#!/bin/sh /etc/rc.common
# Copyright 2019-2022 Stan Grishin (stangri@melmac.ca)
# shellcheck disable=SC1091,SC2039,SC3043,SC3060
PKG_VERSION='dev-test'

# shellcheck disable=SC2034
START=80
# shellcheck disable=SC2034
USE_PROCD=1

if type extra_command 1>/dev/null 2>&1; then
	extra_command 'version' 'Show version information'
else
# shellcheck disable=SC2034
	EXTRA_COMMANDS='version'
fi

readonly packageName='https-dns-proxy'
readonly serviceName="$packageName $PKG_VERSION"
readonly sharedMemoryOutput="/dev/shm/$packageName-output"
readonly _OK_='\033[0;32m\xe2\x9c\x93\033[0m'
readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
readonly PROG=/usr/sbin/https-dns-proxy
readonly DEFAULT_BOOTSTRAP='1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001,8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844'
readonly canaryDomains='use-application-dns.net'
dnsmasqConfig=''; forceDNS=''; forceDNSPorts='';

str_contains() { [ -n "$1" ] &&[ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
is_mac_address() { expr "$1" : '[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]$' >/dev/null; }
is_ipv4() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; }
is_ipv6() { ! is_mac_address "$1" && str_contains "$1" ":"; }
output() {
	local msg memmsg logmsg
	[ -t 1 ] && printf "%b" "$@"
	msg="${1//$serviceName /service }";
	if [ "$(printf "%b" "$msg" | wc -l)" -gt 0 ]; then
		[ -s "$sharedMemoryOutput" ] && memmsg="$(cat "$sharedMemoryOutput")"
		logmsg="$(printf "%b" "${memmsg}${msg}" | sed 's/\x1b\[[0-9;]*m//g')"
		logger -t "$packageName" "$(printf "%b" "$logmsg")"
		rm -f "$sharedMemoryOutput"
	else
		printf "%b" "$msg" >> "$sharedMemoryOutput"
	fi
}
output_ok() { output "$_OK_"; }
output_okn() { output "${_OK_}\\n"; }
output_fail() { output "$_FAIL_"; }
output_failn() { output "${_FAIL_}\\n"; }
uci_add_list_if_new() {
	local key="$1" value="$2" i
	if [ -z "$value" ]; then
		value="${key#*=}"
		key="${key%=*}"
	fi
	[ -n "$key" ] && [ -n "$value" ] || return 1
	for i in $(uci -q get "$key"); do
		[ "$i" = "$value" ] && return 0
	done
	uci -q add_list "${key}=${value}"
}

dnsmasq_restart() { [ -x /etc/init.d/dnsmasq ] || return 0; /etc/init.d/dnsmasq restart >/dev/null 2>&1; }

version() { echo "$PKG_VERSION"; }

xappend() { param="$param $1"; }

append_bool() {
	local section="$1"
	local option="$2"
	local value="$3"
	local default="${4:-0}"
	local _loctmp
	config_get_bool _loctmp "$section" "$option" "$default"
	[ "$_loctmp" -ne 0 ] && xappend "$value"
}

append_parm() {
	local section="$1"
	local option="$2"
	local switch="$3"
	local default="$4"
	local _loctmp
	config_get _loctmp "$section" "$option" "$default"
	[ -n "$_loctmp" ] && xappend "$switch $_loctmp"
}

append_counter() {
	local section="$1"
	local option="$2"
	local switch="$3"
	local default="${4:-0}"
	local _loctmp i
	config_get _loctmp "$section" "$option" "$default"
# shellcheck disable=SC2086,SC2154
	for i in $(seq 1 $_loctmp); do
		xappend '-v'
	done
}

append_bootstrap() {
	local section="$1"
	local option="$2"
	local switch="$3"
	local default="$4"
	local _old_ifs="$IFS"
	local _loctmp _newtmp i
	config_get _loctmp "$section" "$option" "$default"
	[ -z "$_loctmp" ] && return 0
	IFS=" ,"
	for i in $_loctmp; do
		if { [ "$ipv6_resolvers_only" -eq 0 ] && is_ipv4 "$i"; } || \
			{ [ "$ipv6_resolvers_only" -ne 0 ] && is_ipv6 "$i"; }; then
			[ -z "$_newtmp" ] && _newtmp="$i" || _newtmp="${_newtmp},${i}"
		fi
	done
	IFS="$_old_ifs"
	[ -n "$_newtmp" ] && xappend "$switch $_newtmp"
	[ "$ipv6_resolvers_only" -eq 0 ] && xappend '-4'
}

start_instance() {
	local cfg="$1" param listen_addr listen_port ipv6_resolvers_only p
	config_get_bool ipv6_resolvers_only "$cfg" 'use_ipv6_resolvers_only' '0'
	append_parm "$cfg" 'resolver_url' '-r'
	append_parm "$cfg" 'polling_interval' '-i'
	append_parm "$cfg" 'listen_addr' '-a' '127.0.0.1'
	append_parm "$cfg" 'listen_port' '-p' "$port"
	append_parm "$cfg" 'dscp_codepoint' '-c'
	append_bootstrap "$cfg" 'bootstrap_dns' '-b' "$DEFAULT_BOOTSTRAP"
	append_parm "$cfg" 'user' '-u' 'nobody'
	append_parm "$cfg" 'group' '-g' 'nogroup'
	append_parm "$cfg" 'proxy_server' '-t'
	append_parm "$cfg" 'logfile' '-l'
	append_bool "$cfg" 'use_http1' '-x'
	append_counter "$cfg" 'verbosity' '-v' '0'

	procd_open_instance
# shellcheck disable=SC2086
	procd_set_param command $PROG $param
	procd_set_param stderr 1
	procd_set_param stdout 1
	procd_set_param respawn
	if [ "$forceDNS" -ne 0 ]; then
		procd_open_data
		json_add_array firewall
		for p in $forceDNSPorts; do
			if netstat -tuln | grep 'LISTEN' | grep ":${p}" >/dev/null 2>&1 || [ "$p" = '53' ]; then
				json_add_object ''
				json_add_string type redirect
				json_add_string target DNAT
				json_add_string src lan
				json_add_string proto 'tcp udp'
				json_add_string src_dport "$p"
				json_add_string dest_port "$p"
				json_add_boolean reflection 0
				json_close_object
			else
				json_add_object ''
				json_add_string type rule
				json_add_string src lan
				json_add_string dest '*'
				json_add_string proto 'tcp udp'
				json_add_string dest_port "$p"
				json_add_string target REJECT
				json_close_object
			fi
		done
		json_close_array
		procd_close_data
	fi
	procd_close_instance

	if [ "$?" ]; then
		config_get listen_addr "$cfg" 'listen_addr' '127.0.0.1'
		config_get listen_port "$cfg" 'listen_port' "$port"
		if [ "$dnsmasqConfig" = '*' ]; then
			config_load 'dhcp'
			config_foreach dnsmasq_doh_server 'dnsmasq' 'add' "${listen_addr}" "${listen_port}"
		elif [ -n "$dnsmasqConfig" ]; then
			for i in $dnsmasqConfig; do
				if [ -n "$(uci -q get "dhcp.@dnsmasq[$i]")" ]; then
					dnsmasq_doh_server "@dnsmasq[$i]" 'add' "${listen_addr}" "${listen_port}"
				elif [ -n "$(uci -q get "dhcp.${i}")" ]; then
					dnsmasq_doh_server "${i}" 'add' "${listen_addr}" "${listen_port}"
				fi
			done
		fi
		output_ok
		port="$((port+1))"
		forceDNS=0
	else
		output_fail
	fi
}

start_service() {
	local port=5053
	output "Starting $serviceName "
	config_load "$packageName"
	config_get dnsmasqConfig	'config' 'update_dnsmasq_config' '*'
	config_get_bool forceDNS	'config' 'force_dns' '1'
	config_get forceDNSPorts	'config' 'force_dns_port' '53 853'
	dhcp_backup 'create'
	config_load "$packageName"
	config_foreach start_instance "$packageName"
	if [ -n "$(uci -q changes dhcp)" ]; then
		uci -q commit dhcp
		dnsmasq_restart
	fi
	output "\\n"
}

stop_service() {
	local s=0
	output "Stopping $serviceName "
	config_load "$packageName"
	config_get dnsmasqConfig 'config' 'update_dnsmasq_config' '*'
	dhcp_backup 'restore'
	if [ -n "$(uci -q changes dhcp)" ]; then
		uci -q commit dhcp
		dnsmasq_restart || s=1
	fi
# shellcheck disable=SC2015
	[ "$s" -eq 0 ] && output_okn || output_failn
}

# shellcheck disable=SC1091
service_triggers() { 
	local iface
	. /lib/functions/network.sh
	network_flush_cache
	network_find_wan iface
	iface="${iface:-wan}"
	if [ -n "$iface" ]; then
		procd_add_interface_trigger "interface.*" "$iface" "/etc/init.d/${packageName}" restart
	fi
	procd_add_config_trigger "config.change" "$packageName" "/etc/init.d/${packageName}" restart
}

service_started() { procd_set_config_changed firewall; }
service_stopped() { procd_set_config_changed firewall; }

dnsmasq_doh_server() {
	local cfg="$1" param="$2" address="${3:-127.0.0.1}" port="$4" i
	case "$param" in
		add)
			if [ "$forceDNS" -ne 0 ]; then
				for i in $canaryDomains; do
					uci_add_list_if_new "dhcp.${cfg}.server" "/${i}/"
				done
			fi
			case $address in
				0.0.0.0|::ffff:0.0.0.0) address='127.0.0.1';;
				::) address='::1';;
			esac
			uci_add_list_if_new "dhcp.${cfg}.server" "${address}#${port}"
		;;
		remove)
			eval "$(ubus call service list "{ 'verbose': true, 'name': '$packageName' }" | jsonfilter -F '# ' -e 'TUPLES=@[*].instances[*].command[4,6]')"
			for i in $TUPLES; do
				uci -q del_list "dhcp.${cfg}.server=${i}"
			done
		;;
	esac
}

dnsmasq_create_server_backup() {
	local cfg="$1" i
	uci -q get "dhcp.${cfg}" >/dev/null || return 1
	if ! uci -q get "dhcp.${cfg}.doh_backup_noresolv" >/dev/null; then
		if [ -z "$(uci -q get "dhcp.${cfg}.noresolv")" ]; then
			uci -q set "dhcp.${cfg}.noresolv=1"
			uci -q set "dhcp.${cfg}.doh_backup_noresolv=-1"
		elif [ "$(uci -q get "dhcp.${cfg}.noresolv")" != "1" ]; then
			uci -q set "dhcp.${cfg}.noresolv=1"
			uci -q set "dhcp.${cfg}.doh_backup_noresolv=0"
		fi
	fi
	if ! uci -q get "dhcp.${cfg}.doh_backup_server" >/dev/null; then
		if [ -z "$(uci -q get "dhcp.${cfg}.server")" ]; then
			uci -q add_list "dhcp.${cfg}.doh_backup_server="
		fi
		for i in $(uci -q get "dhcp.${cfg}.server"); do
			uci -q add_list "dhcp.${cfg}.doh_backup_server=$i"
			if [ "$i" = "$(echo "$i" | tr -d /\#)" ]; then
				uci -q del_list "dhcp.${cfg}.server=$i"
			fi
		done
	fi
	return 0
}

dnsmasq_restore_server_backup() {
	local cfg="$1" i
	uci -q get "dhcp.${cfg}" >/dev/null || return 0
	if uci -q get "dhcp.${cfg}.doh_backup_noresolv" >/dev/null; then
		if [ "$(uci -q get "dhcp.${cfg}.doh_backup_noresolv")" = "0" ]; then
			uci -q set "dhcp.${cfg}.noresolv=0"
		else
			uci -q del "dhcp.${cfg}.noresolv"
		fi
		uci -q del "dhcp.${cfg}.doh_backup_noresolv"
	fi
	if uci -q get "dhcp.${cfg}.doh_backup_server" >/dev/null; then
		dnsmasq_doh_server "$cfg" 'remove'
		for i in $(uci -q get "dhcp.${cfg}.doh_backup_server"); do
			uci_add_list_if_new "dhcp.${cfg}.server" "$i"
		done
		uci -q del "dhcp.${cfg}.doh_backup_server"
	fi
}

dhcp_backup() {
	local i
	config_load 'dhcp'
	case "$1" in
		create)
			if [ "$dnsmasqConfig" = "*" ]; then
				config_foreach dnsmasq_create_server_backup 'dnsmasq'
			elif [ -n "$dnsmasqConfig" ]; then
				for i in $dnsmasqConfig; do
					if [ -n "$(uci -q get "dhcp.@dnsmasq[$i]")" ]; then
						dnsmasq_create_server_backup "@dnsmasq[$i]"
					elif [ -n "$(uci -q get "dhcp.${i}")" ]; then
						dnsmasq_create_server_backup "$i"
					fi
				done
			fi
			;;
		restore)
			config_foreach dnsmasq_restore_server_backup 'dnsmasq'
			;;
	esac
}