#!/bin/bash

# =================================================================
# --- CEK FILE BENDERA (PANEL KONTROL) ---
# Skrip akan berhenti jika file bendera ini tidak ada.
# =================================================================
FLAG_FILE="/opt/udp-proxy/log/enforcer.enabled"
if [ ! -f "$FLAG_FILE" ]; then
    echo "[$(date)] File bendera '$FLAG_FILE' tidak ditemukan. Penjaga tidak aktif. Keluar."
    exit 0
fi

# =================================================================
# --- KONFIGURASI PENJAGA (UBAH BAGIAN INI SAJA) ---
# =================================================================
PROTECTED_PORT=36712         # Port UDP yang dilindungi
STATE_FILE="/opt/udp-proxy/log/enforcer_state.log"
IPTABLES_CHAIN="UDP_ENFORCER"
MEMORY_MINUTES=10            # Berapa lama mengingat sesi yang tidak aktif
TIMEOUT_MINUTES=15           # Sesi dianggap hangus setelah X menit tidak ada aktivitas
GRACE_PERIOD_SECONDS=0       # Waktu tunggu sebelum IP lama ditendang (0 detik = segera)
# Nama layanan UDP proxy Anda (DITEMUKAN DI LANGKAH 0)
UDP_SERVICE_NAME="udp-custom.service"
# =================================================================

# --- PASTIKAN DIREKTORI YANG DIPERLUKAN ADA ---
mkdir -p "$(dirname "$STATE_FILE")"
touch "$STATE_FILE"

# =================================================================
# --- FUNGSI PEMBERSIH (OTOMATIS LUPA & EKSEKUSI TIMER) ---
# =================================================================
function cleanup() {
    echo "[$(date)] =====> MEMULAI PEMBERSIHAN DAN EKSEKUSI TIMER <====="
    local current_time=$(date +%s)
    local timeout_seconds=$((TIMEOUT_MINUTES * 60))
    local temp_state_file=$(mktemp)

    while IFS=':' read -r user ip last_seen violation_time; do
        if [[ -z "$user" || -z "$ip" || -z "$last_seen" ]]; then continue; fi
        
        local elapsed=$((current_time - last_seen))

        if [ "$elapsed" -lt "$timeout_seconds" ]; then
            if [[ -n "$violation_time" ]]; then
                local violation_elapsed=$((current_time - violation_time))
                if [ "$violation_elapsed" -ge "$GRACE_PERIOD_SECONDS" ]; then
                    echo "[$(date)] >>> EKSEKUSI: Timer habis. Memutus & memblokir IP '$ip' (user: '$user')..."
                    sudo conntrack -D -s "$ip" -p udp 2>/dev/null
                    if ! sudo iptables -C "$IPTABLES_CHAIN" -s "$ip" -j DROP &> /dev/null; then
                        sudo iptables -A "$IPTABLES_CHAIN" -s "$ip" -j DROP -m comment --comment "Kicked $USER on $(date +%F-%T)"
                        echo "[$(date)] >>> IP '$ip' telah diblokir."
                    fi
                    continue
                else
                    echo "[$(date)] [DEBUG] Timer untuk IP '$ip' user '$user' belum habis. Menunggu..."
                    echo "${user}:${ip}:${last_seen}:${violation_time}" >> "$temp_state_file"
                fi
            else
                echo "[$(date)] [DEBUG] Sesi normal untuk user '$user' dari IP '$ip'."
                echo "${user}:${ip}:${last_seen}:" >> "$temp_state_file"
            fi
        else
            echo "[$(date)] Sesi untuk user '$user' dari IP '$ip' kadaluarsa. Membuka blokir..."
            local rule_num=$(sudo iptables -L "$IPTABLES_CHAIN" --line-numbers -n | grep "$ip" | awk '{print $1}' | head -n 1)
            if [ -n "$rule_num" ]; then
                sudo iptables -D "$IPTABLES_CHAIN" "$rule_num"
            fi
        fi
    done < "$STATE_FILE"

    mv "$temp_state_file" "$STATE_FILE"
    echo "[$(date)] =====> PEMBERSIHAN SELESAI <====="
}

# =================================================================
# --- FUNGSI BLOCKING SEGERA (Pendekatan 1) ---
# =================================================================
function immediate_block() {
    local user="$1"
    local old_ip="$2"
    echo "[$(date)] >>> EKSEKUSI SEGERA: Memutus & memblokir IP '$old_ip' (user: '$user')..."
    sudo conntrack -D -s "$old_ip" -p udp 2>/dev/null
    if ! sudo iptables -C "$IPTABLES_CHAIN" -s "$old_ip" -j DROP &> /dev/null; then
        sudo iptables -A "$IPTABLES_CHAIN" -s "$old_ip" -j DROP -m comment --comment "Kicked $user on $(date +%F-%T)"
        echo "[$(date)] >>> IP '$old_ip' telah diblokir SEGERA."
    fi
}

# =================================================================
# --- INISIALISASI PENJAGA ---
# =================================================================
# Buat chain jika belum ada
if ! sudo iptables -L "$IPTABLES_CHAIN" &> /dev/null; then
    echo "[$(date)] Membuat chain iptables: $IPTABLES_CHAIN"
    sudo iptables -N "$IPTABLES_CHAIN"
fi

# --- PASTIKAN POSISI ATURAN BENAR (KRUSIAL) ---
echo "[$(date)] Memastikan aturan iptables berada di posisi teratas..."
sudo iptables -D INPUT -p udp --dport "$PROTECTED_PORT" -j "$IPTABLES_CHAIN" 2>/dev/null
sudo iptables -D FORWARD -p udp --dport "$PROTECTED_PORT" -j "$IPTABLES_CHAIN" 2>/dev/null
sudo iptables -F "$IPTABLES_CHAIN" # Bersihkan aturan lama
sudo iptables -I INPUT 1 -p udp --dport "$PROTECTED_PORT" -j "$IPTABLES_CHAIN"
sudo iptables -I FORWARD 1 -p udp --dport "$PROTECTED_PORT" -j "$IPTABLES_CHAIN"

# Jalankan cleanup di latar belakang (setiap 1 menit - Pendekatan 2)
while true; do
    cleanup
    sleep 60  # Cek setiap 1 menit (bukan 5 menit)
done &
CLEANUP_PID=$!
trap 'kill $CLEANUP_PID; exit' SIGTERM SIGINT

# Memori awal
echo "[$(date)] Memuat memori awal dari $MEMORY_MINUTES menit terakhir..."
sudo journalctl -u "$UDP_SERVICE_NAME" --since "$MEMORY_MINUTES minutes ago" --no-pager | grep "Client connected" | sort | awk -F'[][]' '
{
    for (i=1; i<=NF; i++) {
        if ($i ~ /src:/) { split($i, s, ":"); ip = s[2]; }
        if ($i ~ /user:/) { split($i, u, ":"); user = u[2]; }
    }
    if (user && ip) {
        print user ":" ip ":" systime() ":" > "'"$STATE_FILE"'"
    }
}'
awk -i inplace '!seen[$0]++' "$STATE_FILE"
echo "[$(date)] Memori awal selesai. Penjaga siap bertugas!"

# Loop utama pemantauan
echo "[$(date)] Memantau log layanan: $UDP_SERVICE_NAME"
sudo journalctl -u "$UDP_SERVICE_NAME" -f --no-tail | while read line; do
    if [[ "$line" == *"[INFO]"*"[src:"*"[user:"*"Client connected"* ]]; then
        IP=$(echo "$line" | awk -F'[][]' '{for(i=1;i<=NF;i++){if($i ~ /src:/){split($i, a, ":"); print a[2]}}}')
        USER=$(echo "$line" | awk -F'[][]' '{for(i=1;i<=NF;i++){if($i ~ /user:/){split($i, a, ":"); print a[2]}}}')
        if [[ -n "$IP" && -n "$USER" ]]; then
            echo "[$(date)] Koneksi baru: User '$USER' dari IP '$IP'"
            LAST_ENTRY=$(grep "^${USER}:" "$STATE_FILE" | tail -n 1)
            LAST_IP=$(echo "$LAST_ENTRY" | cut -d':' -f2)
            if [[ -n "$LAST_IP" && "$LAST_IP" != "$IP" ]]; then
                echo "[$(date)] >>> PELANGGARAN: User '$USER' multi-login (IP lama: '$LAST_IP', IP baru: '$IP')."
                # Panggil blocking segera (Pendekatan 1)
                immediate_block "$USER" "$LAST_IP"
                # Hapus entri lama tanpa menunggu grace period
                sed -i "/^${USER}:${LAST_IP}:/d" "$STATE_FILE"
            fi
            echo "${USER}:${IP}:$(date +%s)::" >> "$STATE_FILE"
            awk -i inplace '!seen[$0]++' "$STATE_FILE"
        fi
    elif [[ "$line" == *"[INFO]"*"[src:"*"[user:"*"Client disconnected"* ]]; then
        IP=$(echo "$line" | awk -F'[][]' '{for(i=1;i<=NF;i++){if($i ~ /src:/){split($i, a, ":"); print a[2]}}}')
        USER=$(echo "$line" | awk -F'[][]' '{for(i=1;i<=NF;i++){if($i ~ /user:/){split($i, a, ":"); print a[2]}}}')
        if [[ -n "$IP" && -n "$USER" ]]; then
            echo "[$(date)] User '$USER' dari IP '$IP' disconnect. Membersihkan state..."
            sed -i "/^${USER}:${IP}:/d" "$STATE_FILE"
        fi
    fi
done