#!/bin/sh
set -eu

iptables -t nat -N CREDENTIAL_PROXY 2>/dev/null || true
iptables -t nat -F CREDENTIAL_PROXY

# The MITM proxy uses uid 1337. Excluding that uid prevents its new upstream
# TLS connection from being redirected back into itself.
iptables -t nat -A CREDENTIAL_PROXY -p tcp -m owner --uid-owner 1337 -j RETURN
iptables -t nat -A CREDENTIAL_PROXY -p tcp -j REDIRECT --to-ports 15001

iptables -t nat -C OUTPUT -p tcp --dport 443 -j CREDENTIAL_PROXY 2>/dev/null \
  || iptables -t nat -A OUTPUT -p tcp --dport 443 -j CREDENTIAL_PROXY

echo "installed transparent HTTPS redirect: tcp/443 -> 127.0.0.1:15001"
iptables -t nat -S OUTPUT
iptables -t nat -S CREDENTIAL_PROXY

exec tail -f /dev/null