#!/bin/bash
# Quick check of the contest firewall, to run on a contest machine once the
# firewall is active: allowed sites must answer, every other site must fail,
# also when a program forces the address of the contest site for another name.
CONTEST_URL=${CONTEST_URL:-https://atlantic-canada26.kattis.com}
CONTEST_HOST=${CONTEST_URL#https://}
CONTEST_HOST=${CONTEST_HOST%%/*}
fail=0

report() {
    if [ "$2" = "$3" ]; then
        echo "OK      $1 is $2"
    else
        echo "PROBLEM $1 is $2 (expected: $3)"
        fail=1
    fi
}

check() {
    expected=$1
    url=$2
    if curl -s -o /dev/null --max-time 8 "$url"; then result=reachable; else result=blocked; fi
    report "$url" $result "$expected"
}

# Another site reached through the address of the contest site (Cloudflare)
check_through_contest() {
    host=$1
    if curl -s -o /dev/null --max-time 8 --resolve "$host:443:$contest_ip" "https://$host/"; then
        result=reachable
    else
        result=blocked
    fi
    report "https://$host/ through the address of $CONTEST_HOST" $result blocked
}

check reachable "$CONTEST_URL"
check reachable https://status.kattis.com
check reachable https://devdocs/
check blocked https://open.kattis.com
check blocked https://www.google.com
check blocked https://github.com
check blocked https://chatgpt.com

contest_ip=$(getent ahostsv4 "$CONTEST_HOST" | awk 'NR == 1 {print $1}')
if [ -n "$contest_ip" ]; then
    check_through_contest open.kattis.com
    check_through_contest pastebin.com
    check_through_contest discord.com
else
    echo "PROBLEM $CONTEST_HOST does not resolve"
    fail=1
fi

# DNS: only the allowed names get an answer, and the DNS resolvers outside
# cannot be reached directly (no data exchanged through DNS)
if [ -n "$(dig +short +time=3 +tries=1 TXT example.com 2>/dev/null)" ]; then result=reachable; else result=blocked; fi
report "DNS for other names (TXT example.com)" $result blocked
if dig +time=3 +tries=1 example.com @1.1.1.1 >/dev/null 2>&1; then result=reachable; else result=blocked; fi
report "the DNS resolver 1.1.1.1 directly" $result blocked

echo
for unit in contest-proxy contest-dns; do
    if systemctl is-active --quiet $unit.service; then
        echo "OK      $unit is running"
    else
        echo "PROBLEM $unit.service is not running"
        fail=1
    fi
done
if chronyc -n sources 2>/dev/null | grep -qE '^\^\*'; then
    echo "OK      the clock is synchronized (NTP)"
else
    echo "PROBLEM the clock is not synchronized yet (check again in a minute)"
    fail=1
fi
exit $fail