#!/bin/sh
set -eu

ACTION="${1:-configure}"
case "$ACTION" in
    configure|remove) ;;
    *) exit 64 ;;
esac

firewalld_rule() {
    zone="$1"
    operation="$2"
    rule="$3"
    firewall-cmd --permanent --zone="$zone" "--${operation}-rich-rule=$rule" >/dev/null 2>&1 || true
    firewall-cmd --zone="$zone" "--${operation}-rich-rule=$rule" >/dev/null 2>&1 || true
}

if command -v firewall-cmd >/dev/null 2>&1 \
    && systemctl is-active --quiet firewalld.service 2>/dev/null; then
    zones="$(firewall-cmd --get-active-zones 2>/dev/null | sed -n '/^[^[:space:]]/s/[[:space:]].*$//p')"
    if [ -z "$zones" ]; then
        zones="$(firewall-cmd --get-default-zone 2>/dev/null || true)"
    fi
    operation="add"
    [ "$ACTION" = "configure" ] || operation="remove"
    for zone in $zones; do
        for source in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16; do
            firewalld_rule "$zone" "$operation" "rule priority=32760 family=\"ipv4\" source address=\"$source\" port port=\"53419\" protocol=\"tcp\" accept"
            firewalld_rule "$zone" "$operation" "rule priority=32760 family=\"ipv4\" source address=\"$source\" port port=\"5353\" protocol=\"udp\" accept"
        done
        for source in fc00::/7 fe80::/10; do
            firewalld_rule "$zone" "$operation" "rule priority=32760 family=\"ipv6\" source address=\"$source\" port port=\"53419\" protocol=\"tcp\" accept"
            firewalld_rule "$zone" "$operation" "rule priority=32760 family=\"ipv6\" source address=\"$source\" port port=\"5353\" protocol=\"udp\" accept"
        done
    done
fi

if command -v ufw >/dev/null 2>&1 \
    && ufw status 2>/dev/null | grep -Fq 'Status: active'; then
    for source in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10; do
        if [ "$ACTION" = "configure" ]; then
            ufw allow from "$source" to any port 53419 proto tcp comment 'MASCHINE Linux Agent' >/dev/null 2>&1 || true
            ufw allow from "$source" to any port 5353 proto udp comment 'MASCHINE mDNS' >/dev/null 2>&1 || true
        else
            ufw --force delete allow from "$source" to any port 53419 proto tcp >/dev/null 2>&1 || true
            ufw --force delete allow from "$source" to any port 5353 proto udp >/dev/null 2>&1 || true
        fi
    done
fi
