#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewall6
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

$( shInclude $rootDarkWall/lib/ip6Tools )
$( shInclude $rootDarkWall/lib/route6 )

# firewall6PreStart $jsonIfacePipe
firewall6PreStart() {
 local log="firewall6PreStart:"
 local jsonIfacePipe="$1"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"
# local jsonEth="$( $cmdCat <&0 )"
# jsonEth = "$( $cmdEcho $jsonEth | firewall6PreStart )"
 if [ -z "${eth}" ];then
  shDebug 0 ""$log" bad params empty eth:${eth}"
 else
  local log="${log}[${eth}]:"
#  local jsonEth="$( $cmdEcho ${jsonEth} | route6AddEth )"
  shPipeInit "${log} jsonBuffer-start-write-ips"; local jsonBufferPipe=$?
  shPipeRead ${jsonIfacePipe} | route6AddEth | shPipeWrite $jsonBufferPipe
  if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
   $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
   shDebug 0 ""$log" lost pipe for:${eth}"
  else
   shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
  fi
  shPipeFree $jsonBufferPipe
#  local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route6 )"
  local jsonEthRoute="$(  shPipeReadTee ${jsonIfacePipe} | json64InObjectRead route6 )"
  local ruleEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
  local ruleEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
  if [ -z "${jsonEthRoute}" ] || [ -z "${ruleEthIn}" ] || [ -z "${ruleEthOut}" ];then
   shDebug 0 ""$log" bad params empty ruleEthIn:${ruleEthIn} ruleEthOut:${ruleEthOut} jsonEthRoute:${jsonEthRoute}"
#  else
#   local log="${log}[${ruleEthIn}/${ruleEthOut}]:"
#   # dhclient is alive
#   if [ -n "$( $cmdPs ax | $cmdGrep dhclient | $cmdGrep "${eth}" )" ];then
#    ip6toolsRuleAdd "filter" "${ruleEthIn}	-j InDhcpClient6"
#    ip6toolsRuleAdd "filter" "${ruleEthOut}	-j OutDhcpClient6"
#    shDebug 2 ""$log" enable dhcp for ${eth}."
#   else
#    shDebug 2 ""$log" not enable dhcp for ${eth}."
#   fi
  fi
 fi
}
# firewall6CheckIps $jsonIfacePipe $jsonConfIfacePipe
firewall6CheckIps() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local log="firewallCheckIps:"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"

 if [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth}"
 else
  if [ "$eth" = "lo" ];then
#   local ip6s="$( ip6toolsGetIps )"
   local ip6s="$( $cmdIp -6 route show table local | $cmdGrep 'local ' | $cmdCut -d' ' -f2 )"
  else
   local ip6s=""
   local propsIp6s="$( ip6toolsGetIps "$eth" )"
   for anIp6 in $( $cmdIp -6 route show table local | $cmdGrep "local " | $cmdCut -d' ' -f2 );do
    [ -n "$( $cmdEcho $propsIp6s | $cmdGrep "$anIp6" )" ] && local ip6s="$anIp6 $ip6s"
   done
  fi
  
  local jsonIp6s="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead ip6s )"
  if [ -z "$jsonIp6s" ];then local jsonIp6s="{}";fi
  local ll6=""
  for ip6 in $ip6s;do
   if ip6IsInNetwork "${ip6}" "fe80::/10";then
    if [ -z "${ll6}" ];then local ll6="${ip6}";
    else shDebug 0 ""${log}" multi link local ${ip6} first take ${ll6}"
    fi
   fi
  done
  for ip6 in $ip6s;do
#   if [ -z "${ip6}"  ] || ip6IsInNetwork "${ip6}" "fe80::/10";then continue;fi
   local log="firewall6Check["${eth}"/"${ip6}"]:"
   local jsonIp6="$( $cmdEcho $jsonIp6s | json64InObjectRead "${ip6}" )"
   if [ -n "${jsonIp6}" ];then
    shDebug 1 ""$log" ip6:${ip6} ever inside jsonIp6s"
   else
    local net6=""$( ip6toolsGetNet ""${eth}"" ""${ip6}"" )""
    if [ "${eth}" != "lo" ];then
     echo ip -6 addr replace "${ip6}" dev "${eth}" >> /tmp/ip6replace.log
     ip -6 addr replace "${ip6}" dev "${eth}" >> /tmp/ip6replace.log
    fi
    if [ -z "${net6}" ];then
     shDebug 0 ""${log}" ip6:${ip6} no net6 found!!!!!!!!!!!!!!!!!"
    else
     firewall6Start $jsonIfacePipe $jsonConfIfacePipe "${ip6}"
#     if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
#      shDebug 0 ""${log}" echec firewallStartFile lost json iface"
#     fi
    fi
   fi
  done
 fi
}
# firewall6Start $jsonIfacePipe $jsonConfIfacePipe $ip6
firewall6Start() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip6="$3"
 local log="firewall6Start:"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"

 if [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth}"
 else
  local log="firewall6Start["${eth}"]:"
  
  if [ "${eth}" = "lo" ];then
   # Add Filter Rule
   local markNet6In="$( ip6toolsGetMd5Rule "filter" "${eth}${ip6}In" )"
   local markNet6Out="$( ip6toolsGetMd5Rule "filter" "${eth}${ip6}Out" )"
   local jsonEthRoute6="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead route6 )"
   local markEthIn="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markIn" )"
   local markEthOut="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markOut" )"
   ip6toolsRuleAdd "filter" "$markEthIn -d "${ip6}/128" -j "${markNet6In}""
   ip6toolsRuleAdd "filter" "$markEthOut -s "${ip6}/128" -j "${markNet6Out}""
   shDebug 2 ""${log}" added filter rule"
   local jsonIp6Route="$( $cmdEcho {} )"
   local jsonIp6Route="$( $cmdEcho ${jsonIp6Route} | json64InObjectWrite "markIn" "${markNet6In}" )"
   local jsonIp6Route="$( $cmdEcho ${jsonIp6Route} | json64InObjectWrite "markOut" "${markNet6Out}" )"
   local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite route ${jsonIp6Route} )"
   local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite net "${ip6}/128" )"
   local jsonIp6s="$( $cmdEcho ${jsonIp6s} | json64InObjectWrite "${ip6}" "${jsonIp6}" )"
   
   shPipeInit "${log} jsonBuffer-start6-write-ip6s"; local jsonBufferPipe=$?
   shPipeRead ${jsonIfacePipe} | json64InObjectWrite ip6s "${jsonIp6s}" | shPipeWrite $jsonBufferPipe
   if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
    $cmdEcho "LOST6" | shPipeWrite $jsonIfacePipe
    shDebug 0 ""$log" echec update jsonEth on  jsonIp6Route in lo"
   else
    shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
   fi
   shPipeFree $jsonBufferPipe
  else
   local net6=""$( ip6toolsGetNet ""${eth}"" ""${ip6}"" )""
   if [ -z "${net6}" ];then
    shDebug 0 ""${log}" ip6:${ip6} no net6 found!!!!!!!!!!!!!!!!!"
   else
    local log="firewall6Start["${eth}"/"${ip6}"/"${net6}"]:"
    shPipeInit "${log} jsonBuffer-start6-write-route6"; local jsonBufferPipe=$?
    shPipeRead ${jsonIfacePipe} | route6AddIp "${ip6}" "${net6}" "${ll6}" | shPipeWrite $jsonBufferPipe
    if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
     $cmdEcho "LOST6" | shPipeWrite $jsonIfacePipe
     shDebug 0 ""${log}" echec route6AddIp for ip6:${ip6}"
    else
     shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
     shDebug 1 ""${log}" success route6AddIp for ip6:${ip6}"
    fi
    shPipeFree $jsonBufferPipe
   fi
  fi
  
  firewall6StartFiles $jsonIfacePipe $jsonConfIfacePipe "${ip6}"
#  if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
#   shDebug 0 ""${log}" echec firewall6StartFile"
#  else
#   shDebug 1 ""${log}" sucess firewall6StartFile"
#  fi
 fi
}
# firewall6StartFiles $jsonIfacePipe $jsonConfIfacePipe "${ip6}"
firewall6StartFiles() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip6="$3"
 
 local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
 if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
 for fileMode in $( $cmdEcho ${files} | $cmdTr '|' ' ' );do
  if [ -z "${fileMode}" ];then continue;fi
  local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 )"
  local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
#  if ip6IsInNetwork ${ip6} "::1/128" ; then
#   if [ "$mode" != "lo6" ] ; then
##    shDebug 2 ""${log}" ip6:${ip6} is LinkLoop for lo6 skipe ${mode} ${file} "
#    continue;
#   fi
##  elif ip6IsInNetwork ${ip6} "fe80::/10" ; then
##   if [ "$mode" != "ll6" ] && [ "$mode" != "lo6" ] ; then
###   shDebugHidden 2 ""${log}" ip6:${ip6} is LinkLocal for ll6 skipe ${mode} ${file} " >&2;
##    continue
##   fi
  if [ "$mode" != "net6" ] && [ "$mode" != "ll6" ] && [ "$mode" != "lo6" ];then
#   shDebugHidden 2 ""${log}" ip6:${ip6} is LinkSite/Global for net6 or lo6 skipe ${mode} ${file} " >&2
   continue
  fi
  shPipeReadTee $jsonIfacePipe | firewall6StartFile "${ip6}" "${mode}" "${file}"
 done
}
 
# echo ${jsonEth} | firewall6StartFile "${ip6}" "${mode}" "${file}"
firewall6StartFile() {
 local log="firewall6StartFile"
 local ip6="$1"
 local mode="$2"
 local file64="$3"
 
 local jsonEth="$( $cmdCat <&0 )"
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead eth )"
 local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route6 )"
 local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
 
 if [ -z "${ip6}" ] || [ -z "${eth}" ] || [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ];then
  shDebugHidden 0 ""${log}" bad params empty ip6:${ip6} eth:${eth} markEthIn:${markEthIn} markEthOut:${markEthOut} jsonEthRoute:${jsonEthRoute} jsonEth:${jsonEth}" >&2
 else
  local log="firewall6StartFile[ ${eth}/${ip6} ]"
  local jsonIp6s="$( $cmdEcho ${jsonEth} | json64InObjectRead ip6s )"
  local jsonIp6="$( $cmdEcho ${jsonIp6s} | json64InObjectRead "${ip6}" )"
  if ! ip6IsInNetwork ${ip6} "fe80::/10" ; then
   local net6="$( $cmdEcho ${jsonIp6} | json64InObjectRead net6 )"
   local ll6="$( $cmdEcho ${jsonIp6} | json64InObjectRead ll6 )"
  else
   local net6="fe80::/10"
   local ll6="${ip6}"
  fi
  local jsonIp6Route="$( $cmdEcho ${jsonIp6} | json64InObjectRead route )"
  local markNet6In="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markIn" )"
  local markNet6Out="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markOut" )"
  
  if ( [ -z "${net6}" ] && [ "lo" != "${eth}" ] ) || [ -z "${markNet6In}" ] || [ -z "${markNet6Out}" ];then
   shDebugHidden 0 ""${log}" bad params empty net6:${net6} markNet6In:${markNet6In} markNet6Out:${markNet6Out} jsonIp6:${jsonIp6}" >&2
  else
   local log="${log}[${markNet6In}/${markNet6Out}]"
   # ==================================================================================================
   local file="$( $cmdEcho $file64 | $cmdBase64 -d -i 2>>/dev/null )"
   local clients=""; local servers=""
   local dropIn="";local dropOut="";local ruleIn="";local ruleOut="";local icmpIn="";local icmpOut=""
   local network="${net6}";local markExtraIn="";local markExtraOut="";
   
   if [ ! -f "${file}" ];then shDebugHidden 0 ""$log" echec not file:${file} /${fileMode} ";return;fi
   local ll6solicite="$( ip6toolsGetNodeSollicite ${ll6} )"
   local ip6solicite="$( ip6toolsGetNodeSollicite ${ip6} )"
   ll6solicite="${ll6solicite}" ll6="${ll6}" ip6solicite="${ip6solicite}" ip6="${ip6}" net6="${net6}" gw6="${gw6}" $(shIncludeET $file)
   if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$icmpIn" ] && [ -z "$icmpOut" ];then
    shDebug 0 ""${log}" echec params empty (ip6:"${ip6}"): clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" icmpIO:"$icmpIn"/"$icmpOut""
   else
    local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d'/' -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
    if [ -z "${fileName}" ];then
     shDebug 0 ""${log}" echec $cmdEcho ${file} | $cmdRev | $cmdCut -d'/' -f1 | $cmdTr -d'[:blank:]' | $cmdRev"
    fi
    shDebug 2 ""${log}" eth:"$eth" fileName:"$fileName" ll6:"${ll6}" ip6:"${ip6}" net6:"${net6}" gw6:"${gw6}""
    shDebug 2 ""${log}" file:"${file}" "
    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthIn""	"$dropIn"	"-j DROP"
    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthOut""	"$dropOut"	"-j DROP"
    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthIn""	"$ruleIn"	"-j ACCEPT"
    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthOut""	"$ruleOut"	"-j ACCEPT"
    if [ -n "${icmpIn}" ];then
     local ruleIcmpIn="$(firewall6CreateRule i"${fileName}")"
     ip6toolsRuleAdd "filter" "${markEthIn} -p icmpv6  -j ${ruleIcmpIn}"
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
    fi
    if [ -n "${icmpOut}" ];then
     local ruleIcmpOut="$(firewall6CreateRule o"${fileName}")"
     ip6toolsRuleAdd "filter" "${markEthOut} -p icmpv6  -j ${ruleIcmpOut}"
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
    fi
    # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
    local ruleNetworkIn="$(firewall6CreateRule i"${fileName}")"
    local ruleNetworkOut="$(firewall6CreateRule o"${fileName}")"
    shDebug 2 ""${log}" ruleNetworkIn:${ruleNetworkIn} ruleNetworkOut:${ruleNetworkOut} file:${file} "
    
    iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6In""	"-s" "$network"	"-j "$ruleNetworkIn""
    iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6Out""	"-d" "$network"	"-j "$ruleNetworkOut""
    if [ "$mode" = "lo6" ];then
     iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6In""   "-d" "$network" "-j "$ruleNetworkIn""
     iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6Out""  "-s" "$network" "-j "$ruleNetworkOut""
    fi
    
    local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
    if [ -z "$clients" ];then
     shDebug 2 ""$log" no clients:$clients"
    else
     local clientsRulesName="$(firewall6ClientConf "$clients")"
     if [ -n "$clientsRulesName" ];then
      ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
      ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
     else
      shDebug 0 ""$log" no clientsRulesName for clients:$clients"
     fi
    fi
    
    local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
    if [ -z "$servers" ];then
     shDebug 0 ""$log" no servers:$servers"
    else
     local serversRulesName="$(firewall6ServerConf "$servers")"
     shDebug 2 ""${log}" serverRuleIn:"$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')" serverRuleOut:"$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')" file:${file} "
     if [ -n "$serversRulesName" ];then
      ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
      ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
     else
      shDebug 0 ""$log" no serversRulesName for servers:$servers"
     fi
    fi
   fi
  fi
 fi
}
firewall6StartGw() {
 local log="firewall6StartGw:"
 local ifacesConf="$1"
 
 shDebug "[ INFO ]"$log"ifaceConf "$ifacesConf""
 
 $(shIncludeET $ifacesConf)
 if [ -z "ifaceConf" ];then
  shDebug "[ ERROR ]"$log" echec empty ifaceConf : "$ifacesConf""
 else
  for ifaceConf in $(echo $ifaces | tr -d ' ' | tr -d '\t' | tr -s '|' ' ');do
   local iface=""
   local mode=""
   local file=""
   
   for value in $(echo $ifaceConf | tr ';' ' ');do
    if [ -z "$iface" ];then
     local iface=""$(iptoolsGetHostEth ""$value"")""
    else if [ -z "$mode" ];then
     local mode="$(echo $value | cut -d'/' -f 1)"
     local modeValue="$(echo $value | cut -d'/' -f 2- )"
    else if [ -z "$file" ];then
     local file="$value"
    else
       shDebug "[ ERROR ]"$log" echec reading : "$ifacesConf" unknow:$value in :$ifaceConf"
    fi fi fi
   done
   if [ -n "$mode" ] && [ -n "$file" ];then
    if [ "$mode" = "gw6" ] || [ "$mode" = "igw6" ];then
     shDebug "[ INFO ]"$log"$iface $mode $modeValue $file"
     firewall6Gateway $iface $mode $modeValue $file
    fi
   fi
  done
 fi

}
firewall6Stop() {
 local log="firewall6Stop:"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 if [ -n "$eth" ];then
  for sens in "INPUT" "OUTPUT" "FORWARD";do
#   for rule in $($cmdIptables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
#    firewallDeleteRule $rule $sens
#   done
   for rule in $($cmdIptables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
    firewall6DeleteRule $rule $sens
   done
  done
 fi
}
firewall6DeleteRule() {
 local log="firewall6DeleteRule:"
 local rule="$1"
 local from="$2"
 if [ "$rule" = "ACCEPT" ] || [ "$rule" = "Chain" ] || [ "$rule" = "target" ] || [ -z "$rule" ] || [ -z "$from" ];then
  return
 fi
 
 local subRules="$($cmdIptables -w -nL $rule 2>&1 | tr -s '\n' '¤')"
 if [ -z "$(echo $subRules | grep "ip6tables: No chain/target/match by that name.")" ];then
  for subRule in $(echo "$subRules" | tr -s '¤' '\n'| cut -f1 -d' ');do
   if [ -n "$subRule" ];then firewall6DeleteRule $subRule $rule;fi
  done
  ip6toolsRuleDelete "filter" ""$from""     ""$rule""
 fi
}
firewall6Execute() {
 local log="firewall6Execute:"
 local eth=""$(ip6toolsGetHostEth ""$1"")""
 local mode=""$2""
 local file=""$3""
 
 shDebug "[ INFO ]"$log" eth:"$eth" mode:"$mode" file:"$file""
 
# local ruleIfaceIn=""$(firewall6CreateRule "In"$eth"Iface")""
# local ruleIfaceOut=""$(firewall6CreateRule "Out"$eth"Iface")""
 local ruleIfaceIn="In"$eth"Iface"
 local ruleIfaceOut="Out"$eth"Iface"
 ip6toolsRuleCreate "filter" "$ruleIfaceIn"
 ip6toolsRuleCreate "filter" "$ruleIfaceOut"

 ip6toolsRuleAdd "filter" "INPUT  -i "$eth" -j "$ruleIfaceIn""
 ip6toolsRuleAdd "filter" "OUTPUT -o "$eth" -j "$ruleIfaceOut""

 if [ "$mode" = "lo6" ];then
  local ip6s="$(ip6toolsGetIps)"
 else
  local ip6s="$(ip6toolsGetIps "$eth")"
 fi
 shDebug "[ INFO ]"$log" ip6s:$ip6s"
 for ip6 in $ip6s;do
  if [ -z "${ip6}" ];then continue;fi
  local net="$(ip6toolsGetNet ""$eth"" $ip"")"
  local gw="$(ip6toolsGetGw ""$eth"" ""$ip"")"
  
#  local ruleCltIn="$(firewall6CreateRule In"$eth"Ip)"
#  local ruleCltOut="$(firewall6CreateRule Out"$eth"Ip)"
  local ruleCltIn="In"$eth"Ip"
  local ruleCltOut="Out"$eth"Ip"
  ip6toolsRuleCreate "filter" "$ruleCltIn"
  ip6toolsRuleCreate "filter" "$ruleCltOut"
  
  if [ "$mode" = "lo6" ];then
   ip6toolsRuleAdd "filter" "$ruleIfaceIn -d "$net" -j "$ruleCltIn""
   ip6toolsRuleAdd "filter" "$ruleIfaceOut -s "$net" -j "$ruleCltOut""
  else
   ip6toolsRuleAdd "filter" "$ruleIfaceIn -d "$ip" -j "$ruleCltIn""
   ip6toolsRuleAdd "filter" "$ruleIfaceOut -s "$ip" -j "$ruleCltOut""
  fi
  
  local clients="";local servers="";local forward=""
  
  local dropIn="";local dropOut=""
  local ruleIn="";local ruleOut=""
  local icmpIn="";local icmpOut=""
  local network="${net6}";local markExtraIn="";local markExtraOut="";
  
  ip="${ip6}" net="${net6}" $(shIncludeET $file)
  if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug "[ ERROR ]"$log" echec params(ip:$ip) empty : clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
  else
   shDebug "[ INFO ]"$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw""
   
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"

   local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
   local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
   local forward="$(echo $forward | tr -d ' ' | tr -d '\t')"
   
   # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
   local ruleNetworkIn="$(firewall6CreateRule In"$eth"Network)"
   local ruleNetworkOut="$(firewall6CreateRule Out"$eth"Network)"
   iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleCltIn""	"-s" "$network"	"-j $ruleNetworkIn"
   iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleCltOut""	"-d" "$network"	"-j $ruleNetworkOut"
   
   # clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
   local cltCmdInput="$(firewallGenerate $clients	client INPUT)"
   local cltCmdOutput="$(firewallGenerate $clients	client OUTPUT)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleNetworkIn""   "$cltCmdInput"       "-j ACCEPT"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleNetworkOut""  "$cltCmdOutput"      "-j ACCEPT"
   # servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
   local srvCmdInput="$(firewallGenerate $servers	server INPUT)"
   local srvCmdOutput="$(firewallGenerate $servers	server OUTPUT)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleNetworkIn""   "$srvCmdInput"       "-j ACCEPT"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleNetworkOut""  "$srvCmdOutput"      "-j ACCEPT"
   
   # forward	: PROTO ; PORT |
   #echo $forward
  fi
 done
}
firewall6ClientConf() {
 local log="firewall6ClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$clientsMd5" ];then shDebugHidden 1 ""$log" no client MD5 for clients:$clients" >&2;return 1;fi
 local clientsRule=""$(ip6toolsGetMd5Rule "filter" ""$clientsMd5"")""
 shDebugHidden 1 ""$log" clientsRule:"$clientsRule" clients:"$clients"" >&2
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! ip6toolsRuleExiste "filter" $clientsRuleIn;then
  if ip6toolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" >&2;fi
  ip6toolsRuleCreate "filter" "$clientsRuleIn"
  ip6toolsRuleCreate "filter" "$clientsRuleOut"
  # clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
  for myProto in TCP UDP;do
   local ruleInCltMState="inCltMState${myProto}"
#  local cltCmdInput="$(firewallGenerate $clients	client INPUT)"
   local cltCmdInput="$(firewallCmdGenerate "${myProto}" client INPUT $clients)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ${ruleInCltMState}" >&2
#   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ACCEPT" >&2
   
   local ruleOutCltMState="outCltMState${myProto}"
#  local cltCmdOutput="$(firewallGenerate $clients	client OUTPUT)"
   local cltCmdOutput="$(firewallCmdGenerate "${myProto}" client OUTPUT $clients)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ${ruleOutCltMState}" >&2
#   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ACCEPT" >&2
#  shDebugHidden 1 ""$log" cltCmdInput:"$cltCmdInput" cltCmdOutput:"$cltCmdOutput"" >&2
  done
 else
  shDebugHidden O ""$log" rule ever exist" >&2
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewall6ServerConf() {
 local log="firewall6ServerConf:"
 local servers=""${1}""
 local serversMd5=""$( $cmdEcho ""$servers"" | $cmdMd5sum | $cmdCut -f1 -d' ')""
 if [ -z "$serversMd5" ];then shDebugHidden 1 ""$log" no server MD5 for servers:$servers" >&2;return 1;fi
 local serversRule=""$( ip6toolsGetMd5Rule "filter" ""$serversMd5"" )""
 shDebugHidden 1 ""$log" serversRule:"$serversRule" servers:"$servers"" >&2
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! ip6toolsRuleExiste "filter" $serversRuleIn;then
  if ip6toolsRuleExiste "filter" $serversRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" >&2;fi
  ip6toolsRuleCreate "filter" "$serversRuleIn"
  ip6toolsRuleCreate "filter" "$serversRuleOut"
  # servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
#  local srvCmdInput="$(firewallGenerate $servers	server INPUT)"
#  local srvCmdOutput="$(firewallGenerate $servers	server OUTPUT)"
  for myProto in TCP UDP;do
   local ruleInSrvMState="inSrvMState${myProto}"
   local srvCmdInput="$(firewallCmdGenerate "${myProto}" server INPUT $servers)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ${ruleInSrvMState}" >&2
#   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ACCEPT" >&2
   local ruleOutSrvMState="outSrvMState${myProto}"
   local srvCmdOutput="$(firewallCmdGenerate "${myProto}" server OUTPUT $servers)"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ${ruleOutSrvMState}" >&2
#   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ACCEPT" >&2
  done
  shDebugHidden 1 ""$log" srvCmdInput:"$srvCmdInput" srvCmdOutput:"$srvCmdOutput""
 else
  shDebugHidden 0 ""$log" rule ever exist"
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewall6CreateRule() {
 local log="firewall6CreateRule:"
 local ruleName=""$1""
 local cpt=0

 while ip6toolsRuleExiste "filter" ""$ruleName""$cpt"" && [ $cpt -lt 1000 ];do
  cpt=$((cpt+1))
 done
 ip6toolsRuleCreate "filter" ""$ruleName""$cpt"" 2>&1 >> /dev/null
 echo ""$ruleName""$cpt""
}