#!/bin/sh
# network	: ipv6/mask || dns6/mask
local network="::/0"

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |

#				-- CLIENT --
# [ SSH ]
#local clients="$clients|TCP	;ssh		;root/root"
# [ WEB / WHOIS ]
#local clients="$clients|TCP	;http		;root/root;_apt/nogroup"
#local clients="$clients|TCP	;https		;root/root;_apt/nogroup"
#local clients="$clients|TCP	;whois		;root/root"

#				-- SERVER --
# [ SSH ]
#local servers="$servers|TCP	;ssh		;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
for subnet in $( $cmdEcho "$network" | $cmdTr -s ';' ' ');do
 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 0 8);do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
 done
 
 # icmp (Type 2 - Packet Too Big , code 0)
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (Type 3 - Time Exceeded )
 for code in 0 1;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (Type 4 - Parameter Problem )
 for code in 0 1 2;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0"

 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 0 8);do
  local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
  local  icmpIn="$icmpIn ;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
 done
 
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 #NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
 # DST=2606:4700:4700:0000:0000:0000:0000:1111 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=428239 PROTO=ICMPv6 TYPE=128 CODE=0 ID=38975 SEQ=1 UID=0 GID=0 MARK=0xf
 #NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
 # DST=2606:4700:4700:0000:0000:0000:0000:1111 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=402774 PROTO=ICMPv6 TYPE=128 CODE=0 ID=47857 SEQ=1 UID=0 GID=0 MARK=0xc
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0"

 # === TYPE 135 : Neighbor Solicitation
 #NETFILTER6_INPUTIN=macvlan0 OUT= MAC=33:33:ff:00:00:8c:00:18:8b:8f:48:eb:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0001
 #DST=ff02:0000:0000:0000:0000:0001:ff00:008c LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x19
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d $( shDebugEnable= sh /etc/darkwall/bin/GetNodeSollicite $ip6 )/128	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"

 # === TYPE 136 : Neighbor Advertisement ===
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:01:d4:6a:6a:43:ac:69:86:dd SRC=2a02:842a:285a:9201:e4c6:5f2e:bf96:b9d2
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xc
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
done