#!/bin/sh
set -eu

setup_config() {
    cat > /etc/ferm/ferm.conf <<'EOF'
table filter {
    chain INPUT {
        policy ACCEPT;
        mod state state INVALID DROP;
    }
}
EOF
}

check_present() {
    if iptables-legacy-save 2>/dev/null | grep -q "state INVALID"; then
        return 0
    fi

    if nft list ruleset 2>/dev/null | grep -qi "invalid"; then
        return 0
    fi

    echo "ERROR: firewall rule not present"
    systemctl status ferm.service --no-pager || true
    iptables-legacy-save
    exit 1
}

check_absent() {
    if iptables-legacy-save 2>/dev/null | grep -q "state INVALID"; then
        echo "ERROR: firewall rule still present (iptables-legacy)"
        exit 1
    fi

    if nft list ruleset 2>/dev/null | grep -qi "invalid"; then
        echo "ERROR: firewall rule still present (nft)"
        exit 1
    fi
}
