#!/bin/sh
eval `dbus export shadowsocks`
eval `dbus export ss`
alias echo_date='echo $(date +%Y年%m月%d日\ %X):'
black=$(echo $ss_basic_black_lan | sed "s/,/ /g")
white=$(echo $ss_basic_white_lan | sed "s/,/ /g")
lan_ipaddr=$(nvram get lan_ipaddr)
server_ip=`resolvip $ss_basic_server`
ip1=$(nvram get wan0_ipaddr | cut -d"." -f1)
ip2=$(nvram get wan0_ipaddr | cut -d"." -f2)

# Different routers got different iptables syntax
case $(uname -m) in
  armv7l)
    MATCH_SET='--match-set'
    ;;
  mips)
    MATCH_SET='--set'
    ;;
esac

flush_nat(){
	echo_date 尝试先清除已存在的iptables规则，防止重复添加
	# flush rules if any
	iptables -t nat -F SHADOWSOCKS > /dev/null 2>&1
	iptables -t nat -D PREROUTING -p tcp -j SHADOWSOCKS >/dev/null 2>&1
	iptables -t nat -X SHADOWSOCKS > /dev/null 2>&1
	iptables -t nat -D OUTPUT -p tcp -m set $MATCH_SET router dst -j REDIRECT --to-ports 3333 >/dev/null 2>&1
	iptables -t nat -D PREROUTING -s $lan_ipaddr/24 -p udp --dport 53 -j DNAT --to $lan_ipaddr >/dev/null 2>&1
}

flush_ipset(){
	echo_date 先清空已存在的ipset名单，防止重复添加
	ipset -F router >/dev/null 2>&1
}

destory_ipset(){
	echo_date 摧毁ipset名单
	ipset -X router >/dev/null 2>&1
}

creat_ipset(){
	echo_date 创建ipset名单：router
	ipset -N router iphash
}

apply_nat_rules(){
	echo_date 写入iptables规则到nat表中...
	ip1=$(nvram get wan0_ipaddr | cut -d"." -f1,2)
	iptables -t nat -N SHADOWSOCKS
	iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 100.64.0.0/10 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN
	iptables -t nat -A SHADOWSOCKS -d $ip1.0.0/16 -j RETURN
	[ ! -z "$ss_basic_server_ip" ] && iptables -t nat -A SHADOWSOCKS -d $ss_basic_server_ip -j RETURN

	# lan control
	black=$(echo $ss_basic_black_lan | sed "s/,/\n/g")
	white=$(echo $ss_basic_white_lan | sed "s/,/\n/g")
	if [ $ss_basic_lan_control == 1 ];then
		if [ ! -z $ss_basic_black_lan ];then
			echo_date 添加局域网黑名单IP，这些IP地址将不会走ss.
			for balck_ip in $black
			do
				iptables -t nat -A SHADOWSOCKS -p tcp -s $balck_ip -j RETURN
			done
				[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 80 -j REDIRECT --to-ports 3333
				[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 443 -j REDIRECT --to-ports 3333
				[ $ss_overall_mode == 1 ] && iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 3333
		else
			echo_date 你开启了局域网黑名单，但是未填写任何内容，跳过！
			[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 80 -j REDIRECT --to-ports 3333
			[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 443 -j REDIRECT --to-ports 3333
			[ $ss_overall_mode == 1 ] && iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 3333
		fi
	elif [ $ss_basic_lan_control == 2 ];then
		if [ ! -z $ss_basic_white_lan ];then
			echo_date 添加局域网白名单IP，这些IP地址将会走ss.
			for white_ip in $white
			do
				[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp  -s $white_ip --dport 80 -j REDIRECT --to-ports 3333
				[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp  -s $white_ip --dport 443 -j REDIRECT --to-ports 3333
				[ $ss_overall_mode == 1 ] && iptables -t nat -A SHADOWSOCKS -p tcp  -s $white_ip -j REDIRECT --to-ports 3333
			done
		else
			echo_date 你开启了局域网白名单，但是未填写任何内容，跳过！
			[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 80 -j REDIRECT --to-ports 3333
			[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 443 -j REDIRECT --to-ports 3333
			[ $ss_overall_mode == 1 ] && iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 3333
		fi
	else
		echo_date 局域网控制功能未启用！
		[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 80 -j REDIRECT --to-ports 3333
		[ $ss_overall_mode == 0 ] && iptables -t nat -A SHADOWSOCKS -p tcp --dport 443 -j REDIRECT --to-ports 3333
		[ $ss_overall_mode == 1 ] && iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 3333
	fi
	
	# Apply the rules
	iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
	iptables -t nat -A OUTPUT -p tcp -m set $MATCH_SET router dst -j REDIRECT --to-ports 3333
}

chromecast(){
	if [ "$ss_basic_chromecast" == "1" ]; then
		echo_date 开启chromecast功能（DNS劫持功能）
		iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to $lan_ipaddr >/dev/null 2>&1
	else
		echo_date chromecast功能未开启，建议开启哦~
		iptables -t nat -D PREROUTING -p udp --dport 53 -j DNAT --to $lan_ipaddr >/dev/null 2>&1
	fi
}

case $1 in
start_all)
	flush_nat
	flush_ipset
	destory_ipset
	creat_ipset
	apply_nat_rules
	chromecast
	;;
start_part_for_addon)
	#ss_basic_action=4
	flush_nat
	chromecast
	apply_nat_rules
	;;
*)
	echo "Usage: $0 (start_all|restart_wb_list)"
	exit 1
	;;
esac
