#!/bin/bash
# 95dot1x-macsec: authenticate the port with 802.1X EAP-TLS (TPM-held key,
# client cert in TPM NV) and bring up MACsec before netroot is mounted.
# The supplicant is launched as a systemd "root storage daemon"
# (argv[0] = @wpa_supplicant) so it survives switch-root and keeps the
# MKA session — and therefore the link carrying the root fs — alive.

check() {
    require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
    return 0
}

depends() {
    echo "network-legacy bash"
    return 0
}

installkernel() {
    instmods macsec
    # tpm_crb/tpm_tis are usually built in; assert anyway
    instmods tpm_crb tpm_tis
}

install() {
    # wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
    # RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
    # present by default, so list everything the hook uses.
    # nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
    # distro's dracut nvmf module populates discovery.conf but never registers
    # an initqueue/online autoconnect hook). The nvmf module installs nvme too,
    # but list it here so the hook's dependency is explicit and load-order-safe.
    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
        grep sed cut tr sha256sum sleep mkdir nvme

    # TSS libraries that tpm2_nvread dlopens
    inst_libdir_file "libtss2-*"

    # Fleet-generic supplicant config + RADIUS CA
    inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
    inst_simple /etc/dot1x/radius-ca.pem             /etc/dot1x/radius-ca.pem

    # Hook: runs from the initqueue once the NIC exists, before netroot
    inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"

    # Test-mode (rd.dot1x=0) NVMe-oF connect, driven event-wise on link-up.
    # This distro's nvmf module registers no autoconnect, and a main-initqueue
    # job isn't re-run once the loop waits on events — so connect here instead.
    inst_hook initqueue/online 90 "$moddir/nvmf-connect.sh"

    dracut_need_initqueue
}