#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/standalone
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd="sleep shuf tee mktemp rm cat ifup date sh wc ln"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

pipeJsonBuf=""
darkwallInit() {
 local log="darkwallInit:"
# upnp/lib-sh/upnp\
# upnp/global/vars\
 for toInclude in\
 lib/firewallInit\
 lib/firewallGateway6\
 lib/firewallPnet6\
 lib/config\
 global/vars\
 ;do
  [ -z "${toInclude}" ] && continue
  local timeout=10
  $cmdSleep $( $cmdShuf -i 3-5 -n 1)
  while [ $timeout -gt 0 ] && [ ! -f "$rootDarkWall/${toInclude}" ];do
   local timeout=$(( timeout - 1 ))
   $cmdSleep $( $cmdShuf -i 0-2 -n 1).$( $cmdShuf -i 1-999 -n 1)
   shDebug 0 "${log} file not ready ${timeout} : $rootDarkWall/${toInclude}"
  done
#  local cmdToInclude="$( shInclude $rootDarkWall/${toInclude} )"
#  shDebug 2 " Include $cmdToInclude"
#  $cmdToInclude
  $( shInclude $rootDarkWall/${toInclude} )
  shDebug 2 "${log} Included '${toInclude}'"
 done
 firewallPipe="${pipeCmdFile}"
 shPipeInit "standalone:pipeJsonBuf"; pipeJsonBuf=$?
 $cmdEcho {} | shPipeWrite "$pipeJsonBuf"
 
 [ -d /etc/dhcp ] && local dhcpConfDir="/etc/dhcp"
 if [ -d "$dhcpConfDir" ];then
  [ ! -L "$dhcpConfDir/dhclient-exit-hooks.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifdhcpenter.firewall" "$dhcpConfDir/dhclient-exit-hooks.d/00_darkwall"
  [ ! -L "$dhcpConfDir/dhclient-enter-hooks.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifdhcpexit.firewall" "$dhcpConfDir/dhclient-enter-hooks.d/00_darkwall"
  shDebug 1 "${log} initied to $dhcpConfDir"
 else
  shDebug 1 "${log} no dhcpConfDir"
 fi
 [ -d /etc/NetworkManager ] && networkManagerConfDir="/etc/NetworkManager"
 if [ -d "$networkManagerConfDir" ];then
  [ ! -L "$networkManagerConfDir/dispatcher.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifupd.firewall" "$networkManagerConfDir/dispatcher.d/00_darkwall"
  shDebug 1 "${log} initied to $networkManagerConfDir"
 else
  shDebug 1 "${log} no networkManagerConfDir"
 fi
 [ -d /etc/network ] && local networkConfDir="/etc/network"
 if [ -d "$networkConfDir" ];then
  [ ! -L "$networkConfDir/if-pre-up.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifpreupd.firewall" "$networkConfDir/if-pre-up.d/00_darkwall"
  [ ! -L "$networkConfDir/if-up.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifupd.firewall" "$networkConfDir/if-up.d/00_darkwall"
  [ ! -L "$networkConfDir/if-down.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifdownd.firewall" "$networkConfDir/if-down.d/00_darkwall"
  [ ! -L "$networkConfDir/if-post-down.d/00_darkwall" ] && $cmdLn -s "${rootDarkWall}/bin/ifpostdownd.firewall" "$networkConfDir/if-post-down.d/00_darkwall"
  shDebug 1 "${log} initied to $networkConfDir"
 else
  shDebug 1 "${log} no networkConfDir"
 fi
 $cmdSh ${rootDarkWall}/bin/tryPipeMessage handleReceiveCommand darkwallReceiveCommand  2>&1 >> /tmp/tryPipeMessage.log &
# $cmdEcho "handleReceiveCommand darkwallReceiveCommand" >>"$firewallPipe" &
 shDebug 2 "${log} ended pipeJsonBuf:$pipeJsonBuf firewallPipe:$firewallPipe"
}
# ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe $jsonKey "$jsonValue"
ifaceJsonWrite() {
 local ifacesJsonPipe="$1"
 local eth="$2"
 local ifaceJsonPipe="$3"
 local jsonKey="$4"
 local jsonValue="$5"
 local log="darkwall-ifaceJsonWrite[$eth/$jsonKey]:"
 
 local tmpfile="$($cmdMktemp)"
# shDebug 2 ""${log}" $tmpfile"
 shPipeRead "$ifaceJsonPipe" | json64InObjectWrite "$jsonKey" "$jsonValue" >"$tmpfile"
 $cmdCat "$tmpfile" | shPipeWrite "$ifaceJsonPipe"
 $cmdRm -f "$tmpfile"
# shDebug 1 ""${log}" jsonWriteBig"
 jsonWriteBig "$eth" "$ifacesJsonPipe" "$ifaceJsonPipe"
 
# shPipeInit "${log} MyJsonBuff"; local jsonBuffer=$?
# shPipeRead $ifaceJsonPipe | json64InObjectWrite "$jsonKey" "$jsonValue" | shPipeWrite $jsonBuffer
# jsonWriteBig "${eth}" $ifacesJsonPipe $jsonBuffer
# shPipeFree $jsonBuffer
}

ifacesCheck() {
 local log="darkwall-ifacesCheck:"
 local jsonDataPipe=$pipeJsonBuf
 shDebug 1 ""${log}" jsonData:$( shPipeReadTee $jsonDataPipe | wc )"
 if [ -z "$( shPipeReadTee $jsonDataPipe )" ];then
  shDebug 0 ""${log}" no jsonData"
 else
  shPipeInit "${log} ifacesPipe"; local jsonIfacesPipe=$?
  jsonReadBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe
  if [ -z "$(shPipeReadTee $jsonIfacesPipe )" ];then
   shDebug 0 ""${log}" no jsonIfaces found in pipe"
  else
#   shDebug 0 ""${log}" list jsonIfacesPipe:$jsonIfacesPipe"
#   shPipeReadTee $jsonIfacesPipe | json64InObjectKeyList 2>&1 >/ram/ifaceChecks.keylist
   for jsonKeyEth in $( shPipeReadTee $jsonIfacesPipe | json64InObjectKeyList );do
    local log="darkwall-ifacesCheck["${jsonKeyEth}"]:"
    
    shPipeInit "${log} ifacesConfPipe"; local jsonConfIfacesPipe=$?
    jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
    shPipeInit "${log} confIfacePipe"; local jsonConfIfacePipe=$?
    jsonReadBig "${jsonKeyEth}" $jsonConfIfacesPipe $jsonConfIfacePipe
    shPipeFree $jsonConfIfacesPipe
    
    shPipeInit "${log} ifacePipe"; local jsonIfacePipe=$?
    jsonReadBig "${jsonKeyEth}" $jsonIfacesPipe $jsonIfacePipe
    if [ -z "$(shPipeReadTee $jsonIfacePipe )" ];then
     shDebug 0 ""${log}" no jsonEth"
    else
     shDebug 2 ""${log}" jsonEth:${jsonKeyEth}"
     local ifaceFolder="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "ifaceFolder" )"
     
#     shDebug 2 ""${log}" jsonBufferPipe:$jsonBufferPipe"
     # ============================ Check Ips
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip4-checkips.log"
     firewallCheckIps $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip6-checkips.log"
     firewall6CheckIps $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     # ============================Check pNet
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip4-checkpnet.log"
     firewallPnetCheck $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip6-checkpnet.log"
     firewallPnet6Check $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     # ============================ Check GWs
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip4-checkgw.log"
     firewallGatewayCheck $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     local logFile="${ifaceFolder}/${jsonKeyEth}-ip6-checkgw.log"
     firewallGateway6Check $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
     shDebug 1 ""${log}" checked"
#     shDebug 1 ""${log}" jsonIfacePipe:$( shPipeReadTee $jsonIfacePipe | wc)" 2>&1
     
     jsonWriteBig "${jsonKeyEth}" $jsonIfacesPipe $jsonIfacePipe "firewallCheck"
    fi
    shPipeFree $jsonIfacePipe
    shPipeFree $jsonConfIfacePipe
   done
   local log="darkwall-ifacesCheck[END]:"
   jsonWriteBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe "$log"
   [ -z "$(shPipeReadTee $jsonDataPipe)" ] && shDebug 0 ""${log}" echec lost jsonData update"
  fi
#  shDebug 1 ""${log}" jsonIfacesPipe size:$( shPipeReadTee $jsonIfacesPipe | wc)" 2>&1
  shPipeFree $jsonIfacesPipe
 fi
 shDebug 1 ""${log}" jsonDataPipe site:$( shPipeReadTee $jsonDataPipe | wc)" 2>&1
}
ifacesInit() {
 local log="darkwall-ifacesInit:"
 firewallInit $pipeJsonBuf 2>>"/ram/bkb/firewallInit.log" >&2
 shDebug 2 ""${log}" FireWall Init end"
}

ifacePreStart() {
 local eth="${1}"
 local log="darkwall-ifacePreStart[eth:$eth]:"
 if ifaceStateHas "$ifacesPrestarted" "$eth"; then
  shDebug 2 "$log ${eth} deja Prestarted (cache global)"
  return 0
 fi
 if [ "${eth}" = "--all" ] ;then
  shDebug 1 "${log} PreStart no all"
 else
  local jsonDataPipe=$pipeJsonBuf
  if [ -z "$( shPipeReadTee $jsonDataPipe )" ];then
   shDebug 0 ""${log}" no jsonData"
  else
   #shDebug 1 ""${log}" jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
   shPipeInit "${log} ConfIfacesPipe"; local jsonConfIfacesPipe=$?
   jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
   if [ -z "$( shPipeReadTee $jsonConfIfacesPipe)" ];then
    shDebug 0 ""${log}" no jsonFirewall found in pipe; ifacesFolder fallback to /ram/ifaces"
    local ifacesFolder="/ram/ifaces"
   else
    local ifacesFolder="$(  shPipeReadTee $jsonConfIfacesPipe | json64InObjectRead "ifacesFolder" )"
   fi
   shPipeFree $jsonConfIfacesPipe
   shPipeInit "${log} ifacesPipe"; local jsonIfacesPipe=$?
   jsonReadBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe
   if [ -z "$(shPipeReadTee $jsonIfacesPipe)" ];then
    shDebug 0 ""${log}" no jsonIfaces found in pipe"
   else
    shPipeInit "${log} ifacePipe-read"; local jsonIfacePipe=$?
    jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
    if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
     shDebug 1 "${log} PreStart init json:$eth"
     shPipeFree $jsonIfacePipe
#     shDebug 1 ""${log}" lunch config of $eth"
#     firewallConfigIface "${ifacesConf}" $jsonDataPipe "$eth"
#     shDebug 1 "${log} PreStart configured eth:${eth}"
#     firewallConfigIface "${ifacesConf}" $jsonDataPipe "$eth" 2>>"/ram/bkb/firewallConfIfaces.log" >&2
#     shPipeReadTee $jsonDataPipe 2>&1 >>"/ram/bkb/firewallConf.json"
     shPipeInit "${log} ifacePipe-fromScratch"; local jsonIfacePipe=$?
     $cmdEcho {} | json64InObjectWrite eth "$eth" | shPipeWrite $jsonIfacePipe
    fi
    local ethState="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "state" )"
    if [ -n "$ethState" ];then
     shDebug 2 "${log} ${eth} ever Prestarted 1"
    else
     shDebug 1 "${log} PreStart eth:${eth}"
     local masterEth="$( iptoolsGetHostEth "${eth}" | $cmdCut -d\: -f1 | $cmdCut -d\. -f1 )"
     local bridgeHostEth="$( iptoolsGetBridgeHostEth "${eth}" )"
     local bridgeHostMasterEth="$( $cmdEcho $( iptoolsGetHostEth "${bridgeHostEth}" ) | $cmdCut -d\: -f1 | $cmdCut -d\. -f1 )"
     if [ -z "$bridgeHostMasterEth" ];then
      shDebug 0 "${log} PreStart no bridgeHostMasterEth! param:${1}/eth:$eth/masterEth:$masterEth/bridgeHostEth:$bridgeHostEth/bridgeHostMasterEth:${bridgeHostMasterEth}"
     else
      local ifaceFolder="${ifacesFolder}/${bridgeHostMasterEth}"
      #local ifaceFolder="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "ifaceFolder" )"
      ifaceJsonWrite $jsonIfacesPipe "${eth}" $jsonIfacePipe "ifaceFolder" "${ifaceFolder}"
      shPipeFree $jsonIfacePipe
      shPipeInit "${log} ifacePipe-ifaceFolder-writed"; local jsonIfacePipe=$?
      jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
      if [ "|${masterEth}|" != "|${eth}|" ];then
       ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "masterEth" "${masterEth}"
       shPipeFree $jsonIfacePipe
       shPipeInit "${log} ifacePipe-masterEth-writed"; local jsonIfacePipe=$?
       jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       if [ "|${masterEth}|" != "|${bridgeHostMasterEth}|" ];then
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "bridgeHostMasterEth" "${bridgeHostMasterEth}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-bridgeHostMasterEth-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       else
        local bridgeHostMasterEth=""
#        if [ "|${bridgeHostEth}|" != "|${eth}|" ];then
#         local jsonEth="$( $cmdEcho $jsonEth | json64InObjectWrite "bridgeHostEth" "${bridgeHostEth}" )"
#        fi
       fi
       if [ "|${eth}|" != "|${bridgeHostEth}|" ];then
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "bridgeHostEth" "${bridgeHostEth}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-bridgeHostEth-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       else
        local bridgeHostEth=""
       fi
      else
       if [ "|${masterEth}|" != "|${bridgeHostMasterEth}|" ];then
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "bridgeHostMasterEth" "${bridgeHostMasterEth}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-bridgeHostMasterEth-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       else
        local bridgeHostMasterEth=""
       fi
       if [ "|${eth}|" != "|${bridgeHostEth}|" ];then
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "bridgeHostEth" "${bridgeHostEth}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-bridgeHostEth-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       else
        local bridgeHostEth=""
       fi
       local masterEth=""
      fi
      local ifaceReady=""
      if [ -n "${bridgeHostMasterEth}" ];then
       shPipeInit "${log} MyJsonBridgeMasterEth"; local jsonBridgeMasterEthPipe=$?
       jsonReadBig "${bridgeHostMasterEth}" $jsonIfacesPipe $jsonBridgeMasterEthPipe
       if [ -z "$( shPipeReadTee $jsonBridgeMasterEthPipe | json64InObjectRead "state" )" ];then
        shPipeFree $jsonBridgeMasterEthPipe
        shDebug 0 "${log} PreStart for eth:${eth} the bridgeHostMasterEth:${bridgeHostMasterEth} is not ready!"
        $cmdSh ${rootDarkWall}/bin/tryPipeMessage start ${bridgeHostMasterEth} 2>&1 >> /tmp/tryPipeMessage.log &
#        $cmdEcho "start ${bridgeHostMasterEth}" >>"${firewallPipe}" &
       else
        shDebug 2 "${log} firewall Prestarted Bridge ${eth} => ${bridgeHostMasterEth}"
        local jsonRouteBridge="$( shPipeReadTee ${jsonBridgeMasterEthPipe} | json64InObjectRead route )"
        local jsonRoute6Bridge="$( shPipeReadTee ${jsonBridgeMasterEthPipe} | json64InObjectRead route6 )"
        shPipeFree $jsonBridgeMasterEthPipe
        if [ -n "${masterEth}" ];then
         shPipeInit "${log} MyJsonMasterEth"; local jsonMasterEthPipe=$?
         jsonReadBig "${masterEth}" $jsonIfacesPipe $jsonMasterEthPipe
         if [ -z "$( shPipeReadTee $jsonMasterEthPipe | json64InObjectRead "state" )" ];then
          shDebug 0 "${log} PreStart for eth:${eth} the MasterEth:${masterEth} is not ready!"
         else
          local ifaceReady="1"
         fi
         shPipeFree $jsonMasterEthPipe
        else
         local ifaceReady="1"
        fi
       fi
      else
       if [ -n "${bridgeHostEth}" ];then
        shPipeInit "${log} MyJsonBridgeHostEth"; local jsonBridgeHostEthPipe=$?
        jsonReadBig "${bridgeHostEth}" $jsonIfacesPipe $jsonBridgeHostEthPipe
#        local jsonBridgeEth="$( $cmdEcho $jsonIfaces | json64InObjectRead "${bridgeHostEth}" )"
        if [ -z "$( shPipeReadTee $jsonBridgeHostEthPipe | json64InObjectRead "state" )" ];then
         shDebug 0 "${log} PreStart for eth:${eth} the bridgeHostEth:${bridgeHostEth} is not ready!"
#         $cmdEcho "start ${bridgeHostEth}" >>"${firewallPipe}" &
         $cmdSh ${rootDarkWall}/bin/tryPipeMessage start ${bridgeHostEth} 2>&1 >> /tmp/tryPipeMessage.log &
         shPipeFree $jsonBridgeHostEthPipe
        else
         shDebug 2 "${log} firewall Prestarted Bridge ${eth} => ${bridgeHostEth}"
         local jsonRouteBridge="$( shPipeReadTee $jsonBridgeHostEthPipe | json64InObjectRead route )"
         local jsonRoute6Bridge="$( shPipeReadTee $jsonBridgeHostEthPipe | json64InObjectRead route6 )"
         shPipeFree $jsonBridgeHostEthPipe
         if [ -n "${masterEth}" ];then
          shPipeInit "${log} MyJsonMasterEth"; local jsonMasterEthPipe=$?
          jsonReadBig "${masterEth}" $jsonIfacesPipe $jsonMasterEthPipe
#          local jsonMasterEth="$( $cmdEcho $jsonIfaces | json64InObjectRead "${masterEth}" )"
          if [ -z "$( shPipeReadTee $jsonMasterEthPipe | json64InObjectRead "state" )" ];then
           shDebug 0 "${log} PreStart for eth:${eth} the MasterEth:${masterEth} is not ready!"
          else
           local ifaceReady="1"
          fi
          shPipeFree $jsonMasterEthPipe
         else
          local ifaceReady="1"
         fi
        fi
       else
        if [ -n "${masterEth}" ];then
         shPipeInit "${log} MyJsonMasterEth"; local jsonMasterEthPipe=$?
         jsonReadBig "${masterEth}" $jsonIfacesPipe $jsonMasterEthPipe
         if [ -z "$( shPipeReadTee $jsonMasterEthPipe | json64InObjectRead "state" )" ];then
          shDebug 0 "${log} PreStart for eth:${eth} the MasterEth:${masterEth} is not ready!"
         else
          local ifaceReady="1"
         fi
         shPipeFree $jsonMasterEthPipe
        else
         local ifaceReady="1"
        fi
       fi
      fi
      if [ -z "$ifaceReady" ];then
#       $cmdEcho "pre-start $*" >>"${firewallPipe}" &
       $cmdSh ${rootDarkWall}/bin/tryPipeMessage pre-start $* 2>&1 >> /tmp/tryPipeMessage.log &
       shDebug 0 "${log} PreStart $* rescheduled firewallPipe:${firewallPipe}"
      else
       shDebug 2 "${log} PreStart eth:${eth}/masterEth:${masterEth}/bridgeHostEth:${bridgeHostEth}/bridgeHostMasterEth:${bridgeHostMasterEth}"
       ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe "state" Prestart
       ifaceStateAdd ifacesPrestarted "$eth"
       shPipeFree $jsonIfacePipe
       shPipeInit "${log} ifacePipe-statePrestart-writed"; local jsonIfacePipe=$?
       jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       if [ -n "${jsonRouteBridge}" ];then
        local markBridgeEthIn="$( $cmdEcho ${jsonRouteBridge} | json64InObjectRead "markIn" )"
        local markBridgeEthOut="$( $cmdEcho ${jsonRouteBridge} | json64InObjectRead "markOut" )"
        iptoolsRuleAdd "mangle" "markIn	-m mark --mark 0x0 -i "${eth}" -j ${markBridgeEthIn}"
        iptoolsRuleAdd "mangle" "markOut	-m mark --mark 0x0 -o "${eth}" -j ${markBridgeEthOut}"
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe route "${jsonRouteBridge}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-route-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
        
#       $cmdEcho 1 > /proc/sys/net/ipv6/conf/${eth}/proxy_ndp
#       $cmdEcho 1 > /proc/sys/net/ipv6/conf/${bridgeHostMasterEth}/proxy_ndp
        local mark6BridgeEthIn="$( $cmdEcho ${jsonRoute6Bridge} | json64InObjectRead "markIn" )"
        local mark6BridgeEthOut="$( $cmdEcho ${jsonRoute6Bridge} | json64InObjectRead "markOut" )"
        ip6toolsRuleAdd "mangle" "markIn	-m mark --mark 0x0 -i "${eth}" -j ${mark6BridgeEthIn}"
        ip6toolsRuleAdd "mangle" "markOut	-m mark --mark 0x0 -o "${eth}" -j ${mark6BridgeEthOut}"
        ifaceJsonWrite $jsonIfacesPipe "$eth" $jsonIfacePipe route6 "${jsonRoute6Bridge}"
        shPipeFree $jsonIfacePipe
        shPipeInit "${log} ifacePipe-route6-writed"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
       else
        if [ ! -d "${ifaceFolder}" ];then shDebug 2 "${log} mkdir:${ifaceFolder}" && $cmdMkdir -p "${ifaceFolder}" >&2;fi
        shDebug 2 "${log} Prestarted ${eth}"
        local logFile="${ifaceFolder}/${eth}-ip4.log"
        
#        firewallPreStart $jsonIfacesPipe $jsonIfacePipe >>${logFile} 2>&1
        firewallPreStart $jsonIfacePipe >>${logFile} 2>&1
        jsonWriteBig "${eth}" $jsonIfacesPipe $jsonIfacePipe "$log"
        shPipeFree $jsonIfacePipe
        
        shPipeInit "${log} ifacePipe-firewallPrestarted"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
        if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
         shDebug 0 "${log} $* echec jsonEth after PreStarted empty!!!!!"
        else
         shDebug 2 "${log} Prestarted ${eth}" >>${logFile}
        fi
        local logFile="${ifaceFolder}/${eth}-ip6.log"
        
        firewall6PreStart $jsonIfacePipe >>${logFile} 2>&1
        jsonWriteBig "${eth}" $jsonIfacesPipe $jsonIfacePipe "$log"
        shPipeFree $jsonIfacePipe
        
        shPipeInit "${log} ifacePipe-firewall6Prestarted"; local jsonIfacePipe=$?
        jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
        if [ -z "$( shPipeReadTee $jsonIfacePipe )" ];then
         shDebug 0 "${log} $* echec jsonEth after PreStarted6 empty!!!!!"
        else
         shDebug 2 "${log} Prestarted6 ${eth}" >>${logFile}
        fi
       fi
       shDebug 1 "${log} PreStart ${eth} end"
      fi
     fi
    fi
    shPipeFree $jsonIfacePipe
   fi
   # /no empty jsonIfacesPipe
   jsonWriteBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe "$log"
   #shDebug 1 ""${log}" END jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
   shPipeFree $jsonIfacesPipe
  fi
  #/no json data
 fi
 #/no 'all' iface
}

ifaceStart() {
 local eth="${1}"
 local log="darkwall-ifaceStart[eth:$eth]:"
 local jsonDataPipe=$pipeJsonBuf
 if ifaceStateHas "$ifacesStarted" "$eth"; then
  shDebug 2 "${log} ${eth} deja Started (cache global)"
  return 0
 fi
 if [ -z "$( shPipeReadTee $jsonDataPipe )" ];then
  shDebug 0 ""${log}" no jsonData"
 else
  #shDebug 1 ""${log}" jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
  shPipeInit "${log} ifacesPipe"; local jsonIfacesPipe=$?
  jsonReadBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe
  if [ -z "$( shPipeReadTee $jsonIfacesPipe )" ];then
   shDebug 0 ""${log}" no jsonIfaces found in pipe"
  else
   if [ "${eth}" = "--all" ] ;then
    local isGwRead=1
    for testEth in $( $cmdIp link | $cmdGrep state | $cmdCut -d: -f2 | $cmdCut -d@ -f1 | $cmdTr -d '[:blank:]' );do
     [ -z "${testEth}" ] && continue
#     ( [ "${testEth}" = "gre0" ] || [ "${testEth}" = "gretap0" ] || [ "${testEth}" = "erspan0" ] || [ "${testEth}" = "bond0" ] ) && continue
     # not init 'state' ?
     if [ -z "$( shPipeReadTee "${jsonIfacesPipe}" | json64InObjectRead "${testEth}" | json64InObjectRead "state" )" ];then
      shDebug 0 ""${log}" rescheduled cause eth:${testEth} not ready :$*"
      local isGwRead=0
      local testbridgeHostMasterEth="$( shPipeReadTee "${jsonIfacesPipe}" | json64InObjectRead "${testEth}" | json64InObjectRead "bridgeHostMasterEth" )"
      if [ -n "${testbridgeHostMasterEth}" ];then
       local toTry="${testbridgeHostMasterEth}"
      else
       local toTry="${testEth}"
      fi
      if [ ! -f "/tmp/${toTry}.force" ];then
       shDebug 0 ""${log}" try force up for eth:${toTry} for ${testEth} :$*"
       $cmdIfup "${toTry}" >> "/tmp/${toTry}.force" 2>&1 &
      else
       if [ ! -f "/tmp/${toTry}.pipe" ];then
        $cmdSh ${rootDarkWall}/bin/tryPipeMessage pre-start ${toTry} 2>&1 >> /tmp/tryPipeMessage.log &
#        $cmdEcho "pre-start ${toTry}" >>"$firewallPipe" &
        shDebug 0 ""${log}" rescheduled pre-start:${toTry}"
        $cmdSh ${rootDarkWall}/bin/tryPipeMessage start ${toTry} 2>&1 >> /tmp/tryPipeMessage.log &
#        $cmdEcho "start ${toTry}" >>"$firewallPipe" &
        shDebug 0 ""${log}" rescheduled start:${toTry} cause eth:${testEth} not ready"
        touch "/tmp/${toTry}.pipe" >&2
       else
        shDebug 0 ""${log}" eth:${testEth} not ready, we are lost!!!!!!!!! forced rescheduled has ever done yet."
       fi
      fi
     fi
    done
    if [ 1 -eq ${isGwRead} ];then
#     $cmdEcho "enablegateway" >>"${firewallPipe}" &
     $cmdSh ${rootDarkWall}/bin/tryPipeMessage enablegateway 2>&1 >> /tmp/tryPipeMessage.log &
#     $cmdEcho "darkwallCheck" >>"${firewallPipe}" &
#     $cmdSh ${rootDarkWall}/bin/tryPipeMessage darkwallCheck 2>&1 >> /tmp/tryPipeMessage.log &
     shDebug 1 ""${log}" write enable gateway" >&2
    else
#     $cmdEcho "start $*" >>"$firewallPipe" &
     $cmdSh ${rootDarkWall}/bin/tryPipeMessage start $* 2>&1 >> /tmp/tryPipeMessage.log &
    fi
   else
#    shDebug 1 ""${log}" try read ifacesconf"
    shPipeInit "${log} ifacesConfPipe"; local jsonConfIfacesPipe=$?
    jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
    if [ -z "$( shPipeReadTee $jsonConfIfacesPipe )" ];then
     shDebug 0 ""${log}" no jsonConfIfacesPipe found in pipe:$jsonConfIfacesPipe"
    else
#     shDebug 1 ""${log}" try read ifaceconf $eth"
     shPipeInit "${log} confIfacePipe"; local jsonConfIfacePipe=$?
     jsonReadBig "${eth}" $jsonConfIfacesPipe $jsonConfIfacePipe
    fi
    shPipeFree $jsonConfIfacesPipe
    
    shPipeInit "${log} ifacePipe-start"; local jsonIfacePipe=$?
#    shDebug 1 ""${log}" try read iface $eth"
    jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
    
    if [ -z "$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "state" )" ];then
     shDebug 0 ""${log}" rescheduled cause maybe not prestarted yet"
#     $cmdEcho "pre-start $*" >>"$firewallPipe" &
     $cmdSh ${rootDarkWall}/bin/tryPipeMessage pre-start $* 2>&1 >> /tmp/tryPipeMessage.log &
     shDebug 0 ""${log}" rescheduled PreStart $*"
#     $cmdEcho "start $*" >>"$firewallPipe" &
     $cmdSh ${rootDarkWall}/bin/tryPipeMessage start $* 2>&1 >> /tmp/tryPipeMessage.log &
     shDebug 0 ""${log}" rescheduled start $*"
    elif [ -z "$( shPipeReadTee $jsonConfIfacePipe )" ];then
     shDebug 0 ""${log}" no jsonConfIfacePipe found in pipe"
    else
     local ethState="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "state" )"
     if [ "Start" = "${ethState}" ];then
      shDebug 0 ""${log}" ${eth} ever started"
     elif [ "Prestart" = "${ethState}" ];then
      local ifaceFolder="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "ifaceFolder" )"
      local bridgeHostMasterEth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "bridgeHostMasterEth" )"
      local bridgeHostEth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "bridgeHostEth" )"
      if [ -z "${bridgeHostEth}" ];then
       local logFile="${ifaceFolder}/${eth}-ip4-checkips0.log"
       firewallCheckIps $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
       shDebug 2 ""${log}" started4 ${eth}" >>$logFile 2>&1
       if [ -n "$( shPipeReadTee $jsonIfacePipe )" ] && [ -n "$( shPipeReadTee $jsonConfIfacePipe )" ];then
        shDebug 1 ""${log}" start $* succes"
       else
        shDebug 0 ""${log}" start $* ECHEC; lost JSONETH!!!!!!!!!!!!!!!!!"
       fi
       
       local logFile="${ifaceFolder}/${eth}-ip6-checkips0.log"
       firewall6CheckIps $jsonIfacePipe $jsonConfIfacePipe >>$logFile 2>&1
       shDebug 2 ""${log}" firewall6 started ${eth}" >>$logFile 2>&1
       if [ -n "$( shPipeReadTee $jsonIfacePipe )" ] && [ -n "$( shPipeReadTee $jsonConfIfacePipe )" ];then
        shDebug 1 ""${log}" start6 $* succes"
       else
        shDebug 0 ""${log}" start6 $* ECHEC; lost JSONETH!!!!!!!!!!!!!!!!!"
       fi
      fi
#      if [ -z "${bridgeHostEth}" ];then
#       iptoolsRuleAdd "filter" "FORWARD	-i "${eth}" -j ACCEPT"
#       iptoolsRuleAdd "filter" "FORWARD	-o "${eth}" -j ACCEPT"
#       ip6toolsRuleAdd "filter" "FORWARD	-i "${eth}" -j ACCEPT"
#       ip6toolsRuleAdd "filter" "FORWARD	-o "${eth}" -j ACCEPT"
#      fi
#      shDebug 2 ""${log}" firewall stop upnp ${eth}"
#      if [ -n "$upnpStopFile" ];then $cmdEcho "stop" > $upnpStopFile;fi
#      if [ -f "$upnpPidFile" ];then
#       shDebug 1 ""${log}" have to kill cron pid:$($cmdCat $upnpPidFile)"
#       kill -9 "$(cat $upnpPidFile)"
#       shExecuteNoLog "$cmdRm $upnpPidFile" >&2
#      fi
#      $cmdEcho jsonEth:${jsonEth} >> ${logFile}
#      shPipeFree $jsonConfIfacePipe && jsonConfIfacePipe=""
      shDebug 1 ""${log}" ifaceJsonWrite ${eth}"
      ifaceJsonWrite $jsonIfacesPipe "${eth}" $jsonIfacePipe "state" Start
      ifaceStateAdd ifacesStarted "$eth"
#      shPipeFree $jsonIfacePipe
#      shPipeInit "${log} ifacePipe-startwrited"; local jsonIfacePipe=$?
#      shDebug 1 ""${log}" jsonReadBig jsonIfacePipe:$jsonIfacePipe "
#      jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
##      $cmdEcho "ready" >> "$firewallTmpDir/${eth}.ready"
##      if [ -f "$upnpStopFile" ];then $cmdRm "$upnpStopFile";fi
     else
      shDebug 0 ""${log}" ${eth} not Prestarted ? ethState:${ethState}"
     fi
    fi
    shPipeFree $jsonConfIfacePipe
    shPipeFree $jsonIfacePipe
#    [ -n "$jsonConfIfacePipe" ] && shPipeFree $jsonConfIfacePipe
   fi
  fi
  jsonWriteBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe "$log"
  shPipeFree $jsonIfacesPipe
  
  #shDebug 1 ""${log}" END jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
 fi
}
# ifaceGateway $params 2>>/ram/ifaceGatewayStart.log >&2
ifaceGateway() {
 local log="darkwall-ifaceGateway:"
 local jsonDataPipe=$pipeJsonBuf
 if [ -z "$( shPipeReadTee $jsonDataPipe )" ];then
  shDebug 0 ""${log}" no jsonData"
 else
  local eth=""
  local params=""
  for param in $*;do
   if [ -z "${eth}" ];then local eth="${param}"
   elif [ -z "${params}" ];then local params="${param}"
   else local params="${params} ${param}"
   fi
  done
  local fileMode="${params}"
  local file="$( $cmdEcho ${fileMode} | $cmdCut -d ';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
  local mode="$( $cmdEcho ${fileMode} | $cmdCut -d ';' -f 2 )"
  local log="darkwall-ifaceGateway[$mode/$file]:"
  
  #shDebug 1 ""${log}" jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
  shPipeInit "${log} ifacesPipe"; local jsonIfacesPipe=$?
  shPipeInit "${log} ifaceConfPipe"; local jsonConfIfacesPipe=$?
  jsonReadBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe
  jsonReadBig "jsonConfIfaces" $jsonDataPipe $jsonConfIfacesPipe
  if [ -z "$(shPipeReadTee $jsonIfacesPipe)" ];then
   shDebug 0 ""${log}" no jsonIfaces found in pipe"
  else
   shDebug 1 ""${log}" gateway ${eth} ${fileMode}"
   shPipeInit "${log} ifacePipe"; local jsonIfacePipe=$?
   shPipeInit "${log} confIfacePipe"; local jsonConfIfacePipe=$?
   jsonReadBig "${eth}" $jsonIfacesPipe $jsonIfacePipe
   jsonReadBig "${eth}" $jsonConfIfacesPipe $jsonConfIfacePipe
   if [ "Start" != "$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "state" )" ];then
    $cmdSh ${rootDarkWall}/bin/tryPipeMessage gateway $* 2>&1 >> /tmp/tryPipeMessage.log &
#    $cmdEcho "gateway $*" >>"$firewallPipe" &
    shDebug 0 ""${log}" gateway $* rescheduled cause maybe eth:${eth} not start state :$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "state" )"
   elif [ -z "$(shPipeReadTee $jsonConfIfacePipe)" ];then
    shDebug 0 ""${log}" gateway eth:${eth} losted jsonConfIface "
   else
    local fwdData="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 3 )"
    local srcEth="${eth}"
    local srcLl="$( ip6toolsGetLl $srcEth )"
    if [ "$mode" = "bridge6" ];then
     local fwdEth="$( $cmdEcho ${fwdData} | $cmdCut -d'/' -f 1 )"
    else
     local srcIp="$( $cmdEcho ${fwdData} | $cmdCut -d'/' -f 1 )"
     local fwdEth="$( $cmdEcho ${fwdData} | $cmdCut -d'/' -f 2 )"
     local fwdIp="$( $cmdEcho ${fwdData} | $cmdCut -d'/' -f 3 )"
     local fwdRoundRobin="$( $cmdEcho ${fwdData} | $cmdCut -d'/' -f 4 )"
     if [ -z "$fwdRoundRobin" ];then local fwdRoundRobin="all";fi
     if [ -z "$fwdIp" ];then local fwdIp="*";fi
    fi
    
    local jsonFwdEth="$( shPipeReadTee $jsonIfacesPipe | json64InObjectRead "${fwdEth}" )"
#    local jsonFwdEth="$( $cmdEcho $jsonIfaces | json64InObjectRead "${fwdEth}" )"
    if [ -z "${jsonFwdEth}" ];then
     shDebug 0 ""${log}" gateway fwdEth:${fwdEth} losted jsonFwdEth:${jsonFwdEth} "
    elif [ "Start" != "$( $cmdEcho ${jsonFwdEth} | json64InObjectRead "state" )" ];then
     $cmdSh ${rootDarkWall}/bin/tryPipeMessage gateway $* 2>&1 >> /tmp/tryPipeMessage.log &
#     $cmdEcho "gateway $*" >>"${firewallPipe}" &
     shDebug 0 ""${log}" start $* rescheduled cause maybe ${fwdEth} not start:${jsonFwdEth} "
    else
     local jsonFwd="$( $cmdEcho {} | json64InObjectWrite srcEth "$(shPipeReadTee $jsonIfacePipe)" )"
     local jsonFwd="$( $cmdEcho ${jsonFwd} | json64InObjectWrite srcIp "${srcIp}" )"
     local jsonFwd="$( $cmdEcho ${jsonFwd} | json64InObjectWrite srcLl "${srcLl}" )"
     local jsonFwd="$( $cmdEcho ${jsonFwd} | json64InObjectWrite fwdEth "${jsonFwdEth}" )"
     local jsonFwd="$( $cmdEcho ${jsonFwd} | json64InObjectWrite fwdIp "${fwdIp}" )"
     local jsonFwd="$( $cmdEcho ${jsonFwd} | json64InObjectWrite roundRobin "${fwdRoundRobin}" )"
     
     local ifaceFolder="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "ifaceFolder" )"
     local logFile="$ifaceFolder/${mode}_${srcEth}_${fwdEth}.log"
     if [ "${mode}" = "gw" ] || [ "${mode}" = "igw" ];then
#      if [ ! -f "$logFile" ];then
       $cmdEcho ${jsonFwd} | firewallMangleExecute >>${logFile} 2>&1
       routeAddFwd "${srcEth}" "${fwdEth}" >>${logFile} 2>&1
#      fi
      $cmdEcho ${jsonFwd} | firewallGateway "${mode}" "${file}" >> ${logFile} 2>&1
     elif [ "${mode}" = "gw6" ] || [ "${mode}" = "igw6" ] || [ "${mode}" = "inet6" ];then
#      if [ ! -f "$logFile" ];then
       $cmdEcho ${jsonFwd} | firewall6MangleExecute >>${logFile} 2>&1
       route6AddFwd "${srcEth}" "${fwdEth}" >>${logFile} 2>&1
#      fi
      $cmdEcho ${jsonFwd} | firewall6Gateway "${mode}" "${file}" >> ${logFile} 2>&1
     elif [ "${mode}" = "bridge6" ] ;then
      $cmdEcho ${jsonFwd} | firewall6Bridge "${file}" >> ${logFile} 2>&1
     else
      shDebug 0 ""${log}" mode not found:$mode" >>${logFile}
     fi
     shDebug 1 ""${log}" Started GATEWAY $srcEth => $fwdEth $mode:$file =============" >>${logFile}
    fi
   fi
   shPipeFree $jsonIfacePipe
   shPipeFree $jsonConfIfacePipe
  fi
#  jsonWriteBig "jsonIfaces" $jsonDataPipe $jsonIfacesPipe "$log"
#  shDebug 1 ""${log}" END jsonData:$( shPipeReadTee $jsonDataPipe | wc)"
  
  shPipeFree $jsonConfIfacesPipe
  shPipeFree $jsonIfacesPipe
 fi
}
ifaceStop() {
 local myIface="$1"
 local upnpDataFile="$upnpDataDir/upnpc.$myIface"
 local firewallReadyFile="$firewallTmpDir/$(iptoolsGetHostEth ${myIface}).ready"
 if [ -f "$upnpDataFile" ];then upnpcStop ""$myIface"";fi
 if [ -f "$firewallReadyFile" ];then
  firewallStop ""$myIface""
  $cmdRm "$firewallReadyFile"
 fi
}
#gateway=${gateway:-0}
#standalonePipeIsInit=${standalonePipeIsInit:-0}

# periodical every 15 min
#periodicalTick=900
#periodicalTimeout=$(( $( $cmdDate +"%s" ) + periodicalTick ))
#periodicalCheck() {
# local log="darkwall-periodicalCheck:"
# toPeriodical=$(( periodicalTimeout - $( $cmdDate +"%s" ) ))
# if [ 1 -gt $toPeriodical ];then
#  periodicalTimeout=$(( $( $cmdDate +"%s" ) + periodicalTick ))
#  standalonePeriodical >>/ram/periodical.log 2>&1 &
#  shDebug 1 "${log} lunched standalonePeriodical / next:$periodicalTimeout"
# elif [ $periodicalTick -lt $toPeriodical ];then
##  shDebug 1 "${log} recompute periodicalTimeout cause periodicalTick:${periodicalTick} less than toPeriodical:${toPeriodical}"
#  periodicalTimeout=$(( $( $cmdDate +"%s" ) + periodicalTick ))
# #else
#  #shDebug 2 "${log} no lunch cause stay:${toPeriodical} s /  timeout : $periodicalTimeout" >>/ram/debugPeriodical.log 2>&1
# fi
#}
darkwallIsInit=
darkwallReceiveCommand() {
 local log="darkwallReceiveCommand:"
# shPipeReset
 local command=""
 local params=""
 for param in $($cmdEcho $* | $cmdTr '¤' ';' );do
  if [ -z "${command}" ];then local command="${param}"
  elif [ -z "${params}" ];then local params="${param}"
  else local params="${params} ${param}"
  fi
 done
# shDebug 1 " ${log} $command"
# >> /ram/darkwallReceiveCommand.log 2>&1
 if [ -z "${darkwallIsInit}" ];then
  if [ "$command" = "pipe" ] && [ "$param" = "isstarted" ];then
   darkwallIsInit="1"
   shDebug 1 "${log} go ifacesInit"
   ifacesInit
  else
   shDebug 0 "${log} no init reschedule :$*"
#   $cmdEcho "$*" >>"$firewallPipe" &
   $cmdSh ${rootDarkWall}/bin/tryPipeMessage $command $params 2>&1 >> /tmp/tryPipeMessage.log &
  fi
 else
  if [ "$command" = "pipe" ] && [ "$param" = "isstarted" ];then
   shDebug 0 "${log} no twice init."
  elif [ "$command" = "darkwallPeriodical" ];then
   darkwallPeriodical >&2
  elif [ "$command" = "pre-start" ];then
   ifacePreStart $params 2>>/ram/ifacePrestart.log >&2
  elif [ "$command" = "start" ];then
   ifaceStart $params   2>>/ram/ifaceStart.log >&2
  elif [ "$command" = "enablegateway" ];then
   if [ ! -f /ram/standaloneGateway ];then
    touch /ram/standaloneGateway
    firewallGatewayInit  2>>/ram/standaloneGwinit.log >&2
    shDebug 0 "${log} gw init." 2>>/ram/standaloneGwinit.log >&2
    firewall6GatewayInit 2>>/ram/standaloneGw6init.log >&2
    shDebug 0 "${log} gw6 init." 2>>/ram/standaloneGw6init.log >&2
    touch /tmp/prefix.ready
   fi
  elif [ "$command" = "gateway" ];then
   ifaceGateway $params 2>>/ram/ifaceGatewayStart.log >&2
  elif [ "$command" = "dhcp-enter" ] || [ "$command" = "dhcp-exit" ];then
   ifaceActDhcp $params 2>>/ram/ifaceDhcpAct.log >&2
  else
   shDebug 0 "${log} unknow command:$command params:$params"
  fi
 fi
# shDebug 1 "${log} end $command"
}
dhcpPreviousReason=""
dhcpRenew4Cpt=0
dhcpRenew6Cpt=0
ifaceActDhcp() {
 local log="ifaceActDhcp:"
 local params="$*"
 local jsonDhcp="$( $cmdEcho ${params} | $cmdBase64 -d -i )"
 local interface="$( $cmdEcho ${jsonDhcp} | jsonInObjectRead interface )"
# [ -z "$interface" ] && local interface="$( $cmdEcho ${jsonDhcp} | jsonInObjectRead \"interface\" )"
 local reason="$( $cmdEcho ${jsonDhcp} | jsonInObjectRead reason)"
 if [ -n "$interface" ];then
  if [ "$reason" = "PREINIT6" ] || [ "$reason" = "PREINIT" ];then
   ifacePreStart "$interface"
  elif [ "$reason" = "BOUND6" ] || [ "$reason" = "BOUND" ]\
   || [ "$reason" = "REBIND6" ] || [ "$reason" = "REBIND" ]\
   || [ "$reason" = "BIND6" ] || [ "$reason" = "BIND" ];then
   ifaceStart "$interface"
  elif [ "$reason" = "RENEW" ];then
   dhcpRenew4Cpt=$(( dhcpRenew4Cpt + 1))
  elif [ "$reason" = "RENEW6" ];then
   dhcpRenew6Cpt=$(( dhcpRenew6Cpt + 1))
  else
   shDebug 1 "${log} interface:$interface unknow reason:$reason"
  fi
  ifaceCheckDhcpPrefix
 else
  shDebug 0 "${log} no 'interface' defined in dhcp-enter:$jsonDhcp"
  shDebug 0 "${log} no 'interface' defined in :$params"
 fi
 if [ "$reason" != "RENEW" ] && [ "$reason" != "RENEW6" ] && ( [ "$dhcpPreviousReason" = "RENEW" ] || [ "$dhcpPreviousReason" = "RENEW6" ] );then
  shDebug  1 "${log} reset renew cpt v4:$dhcpRenew4Cpt v6:$dhcpRenew6Cpt"
  dhcpRenew4Cpt=0
  dhcpRenew6Cpt=0
 fi
 dhcpPreviousReason="$reason"
}
ifaceCheckDhcpPrefix() {
 local log="ifaceCheckDhcpPrefix:"
 local IA_PD_IFACE="${IA_PD_IFACE:-$interface}"
 local new_ip6_prefix="$( $cmdEcho ${jsonDhcp} | jsonInObjectRead new_ip6_prefix )"
 if [ -n "$new_ip6_prefix" ];then
  shDebug 1 "${log} CHECK PREFIX:$new_ip6_prefix"
  newPrefixMask=`echo "$new_ip6_prefix" | cut -d/ -f2`
  newPrefix=`echo "$new_ip6_prefix" | cut -d/ -f1`
  # adresse finale: prefix::1/mask → ici prefix est déjà fini par ::
#  shDebug 2 "${log} ip -6 addr show dev "${IA_PD_IFACE}" | grep -q "$newPrefix""
  if ip -6 addr show dev "${IA_PD_IFACE}" | grep -q "$newPrefix"; then
   shDebug 2 "ip -6 ever ready:$newPrefix"
#   shDebug 2 "flush"
#   # Remove old prefix (si différent)
#   ip -6 addr flush dev "${IA_PD_IFACE}" scope global
  else
   # décommente quand tu veux vraiment l'appliquer:
   if $cmdEcho ${newPrefix} | grep -q '::$';then
    shDebug 2 "ip -6 addr add ${newPrefix}1/${newPrefixMask} dev ${IA_PD_IFACE}"
    ip -6 addr add "${newPrefix}1/${newPrefixMask}" dev "${IA_PD_IFACE}"
   else
    shDebug 2 "ip -6 addr add ${newPrefix}/${newPrefixMask} dev ${IA_PD_IFACE}"
    ip -6 addr add "${newPrefix}/${newPrefixMask}" dev "${IA_PD_IFACE}"
   fi
   ip -6 route add "${newPrefix}/${newPrefixMask}" dev "${IA_PD_IFACE}" table local
  fi
#  ip -6 rule add pri 3000 from "${newPrefix}/${newPrefixMask}" table $intranet0Table
#  ip -6 rule add pri 3000 to "${newPrefix}/${newPrefixMask}" table $intranet0Table
  for gw6 in $( ip6toolsGetAllGws );do
   local ethForGw="$( ip6ToolsGetEthForGw ${gw6} )"
   if [ "${ethForGw}" != "${IA_PD_IFACE}" ];then
    shDebug 2 "${log} forward default route ${gw6} over ${ethForGw} for $new_ip6_prefix on ${IA_PD_IFACE}"
    local prefixComment="$( $cmdEcho $new_ip6_prefix | $cmdTr ':' '_' )"
    local inputComment="dhcp-i-${IA_PD_IFACE}-o-${ethForGw}-s-$prefixComment"
    shDebug 2 "${log} ! ip6tables -w -vnL FORWARD | grep -q "${inputComment}""
    if ! ip6tables -w -vnL FORWARD | grep -q "${inputComment}";then
     shDebug 2 "${log} forward -i ${IA_PD_IFACE} -o ${ethForGw} -s $new_ip6_prefix"
     ip6tables -w -I FORWARD -i ${IA_PD_IFACE} -o ${ethForGw} -s $new_ip6_prefix -m comment --comment "${inputComment}" -j ACCEPT
    fi
    local outputComment="dhcp-i-${ethForGw}-o-${IA_PD_IFACE}-d-$prefixComment"
    shDebug 2 "${log} ! ip6tables -w -vnL FORWARD | grep -q "${outputComment}""
    if ! ip6tables -w -vnL FORWARD | grep -q "${outputComment}";then
     shDebug 2 "${log} forward -i ${ethForGw} -o ${IA_PD_IFACE} -d $new_ip6_prefix"
     ip6tables -w -I FORWARD -i ${ethForGw} -o ${IA_PD_IFACE} -d $new_ip6_prefix -m comment --comment "${outputComment}" -j ACCEPT
    fi
    local ll6ForGw="$( ip6toolsGetLLForGw ${gw6} )"
    local jsonGw6Route="$( $cmdEcho {} | routeTableGetFromData "${ethForGw}${ll6ForGw}${gw6}" )"
#    local rtTablePrio="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTablePrio" )"
#    local rtTableMark="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableMark" )"
    local rtTableName="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableName" )"
#    local rtTableCpt="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableCpt" )"
    ip -6 route add "${newPrefix}/${newPrefixMask}" dev "${IA_PD_IFACE}" metric 1234 table $rtTableName
    local jsonMasterEthRoute="$( $cmdEcho {} | routeTableGetFromData "${ll6ForGw}" )"
    local masterRtTableName="$( $cmdEcho $jsonMasterEthRoute | jsonInObjectRead "rtTableName" )"
    ip -6 route add "${newPrefix}/${newPrefixMask}" dev "${IA_PD_IFACE}" metric 1234 table $masterRtTableName
    local jsonMasterEthRoute="$( $cmdEcho {} | routeTableGetFromData "${ethForGw}" )"
    local masterRtTableName="$( $cmdEcho $jsonMasterEthRoute | jsonInObjectRead "rtTableName" )"
    ip -6 route add "${newPrefix}/${newPrefixMask}" dev "${IA_PD_IFACE}" metric 1234 table $masterRtTableName
   fi
  done
# else
#  shDebug 2 "${log} no prefix"
 fi
}
ifacesPrestarted="${ifacesPrestarted:-}"
ifacesStarted="${ifacesStarted:-}"
ifacesGwed="${ifacesGwed:-}"

ifaceStateHas() {
    # $1 = liste, $2 = iface
    case " $1 " in
        *" $2 "*) return 0 ;;
        *)        return 1 ;;
    esac
}

ifaceStateAdd() {
    # $1 = varname, $2 = iface
    eval "local cur=\"\${$1}\""
    case " $cur " in
        *" $2 "*) return 0 ;;
        *)        eval "$1=\"\$cur $2\"";;
    esac
}
darkwallPeriodical() {
 local log="darkwallPeriodical:"
 shDebug 2 ""$log" start" >&2
 [ -f "${rootDarkWall}/data/ipv6-nudge.sh" ] && shDebug 2 ""$log" lunch:$cmdSh ${rootDarkWall}/data/ipv6-nudge.sh" >&2 && $cmdSh "${rootDarkWall}/data/ipv6-nudge.sh" &
 if [ -f /ram/standaloneGateway ];then
  ifacesCheck 2>>/ram/ifaceCheck.log >&2
#  shDebug 1 "${log} ifacesCheck ended." 2>>/ram/ifaceCheck.log >&2
 else
  shDebug 0 "${log} ifacesCheck no startn gateway bit not true. gateway:${gateway}"
  $cmdSh ${rootDarkWall}/bin/tryPipeMessage start --all 2>&1 >> /tmp/tryPipeMessage.log &
  shDebug 0 "${log} rescheduled 'start --all'"
 fi
}

darkwallInit