#!/bin/sh

. /lib/functions/network.sh

nft_insert() {
	local chain="$1"
	local position="$2"
	shift 2

	local line="$(
		nft list chain inet fw4 "$chain" \
		| wc \
		| awk '{print $1 - 4}'
	)"

	[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))

	[[ "$position" -lt 1 ]] && position=1
	[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"

	nft insert rule inet fw4 "$chain" index $(( position - 1 )) $@
}

nft_check_and_insert() {
	local chain="$1"
	local position="$2"
	shift 2

	nft list chain inet fw4 "$chain" | grep -q "$*" 2>/dev/null \
	|| nft_insert "$chain" "$position" $@
}

main() {
	nft add chain inet fw4 "mnh"

	network_find_wan wan_iface
	network_get_device wan_device "$wan_iface"
	# avoid dead lock in `fw4 reload`
	wan_zone=$(QUIET=1 ACTION=device OBJECT=$wan_device utpl -S /usr/share/firewall4/main.uc)

	# before REJECT
	nft_check_and_insert "input_${wan_zone}" -2 jump "mnh" comment \"Hook into mnh input chain\"
}

main