#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/log
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

#requiresCmd=""
#requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
#requiresCmd="${requiresCmd} cut tr rev sort uniq awk head tail"
#shWhichCmd $requiresCmd >/dev/null
#shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )
#
#requiresCmd=""
#requiresCmd="brctl ifup ifdown dhclient"
#shWhichCmd $requiresCmd >/dev/null
#shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$(shInclude $rootDarkWall/lib/ip6Tools)

iptablesLogInit() {
 local rsyslogPath="/etc/rsyslog.d/iptables.conf"
 if [ ! -f "$rsyslogPath" ];then
  echo ":msg,contains,\"NETFILTER_OUTPUT\"	$firewallDropDir/output.log" >> $rsyslogPath
  echo ":msg,contains,\"NETFILTER_INPUT\"	$firewallDropDir/input.log" >> $rsyslogPath
  echo ":msg,contains,\"NETFILTER_FORWARD\"	$firewallDropDir/forward.log" >> $rsyslogPath
  echo ":msg,contains,\"NETFILTER_\"		stop" >> $rsyslogPath
  /etc/init.d/rsyslog restart
 fi
# echo "" > /var/log/iptables/drop/forward.log
# echo "" > /var/log/iptables/drop/input.log
# echo "" > /var/log/iptables/drop/output.log
}

iptablesLogInsert() {
 local log="iptablesLogInsert:"
 local globalRule="-j LOG --log-uid --log-ip-options --log-tcp-options"
# local globalRule="-j LOG --log-uid --log-ip-options --log-headers"
 
 iptablesLogInit
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterInput""
 iptoolsRuleInsert	"filter"	"INPUT -j "$rulesLogWriterInput""
 iptoolsRuleInsert	"filter"	""$rulesLogWriterInput" $globalRule --log-prefix NETFILTER_INPUT"
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterForward""
 iptoolsRuleInsert	"filter"	"FORWARD -j "$rulesLogWriterForward""
 iptoolsRuleInsert	"filter"	""$rulesLogWriterForward" $globalRule --log-prefix NETFILTER_FORWARD"
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterOutput""
 iptoolsRuleInsert	"filter"	"OUTPUT -j "$rulesLogWriterOutput""
 iptoolsRuleInsert	"filter"	""$rulesLogWriterOutput" $globalRule --log-prefix NETFILTER_OUTPUT"
}

# iptables -I OUTPUT -j LOG --log-uid --log-ip-options --log-tcp-options --log-prefix NETFILTER_
# ip6tables -I INPUT -p icmpv6 -j LOG --log-uid --log-ip-options --log-tcp-options --log-prefix NETFILTER6_

iptablesLogStart() {
 local log="iptablesLogStart:"
 local globalRule="-j LOG --log-uid --log-ip-options --log-tcp-options"
# local globalRule="-j LOG --log-uid --log-ip-options --log-headers"
 
 iptablesLogInit
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterInput""
 iptoolsRuleAdd		"filter"	"INPUT -j "$rulesLogWriterInput""
 iptoolsRuleAdd		"filter"	""$rulesLogWriterInput" $globalRule --log-prefix NETFILTER_INPUT"
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterForward""
 iptoolsRuleAdd		"filter"	"FORWARD -j "$rulesLogWriterForward""
 iptoolsRuleAdd		"filter"	""$rulesLogWriterForward" $globalRule --log-prefix NETFILTER_FORWARD"
 
 iptoolsRuleCreate	"filter"	""$rulesLogWriterOutput""
 iptoolsRuleAdd		"filter"	"OUTPUT -j "$rulesLogWriterOutput""
 iptoolsRuleAdd		"filter"	""$rulesLogWriterOutput" $globalRule --log-prefix NETFILTER_OUTPUT"
}

iptablesLogStop() {
 local log="iptablesLogStop:"
 
 iptoolsRuleDelete "filter" "INPUT"	""$rulesLogWriterInput""
 iptoolsRuleDelete "filter" "FORWARD"	""$rulesLogWriterForward""
 iptoolsRuleDelete "filter" "OUTPUT"	""$rulesLogWriterOutput""
}