#!/usr/bin/env bash
set -euo pipefail
umask 077
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
remote="$repo_root/scripts/remote/apply-wireguard-mss.sh"
work="$(mktemp -d /var/tmp/pufferpanel-fork/auto-mtu-tests/mss.XXXXXX)"
trap 'rm -rf "$work"' EXIT
mkdir "$work/bin"
cat >"$work/bin/nft" <<'MOCK'
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' "$*" >>"$MOCK_STATE/log"
case "$*" in
  'list tables') if [[ -e "$MOCK_STATE/table" ]]; then echo 'table inet wireguard_mss'; fi ;;
  'list table inet wireguard_mss') cat "$MOCK_STATE/table" ;;
  '--check --file '*) [[ ! -e "$MOCK_STATE/fail-check" ]] ;;
  '--file '*)
    [[ ! -e "$MOCK_STATE/fail-apply" ]] || exit 1
    cp "$2" "$MOCK_STATE/table"
    ;;
  *) exit 1 ;;
esac
MOCK
chmod 0700 "$work/bin/nft"
export PATH="$work/bin:$PATH" MOCK_STATE="$work" WG_MSS_TEST=1
export WG_MSS_CONFIG="$work/nftables.conf" WG_MSS_FRAGMENT="$work/mss.nft"
printf 'flush ruleset\ntable inet filter { }\n' >"$WG_MSS_CONFIG"
cp "$WG_MSS_CONFIG" "$work/original"

bash "$remote" 1392 --render >"$work/rendered"
[[ "$(grep -c 'tcp option maxseg size > 1352 tcp option maxseg size set 1352' "$work/rendered")" = 2 ]]
[[ "$(grep -c 'tcp option maxseg size > 1332 tcp option maxseg size set 1332' "$work/rendered")" = 2 ]]
[[ "$(grep -c 'tcp flags & (syn | rst) == syn' "$work/rendered")" = 4 ]]
if grep -E 'flush|dnat|snat|masquerade|dport' "$work/rendered"; then exit 1; fi
if bash "$remote" 1279 --render; then exit 1; fi
# Conditions must preserve any smaller advertised MSS in either IP family.
for cap in 1352 1332; do
  for advertised in 536 1200 "$cap" 1460; do
    result="$advertised"
    if ((advertised > cap)); then result="$cap"; fi
    ((result <= advertised && result <= cap))
  done
done
bash "$remote" 1392 >/dev/null
cmp "$work/rendered" "$WG_MSS_FRAGMENT"
[[ "$(grep -Fc "include \"$WG_MSS_FRAGMENT\"" "$WG_MSS_CONFIG")" = 1 ]]
bash "$remote" 1392 >/dev/null
[[ "$(grep -Fc "include \"$WG_MSS_FRAGMENT\"" "$WG_MSS_CONFIG")" = 1 ]]
grep -Fxq 'delete table inet wireguard_mss' "$work/table"
cp "$WG_MSS_CONFIG" "$work/config.before"
cp "$WG_MSS_FRAGMENT" "$work/fragment.before"
cp "$work/table" "$work/table.before"
touch "$work/fail-apply"
if bash "$remote" 1380 >/dev/null; then exit 1; fi
cmp "$work/config.before" "$WG_MSS_CONFIG"
cmp "$work/fragment.before" "$WG_MSS_FRAGMENT"
cmp "$work/table.before" "$work/table"
rm "$work/fail-apply"
touch "$work/fail-check"
if bash "$remote" 1380 >/dev/null; then exit 1; fi
cmp "$work/config.before" "$WG_MSS_CONFIG"
printf '%s\n' 'WireGuard MSS render, caps, repeat apply, validation failure, and atomic-failure rollback tests passed'