#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewallPnet
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} cut tr rev sort uniq awk head"
requiresCmd="${requiresCmd} ip iptables sed"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

#$( shInclude $rootDarkWall/lib/firewall )

# firewallPnetCheck $jsonIfacePipe $jsonConfIfacePipe
firewallPnetCheck() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local log="firewallPnetCheck:"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"
 
 if [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth}"
 else
  local log=""${log}"["${eth}"]:"
  local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
  if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
  for fileMode in $( $cmdEcho ${files} | $cmdTr '|' ' ' );do
   if [ -z "${fileMode}" ];then continue;fi
   local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
   local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
   if [ "$mode" != "pnet" ] ;then
#   shDebug 2 ""${log}" ip:${ip} is Global for inet skipe ${mode} ${file} "
    continue;
   else
    if [ ! -f "${file}" ];then
     shDebug 0 ""$log" echec not file:${file}"
     continue
    else
     if [ -z "${pnetFiles}" ];then
      local pnetFiles="${fileMode}"
     else
      local pnetFiles="${pnetFiles}|${fileMode}"
     fi
    fi
   fi
  done
#  local pnetFiles="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead pnetFiles )"
  if [ -z "${pnetFiles}" ];then local pnetFiles="none";fi
#  shPipeInit "${log} jsonBuffer-pnet-write-files"; local jsonBufferPipe=$?
#  shPipeRead ${jsonIfacePipe} | json64InObjectWrite pnetFiles "${pnetFiles}" | shPipeWrite $jsonBufferPipe
#  if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
#   $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
#   shDebug 0 ""$log" echec update write pnetFile for pnetFiles:${pnetFiles}"
#  else
#   shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
#  fi
#  shPipeFree $jsonBufferPipe
  
  if [ -n "${pnetFiles}" ] && [ "|${pnetFiles}|" != "|none|" ];then
   if [ "$eth" = "lo" ];then
    local ips="$( iptoolsGetIps )"
   else
    local ips="$( iptoolsGetIps "$eth" )"
   fi
   local jsonIps="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead ips )"
   if [ -z "${jsonIps}" ];then local jsonIps="{}";fi
   
   for fileMode in $( $cmdEcho ${pnetFiles} | $cmdTr  -s '|' ' ' );do
    if [ -z "${fileMode}" ];then continue;fi
    local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
    local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
    if [ "$mode" != "pnet" ];then shDebug 2 ""$log" skipe ${mode} "; continue; fi
    
    local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
    shDebug 2 ""$log" fileName:"$fileName" "
    
    for ip in ${ips};do
     if [ -z "${ip}" ];then continue;fi
     local log="${log}["${ip}"]:"
     local jsonIp="$( $cmdEcho ${jsonIps} | json64InObjectRead "$ip" )"
     if [ -z "${jsonIp}" ];then
      shDebug 0 ""${log}" no jsonIp for ${ip}"
      continue
     fi
     
     local m5FileIpSum="$( $cmdEcho ${jsonIp} | json64InObjectRead m5FileIpSum )"
     local net="$( $cmdEcho ${jsonIp} | json64InObjectRead net )"
     local broadcast="$( $cmdEcho ${jsonIp} | json64InObjectRead broadcast )"
     local network=""
     

     local clients="";local servers=""
     local dropIn="";local dropOut="";local ruleIn="";local ruleOut="";local icmpIn="";local icmpOut=""
     local dropEthIn="";local dropEthOut="";local ruleEthIn="";local ruleEthOut="";local icmpEthIn="";local icmpEthOut=""
     
     if [ ! -f "${file}" ];then shDebug 0 ""$log" echec not file:${file} /${fileMode}";continue;fi
     $(shIncludeET $file)
     
     if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$icmpIn" ] && [ -z "$icmpOut" ] \
     && [ -z "$dropEthIn" ] && [ -z "$dropEthOut" ] && [ -z "$ruleEthIn" ] && [ -z "$ruleEthOut" ] && [ -z "$icmpEthIn" ] && [ -z "$icmpEthOut" ] \
     && [ -z "$clients" ] && [ -z "$servers" ];then
      shDebug 0 ""$log" echec params empty (ip:"${ip}"):clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" icmpIO:"$icmpIn"/"$icmpOut" dropEthIO:"$dropEthIn"/"$dropEthOut" ruleEthIO:"$ruleEthIn"/"$ruleEthOut" icmpEthIO:"$icmpEthIn"/"$icmpEthOut""
     else
      shDebug 2 ""$log" "$eth"/ file:"$file" ip:"${ip}" net:"${net}" gw:"${gw}" broadcast:"${broadcast}""
      local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
      anMd5FileIpSum="$( $cmdEcho "${clients}|${servers}|${dropEthIn}|${dropEthOut}|${ruleEthIn}|${ruleEthOut}|${icmpEthIn}|${icmpEthOut}|${dropIn}|${dropOut}|${ruleIn}|${ruleOut}|${icmpIn}|${icmpOut}" | $cmdMd5sum | $cmdCut -f1 -d' ' )"
      if [ -z "${m5FileIpSum}" ];then
       local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
       
       if [ -n "$dropEthIn" ] || [ -n "$dropEthOut" ] || [ -n "$ruleEthIn" ] || [ -n "$ruleEthOut" ] || [ -n "$icmpEthIn" ] || [ -n "$icmpEthOut" ];then
        local jsonEthRoute="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead route )"
        local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
        local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
        
        local pNetEthIn="$(firewallCreateRule pi"${fileName}")"
        local pNetEthOut="$(firewallCreateRule po"${fileName}")"
        iptoolsRuleAdd "filter" "${markEthIn}"	"-j ${pNetEthIn}"
        iptoolsRuleAdd "filter" "${markEthOut}"	"-j ${pNetEthOut}"
        local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "pNetEthIn" "${pNetEthIn}" )"
        local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "pNetEthOut" "${pNetEthOut}" )"
       fi
       if [ -n "$dropIn" ] || [ -n "$dropOut" ] || [ -n "$ruleIn" ] || [ -n "$ruleOut" ] || [ -n "$icmpIn" ] || [ -n "$icmpOut" ];then
        local jsonIpRoute="$( $cmdEcho ${jsonIp} | json64InObjectRead route )"
        local markNetIn="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markIn" )"
        local markNetOut="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markOut" )"
        
        local pNetIn="$(firewallCreateRule pi"${fileName}")"
        local pNetOut="$(firewallCreateRule po"${fileName}")"
        iptoolsRuleAdd "filter" "${markNetIn}"	"-j ${pNetIn}"
        iptoolsRuleAdd "filter" "${markNetOut}"	"-j ${pNetOut}"
        local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "pNetIn" "${pNetIn}" )"
        local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "pNetOut" "${pNetOut}" )"
       fi
      fi
      if [ "|${m5FileIpSum}|" != "|${anMd5FileIpSum}|" ];then
       shDebug 2 ""$log" update m5FileIpSum"
       local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "m5FileIpSum" "${anMd5FileIpSum}" )"
       local jsonIps="$( $cmdEcho ${jsonIps} | json64InObjectWrite "${ip}" "${jsonIp}" )"
       shPipeInit "${log} jsonBuffer-start-write-m5FileIpSum"; local jsonBufferPipe=$?
       shPipeRead ${jsonIfacePipe} | json64InObjectWrite ips "${jsonIps}" | shPipeWrite $jsonBufferPipe
       if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
        $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
        shDebug 0 ""$log" echec update add m5FileIpSum for ips:${jsonIps}"
       else
        shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
       fi
       shPipeFree $jsonBufferPipe
       firewallClean "${pNetEthIn}";firewallClean "${pNetEthOut}";firewallClean "${pNetIn}";firewallClean "${pNetOut}"
       
       if [ -n "$dropEthIn" ] || [ -n "$dropEthOut" ] || [ -n "$ruleEthIn" ] || [ -n "$ruleEthOut" ] || [ -n "$icmpEthIn" ] || [ -n "$icmpEthOut" ];then
        local pNetEthIn="$( $cmdEcho ${jsonIp} | json64InObjectRead "pNetEthIn" )"
        local pNetEthOut="$( $cmdEcho ${jsonIp} | json64InObjectRead "pNetEthOut" )"
        if [ -n "$dropEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetEthIn"	"$dropEthIn"	"-j DROP";fi
        if [ -n "$dropEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetEthOut"	"$dropEthOut"	"-j DROP";fi
        if [ -n "$ruleEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetEthIn"	"$ruleEthIn"	"-j ACCEPT";fi
        if [ -n "$ruleEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetEthOut"	"$ruleEthOut"	"-j ACCEPT";fi
        if [ -n "${icmpEthIn}" ];then
         local ruleIcmpEthIn="$(firewallCreateRule i"${fileName}")"
         iptoolsRuleAdd "filter" "$pNetEthIn -p icmp  -j ${ruleIcmpEthIn}"
         iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthIn""	"$icmpEthIn"	"-j ACCEPT"
        fi
        if [ -n "${icmpEthOut}" ];then
         local ruleIcmpEthOut="$(firewallCreateRule o"${fileName}")"
         iptoolsRuleAdd "filter" "$pNetEthOut -p icmp  -j ${ruleIcmpEthOut}"
         iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthOut""	"$icmpEthOut"	"-j ACCEPT"
        fi
       fi
       # / if dropEthIn dropEthOut ruleEthIn ruleEthOut icmpEthIn icmpEthOut
       if [ -n "$dropIn" ] || [ -n "$dropOut" ] || [ -n "$ruleIn" ] || [ -n "$ruleOut" ] || [ -n "$icmpIn" ] || [ -n "$icmpOut" ];then
        local pNetIn="$( $cmdEcho ${jsonIp} | json64InObjectRead "pNetIn" )"
        local pNetOut="$( $cmdEcho ${jsonIp} | json64InObjectRead "pNetOut" )"
        if [ -n "$dropIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetIn"	"$dropIn"	"-j DROP";fi
        if [ -n "$dropOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetOut"	"$dropOut"	"-j DROP";fi
        if [ -n "$ruleIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetIn"	"$ruleIn"	"-j ACCEPT";fi
        if [ -n "$ruleOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pNetOut"	"$ruleOut"	"-j ACCEPT";fi
        
        if [ -n "${icmpIn}" ] || [ -n "${icmpOut}" ] || [ -n "${clients}" ] || [ -n "${servers}" ];then
         # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
         local ruleNetworkIn="$(firewallCreateRule iN"${fileName}")"
         local ruleNetworkOut="$(firewallCreateRule oN"${fileName}")"
         iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pNetIn"	"-s" "$network"	"-j "$ruleNetworkIn""
         iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pNetOut"	"-d" "$network"	"-j "$ruleNetworkOut""
         
         if [ -n "${icmpIn}" ];then
          local ruleIcmpIn="$(firewallCreateRule i"${fileName}")"
          iptoolsRuleAdd "filter" "${ruleNetworkIn} -p icmp  -j ${ruleIcmpIn}"
          iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
         fi
         if [ -n "${icmpOut}" ];then
          local ruleIcmpOut="$(firewallCreateRule o"${fileName}")"
          iptoolsRuleAdd "filter" "${ruleNetworkOut} -p icmp  -j ${ruleIcmpOut}"
          iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
         fi
         
         local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
         if [ -n "$clients" ];then
          local clientsRulesName="$(firewallClientConf "$clients")"
          if [ -n "$clientsRulesName" ];then
           iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
           iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
          else
           shDebug 0 ""$log" no clientsRulesName for clients:$clients"
          fi
         fi
         
         local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
         if [ -n "$servers" ];then
          local serversRulesName="$(firewallServerConf "$servers")"
          if [ -n "$serversRulesName" ];then
           iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
           iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
          else
           shDebug 0 ""$log" no serversRulesName for servers:$servers"
          fi
         fi
        fi
        #  / if icmpIn icmpOut clients servers
       fi
       # / if dropIn dropOut ruleIn ruleOut icmpIn icmpOut
      fi
      # / if md5 has changed
     fi
     # / if file has good params
    done
    #/ for each ip
   done
   #/ for each files
  fi
  #/ pNetFiles
 fi
 # / valide params
}