#!/bin/sh

uci -q batch <<-EOF >/dev/null
	delete ucitrack.@omr-bypass[-1]
	add ucitrack omr-bypass
	set ucitrack.@omr-bypass[-1].init=omr-bypass
	commit ucitrack
EOF

# The lists of the first omr-bypass ("config bypass 'dpi'" with "list proto",
# "config bypass 'ips'" with "list ip") become one rule each, and the old
# section goes once migrated. "omr-bypass.dpi[-1]" is not uci syntax: this
# never migrated anything.
if [ "$(uci -q get omr-bypass.dpi)" = "bypass" ]; then
	for pro in $(uci -q get omr-bypass.dpi.proto); do
		uci -q add omr-bypass dpis >/dev/null
		uci -q set "omr-bypass.@dpis[-1].proto=$pro"
		uci -q set "omr-bypass.@dpis[-1].interface=all"
	done
	uci -q delete omr-bypass.dpi
	uci -q commit omr-bypass
fi

if [ "$(uci -q get omr-bypass.ips)" = "bypass" ]; then
	for ip in $(uci -q get omr-bypass.ips.ip); do
		uci -q add omr-bypass ips >/dev/null
		uci -q set "omr-bypass.@ips[-1].ip=$ip"
		uci -q set "omr-bypass.@ips[-1].interface=all"
	done
	uci -q delete omr-bypass.ips
	uci -q commit omr-bypass
fi

# Only the entries the old omr-bypass wrote ("/<domain>/.../ss_rules_dst_bypass_all"):
# "dhcp.dnsmasq[0]" (no @) and "omr-bypass.domains[-1]" are not uci syntax, so
# this never read them, and taking every entry would have made bypass rules
# out of the user's own dnsmasq ipsets. Removed once migrated.
if [ -n "$(uci -q get dhcp.@dnsmasq[0].ipset)" ]; then
	for entry in $(uci -q get dhcp.@dnsmasq[0].ipset); do
		case "$entry" in
			/*/ss_rules_dst_bypass_all) ;;
			*) continue ;;
		esac
		domains="$(echo "${entry%/ss_rules_dst_bypass_all}" | sed -e 's:^/::' -e 's:/: :g')"
		for domain in $domains; do
			uci -q batch <<-EOF >/dev/null
				add omr-bypass domains
				set omr-bypass.@domains[-1].name=$domain
				set omr-bypass.@domains[-1].interface=all
			EOF
		done
		uci -q del_list dhcp.@dnsmasq[0].ipset="$entry"
	done
	uci -q commit omr-bypass
	uci -q commit dhcp
fi

if [ "$(uci -q get ucitrack.@shadowsocks-libev[-1].affects | grep omr-bypass)" != "" ]; then
	uci -q batch <<-EOF >/dev/null
		del_list ucitrack.@shadowsocks-libev[-1].affects=omr-bypass
		commit ucitrack
	EOF
fi

if [ "$(uci -q get firewall.omr_bypass)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set firewall.omr_bypass=include
		set firewall.omr_bypass.path=/etc/firewall.omr-bypass
		commit firewall
	EOF
fi

if [ "$(uci -q get omr-bypass.m6replay)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.m6replay=proto
		add_list omr-bypass.m6replay.url='m6web.fr'
		add_list omr-bypass.m6replay.url='6play.fr'
		add_list omr-bypass.m6replay.url='6cloud.fr'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.mycanal)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.mycanal=proto
		add_list omr-bypass.mycanal.url='mycanal.fr'
		add_list omr-bypass.mycanal.url='canal-plus.com'
		add_list omr-bypass.mycanal.url='canalplus.com'
		add_list omr-bypass.mycanal.url='canalplus-cdn.net'
		add_list omr-bypass.mycanal.url='canalplus.pro'
		add_list omr-bypass.mycanal.url='canal-plus.net'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.minecraft)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.minecraft=proto
		add_list omr-bypass.minecraft.url='authserver.mojang.com'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.lesnumeriques)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.lesnumeriques=proto
		add_list omr-bypass.lesnumeriques.url='lesnumeriques.com'
		add_list omr-bypass.lesnumeriques.url='botscorner.com'
		add_list omr-bypass.lesnumeriques.url='app.botscorner.com'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.disneyplus)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.disneyplus=proto
		add_list omr-bypass.disneyplus.url='bamgrid.com'
		add_list omr-bypass.disneyplus.url='disney-plus.net'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.amazonvideo)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.amazonvideo=proto
		add_list omr-bypass.amazonvideo.url='cloudfront.net'
		add_list omr-bypass.amazonvideo.url='llnw.net'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.free)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.free=proto
		add_list omr-bypass.free.url='free.fr'
		add_list omr-bypass.free.url='freebox.fr'
		add_list omr-bypass.free.url='oqee.tv'
		add_list omr-bypass.free.url='oqee.net'
		add_list omr-bypass.free.url='proxad.net'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.orange)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.orange=proto
		add_list omr-bypass.orange.url='orange.fr'
		add_list omr-bypass.orange.url='sosh.fr'
		add_list omr-bypass.orange.url='liveperson.net'
		add_list omr-bypass.orange.url='liveperson.com'
		add_list omr-bypass.orange.url='lpsn.net'
		add_list omr-bypass.orange.url='lpsnmedia.net'
		add_list omr-bypass.orange.url='francetelecom.fr'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.sky)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.sky=proto
		add_list omr-bypass.sky.url='sky.com'
		add_list omr-bypass.sky.url='skycdp.com'
		add_list omr-bypass.sky.url='skyanywhere.com'
		add_list omr-bypass.sky.url='epgsky.com'
		add_list omr-bypass.sky.url='skycdn.it'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.captive_portal)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.captive_portal=proto
		add_list omr-bypass.captive_portal.url='captive.apple.com'
		add_list omr-bypass.captive_portal.url='connectivitycheck.gstatic.com'
		add_list omr-bypass.captive_portal.url='clients3.google.com'
		add_list omr-bypass.captive_portal.url='www.msftconnecttest.com'
		add_list omr-bypass.captive_portal.url='www.msftncsi.com'
		add_list omr-bypass.captive_portal.url='nmcheck.gnome.org'
		add_list omr-bypass.captive_portal.url='networkcheck.kde.org'
		commit omr-bypass
	EOF
fi
if [ "$(uci -q get omr-bypass.global)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.global=global
		commit omr-bypass
	EOF
fi
# Default the domain-bypass IP-refresh cadence to once a day at 2 AM
# (matching the bypass_asn cron just below) instead of the disruptive
# once-an-hour cadence every router was stuck on before reload_rules_hour
# existed (issue #4353 follow-up). Runs on every package upgrade, not just
# a fresh install, so already-provisioned routers get moved off hourly too
# -- guarded on the option itself (not just the section) since `global`
# may already exist here from unrelated hash-gate state.
if [ "$(uci -q get omr-bypass.global.reload_rules_hour)" = "" ]; then
	uci -q batch <<-EOF >/dev/null
		set omr-bypass.global.reload_rules_hour='2'
		commit omr-bypass
	EOF
fi
# The checksums of the bypass lists last sent to the VPS are kept in
# /var/state now (omr-schedule's 030-bypass): drop the ones it committed
if [ -n "$(uci -q get omr-bypass.global.vpn_ipv4_md5)$(uci -q get omr-bypass.global.vpn_ipv6_md5)" ]; then
	uci -q batch <<-EOF >/dev/null
		delete omr-bypass.global.vpn_ipv4_md5
		delete omr-bypass.global.vpn_ipv6_md5
		commit omr-bypass
	EOF
fi
if [ ! -f /etc/crontabs/root ] || [ "$(cat /etc/crontabs/root | grep bypass)" = "" ]; then
	echo "0 2 * * * /etc/init.d/omr-bypass bypass_asn" >> /etc/crontabs/root
fi

# Migrate sections with no interface set to 'default' (skip if already a new-format config)
# A rule with a DSCP class and no interface is a new-format "DSCP marking
# only" rule (no routing change), which an old-format rule never was: the
# check above is no proof of a new-format config (no rule may use
# 'default'), and these rules were turned into default bypass rules on
# every upgrade.
if ! uci -q show omr-bypass | grep -q "\.interface='default'"; then
	_need_commit=0
	for _type in domains ips dest_port src_port macs lan_ip asns dpis categories; do
		for _sec in $(uci -q show omr-bypass | grep "^omr-bypass\.[^.=]*=${_type}$" | cut -d= -f1); do
			[ -n "$(uci -q get "${_sec}.dscp")" ] && continue
			_intf=$(uci -q get "${_sec}.interface" 2>/dev/null)
			if [ -z "$_intf" ]; then
				uci -q set "${_sec}.interface=default"
				_need_commit=1
			fi
		done
	done
	[ "$_need_commit" = "1" ] && uci -q commit omr-bypass
fi

rm -f /tmp/luci-indexcache
exit 0
