#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/ipTools
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} cut tr rev sort uniq awk head sed find"
requiresCmd="${requiresCmd} ip iptables"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$( shInclude $rootDarkWall/lib/ipNetworkMaskTools )

# sshPort=$( iptoolsServiceGetPort tcp ssh )
iptoolsServicesGetPort() {
 local log="iptoolsServicesGetPort:"
 local serviceProto="${1}"
 local serviceName="${2}"
 
 local portFound="$($cmdCat /etc/services | $cmdGrep -i "^${serviceName}" | $cmdGrep -i "${serviceProto}" | $cmdTr -s '[[:blank:]]' '_' | $cmdGrep / | $cmdGrep -i "^${serviceName}_" | $cmdCut -f2 -d_ | $cmdCut -f1 -d/ )"
 if [ -z "${portFound}" ];then
  $cmdEcho "${serviceName}"
 else
  $cmdEcho "${portFound}"
 fi
}
iptoolsRuleExiste() {
 local log="iptoolsRuleExiste:"
 local table=""
 local rule=""
 for param in $*;do
  if [ -z "$table" ];then
   local table="$param"
  else
   local rule="$rule $param"
  fi
 done
 if [ -z "$table" ] || [ -z "$rule" ];then
  shDebugHidden "[ WARN ]"$log" usage : cmd \$table \$rule but (table:$table,rule:$rule)" >&2
 else
  if [ -n "$( $cmdIptables -w -t $table -S $rule 2>/dev/null )" ] ;then
   return 0
  fi
 fi
 return 1
}

iptoolsRuleCreate() {
 local log="iptoolsRuleCreate:"
 local table=""
 local rule=""
 for param in $*;do
  if [ -z "$table" ];then
   local table="$param"
  else
   local rule="$rule $param"
  fi
 done

 if [ -z "$table" ] || [ -z "$rule" ];then
  shDebugHidden 2 ""$log" usage : cmd \$table \$rule but (table:$table,rule:$rule)" >&2
 else
  if ! iptoolsRuleExiste "$table" "$rule" ; then
#   shDebugHidden 2 ""$log" rule $rule in $table exist yet" >&2
#  else
   if ! iptoolsExecute "$cmdIptables -w -t $table -N $rule" ; then
    shDebugHidden 0 ""$log" create rule $rule in $table" >&2
   else
#    shDebugHidden 1 ""$log" create rule $rule in $table" >&2
    return 0
   fi
  fi
 fi
 return 1
}
iptoolsRuleAdd() {
 local log="iptoolsRuleAdd:"
 local table=""
 local destination=""
 local rule=""
 for param in $*;do
  if [ -z "$table" ];then
   local table="$param"
  elif [ -z "$destination" ];then
    local destination="$param"
  else
   local rule="$rule $param"
  fi
 done
 if [ -z "$table" ] || [ -z "$rule" ] ; then
  shDebugHidden 0 ""$log" usage : cmd \$table \$rule but (table:$table,rule:$rule)" >&2
 else
  local comment=""$(echo "$rule" | tr -s " " | tr " " "_")"_"
  local commentRule="-m comment --comment ${comment}"
  local commentSearchRule="-m comment --comment ${comment}"
  local finalRule="${destination} ${commentRule} ${rule}"
  local finalSearchRule="${destination} ${commentSearchRule} ${rule}"
  #shDebugHidden 1 ""$log" check rule before add:$cmdIptables -w -t $table -C $finalSearchRule" >&2
  if iptoolsExecuteNoLog "$cmdIptables -w -t $table -C $finalSearchRule" ; then
   shDebugHidden 1 ""$log" rule exist yet ($table/$destination) :$rule" >&2
  else
   if ! iptoolsExecute "$cmdIptables -w -t $table -A $finalRule" ; then
    shDebugHidden 0 ""$log" add rule ($table/$destination) $rule" >&2
   else
    shDebugHidden 2 ""$log" add rule ($table/$destination) $rule" >&2
    return 0
   fi
  fi
 fi
 return 1
}
iptoolsRuleInsert() {
 local log="iptoolsRuleInsert:"
 local table=""
 local destination=""
 local rule=""
 for param in $*;do
  if [ -z "$table" ];then
   local table="$param"
  elif [ -z "$destination" ];then
    local destination="$param"
  else
   local rule="$rule $param"
  fi
 done
 if [ -z "$table" ] || [ -z "$rule" ] ; then
  shDebugHidden 0 ""$log" usage : cmd \$table \$rule but (table:$table,rule:$rule)" >&2
 else
  local comment=""$(echo "$rule" | tr -s " " | tr " " "_")"_"
  local commentRule="-m comment --comment ${comment}"
  local commentSearchRule="-m comment --comment ${comment}"
  local finalRule="${destination} ${commentRule} ${rule}"
  local finalSearchRule="${destination} ${commentSearchRule} ${rule}"
  #shDebugHidden 1 ""$log" check rule before insert:$cmdIptables -w -t $table -C $finalSearchRule" >&2
  if iptoolsExecuteNoLog "$cmdIptables -w -t $table -C $finalSearchRule" ; then
   shDebugHidden 1 ""$log" rule exist yet ($table/$destination) :$rule" >&2
  else
   if ! iptoolsExecute "$cmdIptables -w -t $table -I $finalRule" ; then
    shDebugHidden 0 ""$log" add rule ($table/$destination) $rule" >&2
   else
    shDebugHidden 2 ""$log" add rule ($table/$destination) $rule" >&2
    return 0
   fi
  fi
 fi
 return 1
}
iptoolsRuleDelete() {
 local log="iptoolsRuleDelete:"
 local table="$1"
 local direction="$2"
 local rule="$3"
# local table=""
# local rule=""
# for param in $*;do
#  if [ -z "$table" ];then
#   local table="$param"
#  else
#   if [ -z "$direction" ];then
#    local direction="$param"
#   else
#    local rule="$rule $param"
#   fi
#  fi
# done
 if [ -z "$table" ] || [ -z "$direction" ] || [ -z "$rule" ];then
  shDebugHidden 2 ""$log" usage : cmd \$table \$direction \$rule but (table:$table,direction:$direction,rule:$rule)" >&2
 else
#  shDebugHidden 1 ""$log" table:$table,direction:$direction,rule:$rule" >&2
  for readCondition in $($cmdIptables -w -t "$table" -S "$direction" 2>&1 | $cmdGrep "$rule" | $cmdGrep "\-A" | $cmdTr ' ' '¤');do
#   if [ "$rule" = "$(echo $readCondition | tr '¤' ' ' | rev | cut -d' ' -f1 | rev)" ] ;then
    conditionExtracted="$( $cmdEcho $readCondition | $cmdTr '¤' ' ' | $cmdRev | $cmdCut -d' ' -f1- | $cmdRev | $cmdCut -d' ' -f2- | $cmdSed 's/\"//g')"
#    shDebugHidden 1 ""$log" rule found to delete : $conditionExtracted" >&2
    if ! iptoolsExecute "$cmdIptables -w -t $table -D $conditionExtracted" ; then
     shDebugHidden 0 ""$log" clean rule -D : $rule (-t $table -D $conditionExtracted)" >&2
    fi
#   fi
  done
  if [ -n "$($cmdIptables -w -t $table -nL $direction 2>&1 | $cmdGrep $rule)" ] && [ -n "$conditionExtracted" ]; then
   if ! iptoolsExecute "$cmdIptables -w -t $table -F $conditionExtracted" ; then
    shDebugHidden 0 ""$log" clean rule -F : $rule (-t $table -F $conditionExtracted)" >&2
   fi
   if ! iptoolsExecute "$cmdIptables -w -t $table -X $conditionExtracted" ; then
    shDebugHidden 0 ""$log" clean rule -X : $rule (-t $table -X $conditionExtracted)" >&2
   fi
  fi
  if [ -n "$($cmdIptables -w -t $table -nL $direction 2>&1 | grep $rule)" ] ; then
   if ! iptoolsExecute "$cmdIptables -w -t $table -F $rule" ; then
    shDebugHidden 0 ""$log" clean rule -F : $rule (-t $table -F $rule)" >&2
   fi
   if ! iptoolsExecute "$cmdIptables -w -t $table -X $rule" ; then
    shDebugHidden 0 ""$log" clean rule -X : $rule (-t $table -X $rule)" >&2
   else
    return 0
   fi
  fi
 fi
 return 1
}
# Thanks, https://Perplexity.ai !
iptoolsExecute() {
 local cmd="$*"
 local max_retry=20
 local attempt=0
 while : ; do
  shExecuteNoLog "$cmd"
  if [ -z "$shExecuteErrorMessage" ]; then
   return 0
  fi
  case "$shExecuteErrorMessage" in
   *"xtables lock"*)
    local retry=true
   ;;
   *"Resource temporarily unavailable."*)
    local retry=true
   ;;
   *)
    local retry=false
   ;;
  esac
  if [ "$retry" != "true" ] || [ "$attempt" -ge "$max_retry" ]; then
   shDebugHidden 0 "msg: $shExecuteErrorMessage" >&2
   return 1
  fi
  local attempt=`expr $attempt + 1`
  shDebugHidden 2 "msg (execute will be delayed, attempt $attempt/$max_retry): $shExecuteErrorMessage" >&2
  shWaitRandom
 done
}
#iptoolsExecuteMessageRetry=""
#iptoolsExecuteMessageRetry="$iptoolsExecuteMessageRetry "$(echo "Another app is currently holding the xtables lock. Perhaps you want to use the -w option?" | tr " " "¤")""
#iptoolsExecuteMessageRetry="$iptoolsExecuteMessageRetry "$(echo "iptables: Resource temporarily unavailable." | tr " " "¤")""
#iptoolsExecute() {
# local params=""
# for param in $*;do
#  local params="$params¤$param"
# done
# for execute in $(echo "$params" | tr -s " " "¤" | tr -s ";" " ");do
#  shExecuteNoLog "$(echo ""$execute"" | tr -s "¤" " ")"
#  if [ ! -z "$shExecuteErrorMessage" ];then
#   for messageRetry in $(echo ""$iptoolsExecuteMessageRetry"");do
#    local messageRetryReady="$(echo "$messageRetry" | tr -s '¤' ' ')"
#    local shExecuteErrorMessageReady="$(echo "$shExecuteErrorMessage" | tr -s ';' ' ')"
#    if [ ! -z "$(echo "$shExecuteErrorMessageReady" | grep "$messageRetryReady")" ] ; then
#     shDebugHidden 2 "msg (execute will be delayed) : $shExecuteErrorMessage" >&2
#     shWaitRandom
#     iptoolsExecute "$execute"
#     if [ ! -z "$shExecuteErrorMessage" ];then
#      return 1
#     else
#      return 0
#     fi
#    fi
#   done
#   shDebugHidden 0 "msg: $shExecuteErrorMessage" >&2
#   return 1
#  fi
# done
# return 0
#}

# Thanks, https://Perplexity.ai !
iptoolsExecuteNoLog() {
 local cmd="$*"
 local max_retry=20
 local attempt=0
 while : ; do
  shExecuteNoLog "$cmd"
  if [ -z "$shExecuteErrorMessage" ]; then
   return 0
  fi
  local retry=false
  for m in $iptoolsExecuteMessageRetry; do
   case "$shExecuteErrorMessage" in
    *"$m"*)
     local retry=true
    ;;
   esac
  done
  if [ "$retry" != "true" ] || [ "$attempt" -ge "$max_retry" ]; then
   # version NoLog : on ne log rien, on remonte juste l’erreur
   return 1
  fi
  local attempt=`expr $attempt + 1`
  shWaitRandom
 done
}

#iptoolsExecuteNoLog() {
# local params=""
# for param in $*;do
#  local params="$params¤$param"
# done
# for execute in $(echo "$params" | tr " " "¤" | tr ";" " ");do
#  shExecuteNoLog "$(echo ""$execute"" | tr "¤" " ")"
#  if [ -n "$shExecuteErrorMessage" ];then
#   for messageRetry in $(echo ""$iptoolsExecuteMessageRetry"");do
#    local messageRetryReady="$(echo "$messageRetry" | tr '¤' ' ')"
#    local shExecuteErrorMessageReady="$(echo "$shExecuteErrorMessage" | tr ';' ' ')"
#    if [ -n "$(echo "$shExecuteErrorMessageReady" | grep "$messageRetryReady")" ] ; then
#     shWaitRandom
#     iptoolsExecuteNoLog "$execute"
#     if [ -n "$shExecuteErrorMessage" ];then
#      return 1
#     else
#      return 0
#     fi
#    fi
#   done
#   return 1
#  fi
# done
# return 0
#}
iptoolsRulesExecute() {
 local log="iptoolsRulesExecute:"
 local cmd="$1"
 local table="$2"
 local ruleName="$3"
 local actions="$4"
 local dest="$5"
 local errorHasOccur=0
 local instruction name rule part first
 
 # Découpe sur ';'
 IFS_SAVE=$IFS
 IFS=';'
 set -- $actions
 IFS=$IFS_SAVE

 for instruction in "$@"; do
  [ -z "$instruction" ] && continue
  local name=""
  local rule=""
  local first=1
  # Découpe sur '|'
  IFS_SAVE2=$IFS
  IFS='|'
  set -- $instruction
  IFS=$IFS_SAVE2
  for part in "$@"; do
   [ -z "$part" ] && continue
   if [ "$first" -eq 1 ]; then
    local name="$( $cmdEcho $part | $cmdTr -s ' ')"
    local first=0
   else
    # concatène les sous-instructions dans rule
    local part="$( $cmdEcho $part | $cmdTr -s ' ')"
    if [ -z "$rule" ]; then
     local rule="$part"
    else
     local rule="$rule $part"
    fi
   fi
  done
  [ -z "$rule" ] && continue
#  shDebugHidden 1 "$log $name to $ruleName ($rule $dest)" >&2
#  shDebugHidden 1 "$cmd $table $ruleName $rule $dest" >&2
  if ! iptoolsExecuteNoLog "$cmd $table $ruleName $rule $dest"; then
   shDebugHidden 0 "$log $cmd $table $ruleName $rule $dest : $shExecuteErrorMessage" >&2
   shExecuteErrorMessage=""
   errorHasOccur=1
  fi
 done
 return $errorHasOccur
}
#iptoolsRulesExecute() {
# local log="iptoolsRulesExecute:"
# local cmd=""$1""
# local table=""$2""
# local ruleName=""$3""
# local actions="$4"
# local dest="$5"
# local errorHasOccur=0
# 
# for instruction in $(echo ""$actions"" | tr -s " " | tr " " "¤" | tr ";" " ");do
#  if [ -n ""$instruction"" ] && [ "$instruction" != " " ] ; then
#   local name="";local rule=""
#   for dataSplit in $(echo ""$instruction"" | tr "\|" " ") ; do
#    if [ -z "$name" ] ; then
#     local name="$(echo "$dataSplit" | tr "¤" " ")"
#    else
#     local rule="$(echo "$dataSplit" | tr "¤" " ")"
#    fi
#   done
#   if [ -n "$rule" ] && [ "$rule" != " " ] ; then
#    if ! iptoolsExecuteNoLog "$cmd $table $ruleName $rule $dest" ; then
#     shDebugHidden 0 ""$log" $name to "$ruleName" ($rule $dest) : $shExecuteErrorMessage" >&2
#     local errorHasOccur=1
#    fi
#   fi
#  fi
# done
# 
# return $errorHasOccur
#}
iptoolsRulesExecuteFlt() {
 local log="iptoolsRulesExecuteFlt:"
 local cmd=""$1""
 local table=""$2""
 local ruleName=""$3""
 local fltSens="$4"
 local actions="$5"
 local dest="$6"
 local errorHasOccur=0
 
 # Découpe sur ';'
 IFS_SAVE=$IFS
 IFS=';'
 set -- $actions
 IFS=$IFS_SAVE
 for instruction in "$@"; do
  [ -z "$instruction" ] && continue
  if ! iptoolsExecuteNoLog "$cmd $table $ruleName $fltSens $instruction $dest" ; then
   shDebugHidden 0 ""$log" $instruction to "$ruleName" ($rule $dest) : $shExecuteErrorMessage" >&2
   local errorHasOccur=1
  fi
 done
 return $errorHasOccur
}

# iptoolsGetMd5Rule "filter" $md5
iptoolsGetMd5Rule() {
 local log="iptoolsGetMd5Rule:"
 local table=""$1""
 local md5=""$2""
 if [ -z "$md5" ];then return 1;fi
 local ruleListMd5="md5"
 local theChaineMd5=""
 iptoolsRuleCreate ""$table"" "$ruleListMd5"
 local ruleFound="$( $cmdIptables -w -t "$table" -nL "$ruleListMd5" | grep "$md5" | cut -f2 -d_ )"
 if [ -z "$ruleFound" ];then
  local ruleCpt="$( $cmdIptables -w -t "$table" -nL "$ruleListMd5" | wc -l )"
  local ruleCpt=$(( ruleCpt - 2 ));
  local newRuleMd5=""$ruleListMd5"-"$ruleCpt""
  iptoolsRuleCreate ""$table"" "$newRuleMd5"
# echo "$cmdIptables -w -t $table -A "$ruleListMd5" -j $newRuleMd5 -m comment --comment ${md5}_${ruleCpt}_" >> "/tmp/firewl.log"
  if ! iptoolsExecute "$cmdIptables -w -t $table -A "$ruleListMd5" -j $newRuleMd5 -m comment --comment ${md5}_${ruleCpt}_" ; then
   shDebugHidden "[ ERROR ]"$log" add rule ($table) $rule" >&2
  else
   shDebugHidden "[ INFO ]"$log" add rule ($table) $rule" >&2
  fi
  local theChaineMd5="${newRuleMd5}"
 else
  local theChaineMd5="${ruleListMd5}-${ruleFound}"
 fi
 echo "${theChaineMd5}"
}
#iptoolsGetGw "${eth}" "${net}"
iptoolsGetGw() {
 iptoolsGetGws "${1}" "${2}" | $cmdTr -s ' ' '\n' | $cmdHead -n 1
}
#iptoolsGetGws "${eth}" "${nets}"
iptoolsGetGws() {
# if [ -n "${1}" ];then local eth="$( iptoolsGetHostEth "${1}" )"; else local eth="";fi
 if [ -n "${1}" ];then local eth="${1}"; else local eth="";fi
 if [ -n "${2}" ];then local nets="${2}"; else local nets="";fi
 if [ -z "${nets}" ] && [ -n "${eth}" ];then
  local nets="$( iptoolsGetNets "${eth}" )"
 fi
 local gws=""
 if [ -z "${eth}" ];then
  local listGws="$( $cmdIp -4 route show | $cmdAwk '/default/ { print $3 }' | $cmdSort -u | $cmdUniq | $cmdTr -s '\n' ' ' )"
 else
  local listGws="$( $cmdIp -4 route show dev "${eth}" | $cmdAwk '/default/ { print $3 }' | $cmdSort -u | $cmdUniq | $cmdTr -s '\n' ' ' )"
 fi
 if [ -n "${listGws}" ];then
  for gw in ${listGws};do
   if [ -z "${gw}" ];then continue;fi
   local isGood=0
   if [ -z "${nets}" ];then
    local isGood=1
   else
    for net in ${nets};do
     if [ -z "${net}" ];then continue;fi
     if ipIsInNetwork "${gw}" "${net}";then
      local isGood=1
     fi
    done
   fi
   if [ 1 -eq $isGood ];then
    if [ -z "${gws}" ];then local gws="${gw}";
    else local gws="${gws} ${gw}";
    fi
   fi
  done
 fi
 $cmdEcho "${gws}"
}
#iptoolsHasMacNextHop "${eth}"
iptoolsHasMacNextHop() {
# if [ -n "${1}" ];then local eth="$( iptoolsGetHostEth "${1}" )"; else local eth="";fi
 if [ -n "${1}" ];then local eth="${1}"; else local eth="";fi
 if [ -z "${eth}" ];then
  local hasMacNextHop="$( $cmdIp -4 route show | $cmdGrep 'default' | $cmdGrep -v 'via' )"
 else
  local hasMacNextHop="$( $cmdIp -4 route show dev "${eth}" | $cmdGrep 'default' | $cmdGrep -v 'via' )"
 fi
 if [ -z "${hasMacNextHop}" ];then
  # not mac next hop present
  return 1;
 else
  # mac next hop link
  return 0;
 fi
}
#iptoolsGetBroadcast "${eth}" "${net}"
iptoolsGetBroadcast() {
 $cmdEcho "$(iptoolsGetBroadcasts "${1}" "${2}" | $cmdTr -s ' ' '\n' | $cmdHead -n 1)"
}
# iptoolsGetBroadcasts "${eth}" "${net}"
iptoolsGetBroadcasts() {
# local eth="$( iptoolsGetHostEth "${1}" )"
 local eth="${1}"
 local nets="${2}"
 if [ -z "${nets}" ] && [ -n "${eth}" ];then
  local nets="$( iptoolsGetNets "${eth}" )"
 fi
 local broadcasts=""
 local listBroadcast=""
 if [ -z "$eth" ];then
  local listBroadcast="$( $cmdIp -4 addr show | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $4}' | $cmdTr -s '\n' ' ' | $cmdSort -u | $cmdUniq )"
 else
  local listBroadcast="$( $cmdIp -4 addr show dev ${eth} | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $4}' | $cmdTr -s '\n' ' ' | $cmdSort -u | $cmdUniq )"
 fi
 if [ -n "${listBroadcast}" ];then
  for broadcast in ${listBroadcast};do
   if [ -z "${broadcast}" ];then continue ;fi
   if [ -z "${nets}" ];then
    local isGood=1
   else
    local isGood=0
    for net in ${nets};do
     if [ -n "${net}" ];then
      if ipIsInNetwork "${broadcast}" "${net}";then
       local isGood=1
      fi
     fi
    done
   fi
   if [ 1 -eq $isGood ];then
    if [ -z "${broadcasts}" ];then local broadcasts="${broadcast}";
    else local broadcasts="${broadcasts} ${broadcast}";
    fi
   fi
  done
 fi
 $cmdEcho "${broadcasts}"
}
#iptoolsGetIp "${eth}" "${net}"
iptoolsGetIp() {
 iptoolsGetIps ""${1}"" ""${2}"" | $cmdTr -s ' ' '\n' | $cmdHead -n 1
}
#iptoolsGetIps "${eth}" "${nets}"
iptoolsGetIps() {
 local ips=""
 if [ -n "${1}" ];then
#  local eth="$( iptoolsGetHostEth "${1}" )"
  local eth="${1}"
  local nets="${2}"
  local listIp="$( $cmdIp -4 addr show dev ${eth} | $cmdGrep ${eth}\$ | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $2}' | $cmdCut -d'/' -f1 | $cmdSort -u | $cmdUniq  | $cmdTr -s '\n' ' ' )"
 else
  local listIp="$( $cmdIp -4 addr show | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $2}' | $cmdCut -d'/' -f1 | $cmdSort -u | $cmdUniq  | $cmdTr -s '\n' ' ' )"
 fi
 
 if [ -n "${listIp}" ];then
  for ip in ${listIp};do
   if [ -z "${ip}" ];then continue ;fi
   local isGood=0
   if [ -n "${nets}" ];then
    for net in ${nets};do
     if ipIsInNetwork "${ip}" "${net}";then
      local isGood=1
     fi
    done
   else
    local isGood=1
   fi
   if [ 1 -eq $isGood ];then
    if [ -z "$ips" ];then local ips="${ip}";
    else local ips="${ips} ${ip}";
    fi
   fi
  done
 fi
 $cmdEcho "${ips}"
}
#iptoolsGetNet "${eth}" "${ip}"
iptoolsGetNet() {
 iptoolsGetNets "${1}" "${2}" | $cmdTr -s ' ' '\n' | $cmdHead -n 1
}
#iptoolsGetNets "${eth}" "${ip}"
iptoolsGetNets() {
# local eth="$( iptoolsGetHostEth "${1}" )"
 local eth="${1}"
 local nets=""
 local ip="${2}"
 if [ -z "$eth" ];then
  #$cmdIp -4 route show | $cmdGrep "scope" | $cmdCut -d' ' -f 1 | $cmdSort -u | $cmdUniq | $cmdTr -s '\n' ' '
  local listNet="$( $cmdIp -4 addr show | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $2}' | $cmdSort -u | $cmdUniq  | $cmdTr -s '\n' ' ' )"
 else
  #$cmdIp -4 route show dev ${eth} | $cmdGrep ${eth}\$ | $cmdGrep "scope" | $cmdCut -d' ' -f 1 | $cmdSort -u | $cmdUniq | $cmdTr -s '\n' ' '
  local listNet="$( $cmdIp -4 addr show dev ${eth} | $cmdGrep ${eth}\$ | $cmdGrep "inet" | $cmdGrep "scope" | $cmdAwk '{print $2}' | $cmdSort -u | $cmdUniq  | $cmdTr -s '\n' ' ' )"
 fi
 if [ -n "${listNet}" ];then
  for net in ${listNet};do
   if [ -z "${net}" ];then continue ;fi
   #echo " ${net}:${ip} $( ipIsInNetwork "${ip}" "${net}" )" >&2
   if [ -z "${ip}" ] || ipIsInNetwork "${ip}" "${net}" ;then
    if [ -z "${nets}" ];then local nets="$( ipCidrToNetwork "${net}" )"
    else local nets="${nets} $( ipCidrToNetwork "${net}" )"
    fi
   fi
  done
 fi
 $cmdEcho ${nets}
}
#ipToolsGetEths "${eth}"
ipToolsGetEths() {
 local ethList=""
 for hwdEth in $( ipToolsGetHwdEths "${1}" );do
  local eth="$(iptoolsGetHostEth "${hwdEth}")"
  local ethEverListed=0
  for ethPresent in ${ethList};do
   if [ "|${eth}|" = "|${ethPresent}|" ];then
    local ethEverListed=1
    break
   fi
  done
  if [ 0 -eq $ethEverListed ];then
    local ethList="${ethList} ${eth}"
  fi
 done
 $cmdEcho "${ethList}"
}
#ipToolsGetHwdEths "${eth}"
ipToolsGetHwdEths() {
 if [ -n "${1}" ];then
  $cmdIp link show dev ${1} | $cmdGrep UP | $cmdCut -d':' -f2 | $cmdTr -d ' ' | $cmdSort -u | $cmdUniq
 else
  $cmdIp link show | $cmdGrep UP | $cmdCut -d':' -f2 | $cmdTr -d ' ' | $cmdSort -u | $cmdUniq
 fi
}
#iptoolsRestartEth() {
# local eth="$( iptoolsGetHostEth "$1" )"
# #/bin/sh -c "$cmdDhclient -r "$eth";$cmdDhclient "$eth"" >> /tmp/result.$eth.restart 2>&1
# #/bin/sh -c "$cmdIfdown "$eth" --force;$cmdIfup "$eth" --force" >> /tmp/result.$eth.restart 2>&1
#}
# iptoolsGetHostEth "${eth}"
iptoolsGetHostEth() {
 local eth=""${1}""
 if [ -z "${eth}" ];then return ;fi
 local linkMasterEth="$( $cmdIp link | $cmdCut -d' ' -f2- | $cmdGrep ^$eth | $cmdCut -f2 -d@ | $cmdCut -f1 -d ':')"
 [ "$linkMasterEth" != "NONE" ] && [ -n "$linkMasterEth" ] && local eth="${linkMasterEth}"
 $cmdEcho ""$eth""
}
# iptoolsGetBridgeHostEth "${eth}"
iptoolsGetBridgeHostEth() {
 local eth=""${1}""
 if [ -z "${eth}" ];then return ;fi
#shDebugHidden "eth:${eth} ${cmdBrctl}" >&2
 for bondFile in $( $cmdFind /proc/net/bonding/* 2>/dev/null );do
  if [ -f ${bondFile} ] && [ -n "$( $cmdCat ${bondFile} | $cmdGrep ${eth}\$ )" ];then
   local eth="$( $cmdEcho ${bondFile} | $cmdRev | $cmdCut -f1 -d/ | $cmdRev )"
  fi
 done
 if [ -x "$cmdBrctl" ] && [ -n "$eth" ]; then
  for brName in $( $cmdBrctl show 2>/dev/null | $cmdCut -f 1 | $cmdTr -d ' ' );do
   if [ -z "${brName}" ];then continue;fi
#  shDebugHidden "br:${brName}" 1>&2
   if [ "${brName}" != "bridgename" ];then
    for ifName in $( $cmdBrctl show "$brName" 2>/dev/null | $cmdTr -d ' ' | $cmdRev | $cmdCut -f 1 | $cmdRev );do
     if [ -z "$ifName" ] ;then continue;fi
     if [ "$ifName" != "interfaces" ];then
      if [ "|${ifName}|" = "|${eth}|" ];then
       local eth="$brName"
       break
      fi
     fi
    done
   fi
  done
 fi
 $cmdEcho ""$eth""
}