#!/bin/bash
# Live mask for everything printed on screen (sed, line buffered).
# - IPv4/IPv6 addresses become x.x.x.x / x:x::x, except the Mullvad server
#   addresses listed in keep_protect.sed (see gen_keep.py).
# - DNS names that are not one of the test sites become [other app].
# - Local network broadcasts (mDNS, LLMNR, SSDP, NetBIOS) lose their content.
# - A "Visible location" that is not a Mullvad server location is hidden.
# - WireGuard public keys are hidden.
# - DNS query lines are shortened (microseconds, query id, size) to fit the screen.
L="$(dirname "$0")"
exec sed -l -E \
  -f "$L/keep_protect.sed" \
  -e 's/(^|[^0-9.])127\.([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})/\1LOOPBACK\2/g' \
  -e 's/([0-9]{1,3}\.){3}[0-9]{1,3}/x.x.x.x/g' \
  -e 's/[0-9a-fA-F]{0,4}(:[0-9a-fA-F]{0,4})*::[0-9a-fA-F:]*/x:x::x/g' \
  -e 's/[0-9a-fA-F]{1,4}(:[0-9a-fA-F]{1,4}){7}/x:x::x/g' \
  -f "$L/keep_restore.sed" \
  -e 's/LOOPBACK/127./g' \
  -e 's/^([0-9]{2}:[0-9]{2}:[0-9]{2})\.[0-9]+ IP6? /\1 /' \
  -e 's/: [0-9]+\+? (\[[0-9a-z]+\] )?([A-Za-z0-9]+\? [^ ]+) \([0-9]+\)$/: \2/' \
  -e '/[A-Za-z0-9]\? /{/\? (www\.)?(debian\.org|kernel\.org|torproject\.org)\.? /!{/\? (www\.)?(debian\.org|kernel\.org|torproject\.org)\.?$/!s/([A-Za-z0-9]+)\? [^ ]+/\1? [other app]/g;};}' \
  -e '/\.(5353|5355|1900|137|138)[: ]/s/(\.(5353|5355|1900|137|138): ).*/\1[local broadcast, hidden]/' \
  -e '/Visible location/{/(Bulgaria|Sweden)/!s/(Visible location: *).*/\1[hidden]/;}' \
  -e 's/[A-Za-z0-9+\/]{43}=/[key hidden]/g'
