#!/bin/sh

. /lib/functions.sh

readonly LNET_RESERVED="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 100.64.0.0/10 224.0.0.0/4 255.255.255.255/32 0.0.0.0/8"
readonly LNET_NAME="system_lnet"
readonly PING_ADDR="1.1.1.1"

_log() {
    local msg="$1" level="${2:-info}" to_console="${3:-1}"
    logger -t xray-manager -p "daemon.$level" "$msg"
    
    if [ "$to_console" = "1" ]; then
        echo "$msg"
    fi
}

_get_md5() { 
    echo "$1" | md5sum | cut -d' ' -f1 
}

_init_vars() {
    config_load xray-manager
    
    local s="main"

    TABLE=$(uci -q get xray-manager.$s.table_name)
    TPROXY_PORT=$(uci -q get xray-manager.$s.tproxy_port)
    TPROXY_MARK=$(uci -q get xray-manager.$s.tproxy_mark)
    CLIENT_MARK=$(uci -q get xray-manager.$s.client_mark)
    TIMEOUT=$(uci -q get xray-manager.$s.timeout)
    IPNET_DIR=$(uci -q get xray-manager.$s.ipnet_dir)
    DNSMASQ_DIR=$(uci -q get xray-manager.$s.dnsmasq_dir)
    CACHE_DIR=$(uci -q get xray-manager.$s.cache_dir)
    ACTIVE_LIST=$(uci -q get xray-manager.$s.active_list)
    
    _get_proxy_list() { PROXY_SERVERS="${PROXY_SERVERS}${PROXY_SERVERS:+ }$1"; }
    PROXY_SERVERS=""
    config_list_foreach "$s" proxy_ip _get_proxy_list

    local required_vars="TABLE TPROXY_PORT TPROXY_MARK CLIENT_MARK TIMEOUT IPNET_DIR DNSMASQ_DIR CACHE_DIR ACTIVE_LIST"

    for var in $required_vars; do
        eval val=\$$var
        if [ -z "$val" ]; then
            _log "Variable '$var' is not set in UCI section 'main'!" "err" "1"
            return 1
        fi
    done

    mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR" "${ACTIVE_LIST%/*}"
    return 0
}

_check_marks() {
    local m_dec=$(printf "%d" "$CLIENT_MARK" 2>/dev/null)
    local m_hex=$(printf "%x" "$m_dec" 2>/dev/null)
    local m_pattern="($m_dec|0x0*$m_hex)"

    if nft list ruleset 2>/dev/null | sed "/table ip $TABLE/,/^}/d" | grep -iqE "mark.*$m_pattern"; then
        _log "Mark 0x$m_hex is busy in another table!" "err" "1"
        return 1
    fi
    return 0
}

_check_dnsmasq() {
    local current_dns_dir=$(uci -q get dhcp.@dnsmasq[0].confdir | awk '{print $1}')

    if [ -z "$current_dns_dir" ]; then
        _log "dnsmasq.confdir is empty. Setting to $DNSMASQ_DIR" "info" "1"
        uci add_list dhcp.@dnsmasq[0].confdir="$DNSMASQ_DIR"
        uci commit dhcp
        DNS_CHANGES=1
    elif [ "$current_dns_dir" != "$DNSMASQ_DIR" ]; then
        _log "dnsmasq.confdir mismatch: $current_dns_dir" "err" "1"
        _log "Expected $DNSMASQ_DIR. Check your DHCP config." "err" "1"
        return 1
    fi
    return 0
}

_load_config_full() {
    _init_vars || return 1
    _check_marks || return 1
    _check_dnsmasq || return 1
    return 0
}

_nft_init() {
    [ -z "$TABLE" ] && return 1
    _log "Initializing NFT table: $TABLE"
    nft add table ip "$TABLE" 2>/dev/null

    nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
    nft flush chain ip "$TABLE" prerouting
    nft add rule ip "$TABLE" prerouting fib daddr type local accept

    nft add chain ip "$TABLE" output { type route hook output priority -150 \; policy accept \; } 2>/dev/null
    nft flush chain ip "$TABLE" output
    nft add rule ip "$TABLE" output fib daddr type local accept

    local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
    ip route show table 110 | grep -q "local default" || ip route add local default dev lo table 110
    ip rule show | grep -q "fwmark $mark_hex lookup 110" || ip rule add fwmark "$TPROXY_MARK" table 110
}

_nft_batch_insert() {
    local table="$1" sname="$2" file="$3"
    {
        printf "add element ip %s %s { " "$table" "$sname"
        awk '/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
            { val = ($1 ~ /\//) ? $1 : $1 "/32"
              printf "%s%s", (count++ ? ", " : ""), val }' "$file"
        echo " }"
    } | nft -f -
}

_nft_apply_data() {
    local sname="$1" file="$2" exc="$3" dir="$4" type="$5" changed="$6" parent="$7"
    [ -z "$TABLE" ] && return 1

    local nft_sname="s_$sname"
    local flags="interval"
    local set_params="type ipv4_addr; flags $flags; auto-merge;"
    
    if [ "$type" = "dom" ] || [ "$type" = "udom" ]; then
        flags="interval,timeout"
        set_params="type ipv4_addr; flags $flags; timeout $TIMEOUT; auto-merge;"
    fi
    
    nft add set ip "$TABLE" "$nft_sname" { $set_params } 2>/dev/null

    if [ "$changed" = "1" ] && [ -s "$file" ] && [[ "$type" == *"ip"* ]]; then
        _log "  -> Syncing '$nft_sname' to NFT ruleset..." "info" "1"
        nft flush set ip "$TABLE" "$nft_sname"
        _nft_batch_insert "$TABLE" "$nft_sname" "$file"
    fi

    if [ "$dir" = "force_src" ]; then
        local chain_name="f_$sname"
        nft add chain ip "$TABLE" "$chain_name" 2>/dev/null
        nft flush chain ip "$TABLE" "$chain_name"
        nft add rule ip "$TABLE" "$chain_name" meta l4proto "{ tcp, udp }" \
            tproxy to 127.0.0.1:"$TPROXY_PORT" \
            ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
        return
    fi
    
    local has_parent=0
    if [ "$exc" = "1" ] && [ -n "$parent" ]; then
        local p_chain="f_${parent}_ip"
        if nft list chain ip "$TABLE" "$p_chain" >/dev/null 2>&1; then
            _log "  -> Adding personal exception '$sname' to chain '$p_chain'" "info" "0"
            nft insert rule ip "$TABLE" "$p_chain" ip daddr "@$nft_sname" accept 2>/dev/null
            has_parent=1
        fi
    fi

    if [ "$exc" = "1" ]; then
        [ "$has_parent" = "1" ] && return 0
        local sel="ip daddr"; [ "$dir" = "src" ] && sel="ip saddr"
        
        if [ "$sname" = "$LNET_NAME" ] && [ "$dir" = "dst" ]; then
            local extra_chains=$(nft list table ip "$TABLE" | grep "chain f_" | awk '{print $2}')
            for c in $extra_chains; do
                nft insert rule ip "$TABLE" "$c" "$sel" "@$nft_sname" accept 2>/dev/null
            done
        fi

        if [ "$dir" = "dst" ] || [ "$dir" = "src" ]; then
            nft insert rule ip "$TABLE" prerouting "$sel" "@$nft_sname" accept 2>/dev/null
        elif [ "$dir" = "out" ]; then
            nft insert rule ip "$TABLE" output "$sel" "@$nft_sname" accept 2>/dev/null
        fi
        return 0
    fi

    if [ "$dir" = "src" ]; then
        nft add rule ip "$TABLE" prerouting ip saddr "@$nft_sname" ct mark set "$CLIENT_MARK" 2>/dev/null
    elif [ "$dir" = "dst" ]; then
        nft add rule ip "$TABLE" prerouting ct mark "$CLIENT_MARK" ip daddr "@$nft_sname" \
            meta l4proto "{ tcp, udp }" tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept 2>/dev/null
    elif [ "$dir" = "out" ]; then
        nft add rule ip "$TABLE" output ip daddr "@$nft_sname" \
            meta l4proto "{ tcp, udp }" counter ct mark set "$CLIENT_MARK" meta mark set "$TPROXY_MARK" accept 2>/dev/null
    fi
}

_process_item() {
    local id="$1" val="$2" type="$3" dir="$4" exc="$5" parent="$6" fullpath hfile changed=0
    
    [ "$type" = "dom" ] || [ "$type" = "udom" ] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
    hfile="$CACHE_DIR/$id.hash"
    
    echo "$fullpath" >> "$ACTIVE_LIST"
    echo "$hfile" >> "$ACTIVE_LIST"

    local new_hash=$(_get_md5 "$val")
    local old_hash=$(cat "$hfile" 2>/dev/null)

    if [ "$SKIP_URL" = "1" ] && { [ "$type" = "uip" ] || [ "$type" = "udom" ]; }; then
        _log "Reloading $id..." "info" "1"
        if [ "$new_hash" != "$old_hash" ]; then
             _log "  -> Warning: UCI config changed. Run 'update' to fetch new data." "warn" "1"
        fi

        [ -f "$fullpath" ] && _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" 0 "$parent"
        return
    fi

    if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ] || [ "$SKIP_URL" = "0" ]; then
        case "$type" in
            ip) 
                echo "$val" | tr ' ' '\n' | sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' | sort -u > "$fullpath.tmp"
                if ! cmp -s "$fullpath.tmp" "$fullpath"; then
                    mv "$fullpath.tmp" "$fullpath"; changed=1
                else
                    rm -f "$fullpath.tmp"
                fi
                ;;
            dom)
                echo "$val" | tr ' ' '\n' | awk -v t="$TABLE" -v i="s_$id" '
                    /^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
                    { gsub(/\r/, ""); print "nftset=/" tolower($1) "/4#ip#" t "#" i }' | sort -u > "$fullpath.tmp"
                if ! cmp -s "$fullpath.tmp" "$fullpath"; then
                    mv "$fullpath.tmp" "$fullpath"; changed=1; DNS_CHANGES=1
                else
                    rm -f "$fullpath.tmp"
                fi
                ;;
            uip|udom)
                _log "Checking $id..." "info" "1"
                local tmp_all="$CACHE_DIR/dl_all_$id"
                : > "$tmp_all"
                local dl_ok=0
                
                for url in $val; do
                    local url_hash=$(echo "$url" | md5sum | cut -c1-8)
                    local etag_file="$CACHE_DIR/${id}_${url_hash}.etag"
                    local cache_raw="$CACHE_DIR/${id}_${url_hash}.raw"
                    local header_file="$CACHE_DIR/header_$id"
                    local old_etag=$(cat "$etag_file" 2>/dev/null | tr -d '\r\n ')
                    local etag_header=""; [ -n "$old_etag" ] && etag_header="-H 'If-None-Match: \"$old_etag\"'"
                    
                    local tmp_single="$CACHE_DIR/tmp_dl_$url_hash"
                    eval "curl -sSfL --connect-timeout 10 $etag_header -D '$header_file' '$url'" > "$tmp_single"
                    local exit_code=$?

                    if grep -q "HTTP/.* 304" "$header_file" 2>/dev/null; then
                        _log "  -> $url_hash: 304 Not Modified" "info" "1"
                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
                        dl_ok=1
                    elif [ $exit_code -eq 0 ] && [ -s "$tmp_single" ]; then
                        _log "  -> $url_hash: 200 OK" "info" "1"
                        local current_etag=$(grep -i "^etag:" "$header_file" | sed 's/[Ee][Tt][Aa][Gg]: //; s/W\///; s/["\r\n ]//g')
                        [ -n "$current_etag" ] && echo "$current_etag" > "$etag_file"
                        cat "$tmp_single" > "$cache_raw"
                        cat "$tmp_single" >> "$tmp_all"
                        dl_ok=1
                    else
                        _log "  -> $url_hash: Error. Trying cache..." "warn" "1"
                        [ -f "$cache_raw" ] && cat "$cache_raw" >> "$tmp_all"
                    fi
                    rm -f "$header_file" "$tmp_single"; echo "" >> "$tmp_all"
                done

                if [ "$dl_ok" = "1" ] && [ -s "$tmp_all" ]; then
                    local out="$CACHE_DIR/out_$id"
                    if [ "$type" = "uip" ]; then
                        sed 's/\r//g; /^#/d; /^[[:space:]]*$/d' "$tmp_all" | awk '{print ($1 ~ /\//) ? $1 : $1"/32"}' | sort -u > "$out"
                    else
                        tr 'A-Z' 'a-z' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
                        sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#s_$id|" > "$out"
                    fi
                    
                    if [ -f "$fullpath" ] && cmp -s "$out" "$fullpath"; then
                        _log "  -> $id: No changes in content." "info" "1"
                        rm -f "$out"
                    else
                        _log "  -> $id: Content updated." "info" "1"
                        mv "$out" "$fullpath"; changed=1
                        [ "$type" = "udom" ] && DNS_CHANGES=1
                    fi
                fi
                rm -f "$tmp_all" ;;
        esac
        echo "$new_hash" > "$hfile"
    fi
    _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "$changed" "$parent"
}

_process_section() {
    local s="$1" name dir exc parent ips doms uips udoms
    config_get name "$s" name; config_get dir "$s" direction "dst"; config_get exc "$s" exclude "0"
    config_get parent "$s" parent
    [ -z "$name" ] && return

    name=${name//[^a-zA-Z0-9_]/}
    _append_list() { CURRENT_VAL="${CURRENT_VAL}${CURRENT_VAL:+ }$1"; }
    
    CURRENT_VAL=""; config_list_foreach "$s" ip _append_list; ips="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" domain _append_list; doms="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" url_ip _append_list; uips="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" url_domain _append_list; udoms="$CURRENT_VAL"
    
    [ -n "$ips" ]   && _process_item "${name}_ip"   "$ips"   "ip"   "$dir" "$exc" "$parent"
    [ -n "$doms" ]  && _process_item "${name}_dom"  "$doms"  "dom"  "$dir" "$exc" "$parent"
    [ -n "$uips" ]  && _process_item "${name}_uip"  "$uips"  "uip"  "$dir" "$exc" "$parent"
    [ -n "$udoms" ] && _process_item "${name}_udom" "$udoms" "udom" "$dir" "$exc" "$parent"
}

_cleanup_orphans() {
    [ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return
    for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
        [ -e "$f" ] || continue
        if ! grep -Fxq "$f" "$ACTIVE_LIST" 2>/dev/null; then
            local base="${f##*/}"; local sname="${base%.*}"
            _log "Orphan detected: $sname. Cleaning up..." "info" "1"
            nft delete set ip "$TABLE" "s_$sname" 2>/dev/null
            [[ "$f" == "$DNSMASQ_DIR"* ]] && DNS_CHANGES=1
            rm -f "$f" "$CACHE_DIR/$sname.hash"
        fi
    done
    rm -f "$ACTIVE_LIST"
}

_wait_for_net() {
    local timeout=20
    _log "Waiting for network routes..."
    while [ ! -s /proc/net/route ] && [ $timeout -gt 0 ]; do
        sleep 1
        timeout=$((timeout - 1))
    done

    timeout=20
    _log "Checking internet connectivity ($PING_ADDR)..."
    while ! ping -q -c 1 -W 2 "$PING_ADDR" >/dev/null 2>&1 && [ $timeout -gt 0 ]; do
        _log "  -> No response from $PING_ADDR, retrying... ($timeout s)"
        sleep 2
        timeout=$((timeout - 2))
    done
    
    if [ $timeout -le 0 ]; then
        _log "  -> WARNING: Internet check failed. Using cache/local data." "warn"
        export SKIP_URL=1
    fi
}

_validate_config() {
    _log "Validating UCI config syntax..." "info" "0"

    local main_allowed="table_name tproxy_port tproxy_mark client_mark timeout ipnet_dir dnsmasq_dir cache_dir active_list proxy_ip"
    local main_required="table_name tproxy_port tproxy_mark client_mark"
    
    for opt in $(uci show xray-manager.@xray-manager[0] | cut -d'.' -f3 | cut -d'=' -f1); do
        if ! echo "$main_allowed" | grep -qw "$opt"; then
            _log "Unknown option '$opt' in xray-manager main section!" "err" "1"
            exit 1
        fi
    done

    validate_list_section() {
        local s="$1"
        local name direction exclude
        local list_allowed="name direction exclude parent ip domain url_ip url_domain"
        
        config_get name "$s" name
        config_get direction "$s" direction
        config_get exclude "$s" exclude

        if [ -z "$name" ]; then
            _log "Section $s is missing 'option name'!" "err" "1"
            exit 1
        fi

        case "$direction" in
            src|dst|out|force_src) ;;
            *) _log "Section '$name' has invalid direction '$direction'!" "err" "1"; exit 1 ;;
        esac

        local has_data=0
        for opt in $list_allowed; do
            [ -n "$(uci -q get xray-manager.$s.$opt)" ] && has_data=1
        done

        if [ "$has_data" -eq 0 ]; then
            _log "Section '$name' has no data (ip, domain, url_ip, etc.)!" "err" "1"
            exit 1
        fi

        for opt in $(uci show xray-manager.$s | cut -d'.' -f3 | cut -d'=' -f1); do
             if ! echo "$list_allowed" | grep -qw "$opt"; then
                _log "Unknown option '$opt' in section '$name'!" "err" "1"
                exit 1
            fi
        done
    }

    config_foreach validate_list_section "xray-list"
}

_apply_force_jumps() {
    local s="$1" n d
    config_get n "$s" name
    config_get d "$s" direction
    if [ "$d" = "force_src" ] && [ -n "$n" ]; then
        n=$(echo "$n" | sed 's/[^a-zA-Z0-9_]//g')
        nft insert rule ip "$TABLE" prerouting ip saddr "@s_${n}_ip" jump "f_${n}_ip" 2>/dev/null
    fi
}

_run() {
    _init_vars || return 1
    _validate_config
    DNS_CHANGES=0
    
    if [ "$FULL_LOAD" = "1" ]; then
        _wait_for_net
        _log "Starting Xray-Manager (Full Load)..." "info" "1"
        _load_config_full || return 1
    else
        _log "Running Xray-Manager (Partial Load)..." "info" "1"
    fi
    
    : > "$ACTIVE_LIST"
    _nft_init || return 1

    if [ -n "$PROXY_SERVERS" ]; then
        _log "Applying proxy server exclusions..."
        local proxy_set="s_proxy_servers"
        nft "add set ip $TABLE $proxy_set { type ipv4_addr; flags interval; }" 2>/dev/null
        nft "flush set ip $TABLE $proxy_set" 2>/dev/null
        for ip in $PROXY_SERVERS; do
            local val=$([ "${ip%/*}" = "$ip" ] && echo "$ip/32" || echo "$ip")
            nft "add element ip $TABLE $proxy_set { $val }" 2>/dev/null
        done
        nft insert rule ip "$TABLE" output ip daddr "@$proxy_set" accept 2>/dev/null
    fi

    config_foreach _process_section "xray-list"
    
    _process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "dst" "1"
    _process_item "$LNET_NAME" "$LNET_RESERVED" "ip" "out" "1"

    config_foreach _apply_force_jumps "xray-list"
    
    _cleanup_orphans
    
    if [ "$DNS_CHANGES" = "1" ]; then
        _log "Domains changes detected. Restarting dnsmasq..." "info" "1"
        /etc/init.d/dnsmasq restart
    else
        _log "No domains changes. dnsmasq restart skipped." "info" "1"
    fi
}

_stop() {
    _load_config_full || exit 1
    _log "Stopping Xray-Manager and flushing NFT table..." "info" "1"
    nft delete table ip "$TABLE" 2>/dev/null
    ip rule del fwmark "$TPROXY_MARK" table 110 2>/dev/null
    ip route del local default dev lo table 110 2>/dev/null
    rm -rf "$IPNET_DIR"/* "$DNSMASQ_DIR"/* "$CACHE_DIR"/*
    /etc/init.d/dnsmasq restart
}

case "$1" in
    start)   export SKIP_URL=0 FULL_LOAD=1; _run ;;
    restart) _stop; export SKIP_URL=0 FULL_LOAD=1; _run ;;
    reload)  export SKIP_URL=1 FULL_LOAD=0; _run ;;
    update)  export SKIP_URL=0 FULL_LOAD=0; _run ;;
    stop)    _stop ;;
    *)       echo "Usage: $0 {start|reload|update|stop|restart}" ;;
esac