#!/bin/sh
# omr-schedule's 010-services used to set restrict_to_lan to 0, and commit
# it, as soon as one network interface had a device name with a dash in it
# (br-lan, pppoe-wan...), i.e. on nearly every router: the proxy rules then
# matched any ingress interface, the WANs included. It doesn't do that any
# more, but a router upgraded from it keeps the 0 it wrote.
# A 0 chosen by hand looks just the same, so this only turns restrict_to_lan
# back on where the old rule would have fired (restrict_to_lan=0 and a dash
# in an interface's device), and only once: restrict_to_lan_migrated keeps a
# later choice of 0 from being undone by the next sysupgrade, which runs the
# uci-defaults again.
. /lib/functions.sh

[ -n "$(uci -q get openmptcprouter.settings)" ] || exit 0
[ "$(uci -q get openmptcprouter.settings.restrict_to_lan_migrated)" = "1" ] && exit 0

_omr_dash_device=""
_omr_find_dash_device() {
	local device
	config_get device "$1" device
	case "$device" in
		*-*) [ -z "$_omr_dash_device" ] && _omr_dash_device="$device" ;;
	esac
}
config_load network
config_foreach _omr_find_dash_device interface

if [ "$(uci -q get openmptcprouter.settings.restrict_to_lan)" = "0" ] && [ -n "$_omr_dash_device" ]; then
	uci -q batch <<-EOF >/dev/null
		set openmptcprouter.settings.restrict_to_lan='1'
		set openmptcprouter.settings.restrict_to_lan_migrated='1'
		commit openmptcprouter
	EOF
	logger -t "omr-uci-defaults" "Proxy restricted to LAN interfaces again (restrict_to_lan=1): an older release turned it off by itself because of the device name ${_omr_dash_device}. Untick 'Restrict proxy to LAN zone' in System > OpenMPTCProuter > Advanced Settings > Other if it was off on purpose."
else
	uci -q batch <<-EOF >/dev/null
		set openmptcprouter.settings.restrict_to_lan_migrated='1'
		commit openmptcprouter
	EOF
fi
exit 0
