#!/usr/bin/env bash
set -Eeuo pipefail

RULE_FILE="/etc/sysconfig/iptables"
BACKUP="${RULE_FILE}.bak.icmp-ts.$(date +%Y%m%d%H%M%S)"
TEMP="${RULE_FILE}.new"

if [[ ${EUID} -ne 0 ]]; then
    echo "ERROR: run as root" >&2
    exit 1
fi

if [[ ! -f "$RULE_FILE" ]]; then
    echo "ERROR: $RULE_FILE not found" >&2
    exit 1
fi

cp -a "$RULE_FILE" "$BACKUP"

rollback() {
    rm -f "$TEMP"
    cp -a "$BACKUP" "$RULE_FILE"
    iptables-restore < "$RULE_FILE"
}
trap rollback ERR

iptables -C INPUT -p icmp --icmp-type timestamp-request -j DROP 2>/dev/null || \
    iptables -I INPUT 1 -p icmp --icmp-type timestamp-request -j DROP

iptables-save > "$TEMP"
iptables-restore --test < "$TEMP"
install -o root -g root -m 0600 "$TEMP" "$RULE_FILE"
rm -f "$TEMP"
systemctl enable iptables >/dev/null

iptables -C INPUT -p icmp --icmp-type timestamp-request -j DROP
grep -Eq -- '--icmp-type (13|timestamp-request).* -j DROP' "$RULE_FILE"
ping -c 1 -W 2 127.0.0.1 >/dev/null

trap - ERR
echo "ICMP_TIMESTAMP_FIX=PASS"
echo "BACKUP=$BACKUP"