#!/bin/ash
set -eu

echo "Apply runtime canary: VM100 eth2/10.200.0.1 -> VM101 eth1 -> mark 0x203 -> vpn3"

nft list table inet router_egress_canary >/dev/null 2>&1 || nft add table inet router_egress_canary
nft list chain inet router_egress_canary prerouting >/dev/null 2>&1 || \
  nft 'add chain inet router_egress_canary prerouting { type filter hook prerouting priority mangle; policy accept; }'

if nft list chain inet router_egress_canary prerouting 2>/dev/null | grep -q 'STEP_033D_VM100_ETH2_TO_VPN3'; then
  echo "canary rule already present"
else
  nft add rule inet router_egress_canary prerouting \
    iifname "eth1" ip saddr 10.200.0.1 \
    meta mark set 0x203 counter \
    comment \"STEP_033D_VM100_ETH2_TO_VPN3\"
  echo "canary rule added"
fi

nft list table inet router_egress_canary
ip rule
ip route get 1.1.1.1 from 10.200.0.1 iif eth1 mark 0x203 2>&1 || true