#!/bin/sh /etc/rc.common
#
# Copyright (C) 2017 Yousong Zhou <yszhou4tech@gmail.com>
# Copyright (C) 2018 Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
#
# This is free software, licensed under the GNU General Public License v3.
# See /LICENSE for more information.
#

USE_PROCD=1
EXTRA_COMMANDS="rules_up rules_down"
START=99

ss_confdir=/var/etc/shadowsocks-libev
ss_bindir=/usr/bin
q='"'

ss_mkjson() {
	echo "{" >"$confjson"
	if ss_mkjson_ "$@" >>$confjson; then
		sed -i -e '/^\s*$/d' -e '2,$s/^/\t/' -e '$s/,$//' "$confjson"
		echo "}" >>"$confjson"
	else
		rm -f "$confjson"
		return 1
	fi
}

ss_mkjson_() {
	local func

	for func in "$@"; do
		"$func" || return 1
	done
}

ss_mkjson_server_conf() {
	local cfgserver

	config_get cfgserver "$cfg" server
	[ -n "$cfgserver" ] || return 1
	eval "$(validate_server_section "$cfg" ss_validate_mklocal)"
	validate_server_section "$cfgserver" || return 1
	[ "$disabled" = 0 ] || return 1
	ss_mkjson_server_conf_ "$cfgserver"
}

ss_mkjson_server_conf_() {
	[ -n "$server_port" ] || return 1
	password="${password//\"/\\\"}"
	key="$(echo $key | sed 's/+/-/g; s/\//_/g;')"
	cat <<-EOF
		${server:+${q}server${q}: ${q}$server${q},}
		"server_port": $server_port,
		${method:+${q}method${q}: ${q}$method${q},}
		${key:+${q}key${q}: ${q}$key${q},}
		${password:+${q}password${q}: ${q}$password${q},}
	EOF
}

ss_mkjson_common_conf() {
	[ "$ipv6_first" = 0 ] && ipv6_first=false || ipv6_first=true
	[ "$fast_open" = 0 ] && fast_open=false || fast_open=true
	[ "$reuse_port" = 0 ] && reuse_port=false || reuse_port=true
	[ "$mptcp" = 0 ] && mptcp=false || mptcp=true
	cat <<-EOF
		"use_syslog": true,
		"ipv6_first": $ipv6_first,
		"fast_open": $fast_open,
		"mptcp": $mptcp,
		"reuse_port": $reuse_port,
		${local_address:+${q}local_address${q}: ${q}$local_address${q},}
		${local_port:+${q}local_port${q}: $local_port,}
		${mode:+${q}mode${q}: ${q}$mode${q},}
		${mtu:+${q}mtu${q}: $mtu,}
		${timeout:+${q}timeout${q}: $timeout,}
		${user:+${q}user${q}: ${q}$user${q},}
	EOF
}

ss_mkjson_ss_local_conf() {
	ss_mkjson_server_conf
	[ "$obfs" = 0 ] && obfs=false || obfs=true
	if $obfs; then
		obfs_options="--obfs $obfs_type"
		[ -z "$obfs_host" ] || obfs_options="$obfs_options --obfs-host $obfs_host"
		[ -z "$obfs_uri" ] || obfs_options="$obfs_options --obfs-uri $obfs_uri"
		[ "$fast_open" = 1 ] && obfs_options="$obfs_options --fast-open"
		[ "$mptcp" = 1 ] && obfs_options="$obfs_options --mptcp"
		[ -z "$timeout" ] || obfs_options="$obfs_options --timeout $timeout"
		cat <<-EOF
			${obfs:+${q}plugin${q}: ${q}/usr/bin/obfs-local $obfs_options${q},}
		EOF
	fi
}

ss_mkjson_ss_redir_conf() {
	ss_mkjson_server_conf || return 1
	[ "$disable_sni" = 0 ] && disable_sni=false || disable_sni=true
	cat <<-EOF
		"disable_sni": $disable_sni,
	EOF
	[ "$obfs" = 0 ] && obfs=false || obfs=true
	if $obfs; then
		obfs_options="--obfs $obfs_type"
		[ -z "$obfs_host" ] || obfs_options="$obfs_options --obfs-host $obfs_host"
		[ -z "$obfs_uri" ] || obfs_options="$obfs_options --obfs-uri $obfs_uri"
		[ "$fast_open" = 1 ] && obfs_options="$obfs_options --fast-open"
		[ "$mptcp" = 1 ] && obfs_options="$obfs_options --mptcp"
		cat <<-EOF
			${obfs:+${q}plugin${q}: ${q}/usr/bin/obfs-local $obfs_options${q},}
		EOF
	fi
}

ss_mkjson_ss_server_conf() {
	ss_mkjson_server_conf_
	[ "$obfs" = 0 ] && obfs=false || obfs=true
	if $obfs; then
		obfs_options="--obfs $obfs_type"
		[ "$fast_open" = 1 ] && obfs_options="$obfs_options --fast-open"
		[ "$mptcp" = 1 ] && obfs_options="$obfs_options --mptcp"
		cat <<-EOF
			${obfs:+${q}plugin${q}: ${q}/usr/bin/obfs-server $obfs_options${q},}
		EOF
	fi
}

ss_mkjson_ss_tunnel_conf() {
	ss_mkjson_server_conf || return 1
	[ -n "$tunnel_address" ] || return 1
	cat <<-EOF
		${tunnel_address:+${q}tunnel_address${q}: ${q}$tunnel_address${q},}
	EOF
	[ "$obfs" = 0 ] && obfs=false || obfs=true
	if $obfs; then
		obfs_options="obfs=$obfs_type"
		[ -z "$obfs_host" ] || obfs_options="$obfs_options --obfs-host $obfs_host"
		[ -z "$obfs_uri" ] || obfs_options="$obfs_options --obfs-uri $obfs_uri"
		cat <<-EOF
			${obfs:+${q}plugin${q}: ${q}/usr/bin/obfs-local $obfs_options${q},}
		EOF
	fi
}

ss_xxx() {
	local cfg="$1"
	local cfgtype="$2"
	local bin="$ss_bindir/${cfgtype/_/-}"
	local confjson="$ss_confdir/$cfgtype.$cfg.json"

	[ -x "$bin" ] || return
	eval "$("validate_${cfgtype}_section" "$cfg" ss_validate_mklocal)"
	"validate_${cfgtype}_section" "$cfg" || return 1
	[ "$disabled" = 0 ] || return

	if ss_mkjson \
			ss_mkjson_common_conf \
			ss_mkjson_${cfgtype}_conf \
			; then
		procd_open_instance "$cfgtype.$cfg"
		procd_set_param command "$bin" -c "$confjson"
		[ "$verbose" = 0 ] || procd_append_param command -v
		[ "$no_delay" = 0 ] || procd_append_param command --no-delay
		[ -z "$bind_address" ] || procd_append_param command -b "$bind_address"
		[ -z "$manager_address" ] || procd_append_param command --manager-address "$manager_address"
		procd_set_param file "$confjson"
		procd_set_param limits nofile="51200 51200"
		procd_set_param respawn
		procd_close_instance
		ss_rules_cb
	fi
}

ss_rules_restart() {
	local cfg="$1"
	local cfgtype="$2"

	eval "$("validate_${cfgtype}_section" "$cfg" ss_validate_mklocal)"
	"validate_${cfgtype}_section" "$cfg" || return 1
	ss_rules_cb
}

ss_rules_cb() {
	local cfgserver server
	if [ "$cfgtype" = ss_redir ]; then
		config_get cfgserver "$cfg" server
		config_get server "$cfgserver" server
		ss_redir_servers="$ss_redir_servers $server"
		if [ "$mode" = "tcp_only" -o "$mode" = "tcp_and_udp" ]; then
			eval "ss_rules_redir_tcp_$cfg=$local_port"
			eval "ss_rules6_redir_tcp_$cfg=$local_port"
		fi
		if [ "$mode" = "udp_only" -o "$mode" = "tcp_and_udp" ]; then
			eval "ss_rules_redir_udp_$cfg=$local_port"
			eval "ss_rules6_redir_udp_$cfg=$local_port"
		fi
	fi
}

ss_rules() {
	local cfg="ss_rules"
	local bin="$ss_bindir/ss-rules"
	local cfgtype
	local local_port_tcp local_port_udp
	local args
	local ss_redir_servers4 dst_ips_bypass4 dst_ips_forward4 src_ips_bypass4 src_ips_forward4 src_ips_checkdst4
	[ -x "$bin" ] || return 1
	config_get cfgtype "$cfg" TYPE
	[ "$cfgtype" = ss_rules ] || return 1

	eval "$(validate_ss_rules_section "$cfg" ss_validate_mklocal)"
	validate_ss_rules_section "$cfg" || return 1
	[ "$disabled" = 0 ] || return 1

	eval local_port_tcp="\$ss_rules_redir_tcp_$redir_tcp"
	eval local_port_udp="\$ss_rules_redir_udp_$redir_udp"
	[ -n "$local_port_tcp" -o -n "$local_port_udp" ] || return 1
	ss_redir_servers4="$(echo "$ss_redir_servers" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"
	
	[ "$dst_forward_recentrst" = 0 ] || args="$args --dst-forward-recentrst"

	dst_ips_bypass4="$(echo "$dst_ips_bypass" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"
	dst_ips_forward4="$(echo "$dst_ips_forward" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"
	src_ips_bypass4="$(echo "$src_ips_bypass" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"
	src_ips_forward4="$(echo "$src_ips_forward" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"
	src_ips_checkdst4="$(echo "$src_ips_checkdst" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort -u)"

	"$bin" \
			-s "$ss_redir_servers4" \
			-l "$local_port_tcp" \
			-L "$local_port_udp" \
			--src-default "$src_default" \
			--dst-default "$dst_default" \
			--local-default "$local_default" \
			--dst-bypass-file "$dst_ips_bypass_file" \
			--dst-forward-file "$dst_ips_forward_file" \
			--dst-bypass "$dst_ips_bypass4" \
			--dst-forward "$dst_ips_forward4" \
			--src-bypass "$src_ips_bypass4" \
			--src-forward "$src_ips_forward4" \
			--src-checkdst "$src_ips_checkdst4" \
			--ifnames "$ifnames" \
			--ipt-extra "$ipt_args" \
			$args \
		|| "$bin" -f
}

ss_rules6() {
	local cfg="ss_rules"
	local bin="$ss_bindir/ss-rules6"
	local cfgtype
	local local_port_tcp local_port_udp
	local args
	local ss_redir_servers6 dst_ips_bypass6 dst_ips_forward6 src_ips_bypass6 src_ips_forward6 src_ips_checkdst6

	[ -x "$bin" ] || return 1
	config_get cfgtype "$cfg" TYPE
	[ "$cfgtype" = ss_rules ] || return 1

	eval "$(validate_ss_rules_section "$cfg" ss_validate_mklocal)"
	validate_ss_rules_section "$cfg" || return 1
	[ "$disabled" = 0 ] || return 1

	eval local_port_tcp="\$ss_rules6_redir_tcp_$redir_tcp"
	eval local_port_udp="\$ss_rules6_redir_udp_$redir_udp"
	[ -n "$local_port_tcp" -o -n "$local_port_udp" ] || return 1
	ss_redir_servers6="$(echo "$ss_redir_servers" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"

	[ "$dst_forward_recentrst" = 0 ] || args="$args --dst-forward-recentrst"

	dst_ips_bypass6="$(echo "$dst_ips_bypass" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"
	dst_ips_forward6="$(echo "$dst_ips_forward" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"
	src_ips_bypass6="$(echo "$src_ips_bypass" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"
	src_ips_forward6="$(echo "$src_ips_forward" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"
	src_ips_checkdst6="$(echo "$src_ips_checkdst" | grep -o '\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}' | sort -u)"

	"$bin" \
			-s "$ss_redir_servers6" \
			-l "$local_port_tcp" \
			-L "$local_port_udp" \
			--src-default "$src_default" \
			--dst-default "$dst_default" \
			--local-default "$local_default" \
			--dst-bypass-file "$dst_ips_bypass_file" \
			--dst-forward-file "$dst_ips_forward_file" \
			--dst-bypass "$dst_ips_bypass6" \
			--dst-forward "$dst_ips_forward6" \
			--src-bypass "$src_ips_bypass6" \
			--src-forward "$src_ips_forward6" \
			--src-checkdst "$src_ips_checkdst6" \
			--ifnames "$ifnames" \
			--ipt-extra "$ipt_args" \
			$args \
		|| "$bin" -f
}

start_service() {
	local cfgtype

	mkdir -p "$ss_confdir"
	config_load shadowsocks-libev
	for cfgtype in ss_local ss_redir ss_server ss_tunnel; do
		config_foreach ss_xxx "$cfgtype" "$cfgtype"
	done
	ss_rules
	ss_rules6
	# Add rule to match traffic marked by firewall for bypass
	ip rule add prio 1 fwmark 0x539 lookup 991337 > /dev/null 2>&1
}

stop_service() {
	local bin="$ss_bindir/ss-rules"
	[ -x "$bin" ] && "$bin" -f
	local bin6="$ss_bindir/ss-rules6"
	[ -x "$bin6" ] && "$bin6" -f
	rm -rf "$ss_confdir"
}

_rules_status() {
	[ -n "$(iptables -t nat -L | grep ss_rules_forward)" ] && return 1
	return 0
}

rules_up() {
	_rules_status || return 0
	config_load shadowsocks-libev
	for cfgtype in ss_redir; do
		config_foreach ss_rules_restart "$cfgtype" "$cfgtype"
	done
	ss_rules
	ss_rules6
}

rules_down() {
	_rules_status && return 0
	local bin="$ss_bindir/ss-rules"
	[ -x "$bin" ] && "$bin" -f
	local bin6="$ss_bindir/ss-rules6"
	[ -x "$bin6" ] && "$bin6" -f
}


service_triggers() {
	procd_add_reload_interface_trigger wan*
	procd_add_reload_trigger shadowsocks-libev
	procd_open_validate
	validate_server_section
	validate_ss_local_section
	validate_ss_redir_section
	validate_ss_rules_section
	validate_ss_server_section
	validate_ss_tunnel_section
	procd_close_validate
}

ss_validate_mklocal() {
	local tuple opts

	shift 2
	for tuple in "$@"; do
		opts="${tuple%%:*} $opts"
	done
	[ -z "$opts" ] || echo "local $opts"
}

ss_validate() {
	uci_validate_section shadowsocks-libev "$@"
}

validate_common_server_options_() {
	local cfgtype="$1"; shift
	local cfg="$1"; shift
	local func="$1"; shift
	local stream_methods='"none", "table", "rc4", "rc4-md5", "aes-128-cfb", "aes-192-cfb", "aes-256-cfb", "aes-128-ctr", "aes-192-ctr", "aes-256-ctr", "bf-cfb", "camellia-128-cfb", "camellia-192-cfb", "camellia-256-cfb", "salsa20", "chacha20", "chacha20-ietf"'
	local aead_methods='"aes-128-gcm", "aes-192-gcm", "aes-256-gcm", "chacha20-ietf-poly1305", "xchacha20-ietf-poly1305"'

	"${func:-ss_validate}" "$cfgtype" "$cfg" "$@" \
		'disabled:bool:0' \
		'server:host' \
		'server_port:port' \
		'password:string' \
		'key:string' \
		"method:or($stream_methods, $aead_methods)"
}

validate_common_client_options_() {
	validate_common_options_ "$@" \
		'server:uci("shadowsocks-libev", "@server")' \
		'local_address:host:0.0.0.0' \
		'local_port:port'
}

validate_common_options_() {
	local cfgtype="$1"; shift
	local cfg="$1"; shift
	local func="$1"; shift

	"${func:-ss_validate}" "$cfgtype" "$cfg" "$@" \
		'disabled:bool:0' \
		'fast_open:bool:0' \
		'ipv6_first:bool:0' \
		'no_delay:bool:0' \
		'reuse_port:bool:0' \
		'mptcp:bool:0' \
		'verbose:bool:0' \
		'mode:or("tcp_only", "udp_only", "tcp_and_udp"):tcp_only' \
		'mtu:uinteger' \
		'timeout:uinteger' \
		'user:string' \
		'obfs:bool:0' \
		'obfs_type:or("http","tls"):http'
}

validate_server_section() {
	validate_common_server_options_ server "$1" "${2}"
}

validate_ss_local_section() {
	validate_common_client_options_ ss_local "$1" "${2}"
}

validate_ss_redir_section() {
	validate_common_client_options_ ss_redir "$1" \
		"${2}" \
		'disable_sni:bool:0' \
		'obfs_host:string' \
		'obfs_uri:string'
}

validate_ss_rules_section() {
	"${2:-ss_validate}" ss_rules "$1" \
		'disabled:bool:0' \
		'redir_tcp:uci("shadowsocks-libev", "@ss_redir")' \
		'redir_udp:uci("shadowsocks-libev", "@ss_redir")' \
		'src_ips_bypass:or(ip4addr,cidr4,ip6addr,cidr6)' \
		'src_ips_forward:or(ip4addr,cidr4,ip6addr,cidr6)' \
		'src_ips_checkdst:or(ip4addr,cidr4,ip6addr,cidr6)' \
		'dst_ips_bypass_file:file' \
		'dst_ips_bypass:or(ip4addr,cidr4,ip6addr,cidr6)' \
		'dst_ips_forward_file:file' \
		'dst_ips_forward:or(ip4addr,cidr4,ip6addr,cidr6)' \
		'src_default:or("bypass", "forward", "checkdst"):checkdst' \
		'dst_default:or("bypass", "forward"):bypass' \
		'local_default:or("bypass", "forward", "checkdst"):bypass' \
		'dst_forward_recentrst:bool:0' \
		'ifnames:maxlength(15)' \
		'ipt_args:string'
}

validate_ss_server_section() {
	validate_common_server_options_ ss_server "$1" \
		validate_common_options_ \
		"${2}" \
		'bind_address:ipaddr' \
		'manager_address:host'
}

validate_ss_tunnel_section() {
	validate_common_client_options_ ss_tunnel "$1" \
		"${2}" \
		'tunnel_address:regex(".+\:[0-9]+")'
}