#!/bin/bash

source ./kernel_config_utils.sh
source ./net_utils.sh

iptables_check() {
    is_error=false
    if ! kernel_config_check CONFIG_NETFILTER; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_NETFILTER_ADVANCED; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_NF_CONNTRACK nf_conntrack; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_NF_NAT nf_nat; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_NETFILTER_XTABLES x_tables; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_IP_NF_IPTABLES ip_tables; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_IP_NF_RAW iptable_raw; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_IP_NF_MANGLE iptable_mangle; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_IP_NF_NAT iptable_nat; then
        is_error=true
    fi
    if ! kernel_config_check CONFIG_IP_NF_FILTER iptable_filter; then
        is_error=true
    fi
    if [ "$is_error" == "true" ]; then
        return 1
    fi

    local tables="raw mangle nat filter"

    for table in $tables; do
        local chains

        case $table in
            "raw")
                chains="PREROUTING OUTPUT"
                ;;
            "mangle")
                chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING"
                ;;
            "nat")
                chains="PREROUTING INPUT OUTPUT POSTROUTING"
                ;;
            "filter")
                chains="INPUT FORWARD OUTPUT"
                ;;
            *)
                echo "invalid table '$table'"
                return 1
                ;;
        esac

        for chain in $chains; do
            if ! iptables_rule_check $table $chain -p tcp --dport 6666 --sport 6666; then
                return 1
            fi
            if ! iptables_rule_check $table $chain -p udp --dport 6666 --sport 6666; then
                return 1
            fi
        done
    done

    return 0
}

