#!/bin/sh

# SPDX-License-Identifier: GPL-2.0-only
# Copyright (c) Facebook, Inc. and its affiliates.

IPT4="/usr/sbin/iptables"

set -- --wait 1 --wait-interval 100

fbwifi_http_port="$(uci get fbwifi.main.http_port)"
[ -n "$fbwifi_http_port" ] || {
	logger -t fbwifi "required option http_port not set"
	exit 1
}

fbwifi_https_port="$(uci get fbwifi.main.https_port)"
[ -n "$fbwifi_https_port" ] || {
	logger -t fbwifi "required option https_port not set"
	exit 1
}

fbwifi_zone="$(uci get fbwifi.main.zone)"
[ -n "$fbwifi_zone" ] || {
	logger -t fbwifi "required option zone  not set"
	exit 1
}

fbwifi_ifaces="$(fw3 -q zone "$fbwifi_zone")"

## Create custom chains
"$IPT4" "$@" -t filter -N FBWIFI_FORWARD 2>/dev/null
"$IPT4" "$@" -t filter -N FBWIFI_INPUT 2>/dev/null
"$IPT4" "$@" -t mangle -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
"$IPT4" "$@" -t mangle -N FBWIFI_PREROUTING 2>/dev/null
"$IPT4" "$@" -t mangle -N FBWIFI_TRAFFIC_ALLOWLIST 2>/dev/null
"$IPT4" "$@" -t nat -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
"$IPT4" "$@" -t nat -N FBWIFI_PREROUTING 2>/dev/null
"$IPT4" "$@" -t nat -N FBWIFI_HOST_REDIRLIST 2>/dev/null

## Flush custom chains
"$IPT4" "$@" -t filter -F FBWIFI_FORWARD
"$IPT4" "$@" -t filter -F FBWIFI_INPUT
"$IPT4" "$@" -t mangle -F FBWIFI_CLIENT_TO_INTERNET
"$IPT4" "$@" -t mangle -F FBWIFI_PREROUTING
"$IPT4" "$@" -t mangle -F FBWIFI_TRAFFIC_ALLOWLIST
"$IPT4" "$@" -t nat -F FBWIFI_CLIENT_TO_INTERNET
"$IPT4" "$@" -t nat -F FBWIFI_PREROUTING
"$IPT4" "$@" -t nat -F FBWIFI_HOST_REDIRLIST

## Populate custom chains
"$IPT4" "$@" -t filter -A FBWIFI_FORWARD -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
"$IPT4" "$@" -t filter -A FBWIFI_FORWARD -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
"$IPT4" "$@" -t filter -A FBWIFI_FORWARD -j REJECT
"$IPT4" "$@" -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_http_port" -m conntrack --ctstate NEW -j ACCEPT
"$IPT4" "$@" -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_https_port"  -m conntrack --ctstate NEW -j ACCEPT
"$IPT4" "$@" -t filter -A FBWIFI_INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
"$IPT4" "$@" -t mangle -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
"$IPT4" "$@" -t mangle -A FBWIFI_PREROUTING -j FBWIFI_TRAFFIC_ALLOWLIST
"$IPT4" "$@" -t nat -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p udp --dport 443 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p udp --dport 443 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
"$IPT4" "$@" -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j REDIRECT --to-ports "$fbwifi_http_port"

## Hook custom chains in firewall3 chains
"$IPT4" "$@" -t filter -I "zone_${fbwifi_zone}_input" 2 -j FBWIFI_INPUT
"$IPT4" "$@" -t filter -I "zone_${fbwifi_zone}_forward" 2 -j FBWIFI_FORWARD
"$IPT4" "$@" -t nat -I "zone_${fbwifi_zone}_prerouting" 2 -j FBWIFI_PREROUTING
# There are no firewall3 zone chains in the mangle table so we need to do this for all interfaces in the zone
for iface in $fbwifi_ifaces; do
	"$IPT4" "$@" -t mangle -I PREROUTING -i "$iface" -j FBWIFI_PREROUTING
done
