#!/usr/bin/env bash
set -Eeuo pipefail

if [[ ${EUID} -ne 0 ]]; then
    echo "ERROR: run as root" >&2
    exit 1
fi

if [[ $# -ne 1 || ! -f "$1" ]]; then
    echo "Usage: $0 /etc/sysconfig/iptables.bak.icmp-ts.YYYYmmddHHMMSS" >&2
    exit 1
fi

BACKUP="$1"
RULE_FILE="/etc/sysconfig/iptables"
TEMP="${RULE_FILE}.rollback"

cp -a "$BACKUP" "$TEMP"
iptables-restore --test < "$TEMP"
install -o root -g root -m 0600 "$TEMP" "$RULE_FILE"
rm -f "$TEMP"
iptables-restore < "$RULE_FILE"

echo "ICMP timestamp hardening rolled back from $BACKUP"