#!/bin/bash
# ==============================================================================
# 07-route-appvms.sh
#
# Configure IPv6 forwarding and firewall rules in sys-fips so AppVMs routed
# through sys-fips can reach FIPS fd00::/8 addresses via fips0.
#
# Usage:
#   sudo bash 07-route-appvms.sh
# ==============================================================================
set -euo pipefail

echo "=== sys-fips AppVM Routing Configuration ==="
echo ""

if [ "$(id -u)" -ne 0 ]; then
    echo "✗ This script must be run as root (sudo)"
    exit 1
fi

ensure_nft_rule() {
    local table="$1"
    local chain="$2"
    local rule="$3"

    if ! nft list chain "$table" "$chain" >/dev/null 2>&1; then
        echo "  WARN: nft chain $table $chain not found; skipping: $rule"
        return 0
    fi

    if nft list chain "$table" "$chain" | grep -F -- "$rule" >/dev/null 2>&1; then
        return 0
    fi

    nft add rule "$table" "$chain" $rule
}

sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
sysctl -w net.ipv6.conf.all.proxy_ndp=1 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
echo "  IPv6 forwarding enabled"

if ! ip link show fips0 >/dev/null 2>&1; then
    echo "  WARNING: fips0 not found (start fips first)"
fi

ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true
echo "  route: fd00::/8 -> fips0"

# Prefer nftables (Qubes-native firewall stack)
echo "  ensuring nftables forward rules"
ensure_nft_rule ip6 qubes-firewall forward 'iifname "vif*" ip6 daddr fd00::/8 accept'
ensure_nft_rule ip6 qubes-firewall forward 'iifname "fips0" ip6 saddr fd00::/8 accept'

# Keep ip6tables fallback for templates where FORWARD policy still depends on it.
if command -v ip6tables >/dev/null 2>&1; then
    ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
        ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
    ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || \
        ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
    ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || \
        ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
    echo "  ip6tables forwarding fallback ensured"
fi

RCLOCAL="/rw/config/rc.local"
MARK_START="# === SYS-FIPS ROUTING START ==="
MARK_END="# === SYS-FIPS ROUTING END ==="

if [ ! -f "$RCLOCAL" ]; then
    mkdir -p /rw/config
    cat > "$RCLOCAL" << 'EOF'
#!/bin/sh
EOF
fi

sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"

cat >> "$RCLOCAL" << 'EOF'
# === SYS-FIPS ROUTING START ===
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1
ip -6 route replace fd00::/8 dev fips0 >/dev/null 2>&1 || true

# nftables forward allow rules for AppVM <-> fips0 traffic
nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
  nft list chain ip6 qubes-firewall forward | grep -F 'iifname "vif*" ip6 daddr fd00::/8 accept' >/dev/null 2>&1 || \
  nft add rule ip6 qubes-firewall forward iifname "vif*" ip6 daddr fd00::/8 accept >/dev/null 2>&1 || true

nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
  nft list chain ip6 qubes-firewall forward | grep -F 'iifname "fips0" ip6 saddr fd00::/8 accept' >/dev/null 2>&1 || \
  nft add rule ip6 qubes-firewall forward iifname "fips0" ip6 saddr fd00::/8 accept >/dev/null 2>&1 || true

# ip6tables fallback
if command -v ip6tables >/dev/null 2>&1; then
  ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
  ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
  ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
fi
# === SYS-FIPS ROUTING END ===
EOF

chmod +x "$RCLOCAL"

echo ""
echo "Current fd00 routes:"
ip -6 route show | grep fd00 || true

echo ""
echo "✓ AppVM routing configured"
echo ""
echo "In dom0, point an AppVM at sys-fips:"
echo "  qvm-prefs <appvm-name> netvm sys-fips"