#!/bin/bash

if [[ "${NETWORK_BASH}" != "" ]]
then
    return
fi



# Includes
#-----------------------------------------------------------------------------------------------------------------------------------

. /usr/global/lib/default.bash
. /usr/global/lib/dns.bash





# Global Variable
#-----------------------------------------------------------------------------------------------------------------------------------

declare -g NETWORK_BASH=1

declare -g  NETWORK_OPENVPN_STATUS

declare -g  NETWORK_SRC_TYPE
declare -Ag NETWORK_SRC_TAB
declare -g  NETWORK_SRC_ID_LIST
declare -Ag NETWORK_SRC_IP_IDX

declare -g  NETWORK_DST_TYPE
declare -Ag NETWORK_DST_TAB
declare -g  NETWORK_DST_ID_LIST

declare -g  NETWORK_CONFIG_FILE="/etc/sysconfig/rx3-network"
declare -g  NETWORK_CONFIG_LOCK="/var/lock/network/rx3-network"
#declare -g  NETWORK_CONFIG_LOCK="${NETWORK_CONFIG_FILE}"




file_lock ${NETWORK_CONFIG_LOCK} READ 9

[ -e "${NETWORK_CONFIG_FILE}" ] && . "${NETWORK_CONFIG_FILE}"

file_unlock 9


if [ ! -v LOG ]
then
    LOG=":"
fi





#--------------------------------------------------------------------------------------------------------------------------
# network_common_load
#--------------------------------------------------------------------------------------------------------------------------

network_common_load()
{
    NETWORK_OPENVPN_STATUS="$( sudo /usr/local/sbin/openvpn-status)"
        NETWORK_TABLE_LIST=""
}





#--------------------------------------------------------------------------------------------------------------------------
# network_common_dump
#--------------------------------------------------------------------------------------------------------------------------

network_common_dump()
{
    echo "NETWORK_OPENVPN_STATUS: [${NETWORK_OPENVPN_STATUS}]"
    echo
    echo "NETWORK_TABLE_LIST: [${NETWORK_TABLE_LIST}]"
    echo
}





#--------------------------------------------------------------------------------------------------------------------------
# network_dst_tab_load
#--------------------------------------------------------------------------------------------------------------------------

network_dst_tab_load()
{
    ndtl_id=0


    while IFS= read -r line
    do
        line=${line%%#*}
        if [[ ! -z "$line" ]]
        then
            set ${line}

              ndtl_name="$1"
              ndtl_type="$2"
            ndtl_device="$3"
            ndtl_config="$4"
             ndtl_table="$5"

            var_assign NETWORK_DST_ID_LIST "${ndtl_id}"        INC
            
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Name"   "${ndtl_name}"
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Type"   "${ndtl_type}"
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Device" "${ndtl_device}"
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Config" "${ndtl_config}"                    
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Table"  "${ndtl_table}"

            var_assign NETWORK_TABLE_LIST  "${ndtl_table}"     INC
            
            tab_assign NETWORK_DST_TAB     "${ndtl_id},Status" "$( ip link show dev ${ndtl_device} 2>/dev/null | grep -q ",UP," && echo 1 || echo 0)"

            dns_lookup A vpn${ndtl_id}.vpn.rx3 "NOCACHE"
            tab_assign NETWORK_DST_TAB "${ndtl_id},IP"     "${dns_value}"

            case "${ndtl_type}"
            in
                "0")
                    set $(ip -s link show ${ndtl_device} 2>/dev/null ) &>/dev/null
		    		    
                    ndtl_bytes_received="$( echo ${27} | numfmt --to=iec-i --suffix=B)"
                        ndtl_bytes_sent="$( echo ${40} | numfmt --to=iec-i --suffix=B)"
                            ndtl_uptime=""
                    ;;

                "1")
                    set $( echo "${NETWORK_OPENVPN_STATUS}" | grep ${ndtl_device}) &>/dev/null

#		    i=1; while [[ $i -lt 50 ]]; do eval "val=\${$i}"; echo "($i):[${val}]" 1>&2; i=$(( $i + 1)); done

		    ndtl_bytes_received="$( echo ${18/bytes,} | numfmt --to=iec-i --suffix=B)"
                        ndtl_bytes_sent="$( echo ${22/bytes,} | numfmt --to=iec-i --suffix=B)"
                        ndtl_start_date="$( grep "ext-client-${ndtl_device}.conf" /var/log/rx3-vpn.status 2>/dev/null | sed -e "s/.*Date: \[//" -e "s/\].*//")"

                        if [[ "${ndtl_start_date}" == "" ]]
                        then
                            ndtl_uptime=""
                        else
                            ndtl_uptime=$( echo "$(($(date +%s) - $(date -d "${ndtl_start_date}" +%s)))" | awk '{days = int($1/86400); print days " day" (( days > 1 ) ? "s" : "") strftime(" %H:%M:%S", $1,1)}')
                        fi
                    ;;
            esac
            
            tab_assign NETWORK_DST_TAB "${ndtl_id},Bytes_Received" "${ndtl_bytes_received}"
            tab_assign NETWORK_DST_TAB "${ndtl_id},Bytes_Sent"     "${ndtl_bytes_sent}"
            tab_assign NETWORK_DST_TAB "${ndtl_id},Uptime"         "${ndtl_uptime}"
                
            ndtl_id=$(( ${ndtl_id} + 1))
        fi                
    done <<< ${NETWORK_DST_CONFIG}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_dst_tab_get
#--------------------------------------------------------------------------------------------------------------------------

network_dst_tab_get()
{
     dst_id="$1"
     
               dst_name=${NETWORK_DST_TAB["${dst_id},Name"]}
               dst_type=${NETWORK_DST_TAB["${dst_id},Type"]}
             dst_device=${NETWORK_DST_TAB["${dst_id},Device"]}
             dst_config=${NETWORK_DST_TAB["${dst_id},Config"]}
              dst_table=${NETWORK_DST_TAB["${dst_id},Table"]}

             dst_status=${NETWORK_DST_TAB["${dst_id},Status"]}
                 dst_ip=${NETWORK_DST_TAB["${dst_id},IP"]}
     dst_bytes_received=${NETWORK_DST_TAB["${dst_id},Bytes_Received"]}
         dst_bytes_sent=${NETWORK_DST_TAB["${dst_id},Bytes_Sent"]}
         dst_start_date=${NETWORK_DST_TAB["${dst_id},Start_Date"]}
             dst_uptime=${NETWORK_DST_TAB["${dst_id},Uptime"]}

}





#--------------------------------------------------------------------------------------------------------------------------
# network_dst_tab_dump
#--------------------------------------------------------------------------------------------------------------------------

network_dst_tab_dump()
{
    echo "NETWORK_DST_ID_LIST: [${NETWORK_DST_ID_LIST}]"
    echo
    
    echo "NETWORK_DST_TAB:"

    for key in "${!NETWORK_DST_TAB[@]}"
    do
        echo "[${key}]: [${NETWORK_DST_TAB[${key}]}]"
    done | sort -n

    echo
}





#--------------------------------------------------------------------------------------------------------------------------
# network_src_tab_load
#--------------------------------------------------------------------------------------------------------------------------

network_src_tab_load()
{
              nstl_id=0
    nstl_port_default=3000


    while IFS= read -r line
    do
        line=${line%%#*}
        if [[ ! -z "$line" ]]
        then
            set ${line}
                
                    nstl_ip="$1"
                  nstl_type="$2"
                 nstl_owner="$3"
                 nstl_table="$4"
            nstl_port_start="$5"
            nstl_port_range="$6"

            if [[ "${nstl_port_start}" == "-" ]]
            then
                nstl_port_start=${nstl_port_default}
            fi

            dns_lookup PTR ${nstl_ip}
	    nstl_name="${dns_value}"
            
            case "${nstl_type}"
            in
                "0"|"1") # Local + Routed
                            nstl_device=""
                            nstl_status="2"
                    
                    nstl_bytes_received=""
                        nstl_bytes_sent=""
                            nstl_uptime=""
                         nstl_last_seen=""
                ;;

                "2") # OpenVPN
                         nstl_device="tun0"
                    nstl_status_line="$( echo "${NETWORK_OPENVPN_STATUS}" | grep "${nstl_device}.log: CLIENT_LIST.*${nstl_ip},")"

                    if [[ "${nstl_status_line}" == "" ]]
                    then
                                nstl_status="0"
                        nstl_bytes_received=""
                            nstl_bytes_sent=""
                            nstl_start_date=""
                                nstl_uptime=""
                             nstl_last_seen="$( stat -c "%x" /etc/openvpn/status/${nstl_name}.status 2>/dev/null | sed -e 's/\..*//')"

                    else
                        nstl_status="1"

                        IFS=,
                        set ${nstl_status_line} &>/dev/null
                        unset IFS
                        
                        nstl_bytes_received=$( echo ${6} | numfmt --to=iec-i --suffix=B)
                            nstl_bytes_sent=$( echo ${7} | numfmt --to=iec-i --suffix=B)
                            nstl_start_date=${8}
                                nstl_uptime=$( echo "$(($(date +%s) - $(date -d "${nstl_start_date}" +%s)))" | awk '{days = int($1/86400); print days " day" (( days > 1 ) ? "s" : "") strftime(" %H:%M:%S", $1,1)}')                       
                                nstl_last_seen="$(stat -c "%x" /etc/openvpn/status/${nstl_name}.status 2>/dev/null | sed -e 's/\..*//')"
                    fi
                ;;
            esac

            if [[ " ${NETWORK_TABLE_LIST} " != *" ${nstl_table} "* ]]
            then
                err_echo "Invalid table number: [${nstl_table}] in network src entry: [${nstl_id}]!"
                exit 1
            fi
            
            
            var_assign NETWORK_SRC_ID_LIST "${nstl_id}" INC
            
            tab_assign NETWORK_SRC_TAB    "${nstl_id},IP"             "${nstl_ip}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Name"           "${nstl_name}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Type"           "${nstl_type}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Owner"          "${nstl_owner}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Table"          "${nstl_table}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Port_Start"     "${nstl_port_start}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Port_Range"     "${nstl_port_range}"

            tab_assign NETWORK_SRC_TAB    "${nstl_id},Device"         "${nstl_device}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Status"         "${nstl_status}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Bytes_Received" "${nstl_bytes_received}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Bytes_Sent"     "${nstl_bytes_sent}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Uptime"         "${nstl_uptime}"
            tab_assign NETWORK_SRC_TAB    "${nstl_id},Last_Seen"      "${nstl_last_seen}"

            tab_assign NETWORK_SRC_IP_IDX "${nstl_ip}"                "${nstl_id}"

                      nstl_id=$(( ${nstl_id} + 1))
            nstl_port_default=$(( ${nstl_port_start} + ${nstl_port_range}))
        fi                
    done <<< ${NETWORK_SRC_CONFIG}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_src_tab_get
#--------------------------------------------------------------------------------------------------------------------------

network_src_tab_get()
{
     src_id="$1"
     
            src_ip=${NETWORK_SRC_TAB["${src_id},IP"]}
          src_name=${NETWORK_SRC_TAB["${src_id},Name"]}
          src_type=${NETWORK_SRC_TAB["${src_id},Type"]}
         src_owner=${NETWORK_SRC_TAB["${src_id},Owner"]}
         src_table=${NETWORK_SRC_TAB["${src_id},Table"]}
    src_port_start=${NETWORK_SRC_TAB["${src_id},Port_Start"]}
    src_port_range=${NETWORK_SRC_TAB["${src_id},Port_Range"]}

    if [[ "${src_port_range}" != "0" ]]
    then
	src_port_end=$(( ${src_port_start} + ${src_port_range} - 1))
    else
	src_port_start=""
	src_port_end=""
    fi
    
             src_device=${NETWORK_SRC_TAB["${src_id},Device"]}
             src_status=${NETWORK_SRC_TAB["${src_id},Status"]}
     src_bytes_received=${NETWORK_SRC_TAB["${src_id},Bytes_Received"]}
         src_bytes_sent=${NETWORK_SRC_TAB["${src_id},Bytes_Sent"]}
         src_start_date=${NETWORK_SRC_TAB["${src_id},Start_Date"]}
             src_uptime=${NETWORK_SRC_TAB["${src_id},Uptime"]}
          src_last_seen=${NETWORK_SRC_TAB["${src_id},Last_Seen"]}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_src_tab_dump
#--------------------------------------------------------------------------------------------------------------------------

network_src_tab_dump()
{
    echo "NETWORK_SRC_ID_LIST: [${NETWORK_SRC_ID_LIST}]"
    echo
    
    echo "NETWORK_SRC_IP_IDX:"
    
    for key in "${!NETWORK_SRC_IP_IDX[@]}"
    do
        echo "[${key}]: [${NETWORK_SRC_IP_IDX[${key}]}]"
    done | sort -n

    echo

    echo "NETWORK_SRC_TAB:"
    
    for key in "${!NETWORK_SRC_TAB[@]}"
    do
        echo "[${key}]: [${NETWORK_SRC_TAB[${key}]}]"
    done | sort -n

    echo
}





#--------------------------------------------------------------------------------------------------------------------------
# network_src_tab_ip_lookup
#--------------------------------------------------------------------------------------------------------------------------

network_src_tab_ip_lookup()
{
    src_ip="$1"
     
    src_id=${NETWORK_SRC_IP_IDX["${src_ip}"]}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_tab_load
#--------------------------------------------------------------------------------------------------------------------------

network_tab_load()
{
    dns_tab_load

    network_common_load
    
    network_dst_tab_load
    network_src_tab_load
    
    dns_tab_save
}





#--------------------------------------------------------------------------------------------------------------------------
# network_tab_dump
#--------------------------------------------------------------------------------------------------------------------------

network_tab_dump()
{
    dns_tab_dump

    network_common_dump

    network_dst_tab_dump
    network_src_tab_dump
}





#--------------------------------------------------------------------------------------------------------------------------
# network_table_init
#--------------------------------------------------------------------------------------------------------------------------

network_table_init()
{
    ${LOG} "Add Rx3 routes in VPN tables"
    
    for table in ${TABLE_LIST}
    do
      for route in ${IP_ROUTE}
      do
	${DEBUG} ip route add ${route/:*/} table ${table} dev ${route/*:/}
      done
    done

    
    ${LOG} "Copy main default rule into table 3 (VPN Local routing table)"
    
    if [[ "$(ip route list match 0.0.0.0 table main)" != "" ]]
    then
	${DEBUG} ip route add $(ip route list match 0.0.0.0 table main) table 3
    fi
}





#--------------------------------------------------------------------------------------------------------------------------
# network_table_deinit
#--------------------------------------------------------------------------------------------------------------------------

network_table_deinit()
{
    ${LOG} "Remove default route in table 3"
    
    ${DEBUG} ip route del default table 3

    
    ${LOG} "Remove Rx3 routes in VPN tables"
    
    for table in ${TABLE_LIST}
    do
        for route in ${IP_ROUTE}
        do
        ${DEBUG} ip route del ${route/:*/} table ${table} dev ${route/*:/} 2>/dev/null
        done
    done
}





#--------------------------------------------------------------------------------------------------------------------------
# network_table_set
#--------------------------------------------------------------------------------------------------------------------------

network_table_set()
{
    nts_ip=$1
    nts_table=$2

    network_src_tab_ip_lookup "${nts_ip}"

    if [[ "${src_id}" == "" ]]
    then
        err_echo "IP not found: [${nts_ip}]!"
	return 1
    fi
    
    if [[ " ${NETWORK_TABLE_LIST} " != *" ${nts_table} "* ]]
    then
        err_echo "Table not found: [${nts_table}]!"
	return 1
    fi

    
    tab_assign NETWORK_SRC_TAB "${src_id},Table" "${ts_table}"
   

    ${DEBUG} sed "/^NETWORK_SRC_CONFIG=\"/,/^\"/ { s/^\(${nts_ip//./\\.}[[:space:]]\+\([^\t ]\+[[:space:]]\+\)\{2\}\)[^[:space:]]\+/\1${nts_table}/ }" -i ${NETWORK_CONFIG_FILE}

    ${DEBUG} ip rule del from ${nts_ip}                2>/dev/null
    ${DEBUG} ip rule add from ${nts_ip} table ${nts_table}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_forward_add
#--------------------------------------------------------------------------------------------------------------------------

network_forward_add()
{
            nfa_ip=$1
    nfa_port_start=$2
      nfa_port_end=$3


    ${DEBUG} iptables -t nat -A PREROUTING-VPN -p tcp -m tcp --dport ${nfa_port_start}:${nfa_port_end} -j DNAT --to ${nfa_ip}
    ${DEBUG} iptables -t nat -A PREROUTING-VPN -p udp -m udp --dport ${nfa_port_start}:${nfa_port_end} -j DNAT --to ${nfa_ip}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_forward_remove
#--------------------------------------------------------------------------------------------------------------------------

network_forward_remove()
{
            nfr_ip=$1
    nfr_port_start=$2
      nfr_port_end=$3

    ${DEBUG} iptables -t nat -D PREROUTING-VPN -p tcp -m tcp --dport ${nfr_port_start}:${nfr_port_end} -j DNAT --to ${nfr_ip}
    ${DEBUG} iptables -t nat -D PREROUTING-VPN -p udp -m udp --dport ${nfr_port_start}:${nfr_port_end} -j DNAT --to ${nfr_ip}
}





#--------------------------------------------------------------------------------------------------------------------------
# network_forward_start
#--------------------------------------------------------------------------------------------------------------------------

network_forward_start()
{
    ${LOG} "Create VPN forward chain"
    
    ${DEBUG} iptables -t nat -N PREROUTING-VPN

    
    ${LOG} "Add jump rule for VPN"

    for dst_id in ${NETWORK_DST_ID_LIST}
    do
        network_dst_tab_get ${dst_id}

        if [[ "${dst_type}" != "0" ]]
        then
	    ${DEBUG} iptables -t nat -A PREROUTING -i ${dst_device} -j PREROUTING-VPN
        fi
    done 

    
    ${LOG} "Add VPN client addresse rules"
    
    for src_id in ${NETWORK_SRC_ID_LIST}
    do
        network_src_tab_get ${src_id}
        
        ${DEBUG} ip rule add from ${src_ip} table ${src_table}

        if [[ "${src_port_range}" != "0" ]]
        then
            network_forward_add "${src_ip}" "${src_port_start}" "${src_port_end}"
        fi
    done
}





#--------------------------------------------------------------------------------------------------------------------------
# network_forward_stop
#--------------------------------------------------------------------------------------------------------------------------

network_forward_stop()
{
   ${LOG} "Remove VPN client addresse rules"
    
    for src_id in ${NETWORK_SRC_ID_LIST}
    do
        network_src_tab_get ${src_id}

        ${DEBUG} ip rule del from ${src_ip} 2>/dev/null

        if [[ "${src_port_range}" != "0" ]]
        then
            network_forward_remove "${src_ip}" "${src_port_start}" "${src_port_end}"
        fi
    done

    
    ${LOG} "Remove Jump rule for VPN"
    
    for dst_id in ${NETWORK_DST_ID_LIST}
    do
        network_dst_tab_get ${dst_id}

        if [[ "${dst_type}" != "0" ]]
        then
	    ${DEBUG} iptables -t nat -D PREROUTING -i ${dst_device} -j PREROUTING-VPN
        fi
    done

    
    ${LOG} "Delete VPN forward chain"
    
    ${DEBUG} iptables -t nat -X PREROUTING-VPN
}





#--------------------------------------------------------------------------------------------------------------------------
# network_status
#--------------------------------------------------------------------------------------------------------------------------

network_status()
{
    echo "Rules:"
    
    ip rule show
    echo

    if [[ "${NETWORK_TABLE_LIST}" == "" ]]
    then
        echo "Network table list empty"
        echo
    else
        for table in ${NETWORK_TABLE_LIST}
        do
	    echo "Table ${table}:"
            
	    ip route list table ${table}
	    echo
        done
    fi
    
    echo "Forward:"
    
    iptables -t nat -L PREROUTING -v -n
    echo
    
    iptables -t nat -L PREROUTING-VPN -v -n
}