#!/bin/sh


# shellcheck source=opennet/packages/on-core/files/usr/lib/opennet/on-helper.sh
. "${IPKG_INSTROOT:-}/usr/lib/opennet/on-helper.sh"


configure_tunnel_network() {
	local uci_prefix=network.on_vpn

	# Abbruch falls das Netzwerk schon vorhanden ist
	[ -n "$(uci_get "$uci_prefix")" ] && return

	# add new network to configuration (to be recognized by olsrd)
	uci set "${uci_prefix}=interface"
	uci set "${uci_prefix}.proto=none"
	uci set "${uci_prefix}.device=tun-on-user"

	apply_changes network
}


configure_tunnel_firewall() {
	local was_changed=0
	local uci_prefix
	uci_prefix=$(find_first_uci_section firewall zone "name=$ZONE_TUNNEL")

	# Zone erzeugen, falls sie noch nicht vorhanden ist
	if [ -z "$(uci_get "$uci_prefix")" ]; then
		# Zone fuer ausgehenden Verkehr definieren
		uci_prefix=firewall.$(uci add firewall zone)
		uci set "${uci_prefix}.name=$ZONE_TUNNEL"
		uci add_list "${uci_prefix}.network=$NETWORK_TUNNEL"
		uci set "${uci_prefix}.forward=REJECT"
		uci set "${uci_prefix}.input=REJECT"
		uci set "${uci_prefix}.output=ACCEPT"
		uci set "${uci_prefix}.masq=1"
		was_changed=1
	fi
	create_uci_section_if_missing firewall forwarding \
			"src=$ZONE_LOCAL" "dest=$ZONE_TUNNEL" \
		&& was_changed=1
	create_uci_section_if_missing firewall rule \
			"src=$ZONE_TUNNEL" "dest_port=22" "target=ACCEPT" "name=on-user-ssh" \
		&& was_changed=1
	create_uci_section_if_missing firewall rule \
			"src=$ZONE_TUNNEL" "proto=icmp" "target=ACCEPT" "name=on-user-icmp" \
		&& was_changed=1
	[ "$was_changed" = "0" ] && return 0
	apply_changes firewall
}

configure_tos_firewall_handling() {
	# Meaning of: <<-'EOF'
	#  <<EOF    is here docs and ends with string EOF as delimiter
	#  <<-EOF   means that leading tabs are stripped even in line containing delimiter
	#  <<-'EOF' means that not interpretation of text will take place
	cat >> /etc/firewall.user <<-'EOF'
	# 
	# Mit TOS 0x08 markierter Traffic wird nicht ueber den User-VPN-Tunnel geleitet, weil wir davon ausgehen,
	#  dass dieser Traffic zum UGW direkt gesendet werden soll. Siehe hierzu auch die Doku:
	#  https://downloads.opennet-initiative.de/openwrt/stable/latest/doc/md__funktionsdetails.html#ugw-nutzer-kombi
	# Wir muessen sicherstellen, dass jeglicher Traffic aus dem LAN kein TOS 0x08 hat.
	#

	ON_CHAIN="on_tos_lan_vpn"
	iptables  -t mangle --new-chain "$ON_CHAIN" 2>/dev/null || iptables  -t mangle --flush "$ON_CHAIN"
	ip6tables -t mangle --new-chain "$ON_CHAIN" 2>/dev/null || ip6tables -t mangle --flush "$ON_CHAIN"

	# Wenn Traffic aus LAN TOS 0x08 hat, dann ersetze TOS durch 0x00
	iptables  -t mangle -A "$ON_CHAIN" -i br-lan -m tos --tos 0x08 -j TOS --set-tos 0x00
	ip6tables -t mangle -A "$ON_CHAIN" -i br-lan -m tos --tos 0x08 -j TOS --set-tos 0x00

	# Loesche Regeln, falls bereits vorhanden. Regeln muessen idempotent sein.
	iptables  -t mangle -D PREROUTING -j "$ON_CHAIN" 2>/dev/null
	ip6tables -t mangle -D PREROUTING -j "$ON_CHAIN" 2>/dev/null
	# Fuege Weiterleitung an unsere Chain hinzu.
	iptables  -t mangle -A PREROUTING -j "$ON_CHAIN"
	ip6tables -t mangle -A PREROUTING -j "$ON_CHAIN"
	EOF
}

configure_tunnel_network
configure_tunnel_firewall
configure_tos_firewall_handling
