#!/bin/bash
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
#
# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
# which generates the key/CSR, talks to the broker, shows the Plymouth
# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS.
# It is a no-op when a cert is already present (normal boot — dot1x-macsec-up.sh
# reads NV) or when disabled via rd.fleet.enrol=0.
#
# The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
# owns only the boot-environment concerns: the empty-NV gate, networking, and the
# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so this
# never reorders the load-bearing boot sequence (invariant #2).
#
# TEST-MODE ENROLMENT (rd.dot1x=0): enrolment ALSO runs on the open/test path so
# the flow can be exercised on a host with a TPM + a reachable broker WITHOUT
# standing up 802.1X/MACsec/RADIUS. In test mode `ip=dhcp` already owns the NIC,
# so this hook must NOT re-DHCP it (that races dracut → "address already
# assigned"); it just uses the existing lease. Production still gates real
# enrolment to the secure path; use rd.fleet.enrol=0 to disable it in either mode.

type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh

STAMP=/run/dot1x/.enrol-done
[ -e "$STAMP" ] && exit 0
mkdir -p /run/dot1x
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"

# --- skip conditions --------------------------------------------------------
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
    info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
fi
# Test mode (rd.dot1x=0): enrolment still runs, but ip=dhcp owns the NIC, so we
# must not reconfigure it below.
TESTMODE=0
[ "$(getarg rd.dot1x=)" = "0" ] && TESTMODE=1

# --- knobs (override on the kernel cmdline) ---------------------------------
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60

# Wait briefly for the TPM resource-manager device so an early settle (before the
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
i=0
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
[ -e /dev/tpmrm0 ] || { warn "tpm-enrol: no TPM (/dev/tpmrm0) — leaving to the secure path"; exit 0; }

# --- already enrolled? then this is a normal boot — do NOT touch the network -
# (Bringing up en* here would fight the secure path, which needs it UNMANAGED for
# wpa_supplicant. So gate on NV BEFORE any network action.)
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
   && [ -s /run/dot1x/nvprobe.der ]; then
    info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
    rm -f /run/dot1x/nvprobe.der
    exit 0
fi

# Committed to enrolling — one attempt per boot.
: > "$STAMP"
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"

# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
NIC=$(getarg rd.dot1x.if=)
if [ -z "$NIC" ]; then
    for _dev in /sys/class/net/*; do
        _name=${_dev##*/}
        case "$_name" in lo|macsec*) continue ;; esac
        NIC=$_name; break
    done
fi
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }

# --- network on the PHYSICAL NIC --------------------------------------------
if [ "$TESTMODE" = "1" ]; then
    # Test mode: ip=dhcp already brought the NIC up + wrote resolv.conf. Do NOT
    # reconfigure it (a second config races dracut → "address already assigned").
    info "tpm-enrol: test mode (rd.dot1x=0) — using the ip=dhcp NIC as-is"
    ip link set "$NIC" up 2>/dev/null || true
else
    # Secure mode: nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own
    # it), but there is no supplicant yet — so explicitly hand the NIC to NM for a
    # plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
    # The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
    ip link set "$NIC" up 2>/dev/null || true
    nmcli device set "$NIC" managed yes 2>/dev/null || true
    nmcli -w 0 device connect "$NIC" 2>/dev/null || true
fi
i=0
while [ "$i" -lt "$NETTMO" ]; do
    ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
    sleep 1; i=$((i + 1))
done
if [ "$i" -ge "$NETTMO" ]; then
    warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
    plymouth message --text="TPM enrolment FAILED (no network)" 2>/dev/null || true
    exit 1
fi
info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)"

# --- hand off to the enrolment binary ---------------------------------------
# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX"
rc=$?
case "$rc" in
    0)
        info "tpm-enrol: enrolled — rebooting into the secure path"
        sleep 2
        systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
            { echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
        exit 0 ;;
    10)
        info "tpm-enrol: fleet-enrol reports cert already present — normal boot"
        exit 0 ;;
    *)
        warn "tpm-enrol: fleet-enrol failed (rc=$rc) — reboot to retry"
        exit 1 ;;
esac