#!/usr/bin/env bash
# ============================================================================
# OpenFUT FIFA-17 — CLIENT-side arming (runs on the GAME machine, e.g. 105).
#
# Companion to the dev container on the SERVER (120). The server runs the heavy
# responders (Blaze / UTAS / roster / POW). Two pieces are inherently local to
# the game and therefore stay here:
#
#   * autopatch.py  — patches FIFA17.exe process memory (ProtoSSL cert-verify).
#                     Must run where the game runs; cannot be containerised.
#   * lsx_responder — the Origin/EADesktop emulator the game dials on the
#                     hardcoded loopback 127.0.0.1:4216. Loopback IPC can't be
#                     cleanly redirected to a remote host, so it lives here.
#
# Everything the game reaches by a routable address is redirected to the server:
#   * winter15.gosredirector.ea.com (hardcoded EA IP 159.153.51.20) -> SERVER:42127
#   * easw.easports.com (dead hardcoded UTAS host)                  -> SERVER (:8099)
#
# The server's responders were started with OPENFUT_ADVERTISE=<SERVER_IP>, so
# after these first redirected contacts the game is handed <SERVER_IP> for every
# later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly.
#
# Usage:   sudo OPENFUT_SERVER=203.0.113.10 ./client_arm.sh
#   (re-run after every reboot; the sysctl/iptables state is volatile)
# ============================================================================
set -euo pipefail

SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}"
GOS_EA_IP="159.153.51.20"     # winter15.gosredirector.ea.com (hardcoded in FIFA17)

if [ "$(id -u)" -ne 0 ]; then
  echo "!! must run as root (sudo). Re-run: sudo OPENFUT_SERVER=$SERVER $0" >&2
  exit 1
fi

echo "[client_arm] backend server = $SERVER"

# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
sysctl -q kernel.yama.ptrace_scope=0

# 2) Redirect the hardcoded Blaze redirector IP to the server's redirector.
#    (Replace any stale rule first so re-runs and IP changes are clean.)
while iptables -t nat -D OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT \
        --to-destination "$SERVER:42127" 2>/dev/null; do :; done
iptables -t nat -A OUTPUT -p tcp -d "$GOS_EA_IP" -j DNAT --to-destination "$SERVER:42127"

# 2b) DNAT from OUTPUT to a REMOTE host needs a matching source-NAT on the way
#     out, or the server's replies (from its own IP) won't match the game's
#     conntrack entry. MASQUERADE the redirected flow so it is SNAT'd to this
#     host's outbound IP. (Harmless duplicate-guarded like the DNAT above.)
while iptables -t nat -D POSTROUTING -p tcp -d "$SERVER" --dport 42127 \
        -j MASQUERADE 2>/dev/null; do :; done
iptables -t nat -A POSTROUTING -p tcp -d "$SERVER" --dport 42127 -j MASQUERADE

# 3) Point the dead hardcoded UTAS host at the server. The port (8099) is carried
#    in the game's own URL, so only the name needs redirecting. Remove any prior
#    OpenFUT-managed line (loopback or other server) and write the current one.
sed -i '/[[:space:]]easw\.easports\.com\b.*# openfut$/d' /etc/hosts
printf '%s\teasw.easports.com\t# openfut\n' "$SERVER" >> /etc/hosts

echo "[client_arm] --- armed ---"
sysctl kernel.yama.ptrace_scope
iptables -t nat -L OUTPUT -n | grep -i "$GOS_EA_IP" || echo "  (DNAT missing!)"
grep 'easw.easports.com' /etc/hosts && echo "  /etc/hosts ok" || echo "  (/etc/hosts easw missing!)"
echo
echo "[client_arm] Next: start the LOCAL pieces (LSX + autopatch) with client_local.sh,"
echo "             ensure the container is up on $SERVER, then launch FIFA 17."