#!/bin/bash
cd /data/bbr/kernel-build/linux-7.1.8
kc() { scripts/config "$@"; }

# Joey base policy
kc --disable SYSTEM_TRUSTED_KEYS --disable SYSTEM_REVOCATION_KEYS
kc --enable TCP_CONG_BBR --disable DEFAULT_CUBIC --enable DEFAULT_BBR --set-str DEFAULT_TCP_CONG bbr
kc --enable NET_SCH_DEFAULT --enable NET_SCH_FQ
kc --module NET_SCH_FQ_CODEL --module NET_SCH_PIE --module NET_SCH_FQ_PIE --module NET_SCH_CAKE
kc --disable DEFAULT_FQ_CODEL --disable DEFAULT_PFIFO_FAST --enable DEFAULT_FQ --set-str DEFAULT_NET_SCH fq
kc --module NETFILTER_XTABLES --enable NETFILTER_XTABLES_LEGACY
kc --module IP_NF_IPTABLES_LEGACY --module IP_NF_FILTER --module IP_NF_NAT --module IP_NF_TARGET_MASQUERADE
kc --module IP_NF_MANGLE --module IP_NF_RAW
kc --module IP6_NF_IPTABLES_LEGACY --module IP6_NF_FILTER --module IP6_NF_NAT --module IP6_NF_MANGLE --module IP6_NF_RAW
kc --disable DEBUG_INFO --enable DEBUG_INFO_NONE
kc --disable DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT --disable DEBUG_INFO_DWARF4 --disable DEBUG_INFO_DWARF5
kc --disable DEBUG_INFO_REDUCED --disable DEBUG_INFO_COMPRESSED --disable DEBUG_INFO_SPLIT
kc --disable DEBUG_INFO_BTF --disable DEBUG_INFO_BTF_MODULES --disable MODULE_ALLOW_BTF_MISMATCH
kc --disable AFS_FS --disable AF_RXRPC --disable RXKAD

# L2TP + VPN additions (re-enable ESP was disabled for Dirty Frag)
for m in XFRM_USER XFRM_ALGO XFRM_ESP INET_ESP INET6_ESP \
  INET_XFRM_MODE_TRANSPORT INET_XFRM_MODE_TUNNEL INET_XFRM_MODE_BEET \
  INET6_XFRM_MODE_TRANSPORT INET6_XFRM_MODE_TUNNEL INET6_XFRM_MODE_BEET \
  INET_AH INET6_AH NET_KEY NET_KEY_MIGRATE \
  L2TP L2TP_DEBUGFS L2TP_IP L2TP_ETH PPP PPP_ASYNC PPP_SYNC_TTY PPP_DEFLATE \
  PPP_BSDCOMP PPP_MPPE PPPOE PPTP PPPOL2TP PPPOLAC PPPOPNS PPP_MULTILINK \
  TUN TAP WIREGUARD \
  NET_IPGRE_DEMUX NET_IPGRE NET_IPGRE_BROADCAST NET_IPIP IPV6_TUNNEL IPV6_GRE \
  NET_FOU NET_FOU_IP_TUNNELS GENEVE VXLAN \
  CRYPTO_CBC CRYPTO_CTR CRYPTO_SHA256 CRYPTO_SHA512 CRYPTO_AES CRYPTO_DES \
  CRYPTO_HMAC CRYPTO_ARC4 CRYPTO_SHA1 CRYPTO_AEAD CRYPTO_GCM CRYPTO_AUTHENC \
  BRIDGE BRIDGE_NETFILTER VLAN_8021Q \
  NET_SCH_MULTIQ NET_SCH_HTB NET_SCH_HFSC \
  NF_CONNTRACK NF_CONNTRACK_FTP NF_CONNTRACK_SIP NF_CONNTRACK_PPTP NF_CONNTRACK_H323 \
  NF_NAT NF_NAT_FTP NF_NAT_SIP NF_NAT_PPTP NF_NAT_H323 IP_NF_TARGET_REDIRECT \
  NETFILTER_XT_MATCH_CONNTRACK NETFILTER_XT_MATCH_STATE NETFILTER_XT_MATCH_MULTIPORT \
  NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_TARGET_TCPMSS NETFILTER_XT_MATCH_OWNER; do
    kc --module "$m" 2>/dev/null || true
done
kc --enable L2TP_V3
kc --enable WIREGUARD_DEBUG

make olddefconfig 2>/dev/null
# Re-apply critical items
kc --enable TCP_CONG_BBR --enable DEFAULT_BBR --enable DEFAULT_FQ --enable NET_SCH_FQ
kc --disable DEBUG_INFO --enable DEBUG_INFO_NONE --disable DEBUG_INFO_BTF
kc --module L2TP --module PPPOL2TP --module PPTP --module PPPOE --module PPP_MPPE
kc --module WIREGUARD --module TUN --module XFRM_ESP --module INET_ESP --module INET6_ESP --module NET_KEY
kc --enable L2TP_V3 --module L2TP_IP --module L2TP_ETH
make olddefconfig 2>/dev/null

echo "Config complete"
grep -q 'CONFIG_L2TP=m' .config && grep -q 'CONFIG_TCP_CONG_BBR=y' .config && echo "CONFIG VALID"