#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewallPnet6
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} cut tr rev sort uniq awk head"
requiresCmd="${requiresCmd} ip iptables sed ping ping6"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$( shInclude $rootDarkWall/lib/firewallPnet )

# firewallPnet6Check $jsonIfacePipe $jsonConfIfacePipe
firewallPnet6Check() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local log="firewallPnet6Check:"
 local eth="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead eth )"
 
 if [ -z "${eth}" ];then
  shDebug 0 ""${log}" bad params empty eth:${eth}"
 else
  local log=""${log}"["${eth}"]:"
  local pnet6Files="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead pnet6Files )"
  if [ -z "${pnet6Files}" ];then
   shDebug 2 ""${log}" go search pnet6 config in files eth:${eth} jsonEth:${jsonEth}"
   
   # ==================================================================================================
   local files="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead files )"
   if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
   for fileMode in $( $cmdEcho ${files} | $cmdTr  -s '|' ' ' );do
    shDebug 2 ""$log" ${fileMode} "
    if [ -z "${fileMode}" ];then continue;fi
    local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
    local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
    if [ "$mode" != "pnet6" ];then shDebug 2 ""$log" skipe ${mode} "; continue; fi
    
    if [ ! -f "${file}" ];then
     shDebug 0 ""$log" echec not file:${file}"
     continue
    else
     if [ -z "${pnet6Files}" ];then
      local pnet6Files="${fileMode}"
     else
      local pnet6Files="${pnet6Files}|${fileMode}"
     fi
    fi
   done
   if [ -z "${pnet6Files}" ];then local pnet6Files="none";fi
   shPipeInit "${log} jsonBuffer-pnet6-write-files"; local jsonBufferPipe=$?
   shPipeRead ${jsonIfacePipe} | json64InObjectWrite pnet6Files "${pnet6Files}" | shPipeWrite $jsonBufferPipe
   if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
    $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
    shDebug 0 ""$log" echec update write pnetFile for pnetFiles:${pnetFiles}"
   else
    shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
   fi
   shPipeFree $jsonBufferPipe
  fi
  if [ -n "${pnet6Files}" ] && [ "|${pnet6Files}|" != "|none|" ];then
   if [ "$eth" = "lo" ];then
    local ip6s="$( ip6toolsGetIps )"
   else
    local ip6s="$( ip6toolsGetIps "$eth" )"
   fi
   local jsonIp6s="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead ip6s )"
   if [ -z "${jsonIp6s}" ];then local jsonIp6s="{}";fi
   
   for fileMode in $( $cmdEcho ${pnet6Files} | $cmdTr  -s '|' ' ' );do
    if [ -z "${fileMode}" ];then continue;fi
    local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
    local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
    if [ "$mode" != "pnet6" ];then shDebug 2 ""$log" skipe ${mode} "; continue; fi
    
    local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
    shDebug 2 ""$log" fileName:"$fileName" "
    
    for ip6 in ${ip6s};do
     if [ -z "${ip6}" ];then continue;fi
     local log="firewallPnet6Check["${eth}"/"${ip6}"]:"
     local jsonIp6="$( $cmdEcho ${jsonIp6s} | json64InObjectRead "${ip6}" )"
     if [ -z "${jsonIp6}" ];then
      shDebug 0 ""${log}" no jsonIp6 for ${ip6}"
      continue
     fi
     
     local m5FileIpSum="$( $cmdEcho ${jsonIp6} | json64InObjectRead m5FileIpSum )"
     local net6="$( $cmdEcho ${jsonIp6} | json64InObjectRead net6 )"
     local ll6="$( $cmdEcho ${jsonIp6} | json64InObjectRead ll6 )"
     local net="${net6}";local ip="${ip6}"
#     local broadcast="$( $cmdEcho ${jsonIp6} | json64InObjectRead broadcast )"
     local network=""
     
     local clients="";local servers=""
     local dropEthIn="";local dropEthOut="";local ruleEthIn="";local ruleEthOut=""
     local dropIn="";local dropOut="";local ruleIn="";local ruleOut=""
     local icmpIn="";local icmpOut=""
     ll6="${ll6}" ip6="${ip6}" net6="${net6}" gw6="${gw6}" $(shIncludeET $file)
     if [ -z "$icmpIn" ] && [ -z "$icmpOut" ] && [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$ruleEthIn" ] && [ -z "$ruleEthOut" ] && [ -z "$dropEthIn" ] && [ -z "$dropEthOut" ];then
      shDebug 0 ""$log" echec params empty (file:"${file}"): clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" ruleEthIO:"$ruleEthIn"/"$ruleEthOut" dropEthIO:"$dropEthIn"/"$dropEthOut""
     else
      shDebug 2 ""$log" file:"$file""
      shDebug 2 ""$log" ll6="${ll6}" ip6="${ip6}" net6="${net6}" gw6="${gw6}""
      anMd5FileIpSum="$( $cmdEcho "${clients}|${servers}|${dropEthIn}|${dropEthOut}|${ruleEthIn}|${ruleEthOut}|${dropIn}|${dropOut}|${ruleIn}|${ruleOut}|${icmpIn}|${icmpOut}" | $cmdMd5sum | $cmdCut -f1 -d' ' )"
      if [ -z "${m5FileIpSum}" ];then
       local jsonEthRoute6="$( shPipeReadTee ${jsonIfacePipe} | json64InObjectRead route6 )"
       local mark6EthIn="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markIn" )"
       local mark6EthOut="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markOut" )"
       local jsonIpRoute6="$( $cmdEcho ${jsonIp6} | json64InObjectRead route )"
       local mark6NetIn="$( $cmdEcho ${jsonIpRoute6} | json64InObjectRead "markIn" )"
       local mark6NetOut="$( $cmdEcho ${jsonIpRoute6} | json64InObjectRead "markOut" )"
       
       local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
       
       local pNet6EthIn="$(firewall6CreateRule i"${fileName}")"
       local pNet6EthOut="$(firewall6CreateRule o"${fileName}")"
       local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "pNet6EthIn" "${pNet6EthIn}" )"
       local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "pNet6EthOut" "${pNet6EthOut}" )"
       ip6toolsRuleAdd "filter" "$mark6EthIn"	"-j ${pNet6EthIn}"
       ip6toolsRuleAdd "filter" "$mark6EthOut"	"-j ${pNet6EthOut}"
       local pNet6In="$(firewall6CreateRule i"${fileName}")"
       local pNet6Out="$(firewall6CreateRule o"${fileName}")"
       local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "pNet6In" "${pNet6In}" )"
       local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "pNet6Out" "${pNet6Out}" )"
       ip6toolsRuleAdd "filter" "$mark6NetIn"	"-j ${pNet6In}"
       ip6toolsRuleAdd "filter" "$mark6NetOut"	"-j ${pNet6Out}"
      else
       local pNet6In="$( $cmdEcho ${jsonIp6} | json64InObjectRead "pNet6In" )"
       local pNet6Out="$( $cmdEcho ${jsonIp6} | json64InObjectRead "pNet6Out" )"
       local pNet6EthIn="$( $cmdEcho ${jsonIp6} | json64InObjectRead "pNet6EthIn" )"
       local pNet6EthOut="$( $cmdEcho ${jsonIp6} | json64InObjectRead "pNet6EthOut" )"
      fi
      if [ "|${m5FileIpSum}|" != "|${anMd5FileIpSum}|" ];then
       shDebug 2 ""$log" update m5FileIpSum"
       local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "m5FileIpSum" "${anMd5FileIpSum}" )"
       local jsonIp6s="$( $cmdEcho ${jsonIp6s} | json64InObjectWrite "${ip6}" "${jsonIp6}" )"
       shPipeInit "${log} jsonBuffer-start-write-m5FileIp6Sum"; local jsonBufferPipe=$?
       shPipeRead ${jsonIfacePipe} | json64InObjectWrite ip6s "${jsonIp6s}" | shPipeWrite $jsonBufferPipe
       if [ -z "$( shPipeReadTee $jsonBufferPipe )" ];then
        $cmdEcho "LOST" | shPipeWrite $jsonIfacePipe
        shDebug 0 ""$log" echec update add m5FileIpSum for ips:${jsonIps}"
       else
        shPipeRead $jsonBufferPipe | shPipeWrite $jsonIfacePipe
       fi
       shPipeFree $jsonBufferPipe

       firewallClean "${pNet6EthIn}";firewallClean "${pNet6EthOut}";firewallClean "${pNet6In}";firewallClean "${pNet6Out}"
       
       if [ -n "$dropEthIn" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6EthIn}""	"$dropEthIn"	"-j DROP";fi
       if [ -n "$dropEthOut" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6EthOut}""	"$dropEthOut"	"-j DROP";fi
       if [ -n "$ruleEthIn" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6EthIn}""	"$ruleEthIn"	"-j ACCEPT";fi
       if [ -n "$ruleEthOut" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6EthOut}""	"$ruleEthOut"	"-j ACCEPT";fi
       
       if [ -n "$dropIn" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6In}""	"$dropIn"	"-j DROP";fi
       if [ -n "$dropOut" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6Out}""	"$dropOut"	"-j DROP";fi
       if [ -n "$ruleIn" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6In}""	"$ruleIn"	"-j ACCEPT";fi
       if [ -n "$ruleOut" ];then iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""${pNet6Out}""	"$ruleOut"	"-j ACCEPT";fi
       
       # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
       local ruleNetworkIn="$(firewall6CreateRule i"${fileName}")"
       local ruleNetworkOut="$(firewall6CreateRule o"${fileName}")"
       iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""${pNet6In}""	"-s" "$network"	"-j "$ruleNetworkIn""
       iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""${pNet6Out}""	"-d" "$network"	"-j "$ruleNetworkOut""
       
       if [ -n "${icmpIn}" ];then
        local ruleIcmpIn="$(firewall6CreateRule i"${fileName}")"
        ip6toolsRuleAdd "filter" "${ruleNetworkIn} -p icmp  -j ${ruleIcmpIn}"
        iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
       fi
       if [ -n "${icmpOut}" ];then
        local ruleIcmpOut="$(firewallCreateRule o"${fileName}")"
        ip6toolsRuleAdd "filter" "${ruleNetworkOut} -p icmp  -j ${ruleIcmpOut}"
        ip6toolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
       fi
       
       local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
       if [ -z "$clients" ];then
        shDebug 2 ""$log" no clients:$clients"
       else
        local clientsRulesName="$(firewallClientConf "$clients")"
        if [ -n "$clientsRulesName" ];then
         ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
         ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
        else
         shDebug 0 ""$log" no clientsRulesName for clients:$clients"
        fi
       fi
       
       local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
       if [ -z "$servers" ];then
        shDebug 0 ""$log" no servers:$servers"
       else
        local serversRulesName="$(firewallServerConf "$servers")"
        if [ -n "$serversRulesName" ];then
         ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
         ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
        else
         shDebug 0 ""$log" no serversRulesName for servers:$servers"
        fi
       fi
      fi
     fi
    done
    #/ for each ip
   done
   #/ for each files
  fi
  #/ pNetFiles
 fi
 # / valide params
 shPipeReadTee ${jsonIfacePipe}
}