#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
local network="${net}"

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#netbios-ns      137/tcp                         # NETBIOS Name Service
#netbios-ns      137/udp
#netbios-dgm     138/tcp                         # NETBIOS Datagram Service
#netbios-dgm     138/udp

local netbiosnsPort="$( iptoolsServicesGetPort udp netbios-ns )"
local netbiosdgmPort="$( iptoolsServicesGetPort udp netbios-dgm )"

# [ 2332.623144] NETFILTER_INPUTIN=eth0.1 OUT= MAC=ff:ff:ff:ff:ff:ff:70:85:c2:4d:42:68:08:00
# SRC=10.90.6.171 DST=10.90.6.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=57495 PROTO=UDP SPT=137 DPT=137 LEN=58 MARK=0xd
local  ruleIn="$ruleIn ;samba_srv	| -s "${net}" -d "${broadcast}"	-p udp --sport ${netbiosnsPort} --dport ${netbiosnsPort} -m state --state NEW,ESTABLISHED,RELATED"
#[ 2822.689956] NETFILTER_INPUTIN=enp8s0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:ae:00:6f:6a:08:00
# SRC=10.90.6.13 DST=10.90.6.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=41786 DF PROTO=UDP SPT=42630 DPT=137 LEN=58
#[ 2822.940338] NETFILTER_INPUTIN=enp8s0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:ae:00:6f:6a:08:00
# SRC=10.90.6.13 DST=10.90.6.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=41814 DF PROTO=UDP SPT=59098 DPT=137 LEN=58
#[ 2823.197356] NETFILTER_INPUTIN=enp8s0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:23:ae:00:6f:6a:08:00
# SRC=10.90.6.13 DST=10.90.6.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=41849 DF PROTO=UDP SPT=58301 DPT=137 LEN=58
local  ruleIn="$ruleIn ;samba_srv	| -s "${net}" -d "${broadcast}"	-p udp --dport ${netbiosnsPort} -m state --state NEW,ESTABLISHED,RELATED"
#[17826.143785] NETFILTER_INPUTIN=eth0.2 OUT= MAC=ff:ff:ff:ff:ff:ff:dc:4a:3e:e6:8d:2d:08:00
# SRC=10.83.10.7 DST=10.83.10.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=35616 PROTO=UDP SPT=138 DPT=138 LEN=209 MARK=0xe
local  ruleIn="$ruleIn ;samba_srv	| -s "${net}" -d "${broadcast}"	-p udp --sport ${netbiosdgmPort} --dport ${netbiosdgmPort} -m state --state NEW,ESTABLISHED,RELATED"

# SMB Server
#local servers="$servers|UDP	;netbios-ns	;root/root"
#local servers="$servers|UDP	;netbios-dgm	;root/root"

local servers="$servers|TCP	;microsoft-ds	"
#local servers="$servers|TCP	;microsoft-ds	;root:root"
local netbiosdsPort="$( iptoolsServicesGetPort tcp microsoft-ds )"
#[ 7145.329719] NETFILTER_OUTPUTIN= OUT=enp8s0 SRC=10.90.6.12 DST=10.90.6.14 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=445 DPT=59418
# WINDOW=64240 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030307) MARK=0xd
local  ruleOut="$ruleOut ;samba_srv	| -s "${ip}" -d "${net}" -p tcp --sport ${netbiosdsPort} -m state --state NEW,ESTABLISHED,RELATED"
#[32102.979459] NETFILTER_INPUTIN=enp8s0 OUT= MAC=c8:0a:a9:0b:92:55:52:54:00:68:82:9e:08:00 SRC=10.90.6.14 DST=10.90.6.12 LEN=52
#  TOS=0x00 PREC=0x00 TTL=128 ID=9520 DF PROTO=TCP SPT=51045 DPT=445 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B40103030801010402) MARK=0xf
local  ruleIn="$ruleIn ;samba_srv	| -d "${ip}" -s "${net}" -p tcp --dport ${netbiosdsPort} -m state --state NEW,ESTABLISHED,RELATED"

local servers="$servers|TCP	;netbios-ssn	;root/root"
local netbiosssnPort="$( iptoolsServicesGetPort tcp netbios-ssn )"
#NETFILTER_OUTPUTIN= OUT=enp8s0 SRC=10.90.6.12 DST=10.90.6.14 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=54389 DF PROTO=TCP SPT=139 DPT=52679
# WINDOW=502 RES=0x00 ACK URGP=0 MARK=0xd
local  ruleOut="$ruleOut ;samba_srv	| -s "${ip}" -d "${net}" -p tcp --sport ${netbiosssnPort} -m state --state NEW,ESTABLISHED,RELATED"

local servers="$servers|TCP	;loc-srv	;root/root"

#local clients="$clients|TCP	;microsoft-ds	;root/root"
#local clients="$clients|TCP	;netbios-ssn	;root/root"
#local clients="$clients|TCP	;loc-srv	;root/root"
## SAMBA - ...
#local clients="$clients|TCP	;3268		;root/root"
#local servers="$servers|TCP	;3268		;root/root"
#local clients="$clients|TCP	;1024		;root/root"
#local servers="$servers|TCP	;1024		;root/root"