#!/usr/bin/env bash
# tpm-selftest.sh — non-destructive check that a workstation's TPM can do
# everything the secure path needs, BEFORE turning on disable_dot1x=false.
#
# Run as root on a booted workstation (the open-port test image is fine — it
# ships the same tooling). Uses SCRATCH handle/NV and cleans them up, so it never
# touches the real 0x81010001 / 0x01800001. Pass --use-real-handles to exercise
# the actual locations instead (still cleaned up unless --keep).
#
# It validates, in order:
#   1. TPM present + tpm2-tools work
#   2. persistent key create + evict (needed to put the EAP-TLS key at the handle)
#   3. NV define/write/read roundtrip (the cert store the boot hook reads)
#   4. an OpenSSL TPM2 provider/engine exists  <-- the usual missing piece
#   5. a CSR + signature USING the TPM key (proves EAP-TLS client auth can work)
#   6. wpa_supplicant build info (macsec driver present?)
set -u

USE_REAL=0; KEEP=0
for a in "$@"; do case "$a" in
  --use-real-handles) USE_REAL=1 ;;
  --keep) KEEP=1 ;;
  *) echo "usage: tpm-selftest.sh [--use-real-handles] [--keep]" >&2; exit 2 ;;
esac; done

export TPM2TOOLS_TCTI="${TPM2TOOLS_TCTI:-device:/dev/tpmrm0}"
if [ "$USE_REAL" = 1 ]; then HANDLE=0x81010001; NV=0x01800001
else HANDLE=0x81008000; NV=0x01500000; fi

WORK=$(mktemp -d); PASS=0; FAIL=0; SKIP=0
ok()   { printf '  \033[32mPASS\033[0m %s\n' "$1"; PASS=$((PASS+1)); }
no()   { printf '  \033[31mFAIL\033[0m %s\n' "$1"; FAIL=$((FAIL+1)); }
skip() { printf '  \033[33mSKIP\033[0m %s\n' "$1"; SKIP=$((SKIP+1)); }

# shellcheck disable=SC2329  # invoked indirectly via trap
cleanup() {
  [ "$KEEP" = 1 ] && { echo "(--keep: leaving $HANDLE / $NV / $WORK in place)"; return; }
  tpm2_evictcontrol -C o -c "$HANDLE" >/dev/null 2>&1 || true
  tpm2_nvundefine "$NV" -C o >/dev/null 2>&1 || true
  rm -rf "$WORK"
}
trap cleanup EXIT

echo "== TPM self-test (handle=$HANDLE nv=$NV) =="

# --- 1. TPM present ---------------------------------------------------------
if [ -c /dev/tpmrm0 ] || [ -c /dev/tpm0 ]; then ok "TPM device present"; else
  no "no /dev/tpmrm0 or /dev/tpm0 — VM needs a vTPM (qm set <id> --tpmstate0 <stor>:1,version=v2.0)"
  echo; echo "Cannot continue without a TPM."; exit 1
fi
if command -v tpm2_getcap >/dev/null && tpm2_getcap properties-fixed >/dev/null 2>&1; then
  ok "tpm2-tools talk to the TPM"
else
  no "tpm2-tools / TPM access failed"; exit 1
fi

# pre-clean the scratch locations in case a previous run aborted
tpm2_evictcontrol -C o -c "$HANDLE" >/dev/null 2>&1 || true
tpm2_nvundefine "$NV" -C o >/dev/null 2>&1 || true

# --- 2. persistent signing key ----------------------------------------------
if tpm2_createprimary -C o -G ecc -g sha256 -c "$WORK/prim.ctx" >/dev/null 2>&1 \
   && tpm2_create -C "$WORK/prim.ctx" -G ecc256:ecdsa-sha256 -u "$WORK/k.pub" -r "$WORK/k.priv" >/dev/null 2>&1 \
   && tpm2_load -C "$WORK/prim.ctx" -u "$WORK/k.pub" -r "$WORK/k.priv" -c "$WORK/k.ctx" >/dev/null 2>&1 \
   && tpm2_evictcontrol -C o -c "$WORK/k.ctx" "$HANDLE" >/dev/null 2>&1 \
   && tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
  ok "created + persisted an ECC signing key at $HANDLE"
else
  no "could not create/persist a key at $HANDLE"
fi

# --- 3. NV roundtrip (the cert store the boot hook reads) -------------------
echo "fleet-tpm-selftest-$(date +%s 2>/dev/null || echo x)" > "$WORK/blob"
SZ=$(stat -c%s "$WORK/blob")
if tpm2_nvdefine "$NV" -C o -s "$SZ" -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null 2>&1 \
   && tpm2_nvwrite "$NV" -C o -i "$WORK/blob" >/dev/null 2>&1 \
   && tpm2_nvread "$NV" -C o -o "$WORK/blob.out" >/dev/null 2>&1 \
   && cmp -s "$WORK/blob" "$WORK/blob.out"; then
  ok "NV define/write/read roundtrip at $NV (matches what the boot hook does)"
else
  no "NV roundtrip at $NV failed"
fi

# --- 4. OpenSSL TPM2 provider / engine --------------------------------------
TPM_OSSL=""
if openssl list -providers 2>/dev/null | grep -qi tpm2; then
  TPM_OSSL=provider; ok "OpenSSL TPM2 PROVIDER present (tpm2-openssl)"
elif openssl engine -t tpm2tss 2>/dev/null | grep -qi available; then
  TPM_OSSL=engine; ok "OpenSSL TPM2 ENGINE present (tpm2-tss-engine)"
else
  no "no OpenSSL TPM2 provider OR engine — install 'tpm2-openssl' (provider) in the image"
  echo "       (this is the likely gap: tpm2-tss alone does NOT give openssl TPM access)"
fi

# --- 5. CSR + signature USING the TPM key (the EAP-TLS make-or-break) --------
if [ -n "$TPM_OSSL" ]; then
  CSR_OK=1
  if [ "$TPM_OSSL" = provider ]; then
    openssl req -new -provider tpm2 -provider default -key "handle:$HANDLE" \
      -subj "/O=fleet/CN=tpm-selftest" -out "$WORK/test.csr" >/dev/null 2>&1 || CSR_OK=0
  else
    openssl req -new -engine tpm2tss -keyform engine -key "$HANDLE" \
      -subj "/O=fleet/CN=tpm-selftest" -out "$WORK/test.csr" >/dev/null 2>&1 || CSR_OK=0
  fi
  if [ "$CSR_OK" = 1 ] && openssl req -in "$WORK/test.csr" -verify -noout >/dev/null 2>&1; then
    ok "built + self-verified a CSR signed BY the TPM key ($TPM_OSSL) — EAP-TLS can use it"
  else
    no "openssl could not sign a CSR with the TPM key via the $TPM_OSSL"
    echo "       -> the key reference method in wpa_supplicant-dot1x.conf needs adjusting"
  fi
else
  skip "CSR/sign test (no openssl TPM integration to test with)"
fi

# --- 6. wpa_supplicant build info -------------------------------------------
if command -v wpa_supplicant >/dev/null; then
  V=$(wpa_supplicant -v 2>&1 | head -1)
  ok "wpa_supplicant present: $V"
  echo "       NOTE: confirm it was built with macsec_linux + the matching TPM key"
  echo "       backend; full EAP-TLS/MKA can only be proven against the authenticator."
else
  no "wpa_supplicant not found"
fi

echo
echo "== summary: $PASS pass, $FAIL fail, $SKIP skip =="
[ "$FAIL" = 0 ] && echo "TPM half looks ready — proceed to the authenticator/RADIUS bench." \
                || echo "Fix the FAILs above before enabling disable_dot1x=false."
exit "$FAIL"