#!/bin/sh

. /lib/functions.sh

_log() {
    local msg="$1"
    local level="${2:-info}"
    local to_console="${3:-0}"
    logger -t xray-manager -p "daemon.$level" "$msg"
    [ "$to_console" = "1" ] && echo "[$level] $msg"
}

_get_md5() { echo "$1" | md5sum | cut -d' ' -f1; }

_nft_init() {
    [ -z "$TABLE" ] && return 1
    nft add table ip "$TABLE" 2>/dev/null
    nft add chain ip "$TABLE" prerouting { type filter hook prerouting priority mangle \; policy accept \; } 2>/dev/null
    nft add chain ip "$TABLE" output { type route hook output priority mangle \; policy accept \; } 2>/dev/null
    nft flush chain ip "$TABLE" prerouting
    nft flush chain ip "$TABLE" output

    if [ "$ROUTE_LOCAL" = "1" ]; then
        [ -z "$TPROXY_MARK" ] && TPROXY_MARK="10"
        local mark_hex=$(printf '0x%x' "$TPROXY_MARK")
        if ! ip route show table 110 | grep -q "local default"; then
             ip route add local default dev lo table 110
        fi
        if ! ip rule show | grep -q "fwmark $mark_hex lookup 110"; then
             ip rule add fwmark "$TPROXY_MARK" table 110
        fi
    fi
}

_nft_apply_data() {
    local sname="$1" file="$2" exc="$3" dir="$4" type="$5" changed="$6"
    [ -z "$TABLE" ] && return 1

    local flags="interval"
    [ "$type" = "dom" ] || [ "$type" = "udom" ] && flags="interval,timeout"
    
    nft add set ip "$TABLE" "$sname" { type ipv4_addr \; flags $flags \; auto-merge \; } 2>/dev/null

    if [ "$changed" = "1" ] && [ -s "$file" ] && { [ "$type" = "ip" ] || [ "$type" = "uip" ]; }; then
        _log "Set '$sname' data refreshed in NFT"
        nft flush set ip "$TABLE" "$sname"
        awk '{print "add element ip '$TABLE' '$sname' { " $1 " }"}' "$file" | nft -f -
    fi

    if [ "$exc" = "1" ]; then
        local selector="ip daddr"
        [ "$dir" = "src" ] && selector="ip saddr"
        nft insert rule ip "$TABLE" prerouting $selector "@$sname" accept
        [ "$ROUTE_LOCAL" = "1" ] && nft insert rule ip "$TABLE" output $selector "@$sname" accept
    elif [ "$dir" = "src" ]; then
        nft add rule ip "$TABLE" prerouting ip saddr "@$sname" ct mark set 0x66
        [ "$ROUTE_LOCAL" = "1" ] && nft add rule ip "$TABLE" output ip saddr "@$sname" ct mark set 0x66
    else
        for proto in tcp udp; do
            nft add rule ip "$TABLE" prerouting ct mark 0x66 ip daddr "@$sname" meta l4proto $proto tproxy to 127.0.0.1:"$TPROXY_PORT" meta mark set "$TPROXY_MARK" accept
            [ "$ROUTE_LOCAL" = "1" ] && nft add rule ip "$TABLE" output ct mark 0x66 ip daddr "@$sname" meta l4proto $proto meta mark set "$TPROXY_MARK" accept
        done
    fi
}

_process_item() {
    local id="$1" val="$2" type="$3" dir="$4" exc="$5"
    local fullpath hfile changed=0
    
    [ -z "$DNSMASQ_DIR" ] || [ -z "$IPNET_DIR" ] && return 1

    [ "$type" = "dom" ] || [ "$type" = "udom" ] && fullpath="$DNSMASQ_DIR/$id.lst" || fullpath="$IPNET_DIR/$id.lst"
    hfile="$CACHE_DIR/$id.hash"
    
    echo "$fullpath" >> "$ACTIVE_LIST"
    echo "$hfile" >> "$ACTIVE_LIST"

    # 1. Сначала считаем хэш текущего конфига
    local new_hash=$(_get_md5 "$val")
    local old_hash=$(cat "$hfile" 2>/dev/null)

    # 2. ОДНА проверка для режима reload/start (SKIP_URL)
    if [ "$SKIP_URL" = "1" ] && { [ "$type" = "uip" ] || [ "$type" = "udom" ]; }; then
        # Проверяем, не изменился ли список ссылок в UCI
        if [ "$new_hash" != "$old_hash" ]; then
            _log "$id: Configuration changed (URLs modified). Please run 'update' to sync!" "warn" "1"
        fi

        if [ -f "$fullpath" ]; then
            _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "0"
            return
        else
            _log "$id: File not found. Run 'update' to download." "warn" "1"
            return
        fi
    fi

    # 3. Режим UPDATE (или обработка локальных списков)
    if [ "$new_hash" != "$old_hash" ] || [ ! -f "$fullpath" ]; then
        changed=1
        case "$type" in
            ip)
                echo "$val" | tr ' ' '\n' | sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' | sort -u > "$fullpath"
                ;;
            dom)
                echo "$val" | tr ' ' '\n' | tr '[:upper:]' '[:lower:]' | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
                sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#$id|" > "$fullpath"
                DNS_CHANGES=1 ;;
            uip|udom)
                _log "Processing $id (multiple URLs)..." "info"
                local tmp_all="/tmp/dl_all_$id"
                : > "$tmp_all"
                
                for url in $val; do
                    local tmp_part="/tmp/dl_part"
                    _log "Downloading part from $url" "info"
                    if curl -sSfL --connect-timeout 10 "$url" -o "$tmp_part"; then
                        cat "$tmp_part" >> "$tmp_all"
                        echo "" >> "$tmp_all"
                        rm -f "$tmp_part"
                    else
                        _log "Failed to download: $url" "err" "1"
                    fi
                done

                if [ -s "$tmp_all" ]; then
                    local out="/tmp/out_$id"
                    if [ "$type" = "uip" ]; then
                        sed 's/\r//g; /^#/d; /^[[:space:]]*$/d; /\//! s|$|/32|' "$tmp_all" | sort -u > "$out"
                    else
                        tr '[:upper:]' '[:lower:]' < "$tmp_all" | grep -oE '([a-z0-9-]+\.)+[a-z]{2,}' | sort -u | \
                        sed "s|^|nftset=/|; s|\$|/4#ip#$TABLE#$id|" > "$out"
                        DNS_CHANGES=1
                    fi
                    mv "$out" "$fullpath"
                    rm -f "$tmp_all"
                    changed=1
                else
                    _log "All downloads for $id failed" "err" "1"
                    rm -f "$tmp_all"
                    return
                fi
                ;;
        esac
        echo "$new_hash" > "$hfile"
    fi
    _nft_apply_data "$id" "$fullpath" "$exc" "$dir" "$type" "$changed"
}

_process_section() {
    local s="$1" name dir exc
    config_get name "$s" name
    config_get dir "$s" direction "dst"
    config_get exc "$s" exclude "0"
    [ -z "$name" ] && return
    local ips doms uips udoms
    _append_list() { CURRENT_VAL="${CURRENT_VAL}${CURRENT_VAL:+ }$1"; }
    CURRENT_VAL=""; config_list_foreach "$s" ip _append_list; ips="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" domain _append_list; doms="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" url_ip _append_list; uips="$CURRENT_VAL"
    CURRENT_VAL=""; config_list_foreach "$s" url_domain _append_list; udoms="$CURRENT_VAL"
    [ -n "$(echo "$ips" | xargs)" ] && _process_item "${name}_ip" "$ips" "ip" "$dir" "$exc"
    [ -n "$(echo "$doms" | xargs)" ] && _process_item "${name}_dom" "$doms" "dom" "$dir" "$exc"
    [ -n "$(echo "$uips" | xargs)" ] && _process_item "${name}_uip" "$uips" "uip" "$dir" "$exc"
    [ -n "$(echo "$udoms" | xargs)" ] && _process_item "${name}_udom" "$udoms" "udom" "$dir" "$exc"
}

_cleanup_orphans() {
    [ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return
    for f in "$IPNET_DIR"/* "$DNSMASQ_DIR"/*; do
        [ -e "$f" ] || continue
        if ! grep -Fxq "$f" "$ACTIVE_LIST" 2>/dev/null; then
            local base="${f##*/}"
            _log "Removing orphan: $base" "info"
            [ "$(dirname "$f")" = "$DNSMASQ_DIR" ] && DNS_CHANGES=1
            rm -f "$f" "$CACHE_DIR/${base%.*}.hash" "$CACHE_DIR/${base%.*}.tstamp"
        fi
    done
    rm -f "$ACTIVE_LIST"
}

_load_config() {
    config_load xray-manager
    TABLE=$(uci -q get xray-manager.@xray-manager[0].table_name)
    TPROXY_PORT=$(uci -q get xray-manager.@xray-manager[0].tproxy_port)
    TPROXY_MARK=$(uci -q get xray-manager.@xray-manager[0].tproxy_mark)
    IPNET_DIR=$(uci -q get xray-manager.@xray-manager[0].ipnet_dir)
    DNSMASQ_DIR=$(uci -q get xray-manager.@xray-manager[0].dnsmasq_dir)
    CACHE_DIR="/tmp/xray-manager.cache"
    ACTIVE_LIST="/tmp/xray_active_files"
    ROUTE_LOCAL=$(uci -q get xray-manager.@xray-manager[0].route_local)
    [ -z "$IPNET_DIR" ] || [ -z "$DNSMASQ_DIR" ] && return 1
    mkdir -p "$IPNET_DIR" "$DNSMASQ_DIR" "$CACHE_DIR"
    if ! uci show dhcp.@dnsmasq[0].confdir 2>/dev/null | grep -q "'$DNSMASQ_DIR'"; then
        uci add_list dhcp.@dnsmasq[0].confdir="$DNSMASQ_DIR"
        uci commit dhcp
        DNS_CHANGES=1
    fi
}

_run() {
    DNS_CHANGES=0
    _load_config || return 1
    : > "$ACTIVE_LIST"
    _nft_init || return 1
    local lnet_val=$(uci -q get xray-manager.@lnet[0].ip)
    [ -n "$lnet_val" ] && _process_item "lnet" "$lnet_val" "ip" "dst" "1"
    config_foreach _process_section "xray-list"
    _cleanup_orphans
    if [ "$DNS_CHANGES" = "1" ]; then
        /etc/init.d/dnsmasq restart
    fi
}

_stop() {
    _load_config || exit 1
    nft delete table ip "$TABLE" 2>/dev/null
    ip rule del fwmark "$TPROXY_MARK" table 110 2>/dev/null
    ip route del local default dev lo table 110 2>/dev/null
    rm -rf "$IPNET_DIR"/* "$DNSMASQ_DIR"/* "$CACHE_DIR"/*
    _log "Xray-manager stopped." "info" "1"
    /etc/init.d/dnsmasq restart
}

case "$1" in
    start|reload) export SKIP_URL=1; _run ;;
    update) export SKIP_URL=0; _run ;;
    stop) _stop ;;
    restart) _stop; export SKIP_URL=1; _run ;;
    *) echo "Usage: $0 {start|reload|update|stop|restart}" ;;
esac