#!/bin/sh /etc/rc.common

START=84

add_category_obj_mem() {
    local computer      
    local child_protect 
    local chat          
    local business      
    local other         
    local leisure       

    config_get computer      $1 computer     
    config_get child_protect $1 child_protect
    config_get chat          $1 chat         
    config_get business      $1 business     
    config_get other         $1 other        
    config_get leisure       $1 leisure      

    name="WCF_$1"

    [ -n "$computer" ] && {
    for mem in $computer; do
        ipset -A $name $mem
    done
    }
    [ -n "$child_protect" ] && {
    for mem in $child_protect; do
        ipset -A $name $mem
    done
    }
    [ -n "$chat" ] && {
    for mem in $chat; do
        ipset -A $name $mem
    done
    }
    [ -n "$business" ] && {
    for mem in $business; do
        ipset -A $name $mem
    done
    }
    [ -n "$business" ] && {
    for mem in $business; do
        ipset -A $name $mem
    done
    }
    [ -n "$other" ] && {
    for mem in $other; do
        ipset -A $name $mem
    done
    }
    [ -n "$leisure" ] && {
    for mem in $leisure; do
        ipset -A $name $mem
    done
    }
}

add_category_obj() {
    name="WCF_$1"

    ipset -X $name 2>/dev/null
    ipset -N $name webcategory 

    add_category_obj_mem $1
}

mdf_category_obj() {
    name="WCF_$1"

    ipset -F $name 
    add_category_obj_mem $1
}

del_category_obj() {
    name="WCF_$1"
    ipset -F $name
    ipset -X $name 2>/dev/null
    #TODO: Update related setlist that access this set,
    #      if this ip object is used in a setlist, the delete is actually failed
    #TODO: Remove related rule that access this set
}

boot() {
	logger "Commtouch init ..."
}

start() {
	local wcf_enable=$(uci -q get wcf.wcf.enable)
	local lic_status=$(uci -q get fw_cf_license.fwlicense.status)
    config_load category_object
    config_foreach add_category_obj
	
	iptables -t filter -F WCF_SET 2>/dev/null || (iptables -N WCF_SET 2>/dev/null; iptables -A forward_csm -j WCF_SET 2>/dev/null)	
	if [ "$wcf_enable" == "1" -a "$lic_status" == "enable" ] ; then
		echo sessiontable clean | shnat_cli >/dev/null
		src_net=$(uci -q get wcf.wcf.source_ip)
		src_mask=$(uci -q get wcf.wcf.source_mask)
		iptables -A WCF_SET -i br-lan -s "$src_net"/"$src_mask" -p tcp --dport 80 -j WEBCATEGORY --set WCF_wcf_category --log --drop
	fi
	
	# move lan_wan traffic control to first rule of forward_csm
	iptables -D zone_lan_forward -j zone_lan_forward_tc 2>/dev/null
	iptables -D forward_csm -i br-lan -j zone_lan_forward_tc 2>/dev/null
	iptables -I forward_csm 1 -i br-lan -j zone_lan_forward_tc 2>/dev/null
}

stop() {
	src_net=$(uci -q get wcf.wcf.source_ip)
	src_mask=$(uci -q get wcf.wcf.source_mask)
	
	iptables -D WCF_SET -i br-lan -s "$src_net"/"$src_mask" -p tcp --dport 80 -j WEBCATEGORY --set WCF_wcf_category --log --drop 2>/dev/null
}

category_obj_apply() {
    addset=`uci fchanges new category_object`
    delset=`uci fchanges delete category_object`
    mdfset=`uci fchanges modify category_object`

    [ -n "$delset" ] && {
        for elem in $delset; do
            del_category_obj $elem

            ruleset=`uci filter url_filter webcategory $elem`
            [ -n "$ruleset" ] && {
                for item in $ruleset; do
                    #echo "cat object: delete url rule $item due to deleted cat $elem"
                    uci delete url_filter.$item
                done 
            }
        done
    }

    config_load category_object

    [ -n "$mdfset" ] && {
        for elem in $mdfset; do
            mdf_category_obj $elem
        done
    }

    [ -n "$addset" ] && {
        for elem in $addset; do
            add_category_obj $elem
        done
    }
}

apply() {
    category_obj_apply
    uci commit category_object
}
