#!/bin/sh
# OpenFUT FIFA 17 — arm the privileged host state (run via pkexec/sudo).
# Idempotent: safe to re-run. Volatile bits (sysctls, iptables) do NOT survive a
# reboot -> re-run after boot. /etc/hosts DOES persist.
set -e

# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
sysctl -q kernel.yama.ptrace_scope=0
# 2) allow routing DNAT'd traffic to loopback
sysctl -q net.ipv4.conf.lo.route_localnet=1
# 3) redirect FIFA17's Blaze dial (winter15 -> 159.153.51.20) to our TLS server :42127
iptables -t nat -C OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127 2>/dev/null \
  || iptables -t nat -A OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127
# 4) point FUT's dead hardcoded UTAS host (easw.easports.com:8099) at our utas_server
grep -q '[[:space:]]easw\.easports\.com\b' /etc/hosts 2>/dev/null \
  || printf '127.0.0.1\teasw.easports.com\n' >> /etc/hosts

echo "--- armed ---"
sysctl kernel.yama.ptrace_scope net.ipv4.conf.lo.route_localnet
iptables -t nat -L OUTPUT -n | grep -i '159.153.51.20' || echo "  (DNAT missing!)"
grep 'easw.easports.com' /etc/hosts && echo "  /etc/hosts ok" || echo "  (/etc/hosts easw missing!)"