#!/bin/sh /etc/rc.common

START=95
STOP=95

ss_local_PID_FILE="/var/run/ss-local.pid"
ss_redir_PID_FILE="/var/run/ss-redir.pid"
ipset_blacklist="/etc/ipset/blacklist"
ipset_whitelist="/etc/ipset/whitelist"

start() {
	
	config_load "shadowsocks"
	local enabled remote rport lport pass redir_enabled redir_port whitelist_enabled blacklist_enabled
	config_get enabled config enabled
	config_get remote config remote_server
	config_get rport config remote_port
	config_get lport config local_port
	config_get cipher config cipher
	config_get pass config password
	config_get redir_enabled config redir_enabled
	config_get redir_port config redir_port
	config_get whitelist_enabled config whitelist_enabled
	config_get blacklist_enabled config blacklist_enabled

	[ -z "$remote" ] || [ -z "$rport" ] || [ -z "$lport" ] || [ -z "$pass" ] && {
		echo "missing parameters. check config"
		return 1
	}

	[ "$enabled" = '1' ] && {

		service_start /usr/bin/ss-local -s "$remote" -p "$rport" -l "$lport" ${cipher:+-m $cipher} -k "$pass" -f "$ss_local_PID_FILE"
	
	}

	[ "$redir_enabled" = '1' ] && {

		service_start /usr/bin/ss-redir -s "$remote" -p "$rport" -l "$redir_port" ${cipher:+-m $cipher} -k "$pass" -f "$ss_redir_PID_FILE"

		remoteip="`ping -q -w1 $remote | grep PING | sed -e "s/).*//" | sed -e "s/.*(//"`"
		
		iptables -t nat -N SHADOWSOCKS
		
		iptables -t nat -A SHADOWSOCKS -d $remoteip -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
		iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN

		if [ "$whitelist_enabled" = '0' ] && [ "$blacklist_enabled" = '0' ]; then
		
			iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports $redir_port
		
		else

			[ "$blacklist_enabled" = '1' ] && {
				
				checkblacklist=$(ipset -L blacklist 2> /dev/null | wc -l)
				[ $checkblacklist -eq 0 -a -f "$ipset_blacklist" ] && {
					ipset -N blacklist nethash --hashsize 64
					for IP in $(cat $ipset_blacklist)
					do
						ipset -A blacklist $IP
					done
					iptables -t nat -A SHADOWSOCKS -p tcp -m set --match-set blacklist src -j RETURN
				}
			}

			[ "$whitelist_enabled" = '1' ] && {
				
				checkwhitelist=$(ipset -L whitelist 2> /dev/null | wc -l)
				[ $checkwhitelist -eq 0 -a -f "$ipset_whitelist" ] && {
					ipset -N whitelist nethash --hashsize 4096
					for IP in $(cat $ipset_whitelist)
					do
						ipset -A whitelist $IP
					done	
				}
				iptables -t nat -A SHADOWSOCKS -p tcp -m set ! --match-set whitelist dst -j REDIRECT --to-ports $redir_port	
			}
		fi
		iptables -t nat -I zone_lan_prerouting -j SHADOWSOCKS
	}
}

ss_local_stop() {
	service_stop /usr/bin/ss-local && {
		rm -rf "$ss_local_PID_FILE"
	}
}

ss_redir_stop() {
	service_stop /usr/bin/ss-redir && {
		fw3 -q restart
		ipset destroy whitelist
		ipset destroy blacklist
		rm -rf "$ss_redir_PID_FILE"
	}
}

stop() {
	ss_local_stop
	ss_redir_stop
}
