#!/bin/sh
# OpenFUT FIFA 17 — arm the privileged host state (run via pkexec/sudo).
# Idempotent: safe to re-run. Volatile bits (sysctls, iptables) do NOT survive a
# reboot -> re-run after boot. /etc/hosts DOES persist.
set -e

# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
sysctl -q kernel.yama.ptrace_scope=0
# 2) allow routing DNAT'd traffic to loopback
sysctl -q net.ipv4.conf.lo.route_localnet=1
# 3) redirect FIFA17's Blaze dial (winter15 -> 159.153.51.20) to our TLS server :42127
iptables -t nat -C OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127 2>/dev/null \
  || iptables -t nat -A OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127
# 4) point FUT's dead hardcoded UTAS host (easw.easports.com:8099) at our utas_server
grep -q '[[:space:]]easw\.easports\.com\b' /etc/hosts 2>/dev/null \
  || printf '127.0.0.1\teasw.easports.com\n' >> /etc/hosts
# 5) POW/EASFC hosts -- ONLY with `root_arm.sh pow`. The preferred redirect is the
#    FIFA_POW_URL client-config key (FUT_POW=1, no root needed); these /etc/hosts
#    entries are the fallback for if the client ignores that key. Kept opt-in
#    because they persist across reboots and silently change where FIFA's EASFC
#    traffic goes. Remove with: root_arm.sh unpow
if [ "${1:-}" = "pow" ]; then
  for h in pas.gt.easfc.ea.com content.lt.easfc.ea.com; do
    grep -q "[[:space:]]$h\b" /etc/hosts 2>/dev/null \
      || printf '127.0.0.1\t%s\n' "$h" >> /etc/hosts
  done
  echo "  POW hosts -> 127.0.0.1"
elif [ "${1:-}" = "unpow" ]; then
  sed -i '/pas\.gt\.easfc\.ea\.com/d;/content\.lt\.easfc\.ea\.com/d' /etc/hosts
  echo "  POW hosts removed"
fi

echo "--- armed ---"
sysctl kernel.yama.ptrace_scope net.ipv4.conf.lo.route_localnet
iptables -t nat -L OUTPUT -n | grep -i '159.153.51.20' || echo "  (DNAT missing!)"
grep 'easw.easports.com' /etc/hosts && echo "  /etc/hosts ok" || echo "  (/etc/hosts easw missing!)"