From 696386a9c1e9379086b32529e1b729994a03d0b6 Mon Sep 17 00:00:00 2001
From: funman300 <funman300@gmail.com>
Date: Tue, 11 Aug 2026 17:19:52 +0000
Subject: [PATCH] client_arm: verify the hosts entry by resolution, not by
 presence

The old check was `grep easw /etc/hosts && echo ok`. It passed on ANY
matching line -- including a line that shadows ours. glibc returns the
first match, and the sed above only deletes lines this script wrote
(`# openfut`), so a foreign entry earlier in the file wins forever and
re-running the script never helps.

Observed today: a leftover `127.0.0.1 easw.easports.com` from the
single-machine era, before the backend moved to its own host. Every arm
reported "/etc/hosts ok" while the name resolved to loopback.

Now it resolves the name -- the same call the game makes -- and compares
address to address, so a server given as a hostname is handled too. On a
mismatch it prints the offending lines with line numbers and says how to
fix them.

It does NOT delete them. This script writes one tagged line and owns only
that line; silently removing entries a user put there by hand is a bigger
hazard than the shadowing it would cure.

Reported as a warning, not an error, because it is survivable: the
responders advertise the server address, so the game stops using this
hostname after the first redirected contact. FIFA reached the FUT hub
today with this exact misconfiguration in place. Claiming it is fatal
would be wrong, and a check that overstates its findings gets ignored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../docker/fifa17-python/client_arm.sh        | 41 +++++++++++++++++--
 1 file changed, 38 insertions(+), 3 deletions(-)

diff --git a/fifa17-recon/docker/fifa17-python/client_arm.sh b/fifa17-recon/docker/fifa17-python/client_arm.sh
index 4b63525..565eb1e 100644
--- a/fifa17-recon/docker/fifa17-python/client_arm.sh
+++ b/fifa17-recon/docker/fifa17-python/client_arm.sh
@@ -27,6 +27,8 @@ set -euo pipefail
 
 SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}"
 GOS_EA_IP="159.153.51.20"     # winter15.gosredirector.ea.com (hardcoded in FIFA17)
+UTAS_HOST="easw.easports.com" # dead UTAS host baked into CardsDLL
+UTAS_RE="${UTAS_HOST//./\\.}" # same, safe to embed in a regex
 
 if [ "$(id -u)" -ne 0 ]; then
   echo "!! must run as root (sudo). Re-run: sudo OPENFUT_SERVER=$SERVER $0" >&2
@@ -55,13 +57,46 @@ iptables -t nat -A POSTROUTING -p tcp -d "$SERVER" --dport 42127 -j MASQUERADE
 # 3) Point the dead hardcoded UTAS host at the server. The port (8099) is carried
 #    in the game's own URL, so only the name needs redirecting. Remove any prior
 #    OpenFUT-managed line (loopback or other server) and write the current one.
-sed -i '/[[:space:]]easw\.easports\.com\b.*# openfut$/d' /etc/hosts
-printf '%s\teasw.easports.com\t# openfut\n' "$SERVER" >> /etc/hosts
+sed -i "/[[:space:]]${UTAS_RE}\b.*# openfut\$/d" /etc/hosts
+printf '%s\t%s\t# openfut\n' "$SERVER" "$UTAS_HOST" >> /etc/hosts
 
 echo "[client_arm] --- armed ---"
 sysctl kernel.yama.ptrace_scope
 iptables -t nat -L OUTPUT -n | grep -i "$GOS_EA_IP" || echo "  (DNAT missing!)"
-grep 'easw.easports.com' /etc/hosts && echo "  /etc/hosts ok" || echo "  (/etc/hosts easw missing!)"
+
+# Verify the hosts entry by EFFECT, not by presence.
+#
+# glibc returns the FIRST match in /etc/hosts, so our line can be written
+# correctly and still lose to an earlier one -- and the sed above only removes
+# lines this script wrote (`# openfut`), so re-running never clears a foreign
+# one. The old check here was `grep easw /etc/hosts && echo ok`, which passed on
+# the shadowing line itself and reported success while resolution was wrong.
+#
+# Observed on 2026-08-11: a leftover `127.0.0.1 easw.easports.com` from the
+# single-machine era shadowed the OpenFUT line, and every re-run said "ok".
+resolved="$(getent ahosts "$UTAS_HOST" 2>/dev/null | awk '{print $1}' | sort -u | tr '\n' ' ')"
+# SERVER may be a hostname, so compare address-to-address rather than comparing
+# the literal string against resolved IPs (which would warn spuriously).
+server_ips="$(getent ahosts "$SERVER" 2>/dev/null | awk '{print $1}' | sort -u)"
+[ -n "$server_ips" ] || server_ips="$SERVER"
+match=0
+for ip in $server_ips; do
+  printf '%s' "$resolved" | grep -qw -- "$ip" && match=1
+done
+if [ "$match" -eq 1 ]; then
+  echo "  /etc/hosts ok ($UTAS_HOST -> $resolved)"
+else
+  echo
+  echo "  !! WARNING: $UTAS_HOST resolves to [$resolved], not $SERVER."
+  echo "     An earlier /etc/hosts line is shadowing the OpenFUT one:"
+  grep -nE "^[[:space:]]*[^#].*[[:space:]]${UTAS_RE}([[:space:]]|\$)" /etc/hosts \
+    | grep -v '# openfut$' | sed 's/^/       /' || true
+  echo
+  echo "     Not fatal: the responders advertise $SERVER, so the game stops using"
+  echo "     this name after the first hop. Worth removing the line above anyway."
+  echo "     Lines are listed rather than deleted -- this script will not remove"
+  echo "     /etc/hosts entries it did not write."
+fi
 echo
 echo "[client_arm] Next: start the LOCAL pieces (LSX + autopatch) with client_local.sh,"
 echo "             ensure the container is up on $SERVER, then launch FIFA 17."