#!/bin/bash
# ============================================================
#  Adobe telemetry/privacy domain block script (macOS)
#  Blocks ONLY data-reporting domains. Does NOT touch
#  activation/licensing/verification servers.
#
#  Usage:
#    sudo ./adobe_telemetry_block.sh              = add blocks
#    sudo ./adobe_telemetry_block.sh --uninstall  = remove blocks
# ============================================================

set -euo pipefail

HOSTS="/etc/hosts"
TAG="# adobe-tel"

# -----------------------------------------------------------
# Data-collection / telemetry / analytics domains to block
# -----------------------------------------------------------
# [Tel] hlrcv.*        = phone-home / telemetry
# [Ana] omtrdc/smetrics = Adobe Analytics / usage tracking
# [CR]  crs/crashrep   = crash reporter / error logging
# [AM]  demdex         = Audience Manager / Experience Cloud ID
# [Geo] geo2/stats     = geo-location / usage stats
# [Sur] survey         = in-app surveys / feedback
# [DTM] adobedtm       = Dynamic Tag Management assets
#
# NOT blocked - activation & licensing:
#   activate* / practivate / lm.licenses / ereg* / wip3 /
#   prod.adobegenuine / crl / ocsp / ts1 / ts2 / lcs-* / ims-prod*
# -----------------------------------------------------------
DOMAINS=(
    "metrics.adobe.com"
    "stats.adobe.com"
    "sstats.adobe.com"
    "sc.omtrdc.net"
    "adobe.tt.omtrdc.net"
    "dpm.demdex.net"
    "demdex.net"
    "assets.adobedtm.com"
    "adobedtm.com"
    "cc-api-data.adobe.io"
    "hlrcv.stage6.adobe.com"
    "hl2rcv.stage6.adobe.com"
    "hlrcv.stage.adobe.com"
    "hl2rcv.stage.adobe.com"
    "gs-els.adobe.com"
    "crs.cr.adobe.com"
    "crashreporter.adobe.com"
    "survey.adobe.com"
    "lm.licenses.adobe.com"
    "activate.adobe.com"
    "activate-sea.adobe.com"
    "activate-sjc0.adobe.com"
    "practivate.adobe.com"
    "ereg.adobe.com"
    "ereg.wip3.adobe.com"
    "adobeereg.com"
    "wip3.adobe.com"
    "prod.adobegenuine.com"
    "data.adobegc.com"
    "ts1.adobe.com"
    "ts2.adobe.com"
    "lcs-cops.adobe.io"
    "3dns-2.adobe.com"
    "3dns-3.adobe.com"
    "adobe-dns-2.adobe.com"
    "adobe-dns-3.adobe.com"
    "adobe-dns.adobe.com"
    "crl.verisign.net"
    "ocsp.verisign.net"
    "crl.adobe.com"
    "adobeid-na1.services.adobe.com"
    "na1r.services.adobe.com"
    "butler.adobe.com"
    "cchome.adobe.io"
    "ic.adobe.io"
    "geo2.adobe.com"
)

# -----------------------------------------------------------
# Check for root privileges
# -----------------------------------------------------------
if [[ $EUID -ne 0 ]]; then
    echo "This script requires root privileges."
    echo "Please run: sudo $0 $*"
    exit 1
fi

# -----------------------------------------------------------
# Flush DNS cache
# -----------------------------------------------------------
flush_dns() {
    echo "Flushing DNS cache..."
    dscacheutil -flushcache 2>/dev/null || true
    killall -HUP mDNSResponder 2>/dev/null || true
    echo "DNS cache flushed."
}

# -----------------------------------------------------------
# Backup hosts file
# -----------------------------------------------------------
backup_hosts() {
    local ts
    ts=$(date +%Y%m%d_%H%M%S)
    local bak="${HOSTS}.bak_${ts}"
    cp "$HOSTS" "$bak"
    echo "Backup: $bak"
}

# -----------------------------------------------------------
# UNINSTALL mode
# -----------------------------------------------------------
if [[ "${1:-}" == "--uninstall" ]]; then
    echo "============================================"
    echo "  Removing entries added by this script"
    echo "============================================"
    echo

    backup_hosts

    # Remove all lines tagged with TAG
    sed -i '' "/${TAG}/d" "$HOSTS"

    echo "Removed all entries tagged: ${TAG}"

    flush_dns
    echo
    echo "Done."
    exit 0
fi

# -----------------------------------------------------------
# INSTALL mode (default)
# -----------------------------------------------------------
echo "============================================"
echo "  Adobe telemetry domain block (macOS)"
echo "============================================"
echo "Target: ${HOSTS}"
echo

backup_hosts

# Ensure hosts file ends with a newline
echo "" >> "$HOSTS"

COUNT=0
SKIP=0

# Check whether a domain already exists as a complete hosts entry.
# Match whole whitespace-separated fields, not substrings: the line
# "127.0.0.1 smetrics.adobe.com" contains the substring "metrics.adobe.com",
# so a naive `grep -F metrics.adobe.com` would wrongly report it as present.
domain_exists() {
    awk -v d="$1" '{for (i=2;i<=NF;i++) if ($i==d) found=1} END{exit !found}' "$HOSTS"
}

for domain in "${DOMAINS[@]}"; do
    if domain_exists "$domain"; then
        SKIP=$((SKIP + 1))
        echo "[.] ${domain} already present, skipped"
    else
        echo "127.0.0.1 ${domain} ${TAG}" >> "$HOSTS"
        COUNT=$((COUNT + 1))
        echo "[+] 127.0.0.1 ${domain}"
    fi
done

echo
echo "============================================"
echo "  Done: added ${COUNT}, skipped ${SKIP}"
echo "============================================"

flush_dns

echo
echo "To restore, run: sudo $0 --uninstall"
exit 0