in ${data_ugid};do
     local cmdUIDGID="$(echo $cmdDataUIDGID | tr '¤' ' ')"
     if [ "$role" = "client" ];then
      if [ -z "$(echo $port | grep :)" ];then
       # -J outCltMState
       local cmd="$cmd;$port	|-p $proto --dport $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW"
       if [ "$proto" = "TCP" ];then
        # -J outCltTcpMState
        local cmd="$cmd;$port     |-p $proto --dport $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        local cmd="$cmd;$port     |-p $proto --dport $port ${cmdUIDGID} -m state --state NEW --syn"
       fi
      else
       # -J outCltMState
       local cmd="$cmd;$port	|-p $proto --match multiport --dports $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW"
       if [ "$proto" = "TCP" ];then
        # -J outCltTcpMState
        local cmd="$cmd;$port     |-p $proto --match multiport --dports $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        local cmd="$cmd;$port     |-p $proto --match multiport --dports $port ${cmdUIDGID} -m state --state NEW --syn"
       fi
      fi
     else if [ "$role" = "server" ];then
      if [ -z "$(echo $port | grep :)" ];then
       # -j outSrvMState
       local cmd="$cmd;$port     |-p $proto --sport $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW"
       if [ "$proto" = "TCP" ];then
        # -j outSrvTcpMState
        local cmd="$cmd;$port     |-p $proto --sport $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED ! --syn"
        local cmd="$cmd;$port     |-p $proto --sport $port ${cmdUIDGID} -m state --state NEW --syn"
       fi
      else
       # -j outSrvMState
       local cmd="$cmd;$port     |-p $proto --match multiport --sports $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED,NEW"
       if [ "$proto" = "TCP" ];then
        # -j outSrvTcpMState
        local cmd="$cmd;$port     |-p $proto --match multiport --sports $port ${cmdUIDGID} -m state --state ESTABLISHED,RELATED ! --syn"
        local cmd="$cmd;$port     |-p $proto --match multiport --sports $port ${cmdUIDGID} -m state --state NEW --syn"
       fi
      fi
     else
      shDebugHidden "[ ERROR ]"$log" echec reading role: unknow $role"
     fi fi # $role is "client" or "server"
    done
   else
    shDebugHidden "[ ERROR ]"$log" echec reading sens: unknow $sens"
   fi fi # $sens "INPUT" or "OUTPUT"
  else
   shDebugHidden 0 ""$log" echec no proto:$proto or no port:$port or no sens:$sens or no role:$role"
  fi # not enought params
 done
 shDebugHidden 2 ""$log" $cmd"
 echo "$cmd"
}
# inCltMState="-m state --state ESTABLISHED,RELATED"
# inCltTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"
# inSrvMState="-m state --state ESTABLISHED,RELATED,NEW"
# inSrvTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"

# outCltMState="-m state --state ESTABLISHED,RELATED,NEW"
# outCltTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"
# outSrvMState="-m state --state ESTABLISHED,RELATED"
# outSrvTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"

firewallCreateRule() {
 local log="firewallCreateRule:"
 local ruleName=""$1""
 local cpt=0

 while iptoolsRuleExiste "filter" ""$ruleName""$cpt"" && [ $cpt -lt 1000 ];do
  cpt=$((cpt+1))
 done
 iptoolsRuleCreate "filter" ""$ruleName""$cpt"" 2>&1 >> /dev/null
 echo ""$ruleName""$cpt""
}


firewallStartGw() {
 local log="firewallStartGw:"
 local ifacesConf="$1"
 
 shDebug "[ INFO ]"$log"ifaceConf "$ifacesConf""
# for eth in $(ipToolsGetEths);do
#  shDebug "[ INFO ]"$log" mangle add $eth"
# done
 
 $(shIncludeET $ifacesConf)
 if [ -z "ifaceConf" ];then
  shDebug "[ ERROR ]"$log" echec empty ifaceConf : "$ifacesConf""
 else
  local initGwNetIptables="$initGwNetIptables iptables -t nat -P PREROUTING ACCEPT"
  local initGwNetIptables="$initGwNetIptables;iptables -t nat -P POSTROUTING ACCEPT"
  local initGwNetIptables="$initGwNetIptables;iptables -t nat -P OUTPUT ACCEPT"
  if ! iptoolsExecute "$initGwNetIptables" ; then
   shDebug "[ ERROR ]"$log" init gw iptables for nat"
  else
   shDebug "[ INFO ]"$log" init gw iptables for nat"
  fi

  for ifaceConf in $(echo $ifaces | tr -d ' ' | tr -d '\t' | tr -s '|' ' ');do
   local iface=""
   local mode=""
   local file=""
   
   for value in $(echo $ifaceConf | tr ';' ' ');do
    if [ -z "$iface" ];then
     local eth=""$value""
#     local iface=""$(iptoolsGetHostEth ""$eth"")""
     local iface=""$eth""
     if [ "$value" = "$iface" ];then
      shDebug "[ INFO ]"$log" value:$value iface:$iface"
#     brctlCmd="${brctlCmd:-$(which brctl)}"
#     brctlCmd="${brctlCmd:-/sbin/brctl}"
#     if [ -x "$brctlCmd" ];then
#      for phyABr in $($brctlCmd show $iface | tail -n+2 | rev | cut -f1 | rev);do
#       for phyBBr in $($brctlCmd show $iface | tail -n+2 | rev | cut -f1 | rev);do
#        if [ "$phyABr" = "$phyBBr" ];then continue
#        else
#         #shDebug "[ INFO ]"$log" iptoolsRuleAdd "filter" "FORWARD -i "$iface" -o "$iface" -s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT""
#         #iptoolsRuleAdd "filter" "FORWARD -i "$phyABr" -o "$phyBBr" -s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT"
#        fi
#       done
#      done
#     fi
     fi
    else if [ -z "$mode" ];then
     local mode="$(echo $value | cut -d'/' -f 1)"
     local modeValue="$(echo $value | cut -d'/' -f 2- )"
    else if [ -z "$file" ];then
     local file="$value"
    else
       shDebug "[ ERROR ]"$log" echec reading : "$ifacesConf" unknow:$value in :$ifaceConf"
    fi fi fi
   done
   if [ -n "$mode" ] && [ -n "$file" ];then
    if [ "$mode" = "gw" ] || [ "$mode" = "igw" ];then
     shDebug "[ INFO ]"$log"$iface $mode $modeValue $file"
     local ip="$( $cmdEcho $modeValue | $cmdCut -f1 -d/ )"
     local ethFwd="$( $cmdEcho $modeValue | $cmdCut -f2 -d/ )"
     local ipFwd="$( $cmdEcho $modeValue | $cmdCut -f3 -d/ )"
     firewallGateway $iface $ip $ethFwd $ipFwd $mode $file
    elif [ "$mode" = "mangle" ];then
     shDebug "[ INFO ]"$log" firewallMangleExecute [$eth,$modeValue]"
     firewallMangleExecute $eth $modeValue
    fi
   fi
  done
 fi

}
firewallStart2() {
 
 local ruleInException="$(firewallCreateRule InStartException)"
 local ruleOutException="$(firewallCreateRule OutStartException)"
 iptoolsRuleAdd "filter" "INPUT  -j "$ruleInException""
 iptoolsRuleAdd "filter" "OUTPUT -j "$ruleOutException""
 
 iptoolsRuleAdd "filter" ""$ruleInException"	-p UDP --sport 53	-j ACCEPT"
 iptoolsRuleAdd "filter" ""$ruleOutException"	-p UDP --dport 53	-j ACCEPT"
 iptoolsRuleAdd "filter" ""$ruleInException"	-p UDP --dport 53	-j ACCEPT"
 iptoolsRuleAdd "filter" ""$ruleOutException"	-p UDP --sport 53	-j ACCEPT"
 
 local ifaceIsGw=0
 local ifaces=""
 $(shIncludeET $ifacesConf)
 if [ -z "$ifaces" ];then
  shDebug 0 ""$log" echec empty ifaceConf : "$ifaces""
 else
  for ifaceConf in $(echo $ifaces | tr -d ' ' | tr -d '\t' | tr -s '|' ' ');do
   local iface=""
   local mode=""
   local file=""
   
   for value in $(echo $ifaceConf | tr ';' ' ');do
    if [ -z "$iface" ];then
     local iface=""$value""
    else if [ -z "$mode" ];then
     local mode="$(echo $value | cut -d'/' -f 1)"
     local modeValue="$(echo $value | cut -d'/' -f 2- )"
    else if [ -z "$file" ];then
     local file="$value"
    else
     shDebug 0 ""$log" echec reading : "$ifacesConf" unknow:$value in :$ifaceConf"
    fi fi fi
   done
   local brIface=""$(iptoolsGetHostEth ""$iface"")""
   if [ "$iface" = "$eth" ] && [ -n "$mode" ];then
    if [ "$mode" = "mangle" ];then
     shDebug "[ INFO ]"$log" will lunch mangle to next upnpSrv Check"
    else if [ -n "$file" ];then
     if [ "$mode" = "bridge" ];then
      firewallBridge $eth $file
      shDebug "[ INFO ]"$log" firewallBridge [$iface,$file]"
     else if [ "$mode" = "lo" ] || [ "$mode" = "net" ];then
      if [ "$eth" != "$brIface" ];then
       shDebug "[ WARN ]"$log" $eth bridged => $brIface"
      else
       firewallExecute $eth $mode $file
       shDebug "[ INFO ]"$log" firewallExecute [$iface,$mode,$file]"
      fi
     else if [ "$mode" = "lo6" ] || [ "$mode" = "net6" ];then
      firewall6Execute $eth $mode $file
     else if [ "$mode" = "gw" ] || [ "$mode" = "igw" ];then
      local ifaceIsGw=1
      shDebug "[ INFO ]"$log" will lunch gw to next upnpSrv Check"
      if [ -f "$firewallTmpDir/gw.ready" ];then rm $firewallTmpDir/gw.ready;fi
     else
      shDebug 0 ""$log" echec unknow mode:$mode in :$ifaceConf"
     fi fi fi fi
    fi fi
   fi
  done
 fi
 if [ $ifaceIsGw -eq 1 ];then
  firewallGwInterface "$eth"
 fi
 firewallDeleteRule $ruleInException	"INPUT"
 firewallDeleteRule $ruleOutException	"OUTPUT"
}