#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/route
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

#$(shInclude $rootDarkWall/lib/ip6Tools)
#$(shInclude $rootDarkWall/lib/ipNetworkMaskTools)
$(shInclude $rootDarkWall/lib/bridge)

requiresCmd="printf cat rev tr cut grep echo ping ip"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

[ ! -d "/etc/iproute2" ] && mkdir "/etc/iproute2"
fileRtTable="/etc/iproute2/rt_tables"
[ ! -f "$fileRtTable" ] && if [ -f /usr/share/iproute2/rt_tables ];then
 cp "/usr/share/iproute2/rt_tables" "$fileRtTable"
else
 $cmdEcho "255     local\n254     main\n253     default\n0       unspec" >> $fileRtTable
fi

# rtTableData="$(routeTableGetIfaceData "$eth" )"
# 
# local ${jsonRoute} = "$( $cmdEcho ${jsonRoute} | routeTableGetFromData "$data" "$overData" )"
routeTableGetFromData() {
 local log="routeTableGetFromData:"
 local jsonRoute="$( $cmdCat <&0 )"
 local params=""
 for param in $*;do
  if [ -z "$params" ];then local params="$param"
  else local params="$params $param"
  fi
 done
 if [ -z "$params" ];then
  shDebugHidden 0 ""${log}" no param given:'${params}'" >&2
 else
  local data64="$( $cmdEcho "${params}" | $cmdBase64 | $cmdTr -d '\n' )"
  if [ -z "${jsonRoute}" ];then local jsonRoute="{}";fi
  
  # route table Cpt start at '10'
  local rtTableData=""
  local rtTableCpt=10
  for rtLine in $( $cmdCat "${fileRtTable}" | $cmdTr "[[:blank:]]" "_" | $cmdGrep '0X' );do
   local anData64="$( $cmdEcho $rtLine | $cmdCut -d'|' -f 4 )"
   if [ -z "$anData64" ];then continue
   elif [ "|$data64|" = "|$anData64|" ];then
    if [ -n "$rtTableData" ];then shDebugHidden 0 ""$log" data found twice:'${params}'/${rtTableData}:${rtLine}" >&2;fi
    local rtTableData="$( $cmdEcho $rtLine | $cmdCut -d'#' -f 2- | $cmdTr -d '[[:space:]]' | $cmdTr -d '_' )"
    #local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableData" "${rtTableData}" )"
    local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableCpt" "${rtTableCpt}" )"
    local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableMark" "$( $cmdEcho ${rtTableData} | $cmdCut -d'|' -f 1 )" )"
    local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableName" "$( $cmdEcho ${rtTableData} | $cmdCut -d'|' -f 2 )" )"
    local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTablePrio" "$( $cmdEcho ${rtTableData} | $cmdCut -d'|' -f 3 )" )"
   else
    local rtTableCpt=$((rtTableCpt + 1))
   fi
  done
  
  if [ -z "$rtTableData" ];then
   local rtTableName="i$rtTableCpt"
   local rtTablePrio="5$rtTableCpt"
   local rtTableMark="$( $cmdEcho $( $cmdPrintf '0x%x' $rtTableCpt 2>&1 ) | $cmdTr '[:lower:]' '[:upper:]' )"
   local rtTableData="$rtTableMark|$rtTableName|$rtTablePrio|$data64"
   local rtTableLine="$rtTableCpt	$rtTableName # $rtTableData"
   $cmdEcho "$rtTableLine" >> "$fileRtTable"
   shDebugHidden  2 ""$log" add new data to RT TABLE :$rtTableData" >&2
   #local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableData" "${rtTableData}" )"
   local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableCpt" "${rtTableCpt}" )"
   local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableMark" "${rtTableMark}" )"
   local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTableName" "${rtTableName}" )"
   local jsonRoute="$( $cmdEcho $jsonRoute | jsonInObjectWrite "rtTablePrio" "${rtTablePrio}" )"
  else
   shDebugHidden 2 ""$log" ever existe read data :$rtTableData" >&2
  fi
 fi
 $cmdEcho "${jsonRoute}"
}
# local jsonEth="$( $cmdEcho {jsonEth} | routeAddEth )"
routeAddEth() {
 local log="routeAddEth:"
 local jsonEth="$( $cmdCat <&0 )"
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead "eth" )"
 local ethCleanIp="$( $cmdEcho ${eth} | $cmdCut -d\: -f1 )"
 if [ -z "${jsonEth}" ] || [ -z "${eth}" ];then
  shDebugHidden 0 ""${log}" bad params empty eth:${eth} jsonEth:${jsonEth}" >&2
 else
  local log="routeAddEth[eth:${eth}]:"
  local masterEth="$( $cmdEcho ${jsonEth} | json64InObjectRead "masterEth" )"
  if [ -z "${masterEth}" ];then local masterEth="${eth}";fi
  local masterEth="$( $cmdEcho ${masterEth} | $cmdCut -d\: -f1 )"
  local log="routeAddEth[${eth}/${masterEth}]:"
  
  local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route )"
  if [ -n "${jsonEthRoute}" ];then
   local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
   local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
   shDebugHidden 0 ""${log}" echec jsonEthRoute ever registered markEthIn:${markEthIn} markEthOut:${markEthOut}" >&2
  else
#   local markEthIn=""$(iptoolsGetMd5Rule "filter" "in${eth}" )""
#   local markEthOut=""$(iptoolsGetMd5Rule "filter" "out${eth}" )""
   local jsonEthRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}" )"
   local rtTbleMark="$( $cmdEcho $jsonEthRoute | jsonInObjectRead rtTableMark )"
   local markEthIn="$( $cmdEcho in${eth}${rtTbleMark} | $cmdTr ':' '_' )"
   local markEthOut="$( $cmdEcho out${eth}${rtTbleMark} | $cmdTr ':' '_' )"
   iptoolsRuleCreate "filter" "${markEthIn}"
   iptoolsRuleCreate "filter" "${markEthOut}"
   local jsonEthRoute="$( $cmdEcho ${jsonEthRoute} | json64InObjectWrite "markIn" ${markEthIn} )"
   local jsonEthRoute="$( $cmdEcho ${jsonEthRoute} | json64InObjectWrite "markOut" ${markEthOut} )"
   local jsonEth="$( $cmdEcho ${jsonEth} | json64InObjectWrite route ${jsonEthRoute} )"
  fi
  local rtTablePrio="$( $cmdEcho ${jsonEthRoute} | jsonInObjectRead "rtTablePrio" )"
  local rtTableMark="$( $cmdEcho ${jsonEthRoute} | jsonInObjectRead "rtTableMark" )"
  local rtTableName="$( $cmdEcho ${jsonEthRoute} | jsonInObjectRead "rtTableName" )"
  local rtTableCpt="$( $cmdEcho ${jsonEthRoute} | jsonInObjectRead "rtTableCpt" )"
  if [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ] || [ -z "${rtTablePrio}" ] || [ -z "${rtTableMark}" ] || [ -z "${rtTableName}" ] || [ -z "${rtTableCpt}" ];then
   shDebugHidden 0 ""${log}"  bad params empty markEthIn:${markEthIn} markEthOut:${markEthOut} rtTablePrio:${rtTablePrio} rtTableMark:${rtTableMark} rtTableName:${rtTableName} rtTableCpt:${rtTableCpt}" >&2
  else
   shDebugHidden 2 ""$log" add route for mark ${rtTableMark} for ${eth} on ${rtTableName}" >&2
   if ! iptoolsExecute "$cmdIp -4 route add 255.255.255.255/32 dev ${ethCleanIp} metric 128 table ${rtTableName}" ; then
    shDebugHidden 0 ""$log" route add 255.255.255.255/32 on ${eth}" >&2
   else
    shDebugHidden 2 ""$log" route add 255.255.255.255/32 on ${eth}" >&2
   fi
#   if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${eth} oif ${eth} lookup ${rtTableName}" ; then
   iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}"
   iptoolsExecute "$cmdIp -4 rule add pri 30${rtTableCpt} oif ${ethCleanIp} lookup ${rtTableName}"
   iptoolsExecute "$cmdIp -4 rule add pri 30${rtTableCpt} iif ${ethCleanIp} lookup ${rtTableName}"
   shDebugHidden 2 ""${log}" $eth ip rule add pri" >&2

   iptoolsRuleCreate "mangle" "${markEthIn}"
   iptoolsRuleCreate "mangle" "${markEthOut}"
  # Add Filter Eth Rule
   iptoolsRuleAdd "mangle" "markIn		-m mark --mark 0x0 -i "${ethCleanIp}" -j ${markEthIn}"
   iptoolsRuleAdd "mangle" "markOut		-m mark --mark 0x0 -o "${ethCleanIp}" -j ${markEthOut}"
   shDebugHidden 1 ""${log}" added filter rule" >&2
   iptoolsRuleAdd "filter" "INPUT  -i "${eth}" -j "${markEthIn}"" >&2
   iptoolsRuleAdd "filter" "OUTPUT -o "${eth}" -j "${markEthOut}"" >&2
   if [ "|${eth}|" != "|${masterEth}|" ];then
     iptoolsRuleAdd "filter" "INPUT  -i "${masterEth}" -j "${markEthIn}"" >&2
     iptoolsRuleAdd "filter" "OUTPUT -o "${masterEth}" -j "${markEthOut}"" >&2

#   local jsonMasterEthRoute="$( $cmdEcho {} | routeTableGetFromData "${masterEth}" )"
#   local masterRtTbleMark="$( $cmdEcho $jsonMasterEthRoute | jsonInObjectRead rtTableMark )"
#   local markMasterEthIn="$( $cmdEcho in${masterEth}${masterRtTbleMark} | $cmdTr ':' '_' )"
#   local markMasterEthOut="$( $cmdEcho out${masterEth}${masterRtTbleMark} | $cmdTr ':' '_' )"
#   iptoolsRuleCreate "mangle" "${markMasterEthIn}"
#   iptoolsRuleCreate "mangle" "${markMasterEthOut}"
#   iptoolsRuleCreate "filter" "${markMasterEthIn}"
#   iptoolsRuleCreate "filter" "${markMasterEthOut}"
##   local markMasterEthIn="$( $cmdEcho ${jsonMasterEthRoute} | json64InObjectRead "markIn" )"
##   local markMasterEthOut="$( $cmdEcho ${jsonMasterEthRoute} | json64InObjectRead "markOut" )"
#   # Add Filter Eth Rule
##   iptoolsRuleInsert "filter" "INPUT  -i "${eth}" -j "${markMasterEthIn}"" >&2
##   iptoolsRuleInsert "filter" "OUTPUT -o "${eth}" -j "${markMasterEthOut}"" >&2
##   iptoolsRuleInsert "filter" "${markMasterEthIn} -j "${markEthIn}"" >&2
##   iptoolsRuleInsert "filter" "${markMasterEthOut} -j "${markEthOut}"" >&2
##   iptoolsRuleInsert "filter" "INPUT  -i "${masterEth}" -j "${markEthIn}"" >&2
##   iptoolsRuleInsert "filter" "OUTPUT -o "${masterEth}" -j "${markEthOut}"" >&2
##   iptoolsRuleInsert "filter" "${markMasterEthIn} -j "${markEthIn}"" >&2
##   iptoolsRuleInsert "filter" "${markMasterEthOut} -j "${markEthOut}"" >&2
##   iptoolsRuleInsert "mangle" "${markMasterEthIn} -m mark --mark 0x0 -j "${markEthIn}""
##   iptoolsRuleInsert "mangle" "${markMasterEthOut} -m mark --mark 0x0 -j "${markEthOut}""
#   iptoolsRuleInsert "mangle" "${markMasterEthIn} -j "${markEthIn}""
#   iptoolsRuleInsert "mangle" "${markMasterEthOut} -j "${markEthOut}""
#   shDebugHidden 1 ""${log}" added filter rule" >&2
#   shDebugHidden 0 ""$log" on master for rule, cause ${eth} != ${masterEth}" >&2
#  else
   fi
   
##   iptoolsRuleAdd "mangle" "${markEthIn}	-m mark --mark 0x0 -j CONNMARK --set-mark "${rtTableMark}""
#   iptoolsRuleAdd "mangle" "${markEthIn}	-m mark --mark 0x0 -j MARK --set-mark "${rtTableMark}""
#   iptoolsRuleAdd "mangle" "${markEthIn}	-m mark --mark 0x0 -s 0.0.0.0 -d 255.255.255.255 -j MARK --set-mark "${rtTableMark}""
    
#   iptoolsRuleAdd "mangle" "${markEthOut}	-m mark --mark 0x0 -j CONNMARK --set-mark "${rtTableMark}""
  fi
 fi
 $cmdEcho ${jsonEth}
}

# local jsonEth="$( $cmdEcho ${jsonEth} | routeAddIp "${ip}" "${net}" "${broadcast}" "${gws}" )"
routeAddIp() {
 local log="routeAddIp"
 local jsonEth="$( $cmdCat <&0 )"
 
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead "eth" )"
 local ethCleanIp="$( $cmdEcho ${eth} | $cmdCut -d\: -f1 )"
 
 local masterEth="$( $cmdEcho ${jsonEth} | json64InObjectRead "masterEth" )"
 local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead "route" )"
 local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
 if [ -z "${masterEth}" ];then local masterEth="${eth}";fi
 if [ -z "${eth}" ] || [ -z "${masterEth}" ] || [ -z "${jsonEthRoute}" ] || [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ] ;then
  shDebugHidden 0 ""$log" echec param no eth:${eth} or no masterEth:${masterEth} or markEthIn:${markEthIn} or markEthOut:${markEthOut} or no jsonEthRoute:${jsonEthRoute} (jsonEth:${jsonEth})" >&2
 else
  local log="${log}[${eth}/${masterEth}]"
  local ip=""
  local net=""
  for param in $*;do
   if [ -z "${ip}" ];then local ip="$param"
   elif [ -z "${net}" ];then local net="$param"
   else
    shDebugHidden 0 ""$log" echec param no unknow param:${param}" >&2
   fi
  done
  [ -n "${net}" ] && local broadcast="$(iptoolsGetBroadcast "${eth}" "${net}" )"
  if [ -z "${ip}" ] || ( [ -z "${net}" ] && [ "${eth}" != "lo" ] );then
   shDebugHidden 0 ""$log" echec params ip:$ip net:$net" >&2
  else
   local log="${log}[${ip}/${net}]"
   local jsonIps="$( $cmdEcho ${jsonEth} | json64InObjectRead ips )"
   if [ -z "${jsonIps}" ];then local jsonIps="{}";fi
   local jsonIp="$( $cmdEcho ${jsonIps} | json64InObjectRead "${ip}" )"
   if [ -n "${jsonIp}" ];then
    local jsonIpRoute="$( $cmdEcho ${jsonIp} | json64InObjectRead route )"
    if [ -z "${jsonIpRoute}" ];then
     shDebugHidden 0 ""${log}" jsonIp haven't jsonIpRoute"
    fi
    shDebugHidden 0 ""$log" echec jsonIp ever registered"
   else
    if [ "${ethCleanIp}" = "lo" ];then
     local markNetIn="$( iptoolsGetMd5Rule "filter" "${eth}${ip}In" )"
     local markNetOut="$( iptoolsGetMd5Rule "filter" "${eth}${ip}Out" )"
     # Add Filter Rule
     shDebugHidden 2 ""${log}" added filter rule" >&2
     iptoolsRuleAdd "filter" "$markEthIn -d "${ip}/32" -j "${markNetIn}"" >&2
     iptoolsRuleAdd "filter" "$markEthOut -s "${ip}/32" -j "${markNetOut}"" >&2
     local jsonIpRoute="$( $cmdEcho {} )"
     local jsonIpRoute="$( $cmdEcho ${jsonIpRoute} | json64InObjectWrite "markIn" "${markNetIn}" )"
     local jsonIpRoute="$( $cmdEcho ${jsonIpRoute} | json64InObjectWrite "markOut" "${markNetOut}" )"
     local jsonIp="$( $cmdEcho {} | json64InObjectWrite route ${jsonIpRoute} )"
     local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite net "${ip}/32" )"
     # ==============
     local jsonEthRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}" )"
     local rtTableName="$( $cmdEcho ${jsonEthRoute} | jsonInObjectRead "rtTableName" )"
     iptoolsExecute "$cmdIp -4 route add local ${ip}/32 dev ${ethCleanIp} proto kernel scope host metric 256 table ${rtTableName}"
     if ! iptoolsExecute "${initIpRoute}" ; then
      shDebugHidden 0 ""${log}" route add ${eth} for ${ip} in ${anRtTableName}:${initIpRoute}" >&2
     else
      shDebugHidden 2 ""$log" route add ${eth} for ${ip} in ${anRtTableName}:${initIpRoute}" >&2
     fi
    else
     local jsonIpRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${net}" )"
     local jsonIpRoute="$( $cmdEcho ${jsonIpRoute} | json64InObjectWrite "markIn" "$(iptoolsGetMd5Rule "filter" "${eth}${ip}In" )" )"
     local jsonIpRoute="$( $cmdEcho ${jsonIpRoute} | json64InObjectWrite "markOut" "$(iptoolsGetMd5Rule "filter" "${eth}${ip}Out" )" )"
     local jsonIp="$( $cmdEcho {} | json64InObjectWrite route ${jsonIpRoute} )"
     local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "net" "${net}" )"
     
     local markNetIn="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markIn" )"
     local markNetOut="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markOut" )"
     
     local rtTablePrio="$( $cmdEcho ${jsonIpRoute} | jsonInObjectRead "rtTablePrio" )"
     local rtTableMark="$( $cmdEcho ${jsonIpRoute} | jsonInObjectRead "rtTableMark" )"
     local rtTableName="$( $cmdEcho ${jsonIpRoute} | jsonInObjectRead "rtTableName" )"
     local rtTableCpt="$( $cmdEcho ${jsonIpRoute} | jsonInObjectRead "rtTableCpt" )"
     if [ -z "${markNetIn}" ] || [ -z "${markNetOut}" ] || [ -z "${rtTablePrio}" ] || [ -z "${rtTableMark}" ] || [ -z "${rtTableName}" ] || [ -z "${rtTableCpt}" ];then
      shDebugHidden 0 ""${log}" params empty markNetIn:${markNetIn} markNetOut:${markNetOut} rtTablePrio:${rtTablePrio} rtTableMark:${rtTableMark} rtTableName:${rtTableName} rtTableCpt:${rtTableCpt}" >&2
     else
      # Add Filter Rule
      iptoolsRuleAdd "filter" "$markEthIn -d "${ip}/32" -j "${markNetIn}"" >&2
      iptoolsRuleAdd "filter" "$markEthOut -s "${ip}/32" -j "${markNetOut}"" >&2
#      iptoolsRuleAdd "filter" "$markEthIn -s "${net}" -j "${markNetIn}"" >&2
#      iptoolsRuleAdd "filter" "$markEthOut -d "${net}" -j "${markNetOut}"" >&2
      shDebugHidden 2 ""${log}" added filter rule" >&2
      
      shDebugHidden 2 ""$log" add mark for ${eth}.${net}|${ip} " >&2
      
#      if ! iptoolsExecute "$cmdIp -4 route add ${net} dev ${ethCleanIp} src ${ip} metric 512 table ${rtTableName}" ; then
#       for anRtTableName in ${rtTableName} $( $cmdEcho "${jsonEthRoute}" | jsonInObjectRead "rtTableName" );do
      for anRtTableName in ${rtTableName};do
       iptoolsExecute "$cmdIp -4 route add local ${ip}/32 dev ${ethCleanIp} proto kernel scope host metric 256 table ${anRtTableName}"
       iptoolsExecute "$cmdIp -4 route add broadcast ${broadcast} dev ${ethCleanIp} proto kernel scope link metric 512 table ${anRtTableName}"
       iptoolsExecute "$cmdIp -4 route add ${net} dev ${ethCleanIp} scope link metric 512 table ${anRtTableName}"
       shDebugHidden 2 ""${log}" route add ${eth} ${net} for ${ip} in ${anRtTableName}:${initIpRoute}" >&2
      done
#      if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${eth} oif ${eth} lookup ${rtTableName}" ; then
      iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 6${rtTableCpt} iif ${ethCleanIp} from ${net} lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 6${rtTableCpt} oif ${ethCleanIp} from ${net} lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 6${rtTableCpt} iif ${ethCleanIp} to ${net} lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 6${rtTableCpt} oif ${ethCleanIp} to ${net} lookup ${rtTableName}"
#      iptoolsExecute "$cmdIp -4 rule add pri 6${rtTableCpt} fwmark 0x0/0xFF to ${net} lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 16${rtTableCpt} from ${ip}/32 lookup ${rtTableName}"
      iptoolsExecute "$cmdIp -4 rule add pri 16${rtTableCpt} to ${ip}/32 lookup ${rtTableName}"
      shDebugHidden 2 ""${log}" $eth ip rule add pri" >&2
      
      iptoolsRuleCreate "mangle" "${markNetIn}"
      iptoolsRuleCreate "mangle" "${markNetOut}"
      
      iptoolsRuleInsert "mangle" "${markEthIn}	-m mark --mark 0x0 -d "${ip}/32" -j "${markNetIn}""
#      iptoolsRuleInsert "mangle" "${markEthIn}	-m mark --mark 0x0 -s "${net}" -j "${markNetIn}""
#      iptoolsRuleInsert "mangle" "${markEthOut}	-m mark --mark 0x0 -d "${net}" -j "${markNetOut}""
      iptoolsRuleInsert "mangle" "${markEthOut}	-m mark --mark 0x0 -s "${ip}/32" -j "${markNetOut}""
      
#      iptoolsRuleInsert "mangle" "${markNetIn}	-m mark --mark 0x0 -d "${ip}" -j CONNMARK --set-mark "${rtTableMark}""
      iptoolsRuleInsert "mangle" "${markNetIn}	-m mark --mark 0x0 -j MARK --set-mark "${rtTableMark}""
#      iptoolsRuleInsert "mangle" "${markNetOut}	-m mark --mark 0x0 -s "${ip}" -j CONNMARK --set-mark "${rtTableMark}""
      iptoolsRuleInsert "mangle" "${markNetOut}	-m mark --mark 0x0 -j MARK --set-mark "${rtTableMark}""
     fi
     # incomplet mark of table
    fi
    # is lo or not
    local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "ip" "${ip}" )"
    if [ -n "${broadcast}" ];then local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "broadcast" "${broadcast}" )";fi
    shDebugHidden 1 ""${log}" jsonIp: ip:"${ip}" net:"${net}" broadcast:"${broadcast}" gws:${gws} registered" >&2
   fi
   # jsonIp is empty
  fi
  # no ip/no net
  local jsonIps="$( $cmdEcho $jsonIps | json64InObjectWrite "$ip" "$jsonIp" )"
  local jsonEth="$( $cmdEcho $jsonEth | json64InObjectWrite ips "$jsonIps" )"
 fi
 # bad params
 $cmdEcho ${jsonEth}
}
routeAddFwd() {
 local log="routeAddFwd:"
# local srcEth=""$( iptoolsGetHostEth ""${1}"" )""
 local srcEth=""${1}""
 local srcEthClean=""$( $cmdEcho ""${1}""  | $cmdTr ':' '_' )""
 local srcEthCleanIp=""$( $cmdEcho ""${1}""  | $cmdCut -d ':' -f 1 )""
# local fwdEth=""$( iptoolsGetHostEth ""${2}"" )""
 local fwdEth=""${2}""
 local fwdEthClean=""$( $cmdEcho ""${2}"" | $cmdTr ':' '_' )""
 local fwdEthCleanIp=""$( $cmdEcho ""${2}"" | $cmdCut -d ':' -f 1 )""
 
 local ruleSrcIfaceIn="In"${srcEthClean}""
 local ruleSrcIfaceOut="Out"${srcEthClean}""
 
 local ruleFwdIfaceIn="In"${fwdEthClean}""
 local ruleFwdIfaceOut="Out"${fwdEthClean}""
 
 #local ruleIfaceIn=""$(firewallCreateRule	"Gw"$eth"In")""
 #local ruleIfaceOut=""$(firewallCreateRule	"Gw"$eth"Out")""
 local ruleGwIn="Gw"${srcEthClean}"-"${fwdEthClean}"I"
 local ruleGwOut="Gw"${srcEthClean}"-"${fwdEthClean}"O"
 iptoolsRuleCreate "filter" "$ruleGwIn"
 iptoolsRuleCreate "filter" "$ruleGwOut"
 
 iptoolsRuleAdd "filter" ""$ruleSrcIfaceIn"	-j "$ruleGwIn""
 iptoolsRuleAdd "filter" "FORWARD	-i "${srcEthCleanIp}"	-o "${fwdEthCleanIp}"	-j "$ruleGwIn""
 iptoolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleGwIn""
 
 iptoolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleGwOut""
 iptoolsRuleAdd "filter" "FORWARD	-i "${fwdEthCleanIp}"	-o "${srcEthCleanIp}"	-j "$ruleGwOut""
 iptoolsRuleAdd "filter" ""$ruleSrcIfaceOut"	-j "$ruleGwOut""
}
mangleRefresh() {
 local log="mangleRefresh"
 # for enterSoluce in "FORWARD" "INPUT";do
 for enterSoluce in "PREROUTING" "INPUT" "FORWARD" "OUTPUT";do
  #shDebugHidden "[ INFO ]"$log" iptoolsRuleDelete mangle $enterSoluce save-mark" >&2
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark" >&2
  iptoolsRuleDelete "mangle" "$enterSoluce"     "restore-mark" >&2
  shDebugHidden 1 ""$log" iptoolsRuleAdd mangle $enterSoluce -j CONNMARK     --save-mark" >&2
  iptoolsRuleAdd "mangle" "$enterSoluce -j CONNMARK	--save-mark" >&2
  iptoolsRuleInsert "mangle" "$enterSoluce	-j CONNMARK     --restore-mark" >&2
 done
}
#  local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state offlink )"
# $cmdEcho ${jsonGw} | routeAddGw "${eth}" "${ip}" "${net}" "${markEthIn}" "${markNetIn}"
#        local refreshMangle=1
routeAddGw() {
 local log="routeAddGw[$*]:"
 local jsonGw="$( $cmdCat <&0 )"
 if [ -z "${jsonGw}" ];then
  shDebugHidden 0 ""$log" no jsonGw in stdin" >&2
  return ;
 fi
 
 local eth="${1}"
 local ip="${2}"
 local net="${3}"
 local markEthIn="${4}"
 local markNetIn="${5}"
 local gw="$( $cmdEcho ${jsonGw} | json64InObjectRead ip )"
 if [ -z "${eth}" ] || [ -z "${gw}" ] || [ -z "${ip}" ] || [ -z "${markEthIn}" ] || [ -z "${markNetIn}" ];then
   shDebugHidden 0 ""${log}" bad params eth:${eth} gw:${gw} ip:${ip} markEthIn:${markEthIn} markNetIn:${markNetIn}" >&2
 else
  local log="routeAddGw[${eth}/${ip}/${gw}]:"
  local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
  if [ -z "${jsonGwRoute}" ];then
   local mac="$( getMacForIpInEth "${gw}" "${eth}" )"
   if [ -z "${mac}" ];then
    shDebugHidden 0 ""${log}" no MAC for ${gw}" >&2
   else
    local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite mac "${mac}" )"
   fi
   shDebugHidden 1 ""${log}" '"${gw}"/"${mac}"' register mac route" >&2
#   if [ -n "${mac}" ] || [ -n "$( echo ${eth} | grep 'tun' )" ];then
    local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${gw}" )"
#   else
#    local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${net}" )"
#   fi
   local rtTablePrio="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTablePrio" )"
   local rtTableMark="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableMark" )"
   local rtTableName="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableName" )"
   
   if [ -z "$rtTablePrio" ] || [ -z "$rtTableMark" ] || [ -z "$rtTableName" ];then
    shDebugHidden 0 ""$log" echec rtTablePrio:$rtTablePrio rtTableMark:$rtTableMark rtTableName:$rtTableName" >&2
   else
    local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite route "${jsonGwRoute}" )"
#   local initMangleIface="$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${intEth} oif ${outEth} lookup ${rtTableName}"
#   if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${eth} oif ${eth} lookup ${rtTableName}" ; then
    if [ -z "${jsonGw}" ] || ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}" >&2; then
     shDebugHidden 0 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio} jsonGw:${jsonGw}" >&2
    else
     shDebugHidden 2 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio}" >&2
#     iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j CONNMARK --set-mark "${rtTableMark}""
     if [ -n "${mac}" ];then
      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j MARK --set-mark "${rtTableMark}"" >&2
     else
      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -j MARK --set-mark "${rtTableMark}"" >&2
     fi
    fi
   fi
  fi
 fi
 $cmdEcho ${jsonGw}
}
routeAddMacNextHop() {
 local log="routeAddMacNextHop[$*]:"
 local jsonGw="$( $cmdCat <&0 )"
 if [ -z "${jsonGw}" ];then
  shDebugHidden 0 ""$log" no jsonGw in stdin" >&2
  return ;
 fi
 
 local eth="${1}"
 local ip="${2}"
 local net="${3}"
 local markEthIn="${4}"
 local markNetIn="${5}"
 local gw="$( $cmdEcho ${jsonGw} | json64InObjectRead ip )"
 if [ -z "${eth}" ] || [ -z "${gw}" ] || [ -z "${ip}" ] || [ -z "${markEthIn}" ] || [ -z "${markNetIn}" ];then
   shDebugHidden 0 ""${log}" bad params eth:${eth} gw:${gw} ip:${ip} markEthIn:${markEthIn} markNetIn:${markNetIn}" >&2
 else
  local log="routeAddMacNextHop[${eth}/${ip}/${gw}]:"
  local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
  if [ -z "${jsonGwRoute}" ];then
   #local mac="$( getMacForIpInEth "${gw}" "${eth}" )"
   #if [ -z "${mac}" ];then
   # shDebugHidden 0 ""${log}" no MAC for ${gw}" >&2
   ##else
   # local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite mac "${mac}" )"
   #fi
   #shDebugHidden 1 ""${log}" '"${gw}"/"${mac}"' register mac route" >&2
#   if [ -n "${mac}" ] || [ -n "$( echo ${eth} | grep 'tun' )" ];then
    local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${gw}" )"
#   else
#    local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${net}" )"
#   fi
   local rtTablePrio="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTablePrio" )"
   local rtTableMark="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableMark" )"
   local rtTableName="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableName" )"
   
   if [ -z "$rtTablePrio" ] || [ -z "$rtTableMark" ] || [ -z "$rtTableName" ];then
    shDebugHidden 0 ""$log" echec rtTablePrio:$rtTablePrio rtTableMark:$rtTableMark rtTableName:$rtTableName" >&2
   else
    local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite route "${jsonGwRoute}" )"
#   local initMangleIface="$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${intEth} oif ${outEth} lookup ${rtTableName}"
#   if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${eth} oif ${eth} lookup ${rtTableName}" ; then
    if [ -z "${jsonGw}" ] || ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}" >&2; then
     shDebugHidden 0 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio} jsonGw:${jsonGw}" >&2
    else
     shDebugHidden 2 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio}" >&2
#     iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j CONNMARK --set-mark "${rtTableMark}""
#     if [ -n "${mac}" ];then
#      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j MARK --set-mark "${rtTableMark}"" >&2
#     else
      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -j MARK --set-mark "${rtTableMark}"" >&2
#     fi
    fi
   fi
  fi
 fi
 $cmdEcho ${jsonGw}
}

# mangleEnableGw "${eth}" "${ip}" "${net}" "${gw}" "${rtTableName}" >&2
mangleEnableGw() {
 local log="mangleEnableGw:"
# local eth=""$( iptoolsGetHostEth ""${1}"" | $cmdCut -f1 -d\: )""
 local eth="${1}"
 local ip="${2}"
 local net="${3}"
 local gw="${4}"
 local rtTableName="${5}"
 
 if [ -z "${eth}" ] || [ -z "${ip}" ] || [ -z "${net}" ] || [ -z "${gw}" ] || [ -z "${rtTableName}" ];then
  shDebugHidden 0 ""$log" bad params [ eth:${eth} ip:${ip} net:${net} gw:${gw} rtTableName:${rtTableName} ]" >&2
 else
  local log="mangleEnableGw[${eth}/${ip}/${net}/${gw}/${rtTableName}]:"
  iptoolsExecute "$cmdIp -4 route add local ${ip}/32 dev ${eth} proto kernel scope host metric 256 table ${rtTableName}"
  iptoolsExecute "$cmdIp -4 route add ${net} dev ${eth} scope link metric 512 table ${rtTableName}"
  iptoolsExecute "$cmdIp -4 route add ${gw} dev ${eth} scope link metric 128 table ${rtTableName}"
  iptoolsExecute "$cmdIp -4 route add default via ${gw} metric 1024 dev ${eth} table ${rtTableName}"
   shDebugHidden 1 ""$log" enabled route on gw" >&2
 fi
}
# mangleEnableNextMacHop "${eth}" "${ip}" "${net}" "${rtTableName}" >&2
mangleEnableNextMacHop() {
 local log="mangleEnableNextMacHop:"
# local eth=""$( iptoolsGetHostEth ""${1}"" | $cmdCut -f1 -d\: )""
 local eth="${1}"
 local ip="${2}"
 local net="${3}"
 local rtTableName="${4}"
 
 if [ -z "${eth}" ] || [ -z "${ip}" ] || [ -z "${net}" ] || [ -z "${rtTableName}" ];then
  shDebugHidden 0 ""$log" bad params [ eth:${eth} ip:${ip} net:${net} rtTableName:${rtTableName} ]" >&2
 else
  local log="mangleEnableNextMacHop[${eth}/${ip}/${net}/${rtTableName}]:"
  iptoolsExecute "$cmdIp -4 route add local ${ip}/32 dev ${eth} proto kernel scope host metric 256 table ${rtTableName}"
  iptoolsExecute "$cmdIp -4 route add ${net} dev ${eth} scope link metric 512 table ${rtTableName}"
  iptoolsExecute "$cmdIp -4 route add default dev ${eth} metric 1024 table ${rtTableName}"
  shDebugHidden 1 ""$log" enabled route on nextMacHop" >&2
 fi
}

getMacForIpInEth() {
 local log="getMacForIpInEth:"
 local ip="$1"
 local eth="$2"
 local mac="$(tryGetMacForIpInEth $eth $ip)"
 if [ -z "$mac" ];then tryPingIpInEth $eth $ip;local mac="$(tryGetMacForIpInEth $eth $ip)";fi
 echo ""$mac""
}

tryGetMacForIpInEth() {
 local log="tryGetMacForIpInEth"
 local eth=""$(iptoolsGetHostEth ""$1"" | $cmdCut -f1 -d\: )""
 local ip="$2"

 local mac=""
 for arpLine in $($cmdIp -4 neigh | $cmdGrep " dev $eth " | $cmdGrep -v "FAILED" | $cmdGrep -v "INCOMPLETE" | $cmdTr -s ' ' '_');do
  local arpIp="$(echo $arpLine | $cmdCut -d'_' -f 1)"
  if [ "|$arpIp|" = "|$ip|" ];then
   local mac="$(echo $arpLine | $cmdCut -d'_' -f 5)"
  fi
 done
 echo ""$mac""
}
# tryPingIpInEth $eth $ip
tryPingIpInEth() {
 local log="tryPingIpInEth"
 local eth=""$(iptoolsGetHostEth ""$1"" | $cmdCut -f1 -d\: )""
 local ip="$2"
 if [ -z "$( $cmdPing -I $eth -c 1 $ip 2>/dev/null | grep time=)" ];then
  #local ruleInException="$(firewallCreateRule InStartException)"
  # icmp (echo-reply:0/0, echo-request:8/0)
  local ruleInException="Inpingexception"
  iptoolsRuleCreate "filter" "$ruleInException" && iptoolsRuleAdd "filter" ""$ruleInException"		-p icmp --icmp-type 8/0	-j ACCEPT"
  
  #local ruleOutException="$(firewallCreateRule OutStartException)"
  local ruleOutException="Outpingexception"
  iptoolsRuleCreate "filter" "$ruleOutException" && iptoolsRuleAdd "filter" ""$ruleOutException"	-p icmp --icmp-type 0/0	-j ACCEPT"
  
  iptoolsRuleAdd "filter" "INPUT	-i "$eth" -j "$ruleInException""
  iptoolsRuleAdd "filter" "OUTPUT	-o "$eth" -j "$ruleOutException""
  
  $cmdPing -I $eth -c 1 $ip > /dev/null 2>&1
  
  iptoolsRuleDelete "filter" "INPUT"	"-i "$eth" -j "$ruleInException""
  iptoolsRuleDelete "filter" "OUTPUT"	"-o "$eth" -j "$ruleOutException""
 fi
}








# local ip=""
# local net=""
# local broadcast=""
# local gws=""
# for param in $*;do
#  if [ -z "${ip}" ];then local ip="$param"
#  elif [ -z "${net}" ];then local net="$param"
#  elif [ -z "${broadcast}" ];then local broadcast="$param"
#  else local gws="$gws $param"
#  fi
# done
# if [ -z "${ip}" ] || [ -z "${net}" ];then
#  shDebugHidden 0 ""$log" echec params ip:$ip net:$net" >&2
# else
#  local log="${log}[${ip}/${net}]"