#!/bin/bash

# Fast multi-country IP blocking using ipset
# ipset is much faster than individual UFW rules

LOG_FILE="/var/log/block-countries-ips.log"
TEMP_DIR="/tmp/country-blocks"

# Countries to block (add more as needed)
declare -A COUNTRIES=(
    ["singapore"]="SG"
    ["china"]="CN"
)

log_message() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Create temp directory
mkdir -p "$TEMP_DIR"

log_message "Starting multi-country IP block update"

# Function to download and process IPs for a country
process_country() {
    local country_name=$1
    local country_code=$2
    local ipset_name=$country_name
    local temp_file="$TEMP_DIR/${country_code}-ips.txt"
    local data_file="$TEMP_DIR/${country_code}-data.json"
    
    log_message "Processing $country_name ($country_code)..."
    
    # Download country IP ranges from RIPE
    curl -s "https://stat.ripe.net/data/country-resource-list/data.json?resource=${country_code}" -o "$data_file"
    
    if [ $? -ne 0 ]; then
        log_message "ERROR: Failed to download IP data for $country_name"
        return 1
    fi
    
    # Extract IPv4 ranges
    jq -r '.data.resources.ipv4[]' "$data_file" > "$temp_file"
    
    if [ ! -s "$temp_file" ]; then
        log_message "ERROR: No IP ranges found for $country_name"
        return 1
    fi
    
    COUNT=$(wc -l < "$temp_file")
    log_message "Downloaded $COUNT IP ranges for $country_name"
    
    # Create new ipset (or recreate if exists)
    ipset list "$ipset_name" >/dev/null 2>&1
    if [ $? -eq 0 ]; then
        # Set exists, create temporary set and swap
        log_message "Updating existing ipset for $country_name"
        ipset create "${ipset_name}_temp" hash:net
        
        while IFS= read -r ip_range; do
            ipset add "${ipset_name}_temp" "$ip_range" 2>/dev/null
        done < "$temp_file"
        
        # Swap the sets atomically
        ipset swap "${ipset_name}_temp" "$ipset_name"
        ipset destroy "${ipset_name}_temp"
    else
        # Set doesn't exist, create it
        log_message "Creating new ipset for $country_name"
        ipset create "$ipset_name" hash:net
        
        while IFS= read -r ip_range; do
            ipset add "$ipset_name" "$ip_range" 2>/dev/null
        done < "$temp_file"
        
        # Add iptables rule to block the set
        iptables -I INPUT -m set --match-set "$ipset_name" src -j DROP -m comment --comment "Block $country_name"
    fi
    
    log_message "ipset updated with $COUNT ranges for $country_name"
    
    return 0
}

# Process each country
for country_name in "${!COUNTRIES[@]}"; do
    country_code="${COUNTRIES[$country_name]}"
    process_country "$country_name" "$country_code"
done

# Cleanup
rm -rf "$TEMP_DIR"

log_message "Multi-country IP block update completed"

# Display summary
log_message "=== BLOCKING SUMMARY ==="
for country_name in "${!COUNTRIES[@]}"; do
    if ipset list "$country_name" >/dev/null 2>&1; then
        entry_count=$(ipset list "$country_name" | grep -c "^[0-9]")
        log_message "$country_name: $entry_count IP ranges blocked"
    fi
done