#!/bin/sh

if [ -z "$(uci -q get firewall.omr_dst_videochat_v4)" ]; then
	uci -q batch <<-EOF >/dev/null
		set firewall.omr_dst_videochat_v4=ipset
		set firewall.omr_dst_videochat_v4.name='omr_dst_videochat_v4'
		set firewall.omr_dst_videochat_v4.family='ipv4'
		set firewall.omr_dst_videochat_v4.loadfile='/etc/luci-uploads/videochatipv4.list'
		add_list firewall.omr_dst_videochat_v4.match='dest_net'
		add_list firewall.omr_dst_videochat_v4.match='dest_port'
		set firewall.omr_dst_videochat_v6=ipset
		set firewall.omr_dst_videochat_v6.name='omr_dst_videochat_v6'
		set firewall.omr_dst_videochat_v6.family='ipv6'
		set firewall.omr_dst_videochat_v6.loadfile='/etc/luci-uploads/videochatipv6.list'
		add_list firewall.omr_dst_videochat_v6.match='dest_net'
		add_list firewall.omr_dst_videochat_v6.match='dest_port'
		set firewall.omr_dst_videochatrule_v4=rule
		set firewall.omr_dst_videochatrule_v4.name='omr_dst_videochatrule_v4'
		set firewall.omr_dst_videochatrule_v4.family='ipv4'
		set firewall.omr_dst_videochatrule_v4.src='*'
		set firewall.omr_dst_videochatrule_v4.ipset='omr_dst_videochat_v4'
		set firewall.omr_dst_videochatrule_v4.dest='*'
		set firewall.omr_dst_videochatrule_v4.target='DSCP'
		set firewall.omr_dst_videochatrule_v4.set_dscp='AF41'
		set firewall.omr_dst_videochatrule_v4.enabled='1'
		set firewall.omr_dst_videochatrule_v6=rule
		set firewall.omr_dst_videochatrule_v6.name='omr_dst_videochatrule_v6'
		set firewall.omr_dst_videochatrule_v6.family='ipv6'
		set firewall.omr_dst_videochatrule_v6.src='*'
		set firewall.omr_dst_videochatrule_v6.ipset='omr_dst_videochat_v6'
		set firewall.omr_dst_videochatrule_v6.dest='*'
		set firewall.omr_dst_videochatrule_v6.target='DSCP'
		set firewall.omr_dst_videochatrule_v6.set_dscp='AF41'
		set firewall.omr_dst_videochatrule_v6.enabled='1'
		commit firewall
	EOF
fi

# Migrate: ipset option 'name' was a typo (missing '_') so it never matched what
# the rule's 'ipset' option references, making fw4 log "references unknown set"
# and drop the DSCP marking rule entirely.
if [ "$(uci -q get firewall.omr_dst_videochat_v4.name)" = "omr_dst_videochatv4" ] || \
   [ "$(uci -q get firewall.omr_dst_videochat_v6.name)" = "omr_dst_videochatv6" ]; then
	uci -q batch <<-EOF >/dev/null
		set firewall.omr_dst_videochat_v4.name='omr_dst_videochat_v4'
		set firewall.omr_dst_videochat_v6.name='omr_dst_videochat_v6'
		commit firewall
	EOF
	if [ -n "$(nft list ruleset 2>/dev/null)" ]; then
		/sbin/fw4 -q stop >/dev/null 2>&1 || true
		sleep 2
		/sbin/fw4 -q flush >/dev/null 2>&1 || true
		/sbin/fw4 -q start >/dev/null 2>&1 || true
	fi
fi

# The lists used to be fetched straight into /etc (flash) every day, an
# empty file or an error page included, and the firewall reloaded each
# time: omr-dscp-videochat-update only does it when needed
if grep -q 'videochatipv[46]\.list' /etc/crontabs/root 2>/dev/null; then
	sed -i '/videochatipv[46]\.list/d' /etc/crontabs/root
fi
if ! grep -q omr-dscp-videochat-update /etc/crontabs/root 2>/dev/null; then
	# One minute after omr-banudpip-update, so the two reloads don't overlap
	echo '1 1 * * * /usr/bin/omr-dscp-videochat-update' >> /etc/crontabs/root
fi