#!/bin/sh /etc/rc.common

START=88
STOP=15

NAME=udp2raw

_log() {
	logger -p "daemon.$1" -t "$NAME" "$2"
}

has_valid_server() {
	local server
	for server in $@; do
		[ "$(uci_get $NAME $server)" = "servers" ] && return 0
	done
	return 1
}

add_ipt_rule() {
	if [ -z "$ipt_cmd" ]; then
		command -v iptables >/dev/null 2>&1 || return 1
		ipt_cmd='iptables'
		[ -n "$(iptables -h 2> /dev/null | grep -e '--wait')" ] && ipt_cmd="$ipt_cmd --wait"
		echo "# firewall include file" > "/var/etc/$NAME.include"
	else
		echo "$ipt_cmd" | grep -q -e '--wait'
		[ $? -ne 0 ] && sleep 2
	fi

	$ipt_cmd -I INPUT -s "$server_addr"/32 -p tcp -m tcp --sport "$server_port" -m comment --comment "${NAME}DwrW" -j DROP
}

flush_ipt_rules() {
	iptables-save -c | grep -v "${NAME}DwrW" | iptables-restore -c
	[ -f "/var/etc/$NAME.include" ] && rm -f "/var/etc/$NAME.include"
}

export_ipt_rules() {
	[ -f "/var/etc/$NAME.include" ] || return
	cat <<-CAT >> "/var/etc/$NAME.include"
	iptables-save -c | grep -v "${NAME}DwrW" | iptables-restore -c
	iptables-restore -n <<-EOF
	$(iptables-save -t filter | grep -E "${NAME}DwrW|^\*|^COMMIT" | sed 's/^-A /-I /')
	EOF
CAT
}

create_config() {
	local config_file="$1"
	echo "# auto-generated config file from /etc/config/udp2raw" > $config_file

	echo "-c" >> $config_file
	echo "-l ${listen_addr}:${listen_port}" >> $config_file
	echo "-r ${server_addr}:${server_port}" >> $config_file

	[ -n "$raw_mode" ] && echo "--raw-mode ${raw_mode}" >> $config_file
	[ -n "$key" ] && echo "--key ${key}" >> $config_file
	[ -n "$cipher_mode" ] && echo "--cipher-mode ${cipher_mode}" >> $config_file
	[ -n "$auth_mode" ] && echo "--auth-mode ${auth_mode}" >> $config_file

	[ $auto_rule -eq 1 -a $keep_rule -eq 1 ] && echo "--auto-rule" >> $config_file
	[ $auto_rule -eq 1 -a $keep_rule -eq 1 ] && echo "--keep-rule" >> $config_file

	[ -n "$seq_mode" ] && echo "--seq-mode ${seq_mode}" >> $config_file
	[ -n "$lower_level" ] && echo "--lower-level ${lower_level}" >> $config_file
	[ -n "$source_ip" ] && echo "--source-ip ${source_ip}" >> $config_file
	[ -n "$source_port" ] && echo "--source-port ${source_port}" >> $config_file
	echo "--retry-on-error" >> $config_file

	[ -n "$log_level" ] && echo "--log-level ${log_level}" >> $config_file
	echo "--disable-color" >> $config_file
}

validate_config_section() {
	local ret=$(/sbin/validate_data "$NAME" general "$1" \
		'server:uciname' \
		'daemon_user:string:root' \
		2> /dev/null)
	[ $? -ne 0 ] && return 1
	eval "$ret"
}

validate_server_section() {
	local ret=$(/sbin/validate_data "$NAME" servers "$1" \
		'server_addr:host' \
		'server_port:port:8080' \
		'listen_addr:ipaddr:127.0.0.1' \
		'listen_port:port:2080' \
		'raw_mode:or("faketcp", "udp", "icmp"):faketcp' \
		'key:string' \
		'cipher_mode:or("aes128cbc", "xor", "none"):aes128cbc' \
		'auth_mode:or("md5", "crc32", "simple", "none"):md5' \
		'auto_rule:bool:1' \
		'keep_rule:bool:0' \
		'seq_mode:range(0,4)' \
		'lower_level:string' \
		'source_ip:ipaddr' \
		'source_port:port' \
		'log_level:range(0,6)' \
		2> /dev/null)
	[ $? -ne 0 ] && return 1
	eval "$ret"
}

start_instance() {
	local server="$1"

	if [ -z "$server" -o "$server" == "nil" ]; then
		return 0
	elif ! validate_server_section "$server"; then
		_log "err" "Server config validation failed."
		return 1
	fi

	/sbin/validate_data "ipaddr" "$server_addr" >/dev/null 2>&1
	[ $? -ne 0 ] && server_addr=$(nslookup "$server_addr" | \
		sed -n 's/^Address[[:space:]]*[0-9]*:[[:space:]]*\(\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}\)$/\1/p')
	if [ -z "$server_addr" ]; then
		_log "err" "Server address validation failed."
		return 1
	fi

	[ -d /var/etc ] || mkdir -p /var/etc
	local config_file="/var/etc/${NAME}.${server}.conf"
	create_config "$config_file" || return 1
	[ -d "/var/log/${NAME}" ] || mkdir -p "/var/log/${NAME}"

	if [ $auto_rule -eq 1 -a $keep_rule -ne 1 ]; then
		add_ipt_rule || { _log "err" "added iptables rule failed."; return 1; }
	fi

	/usr/bin/udp2raw --conf-file "$config_file" >> "/var/log/${NAME}/${NAME}.${server}.log" &
	echo $! > "/var/run/${NAME}.${server}.pid"
	return 0
}

start() {
	pgrep "/usr/bin/${NAME}" >/dev/null 2>&1 && return

	if ! validate_config_section "general" ; then
		_log "err" "Config validate failed."
		return 1
	fi
	has_valid_server $server || return 1
	flush_ipt_rules
	for srv in $server; do
		start_instance $srv
	done
	export_ipt_rules
}

stop() {
	local pids=$(pgrep "/usr/bin/${NAME}" 2> /dev/null)
	[ $? -ne 0 ] && return
	for pid in $pids; do
		kill $pid >/dev/null 2>&1
	done
	flush_ipt_rules
	return 0
}

restart() {
	stop
	sleep 1
	start
}
