#!/usr/bin/env bash
# Copyright 2020 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

#### CATEGORY=Other
### register host tools at MacOS Application Firewall
## Register host tools at MacOS Application Firewall
##
## NOTE: This script uses sudo and will thus ask for your password!
##
##   -n|--dry-run         Just print all steps, don't do any configuration

source "$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"/lib/vars.sh || exit $?
fx-config-read

FIREWALL_CMD="/usr/libexec/ApplicationFirewall/socketfilterfw"

function dryer {
  if ! "$dryrun"; then
    "${@}"
    return $?
  fi
  echo >&2 "+ $@"
  return 0
}

function list_tools {
  TOOL_LIST="$(${FIREWALL_CMD} --listapps | grep "${FUCHSIA_DIR}" | awk '{print $3}')"
  for f in "${TOOL_LIST[@]}"; do
    echo "${f}"
  done
}

function clear_tools {
  TOOL_LIST="$(${FIREWALL_CMD} --listapps | grep "${FUCHSIA_DIR}" | awk '{print $3}')"
  for f in ${TOOL_LIST}; do
    dryer sudo ${FIREWALL_CMD} --remove "${f}" > /dev/null
  done
}

function allow_tools {
  for f in ${ZIRCON_TOOLS_DIR}/*; do
    dryer sudo ${FIREWALL_CMD} --add "$f" --unblockapp "$f" > /dev/null
  done
  for f in ${FUCHSIA_BUILD_DIR}/host-tools/*; do
    dryer sudo ${FIREWALL_CMD} --add "$f" --unblockapp "$f" > /dev/null
  done
}

function main {
  echo "  clearing firewall rules.."
  clear_tools
  echo "  adding firewall rules.."
  allow_tools

  # Activate the changes
  dryer sudo ${FIREWALL_CMD} --setglobalstate off > /dev/null
  dryer sudo ${FIREWALL_CMD} --setglobalstate on > /dev/null
  echo "..done"

  echo "  following tools are registered in the firewall rules:"
  echo " "
  list_tools
  echo " "
}

dryrun=false
while [[ $# > 0 ]]; do
  case "$1" in
  -n|--dry-run)
    fx-warn "Running in dry-run mode"
    dryrun=true
    ;;
  -h|--help|*)
    fx-command-help
    exit 1
    ;;
  esac
  shift
done

main