#!/bin/sh

. /lib/functions.sh

readonly LNET_RESERVED="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10 224.0.0.0/4 255.255.255.255/32 0.0.0.0/8"
readonly LNET_NAME="system_lnet"
readonly TEST_DOMAIN="github.com"
readonly PING_ADDR=1.1.1.1
readonly RT_TABLE=110
readonly DEBUG=0
readonly DEBUG_LOG="/tmp/xray-manager.log"

_log() {
    local msg="$1" 
    local level="${2:-info}"
    local to_console="${3:-1}"

    [ "$level" = "debug" ] && [ "$DEBUG" -ne 1 ] && return

    if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
        echo "$(date '+%Y-%m-%d %H:%M:%S') $msg" >> "$DEBUG_LOG"
    fi

    local sys_level="info"
    case "$level" in
        info)  sys_level="info" ;;
        crit)  sys_level="crit" ;;
        err)   sys_level="err" ;;
        warn)  sys_level="warning" ;;
        debug) sys_level="debug" ;;
    esac

    [ "$level" != "debug" ] && logger -t xray-manager -p "daemon.$sys_level" "$msg"

    if [ "$to_console" = "1" ]; then
        printf "%s\n" "$msg"
    fi
}

_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }

_init_vars() {
    _log "config: loading configuration" "debug"
    config_load xray-manager
    local s="main"
    TABLE=$(uci -q get xray-manager.$s.table_name)
    TPROXY_PORT=$(uci -q get xray-manager.$s.tproxy_port)
    TPROXY_MARK=$(uci -q get xray-manager.$s.tproxy_mark)
    CLIENT_MARK=$(uci -q get xray-manager.$s.client_mark)
    TIMEOUT=$(uci -q get xray-manager.$s.timeout)
    IPNET_DIR=$(uci -q get xray-manager.$s.ipnet_dir)
    DNSMASQ_DIR=$(uci -q get xray-manager.$s.dnsmasq_dir)
    CACHE_DIR=$(uci -q get xray-manager.$s.cache_dir)
    ACTIVE_LIST=$(uci -q get xray-manager.$s.active_list)
    
    _get_proxy_list() { PROXY_SERVERS="${PROXY_SERVERS}${PROXY_SERVERS:+ }$1"; }
    PROXY_SERVERS=""
    config_list_foreach "$s" proxy_ip _get_proxy_list

    local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK TIMEOUT IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST"
    for var in $required_vars; do
        eval val=\$$var
        if [ -z "$val" ]; then
            _log "config: variable '$var' is missing" "crit"
            return 1
        fi
    done

    _log "config: loaded table=$TABLE, port=$TPROXY_PORT, mark=$TPROXY_MARK" "debug"
    mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "${ACTIVE_LIST%/*}"

    if [ "$DEBUG" = "1" ] && [ -n "$DEBUG_LOG" ]; then
        : > "$DEBUG_LOG" 2>/dev/null
    fi

    return 0
}

_validate_config() {
    _log "config: validating uci syntax" "debug"
    
    local dns_confdir
    dns_confdir=$(uci -q get dhcp.@dnsmasq[0].confdir)
    if [ -z "$dns_confdir" ] || ! echo "$dns_confdir" | grep -q "$DNSMASQ_DIR"; then
        _log "config: $DNSMASQ_DIR is not set in dnsmasq" "warn"
    fi

    local allowed_opts="name direction exclude parent ip domain url_ip url_domain"

    validate_list_section() {
        local s="$1" name direction
        config_get name "$s" name
        config_get direction "$s" direction "dst"

        if [ -z "$name" ]; then
            _log "config: section $s is missing name" "crit"
            exit 1
        fi

        local current_opt
        for current_opt in $(uci show xray-manager."$s" | cut -d'.' -f3 | cut -d'=' -f1 | sort -u); do
            case "$current_opt" in
                .*) continue ;;
            esac
            
            if ! echo "$allowed_opts" | grep -qw "$current_opt"; then
                _log "$name: unknown option: '$current_opt'" "err"
                exit 1
            fi
        done

        case "$direction" in
            src|dst|out|force_src) ;;
            *) _log "$name: invalid direction: $direction" "err"; exit 1 ;;
        esac
    }
    config_foreach validate_list_section "xray-list"
    _log "config: validation complete" "info"
}

_nft_init() {
    _log "$TABLE: initializing nft table" "info"
    nft add table ip "$TABLE" 2>/dev/null
    
    _log "$TABLE: setting up base chains" "debug"
    nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
    nft flush chain ip "$TABLE" prerouting
    nft add rule ip "$TABLE" prerouting fib daddr type local accept
    
    nft add chain ip "$TABLE" output { type filter hook output priority -150 \; policy accept \; } 2>/dev/null
    nft flush chain ip "$TABLE" output
    nft add rule ip "$TABLE" output fib daddr type local accept

    local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
    _log "route: configuring table $RT_TABLE, mark $mark_hex" "debug"
    ip route show table $RT_TABLE | grep -q "local default" || ip route add local default dev lo table $RT_TABLE
    ip rule show | grep -q "fwmark $mark_hex lookup $RT_TABLE" || ip rule add fwmark "$TPROXY_MARK" table $RT_TABLE
}

_nft_prepare_data() {
    local id="$1" file="$2" type="$3" changed="$4" dir="$5"
    local sname="s_$id"
    local set_params="type ipv4_addr; flags interval; auto-merge;"
    
    [[ "$type" == *dom ]] && set_params="type ipv4_addr; flags interval,timeout; timeout $TIMEOUT; auto-merge;"
    
    _log "$sname: creating nft set" "debug"
    nft add set ip "$TABLE" "$sname" { $set_params } 2>/dev/null

    if [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
        if [ "$changed" = "1" ] || [ "$FULL_LOAD" = "1" ]; then
            _log "$sname: flushing and loading elements" "debug"
            nft flush set ip "$TABLE" "$sname"
            { 
                printf "add element ip %s %s { " "$TABLE" "$sname"
                awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { addr = ($1 ~ /\// ? $1 : $1"/32"); printf "%s%s", (count++ ? ", " : ""), addr }' "$file"
                printf " }\n" 
            } | nft -f -
        fi
    fi

    if [ "$dir" = "force_src" ]; then
        local cn="f_$id"
        _log "$cn: creating force-chain" "debug"
        nft add chain ip "$TABLE" "$cn" 2>/dev/null
        nft flush chain ip "$TABLE" "$cn"
        nft add rule ip "$TABLE" "$cn" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
    fi
}

_nft_apply_rule() {
    local sname="$1" dir="$2" exc="$3" parent="$4" mode="$5"
    local nft_sname="s_$sname"
    local sel="ip daddr"
    [ "$dir" = "src" ] && sel="ip saddr"

    case "$mode" in
        jumps)
            [ "$dir" = "force_src" ] && {
                _log "$nft_sname: applying jump to f_$sname" "debug"
                nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" jump "f_${sname}" 2>/dev/null
            }
            ;;
        exclude)
            [ "$exc" != "1" ] && [ "$sname" != "$LNET_NAME" ] && return
            
            local target_info=""
            [ -n "$parent" ] && target_info=" target=$parent"
            _log "$nft_sname: applying exclude rule$target_info" "debug"

            if [ -n "$parent" ]; then
                nft insert rule ip "$TABLE" "$parent" ip daddr "@$nft_sname" accept 2>/dev/null
            else
                [ "$dir" != "out" ] && nft add rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
                [ "$dir" = "out" ] && nft add rule ip "$TABLE" output "$sel" "@$nft_sname" accept 2>/dev/null
            fi
            ;;
        main_rules)
            [ "$exc" = "1" ] || [ "$dir" = "force_src" ] && return
            
            _log "$nft_sname: applying tproxy rules" "debug"

            if [ "$mode_chain" = "prerouting" ] && [ "$dir" != "out" ]; then
                if [ "$dir" = "src" ]; then
                    nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
                else
                    nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
                fi
            elif [ "$mode_chain" = "output" ] && [ "$dir" = "out" ]; then
                nft add rule ip "$TABLE" output ip daddr "@$nft_sname" meta l4proto "{ tcp, udp }" counter ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
            fi
            ;;
    esac
}

_process_item() {
    local id="$1" val="$2" type="$3" dir="$4" exc="$5" parent="$6" 
    local fullpath hfile changed=0
    
    [[ "$type" == *dom ]] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
    hfile="$CACHE_DIR/$id.hash"
    
    echo "$fullpath" >> "$ACTIVE_LIST"
    echo "$hfile" >> "$ACTIVE_LIST"
    
    local new_hash=$(_get_md5 "$val")
    local old_hash=$(cat "$hfile" 2>/dev/null)

    local status="stable"
    if [ "$new_hash" != "$old_hash" ]; then
        status="changed"
        [ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]] && NEED_UPDATE=1
    fi
   
    _log "$id status: $status" "debug"

    if [ "$SKIP_URL" = "1" ] && [[ "$type" == u* ]]; then
        _log "$id: skipping download (reload mode)" "debug"
        [ ! -f "$fullpath" ] && { _log "$id: data file missing" "warn"; NEED_UPDATE=1; }
        [ -f "$fullpath" ] && _nft_prepare_data "$id" "$fullpath" "$type" 0 "$dir"
        return
    fi

    if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ] || [ "$SKIP_URL" = "0" ]; then
        case "$type" in
            ip)
                echo "$val" | tr ' ' '\n' | sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' -e '/\//! s|$|/32|' | sort -u > "$fullpath.tmp"
                ;;
            dom)
                echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next } { gsub(/\r/, ""); printf "nftset=/%s/4#ip#%s#%s\n", tolower($1), t, i }' | sort -u > "$fullpath.tmp"
                ;;
            uip|udom)
                _log "$id: fetching remote list" "info"
                local tmp_all="$CACHE_DIR/dl_$id"
                : > "$tmp_all"
                local dl_ok=0

                for url in $val; do
                    local uhash=$(echo "$url" | md5sum | cut -c1-8)
                    _log "$id: downloading $url" "debug"
                    local cache_raw="$CACHE_DIR/${id}_$uhash.raw"
                    local hfile_tmp="$CACHE_DIR/h_$id"
                    local etag_f="$CACHE_DIR/${id}_$uhash.etag"
                    local etag=$(cat "$etag_f" 2>/dev/null)

                    curl -sSfL --connect-timeout 15 ${etag:+-H "If-None-Match: \"$etag\""} -D "$hfile_tmp" "$url" > "$tmp_all.raw"
                    local res=$?
                    
                    if grep -q "304" "$hfile_tmp" 2>/dev/null; then
                        _log "$id: 304 not modified" "info"
                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
                    elif [ $res -eq 0 ] && [ -s "$tmp_all.raw" ]; then
                        _log "$id: 200 ok" "info"
                        grep -i "^etag:" "$hfile_tmp" | awk -F': ' '{print $2}' | sed 's/W\///; s/["\r\n ]//g' > "$etag_f"
                        cat "$tmp_all.raw" > "$cache_raw"
                        cat "$tmp_all.raw" >> "$tmp_all"
                        dl_ok=1
                    else
                        _log "$id: download failed, using local cache" "warn"
                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all" && dl_ok=1
                    fi
                done

                if [ "$dl_ok" = "1" ]; then
                    if [ "$type" = "uip" ]; then
                        sed -e 's/\r//g' -e '/^#/d' -e '/^[[:space:]]*$/d' "$tmp_all" | awk '{ print ($1 ~ /\// ? $1 : $1"/32") }' | sort -u > "$fullpath.tmp"
                    else
                        tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | awk -v t="$TABLE" -v i="s_$id" '{ printf "nftset=/%s/4#ip#%s#%s\n", $1, t, i }' > "$fullpath.tmp"
                    fi
                fi 
                ;;
        esac

        if [ -s "$fullpath.tmp" ] && ! cmp -s "$fullpath.tmp" "$fullpath"; then
            mv "$fullpath.tmp" "$fullpath"
            changed=1
            [[ "$type" == *dom ]] && DNS_CHANGES=1
            _log "$id: list updated" "info"
        else 
            rm -f "$fullpath.tmp"
        fi
        echo "$new_hash" > "$hfile"
    fi
    _nft_prepare_data "$id" "$fullpath" "$type" "$changed" "$dir"
}

_process_section() {
    local s="$1" mode="$2" name dir exc parent
    config_get name "$s" name
    config_get dir "$s" direction "dst"
    config_get exc "$s" exclude "0"
    config_get parent "$s" parent
    
    [ -z "$name" ] && return
    name=${name//[^a-zA-Z0-9_]/}

    [ "$exc" = "1" ] && [ -n "$parent" ] && parent="f_${parent}_ip"

    if [ -z "$mode" ]; then
        _log "$name: configuring section" "debug"
        _get_v() { V="${V}${V:+ }$1"; }
        V=""; config_list_foreach "$s" ip _get_v; [ -n "$V" ] && _process_item "${name}_ip" "$V" "ip" "$dir" "$exc" "$parent"
        V=""; config_list_foreach "$s" domain _get_v; [ -n "$V" ] && _process_item "${name}_dom" "$V" "dom" "$dir" "$exc" "$parent"
        V=""; config_list_foreach "$s" url_ip _get_v; [ -n "$V" ] && _process_item "${name}_uip" "$V" "uip" "$dir" "$exc" "$parent"
        V=""; config_list_foreach "$s" url_domain _get_v; [ -n "$V" ] && _process_item "${name}_udom" "$V" "udom" "$dir" "$exc" "$parent"
    else
        [ -f "$IPNET_DIR/${name}_ip.lst" ] && _nft_apply_rule "${name}_ip" "$dir" "$exc" "$parent" "$mode"
        [ -f "$DNSMASQ_DIR/${name}_dom.lst" ] && _nft_apply_rule "${name}_dom" "$dir" "$exc" "$parent" "$mode"
        [ -f "$IPNET_DIR/${name}_uip.lst" ] && _nft_apply_rule "${name}_uip" "$dir" "$exc" "$parent" "$mode"
        [ -f "$DNSMASQ_DIR/${name}_udom.lst" ] && _nft_apply_rule "${name}_udom" "$dir" "$exc" "$parent" "$mode"

        if [ "$mode" = "exclude" ] && [ "$dir" = "force_src" ]; then
             _log "$name: force-src: injecting lnet exclusion" "debug"
             _nft_apply_rule "$LNET_NAME" "dst" "1" "f_${name}_ip" "exclude"
        fi
    fi
}

_run() {
    _log "main: starting execution ($1)" "info"
    _init_vars || return 1
    _validate_config
    DNS_CHANGES=0; NEED_UPDATE=0; : > "$ACTIVE_LIST"
    
    [ "$FULL_LOAD" = "1" ] && _wait_for_net
    _nft_init

    _log "main: processing data sections" "debug"
    config_foreach _process_section "xray-list"
    _process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "dst" "1"

    _log "main: applying nft rules" "info"
    config_foreach _process_section "xray-list" "jumps"
    _nft_apply_rule "$LNET_NAME" "dst" "1" "" "exclude"
    config_foreach _process_section "xray-list" "exclude"
    
    _log "main: applying proxy bypass" "debug"
    [ -n "$PROXY_SERVERS" ] && nft add rule ip "$TABLE" output ip daddr "@s_proxy_servers" accept 2>/dev/null
    
    _log "main: applying tproxy rules" "debug"
    mode_chain="prerouting"; config_foreach _process_section "xray-list" "main_rules"
    mode_chain="output";     config_foreach _process_section "xray-list" "main_rules"

    _log "main: cleaning up orphans" "info"
    if [ -n "$IPNET_DIR" ] && [ -n "$DNSMASQ_DIR" ]; then
        for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
            [ -e "$f" ] || continue
            if ! grep -Fxq "$f" "$ACTIVE_LIST"; then
                local fname="${f##*/}"
                _log "orphan: removing $fname" "info"
                case "$f" in "$DNSMASQ_DIR"/*) DNS_CHANGES=1 ;; esac
                nft delete set ip "$TABLE" "s_${fname%.*}" 2>/dev/null
                rm -f "$f"
            fi
        done
    fi

    [ "$DNS_CHANGES" = "1" ] && { _log "dnsmasq: restarting service" "info"; /etc/init.d/dnsmasq restart; }
    [ "$SKIP_URL" = "1" ] && [ "$NEED_UPDATE" = "1" ] && { 
        _log "main: outdated lists detected" "warn"
        _log "main: run 'update' to refresh data" "warn"
    }
    
    _log "main: execution finished" "info"
}

_wait_for_net() {
    _log "network: checking connectivity" "info"
    local t=1
    while [ "$t" -le 20 ]; do
        if ping -q -c 1 -W 2 "$PING_ADDR" >/dev/null 2>&1; then
            if nslookup "$TEST_DOMAIN" >/dev/null 2>&1; then
                _log "network: access confirmed" "info"
                return 0
            else
                _log "network: dns resolution failed" "warn"
            fi
        else
            _log "network: unreachable" "warn"
        fi
        sleep 2; t=$((t + 2))
    done
    _log "network: timeout: switching to offline mode" "warn"
    export SKIP_URL=1
}

_stop() {
    _log "main: stopping service" "info"
    _init_vars 
    nft delete table ip "$TABLE" 2>/dev/null
    ip rule del fwmark "$TPROXY_MARK" table $RT_TABLE 2>/dev/null
    ip route del local default dev lo table $RT_TABLE 2>/dev/null
    /etc/init.d/dnsmasq restart
    _log "main: service stopped" "info"
}

case "$1" in
    start)      export SKIP_URL=0 FULL_LOAD=1; _run "start" ;;
    stop)       _stop ;;
    restart)    _stop; export SKIP_URL=0 FULL_LOAD=1; _run "restart" ;;
    reload)     export SKIP_URL=1 FULL_LOAD=0; _run "reload" ;;
    update)     export SKIP_URL=0 FULL_LOAD=0; _run "update" ;;
    *)          echo "Usage: $0 {start|stop|restart|reload|update}"; exit 1 ;;
esac