#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
local network="${net}"
#				-- CLIENT --
#local clients="$clients|TCP	;smtp		;Debian-exim/Debian-exim"

#				-- SERVER --
#local servers="$servers|UDP	;domain		;bind/bind"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
local rootUID="$( shUserId root )"
local rootGID="$( shGroupId root )"

# [ TCP ] RPCBIND
for port in nfs;do
 local tcpPort="$( iptoolsServicesGetPort tcp ${port} )"
 local udpPort="$( iptoolsServicesGetPort udp ${port} )"
 local  ruleIn="$ruleIn	;rpcbind| -p tcp --dport ${tcpPort} -m state --state NEW"
 local ruleOut="$ruleOut;rpcbind| -p tcp --sport ${tcpPort} -m state --state ESTABLISHED,RELATED -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
 local ruleOut="$ruleOut;rpcbind| -p tcp --sport ${tcpPort} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
 local  ruleIn="$ruleIn	;rpcbind| -p tcp --dport ${tcpPort} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
# local  ruleIn="$ruleIn	;rpcbind| -p udp --dport ${udpPort} -m state --state NEW"
# local ruleOut="$ruleOut;rpcbind| -p udp --sport ${udpPort} -m state --state ESTABLISHED,RELATED -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
done

# RPC
#for port in $(ss -lp | grep rpc | tr -s '[[:blank:]]' '\t' | cut -f 5 | grep "0.0.0.0" | sort | uniq | cut -f2 -d\:);do
for proto in tcp udp;do
 for port in $( ss -lp 2>/dev/null | grep rpc | tr -s '[[:blank:]]' '\t' | cut -f 5 | grep -E "(\*|0.0.0.0)" | sort | uniq | cut -f2 -d\: | grep -v "*" );do
  if [ -n "$( echo ${port} | grep - )" ];then local port="$( echo ${port} | cut -f2 -d- )";fi
  local tcpPort="$( iptoolsServicesGetPort tcp ${port} )"
  local udpPort="$( iptoolsServicesGetPort udp ${port} )"
  if [ "tcp" = "$proto" ];then
   # [ TCP ] RPC
    local  ruleIn="$ruleIn ;rpcbind| -p tcp --dport ${tcpPort} -m state --state NEW"
    local ruleOut="$ruleOut;rpcbind| -p tcp --sport ${tcpPort} -m state --state ESTABLISHED,RELATED -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
    local ruleOut="$ruleOut;rpcbind| -p tcp --sport ${tcpPort} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
    local  ruleIn="$ruleIn ;rpcbind| -p tcp --dport ${tcpPort} -m state --state ESTABLISHED,RELATED,NEW ! --syn"
   else
    # [ UDP ] RPC
    local  ruleIn="$ruleIn ;rpcbind| -p udp --dport ${udpPort} -m state --state NEW"
    local ruleOut="$ruleOut;rpcbind| -p udp --sport ${udpPort} -m state --state ESTABLISHED,RELATED -m owner --uid-owner ${rootUID} --gid-owner ${rootGID}"
   fi
  done
done

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |