#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewallInit
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} ip ip6tables iptables modprobe lsmod find cut tr"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient cp"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

# firewallInit $pipeJsonBuf 2>>"/ram/bkb/firewallInit.log"
firewallInit() {
 local log="firewallInit:"
 shDebug 2 ""$log" "
 
 local jsonDataPipe="$1"
 
 shErrorOnMissing "cmdIp cmdIptables cmdIp6tables cmdModprobe"
 firewallInitModes
 if [ ! -f /etc/iproute2/rt_tables_origine ];then
  $cmdCp /etc/iproute2/rt_tables /etc/iproute2/rt_tables_origine
 else
  $cmdCp /etc/iproute2/rt_tables_origine /etc/iproute2/rt_tables
 fi
 firewallInitMangle
 
# firewallInitDhcp
# 
 local initIptables="$initIptables $cmdIptables -w -t filter -P INPUT	DROP"
 local initIptables="$initIptables;$cmdIptables -w -t filter -P FORWARD	DROP"
 local initIptables="$initIptables;$cmdIptables -w -t filter -P OUTPUT	DROP"
 if ! iptoolsExecute "$initIptables" ; then
  shDebug 0 ""$log" init policy iptables"
 else
  shDebug 2 ""$log" init policy iptables"
 fi
 
 local initIp6tables="$initIp6tables $cmdIp6tables -w -t filter -P INPUT	DROP"
 local initIp6tables="$initIp6tables;$cmdIp6tables -w -t filter -P FORWARD	DROP"
 local initIp6tables="$initIp6tables;$cmdIp6tables -w -t filter -P OUTPUT	DROP"
 if ! iptoolsExecute "$initIp6tables" ; then
  shDebug 0 ""$log" init policy ip6tables"
 else
  shDebug 2 ""$log" init policy ip6tables"
 fi
 local markIn="markIn"
 local markOut="markOut"
 iptoolsRuleCreate "mangle" "$markIn"
 iptoolsRuleCreate "mangle" "$markOut"
 ip6toolsRuleCreate "mangle" "$markIn"
 ip6toolsRuleCreate "mangle" "$markOut"
 for enterSoluce in "PREROUTING" "INPUT" "FORWARD";do
# iptoolsRuleAdd "mangle" "$enterSoluce	-m mark --mark 0x0 -j ${markIn}"
  
#  iptoolsRuleAdd "mangle" "$enterSoluce		-j ${markIn}"
  iptoolsRuleAdd "mangle" "$enterSoluce		-m mark --mark 0x0 -j ${markIn}"
  
#  ip6toolsRuleAdd "mangle" "$enterSoluce	-j ${markIn}"
  ip6toolsRuleAdd "mangle" "$enterSoluce	-m mark --mark 0x0 -j ${markIn}"
 done
 for enterSoluce in "OUTPUT";do
  iptoolsRuleAdd "mangle" "$enterSoluce		-m mark --mark 0x0 -j ${markOut}"
#  iptoolsRuleAdd "mangle" "$enterSoluce	-j ${markOut}"
  
  ip6toolsRuleAdd "mangle" "$enterSoluce	-m mark --mark 0x0 -j ${markOut}"
#  ip6toolsRuleAdd "mangle" "$enterSoluce	-j ${markOut}"
 done
 #Mark packets [ save the mark in end of all interface ]
 #iptables -t mangle -A INPUT -j CONNMARK --save-mark
#for enterSoluce in "FORWARD" "INPUT";do
 for enterSoluce in "PREROUTING" "INPUT" "FORWARD" "OUTPUT";do
  #shDebug 1 ""$log" iptoolsRuleDelete mangle $enterSoluce save-mark"
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark"
  ip6toolsRuleDelete "mangle" "$enterSoluce"     "save-mark"

  iptoolsRuleDelete "mangle" "$enterSoluce"     "restore-mark"
  ip6toolsRuleDelete "mangle" "$enterSoluce"     "restore-mark"

  iptoolsRuleAdd "mangle" "$enterSoluce		-j CONNMARK	--save-mark"
  ip6toolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"

  iptoolsRuleInsert "mangle" "$enterSoluce	-m mark --mark 0x0 -j CONNMARK     --restore-mark"
  ip6toolsRuleInsert "mangle" "$enterSoluce	-m mark --mark 0x0 -j CONNMARK     --restore-mark"
#  if [ "PREROUTING" != "${enterSoluce}" ];then
#  fi
 done
 
 for proto in TCP UDP;do
  # -j inCltMState
  local ruleInCltMState="inCltMState${proto}"
  iptoolsRuleCreate "filter" "$ruleInCltMState"
  iptoolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state ESTABLISHED,RELATED -j ACCEPT"
  ip6toolsRuleCreate "filter" "$ruleInCltMState"
  ip6toolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state ESTABLISHED,RELATED -j ACCEPT"
  
  # -J outCltMState
  local ruleOutCltMState="outCltMState${proto}"
  iptoolsRuleCreate "filter" "$ruleOutCltMState"
  iptoolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  ip6toolsRuleCreate "filter" "$ruleOutCltMState"
  ip6toolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  
  # -j inSrvMState
  local ruleInSrvMState="inSrvMState${proto}"
  iptoolsRuleCreate "filter" "$ruleInSrvMState"
  iptoolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  ip6toolsRuleCreate "filter" "$ruleInSrvMState"
  ip6toolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  
  # -j outSrvMState
  local ruleOutSrvMState="outSrvMState${proto}"
  iptoolsRuleCreate "filter" "$ruleOutSrvMState"
  iptoolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED -j ACCEPT"
  ip6toolsRuleCreate "filter" "$ruleOutSrvMState"
  ip6toolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED -j ACCEPT"

  if [ "$proto" = "TCP" ];then
   # -j inCltTcpMState
   iptoolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state ESTABLISHED,RELATED ! --syn -j ACCEPT"
   iptoolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state ESTABLISHED,RELATED ! --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleInCltMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   # -J outCltTcpMState
   iptoolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
   iptoolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleOutCltMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   # -j inSrvTcpMState
   iptoolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
   iptoolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleInSrvMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   # -j outSrvTcpMState
   iptoolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED ! --syn -j ACCEPT"
   iptoolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state ESTABLISHED,RELATED ! --syn -j ACCEPT"
   ip6toolsRuleAdd "filter" "$ruleOutSrvMState" "-p $proto -m state --state NEW --syn -j ACCEPT"
  fi
 done
# inCltMState="-m state --state ESTABLISHED,RELATED"
# outCltMState="-m state --state ESTABLISHED,RELATED,NEW"

# inCltTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"
# outCltTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"

# inSrvMState="-m state --state ESTABLISHED,RELATED,NEW"
# inSrvTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"

# outSrvMState="-m state --state ESTABLISHED,RELATED"
# outSrvTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"

 local ifacesFolder="/ram/ifaces"
 if [ ! -d "${ifacesFolder}" ];then $cmdMkdir "${ifacesFolder}";fi
 local fileExport="${ifacesFolder}/initState.log"
 $cmdEcho "=== ip 4 rule" >> $fileExport
 $cmdIp -4 rule >> $fileExport
 $cmdEcho "=== ip 4 route" >> $fileExport
 $cmdIp -4 route show table all >> $fileExport
 $cmdEcho "=== ip 6 rule" >> $fileExport
 $cmdIp -6 rule >> $fileExport
 $cmdEcho "=== ip 6 route" >> $fileExport
 $cmdIp -6 route show table all >> $fileExport
 firewallConfig "${ifacesConf}" $jsonDataPipe 2>>"/ram/bkb/firewallConf.log"
 #shPipeReadTee $jsonDataPipe 2>&1 >>"/ram/bkb/firewallConf.json"
 
 shPipeInit "${log} MyJsonBuff-init"; local jsonBufferPipe=$?
 jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonBufferPipe "firewallInit"
 shPipeInit "${log} MyJsonConfIfaces-init"; local jsonConfIfacesPipe=$?
 shPipeRead $jsonBufferPipe | json64InObjectWrite ifacesFolder "$ifacesFolder" | shPipeWrite $jsonConfIfacesPipe
 shPipeFree $jsonBufferPipe
 
 jsonWriteBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe "firewallInit"
 shPipeFree $jsonConfIfacesPipe
 
 shPipeInit "${log} MyJsonBuff-init"; local jsonBufferPipe=$?
 $cmdEcho "{}" | shPipeWrite $jsonBufferPipe
 jsonWriteBig "jsonIfaces" $jsonDataPipe $jsonBufferPipe "firewallInit"
 shPipeFree $jsonBufferPipe
 
 iptoolsExecute "$cmdIp -6 rule add pri 10000 from all table local"
 iptoolsExecute "$cmdIp -6 rule del pri 0"
## iptoolsExecute "$cmdIp -6 rule add pri 0 to ff00::/8 table local"

# iptoolsExecute "$cmdIp -4 rule add pri 10000 table local"
# iptoolsExecute "$cmdIp -4 rule del pri 0"
}
firewallInitDhcp() {
 local log="firewallInitDhcp:"

 local ruleInDhcpClient="InDhcpClient"
 local ruleOuDhcpClient="OutDhcpClient"
 iptoolsRuleCreate "filter" "$ruleInDhcpClient"
 iptoolsRuleCreate "filter" "$ruleOuDhcpClient"
 
 local ruleIn=""
 local ruleOut=""
 # dhcp server (bootps : 67, bootpc : 68)
 # Exception dhcp from unknow 'ip'
 local ruleIn="$ruleIn		;dhcp	| -p udp --dport bootpc --sport bootps -m state --state ESTABLISHED,RELATED,NEW"
 local ruleIn="$ruleIn		;dhcp	| -p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW"
 #local ruleIn="$ruleIn		;dhcp	| -p udp --sport bootpc --dport bootps -m state --state ESTABLISHED"
 # dhcp (bootps : 67, bootpc : 68)
 #local ruleOut="$ruleOut	;dhcp	| -s 0.0.0.0/32		-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,NEW"
 local ruleOut="$ruleOut	;dhcp	| -s 0.0.0.0/32		-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root"
 local ruleOut="$ruleOut	;dhcp	| -s 0.0.0.0					-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root"
 local ruleOut="$ruleOut	;dhcp	| -s 169.254.0.0/16	-d 255.255.255.255/32	-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root"
 local ruleOut="$ruleOut	;dhcp	| 						-p udp --sport bootpc --dport bootps -m state --state ESTABLISHED,RELATED,NEW -m owner --uid-owner root --gid-owner root"
 local ruleOut="$ruleOut	;dhcp	| 						-p udp --sport bootps --dport bootpc -m state --state ESTABLISHED		-m owner --uid-owner root --gid-owner root"
 
 iptoolsRulesExecute "iptoolsRuleAdd" "filter" "InDhcpClient"	"$ruleIn"	"-j ACCEPT"
 iptoolsRulesExecute "iptoolsRuleAdd" "filter" "OutDhcpClient"	"$ruleOut"	"-j ACCEPT"
 
 # dhcpv6 client (546) / serveur ou relais (547)
 # Advertise/Reply renvoyé en multicast par certains relais (rare, mais prévu par la RFC 8415)
 ip6toolsRuleCreate "filter" "InDhcpClient6RareCase"
 ip6toolsRuleAdd "filter" "InDhcpClient6RareCase -s fe80::/10 -d ff02::1:2/128 -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT"
 for iface in $($cmdIp link | $cmdGrep BROADCAST | $cmdCut -d':' -f2 | $cmdTr -d '[:blank:]');do
  iptoolsRuleAdd "filter" "INPUT -i $iface	-j InDhcpClient"
  iptoolsRuleAdd "filter" "OUTPUT -o $iface	-j OutDhcpClient"
  ip6toolsRuleAdd "filter" "INPUT -i $iface	-j InDhcpClient6RareCase"
  for ll6 in $( $cmdIp -6 addr show dev $iface scope link | $cmdGrep "scope link" | $cmdRev | $cmdCut -f2 -d'/' | $cmdCut -f1 -d' ' | $cmdRev );do
   # Réponse unicast du serveur/relais vers le client (cas que tu as capturé : SPT=547 DPT=546)
   local ruleIn="$ruleIn          ;dhcpv6 | -i $iface -s fe80::/10           -d "${ll6}/128"        -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED"
   # Solicit/Request/Confirm/Rebind/Decline/Release envoyés en multicast (adresse serveur inconnue)
   local ruleOut="$ruleOut        ;dhcpv6 | -o $iface -s "${ll6}/128"        -d ff02::1:2/128       -p udp -m udp --sport 546 --dport 547 -m state --state NEW"
   # Renew/Release en unicast si le serveur a fourni son adresse (option "Server Unicast")
   local ruleOut="$ruleOut        ;dhcpv6 | -o $iface -s "${ll6}/128"        -d fe80::/10           -p udp -m udp --sport 546 --dport 547 -m state --state NEW,ESTABLISHED,RELATED"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" "INPUT"   "$ruleIn"       "-j ACCEPT"
   iptoolsRulesExecute "ip6toolsRuleAdd" "filter" "OUTPUT"   "$ruleOut"       "-j ACCEPT"
  done
 done
}
firewallInitMangle() {
 local log="firewallInitMangle:"
 # iptables -t mangle -P PREROUTING	ACCEPT
 # iptables -t mangle -P INPUT		ACCEPT
 # iptables -t mangle -P FORWARD		ACCEPT
 # iptables -t mangle -P OUTPUT		ACCEPT
 # iptables -t mangle -P POSTROUTING	ACCEPT
 local initMangleIptables="$initMangleIptables $cmdIptables -w -t mangle -P PREROUTING	ACCEPT"
 local initMangleIptables="$initMangleIptables;$cmdIptables -w -t mangle -P INPUT		ACCEPT"
 local initMangleIptables="$initMangleIptables;$cmdIptables -w -t mangle -P FORWARD	ACCEPT"
 local initMangleIptables="$initMangleIptables;$cmdIptables -w -t mangle -P OUTPUT		ACCEPT"
 local initMangleIptables="$initMangleIptables;$cmdIptables -w -t mangle -P POSTROUTING	ACCEPT"
 if ! iptoolsExecute "$initMangleIptables" ; then
  shDebug 0 ""$log" init policy mangle"
 else
  shDebug 2 ""$log" init policy mangle"
 fi
 
 iptoolsRuleAdd "mangle" "POSTROUTING	-j CONNMARK	--save-mark"
 iptoolsRuleInsert "mangle" "PREROUTING	-j CONNMARK     --restore-mark"
 iptoolsRuleInsert "mangle" "INPUT	-j CONNMARK     --restore-mark"
 iptoolsRuleInsert "mangle" "FORWARD	-j CONNMARK     --restore-mark"
 iptoolsRuleInsert "mangle" "OUTPUT	-j CONNMARK     --restore-mark"
 shDebug 2 ""$log" mangle postrouting save/restore mark"
}
firewallInitModes() {
 for modName in \
  ;do
   firewallInitActiveMode "${modName}"
  done
}
# ["ip6table_nat"] NAT IPv6 - le coupable principal
# ["ip6table_filter"] filtrage IPv6 (parfois absent)
# ["ip6table_mangle"] mangle IPv6 (fwmark, DSCP...)
# ["ip6_tables"] table de base IPv6
# ["nf_nat"] NAT générique (IPv4+IPv6)
# ["nf_conntrack"] conntrack générique
# ["nf_conntrack_ftp"] helper FTP
# ["xt_conntrack"] match --state/--ctstate
# ["xt_connmark"] match/set connmark
# ["xt_mark"] fwmark
# ["xt_nat"] SNAT/DNAT via xtables
# ["xt_owner"] match owner UID/GID
# ["xt_comment"] commentaires dans règles
# ["xt_physdev"] match physdev (bridge)
# ["xt_tcpudp"] match --sport/--dport
# ["xt_LOG"] LOG target
# ["xt_hl"] IPv6 hop-limit
# ["br_netfilter"] filtrage sur bridge
# ["8021q"] VLAN 802.1q
# ["ip_tables"] iptables IPv4 base
# ["nf_defrag_ipv4"] defrag IPv4 (requis par conntrack)
# ["nf_defrag_ipv6"] defrag IPv6 (requis par conntrack)
# ["nfnetlink"] netlink pour conntrack userspace
# ["ipt_LOG"] [old] LOG target
# ["ipt_owner"] [old] match owner UID/GID
# ["ipt_mark"] [old] fwmark
# ["ip_conntrack"] [old] conntrack générique
firewallInitModes() {
 for modName in \
  "ip6table_nat"	\
  "ip6table_filter"	\
  "ip6table_mangle"	\
  "ip6_tables"		\
  "nf_nat"		\
  "nf_conntrack"	\
  "nf_conntrack_ftp"	\
  "xt_conntrack"	\
  "xt_connmark"		\
  "xt_mark"		\
  "xt_nat"		\
  "xt_owner"		\
  "xt_comment"		\
  "xt_physdev"		\
  "xt_tcpudp"		\
  "xt_LOG"		\
  "xt_hl"		\
  "br_netfilter"	\
  "8021q"		\
  "ip_tables"		\
  "iptable_filter"	\
  "iptable_mangle"	\
  "iptable_nat"		\
  "nf_defrag_ipv4"	\
  "nf_defrag_ipv6"	\
  "nfnetlink"		\
  "nfnetlink_queue"	\
  "ipt_LOG"		\
  "ipt_limit"		\
  "ipt_MASQUERADE"	\
  "ipt_owner"		\
  "ipt_REJECT"		\
  "ipt_mark"		\
  "ipt_tcpmss"		\
  "ipt_state"		\
  "ipt_unclean"		\
  "ip_queue"		\
  "ip_conntrack"	\
  "multiport"		\
  ;do
   firewallInitActiveMode "${modName}"
  done
}
#firewallInitModes() {
# for modName in "ip6table_nat" "br_netfilter" "ip_tables" "iptable_filter" "iptable_mangle" "iptable_nat" "ip_queue" "ip_conntrack" "ipt_LOG" \
# "ipt_limit" "ipt_MASQUERADE" "ipt_owner" "ipt_REJECT" "ipt_mark" "ipt_tcpmss" \
# "multiport" "ipt_state" "ipt_unclean" "nfnetlink_queue" "nf_conntrack" "xt_conntrack" "8021q" "xt_comment" "xt_physdev" ;do
#  firewallInitActiveMode "${modName}"
# done
#}
firewallInitActiveBridge() {
 for modName in "br_netfilter" "nf_conntrack_bridge";do
  firewallInitActiveMode "${modName}"
 done
}
firewallInitActiveFtp() {
 for modName in "ip_nat_ftp" "ip_conntrack_ftp" "nf_conntrack_ftp";do
  firewallInitActiveMode "${modName}"
 done
}
firewallInitActiveTftp() {
 for modName in "ip_conntrack_tftp" "nf_conntrack_tftp";do
  firewallInitActiveMode "${modName}"
 done
}
firewallInitActiveIrc() {
 for modName in "ip_conntrack_irc";do
  firewallInitActiveMode "${modName}"
 done
}
firewallInitActiveMode() {
 local log="firewallInitActiveMode:"
 local modName="${*}"
 if [ -n "$( $cmdFind /lib/modules | $cmdGrep $modName)" ];then
  if [ -n "$( $cmdLsmod | $cmdGrep $modName)" ];then
   shDebugHidden 2 ""$log" init $modName active yet" >&2
  else
   $cmdEcho "$log" start $modName >> /dev/kmsg
   if iptoolsExecute "$cmdModprobe --first-time $modName" ; then
    shDebugHidden 2 ""$log" init $modName" >&2
   else
    shDebugHidden 0 ""$log" init $modName" >&2
   fi
  fi
 fi
}