#!/bin/bash
# iptables -N dns-opened
# iptables -A dns-opened -j RETURN
# iptables -t filter -I dns-opened 1 -s ${peer_ip} -d 0.0.0.0/0 -m set ! --match-set dns_opened_10_40_52_218 dst -j DROP
#
# Author: dimitry.lukin@gmail.com
# Ver: 2022033100
# initial version
# Ver: 2022040500
# Changes: added nrdp60-appboot.netflix.com test
# Ver: 2022040800
# Changes: added ttl handling from patched dnsmasq
# Ver: 2022050100
# Changes: (darv) Change Multiple URL's.
#
# kill it with
# # pkill add2ipset

#set -x

LANG="en_EN.utf8"

function add2ipset () {
        TFILE=$1
        stdbuf -oL tail -F $TFILE | stdbuf -oL \
                sed -nr "s/.*query\[A\] ([0-9,A-z,\.,\-]+) from ([0-9,\.]+)$/req \1 \2/p;s/.*ipset add ([0-9]+|dns_opened)\[A\] ([0-9,\.]+).*/rep \1 \2/p;s/.*cached ([0-9]+)::.*is ([0-9,\.]+)/rep \1 \2/p" | \
                while read mode site ipaddr; do
                echo $mode $site $ipaddr
                case $mode in
                "req")
                        if [ "${ipaddr}" == "10.255.0.1" ]; then ipaddr="fakeaddress"; fi
                        if [[ "${site}" == "nrdp60-appboot.netflix.com" ]] || [[ "${site}" == "nrdp52-appboot.netflix.com" ]]  || [[ "${site}" == "nrdp51-appboot.netflix.com" ]] || [[ "${site}" == "nrdp50-appboot.netflix.com" ]]; then
#                               ipset save dns_whitelist_perm |  sed  "s/dns_whitelist_perm/dns_opened_$(echo $ipaddr | tr '\.' '_')/" | tail -n +2  > /tmp/dns_whitelist_perm.$ipaddr;
#                               ipset save dns_whitelist_perm > /tmp/dns_whitelist_perm.$ipaddr;
#                               sed -i "s/dns_whitelist_perm/dns_opened_$(echo $ipaddr | tr '\.' '_')/" /tmp/dns_whitelist_perm.$ipaddr
#                               sed -i 1d /tmp/dns_whitelist_perm.$ipaddr
#                               ipset -! restore < /tmp/dns_whitelist_perm.$ipaddr;
# if client requests these addresses it needs to set flag in /var/opt to process it from cron
# cron runs flushipset secript to restore normal mode  with ipset blocks
                                touch /var/opt/${ipaddr}
                                for i in $(seq 1 5); do iptables -t mangle -D PREROUTING $(iptables -n -t mangle -L PREROUTING --line-numbers | grep ${ipaddr} | cut -f1 -d' '| tail -1); done
                                for i in $(seq 1 5); do iptables -D dns-opened $(iptables -nL --line-numbers | grep ${ipaddr} | cut -f1 -d' ' | tail -1); done
                        fi
                        ips=$ipaddr
                ;;
                "rep")
                        if [ "x${ips}" == "x10.255.0.1" ]; then ips="fakeaddress"; fi
                        timeout=$site
                        if [[ "x$site" == "xdns_opened" ]]; then timeout=0; fi
                        # 20220410 new Jake idea to add 600 to every ttl
                        timeout=$( expr $timeout + 300 )
#                       timeout=$((timeout * 2 + 5))
                        #
                        ipset add -! dns_opened_$(echo $ips | tr '\.' '_') $ipaddr timeout $timeout
                ;;
                *)
                        echo errr
                ;;
                esac
        done

}

export -f add2ipset

if [[ $(pgrep -f add2ipset | wc -l) -gt 10 ]]; then exit; fi

for i in $(ls -1 /var/log/dnsmasq-*.log | grep -v port); do
        add2ipset $i &
done