#!/bin/bash
# Keeps the address set of the time servers up to date, in one atomic
# nftables transaction. NTP pools answer with different addresses at each
# query, so the addresses chrony actually picked are added to those resolved
# here. Web traffic does not need addresses: the local proxy connects by name.

CONF=/etc/contest-firewall
TMP=$(mktemp)
mkdir -p /run/contest-firewall

# One run at a time (the timer and a manual run can overlap)
exec 9> /run/contest-firewall/lock
flock 9

entries() {
    sed -e 's/#.*//' -e 's/[[:space:]]//g' "$1" | grep -v '^$'
}

ntp_addresses() {
    {
        for name in $(entries "$CONF/ntp_servers.txt"); do
            dig +short A "$name"
        done
        chronyc -n sources 2>/dev/null | awk '/^\^/ {print $2}'
    } | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | sort -u
}

{
    echo "flush set inet filter ntp_ips"
    for ip in $(ntp_addresses); do
        echo "add element inet filter ntp_ips { $ip }"
    done
} > "$TMP"

# Apply atomically, then keep a copy of the active ruleset
nft -f "$TMP"
rm -f "$TMP"
nft list ruleset > /etc/nftables.rules