#!/bin/bash
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
#
# INLINE empty-NV enrolment (docs/tpm-enrolment-design.md, "inline single-UKI").
# The production UKI auto-detects a host with NO client cert in TPM NV and, in
# that case ONLY, branches into first-time identity enrolment:
#   1. generate a signing key IN the TPM, persist at 0x81010001 (if absent)
#   2. build a CSR with that key via the openssl tpm2 provider (key never leaves)
#   3. pre-auth DHCP on the PHYSICAL NIC (plaintext L2 — same pre-auth permit the
#      firmware used to fetch the UKI; there is no macsec/identity yet)
#   4. POST CSR + device context to the enrolment broker; show the returned
#      fingerprint on the Plymouth splash for an admin to cross-check + approve
#   5. poll until APPROVED, write the issued cert (DER) to NV 0x01800001
#   6. REBOOT — the next boot finds the cert present and runs the normal secure
#      path (this hook exits 0 immediately when a cert is already present).
#
# Empty-NV and the normal secure path are MUTUALLY EXCLUSIVE (a host with no cert
# cannot do 802.1X→MACsec→NVMe at all), so this never interleaves with — or
# reorders — the load-bearing secure boot sequence (invariant #2). Enrolment is
# gated to the secure build (skipped under rd.dot1x=0) because the open/test path
# has no trustworthy device identity to enrol (design open-question).

type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh

# One enrol attempt per boot. The stamp is set only once we COMMIT to enrolling
# (NV confirmed empty) — not on entry — so the "cert present"/skip paths stay
# re-runnable across repeated settled invocations, matching dot1x-macsec-up.sh
# (which likewise stamps only on a terminal decision).
STAMP=/run/dot1x/.enrol-done
[ -e "$STAMP" ] && exit 0
mkdir -p /run/dot1x

export TPM2TOOLS_TCTI="device:/dev/tpmrm0"

ply()    { plymouth update --status="$1" 2>/dev/null || true; }
plymsg() { plymouth message --text="$1"  2>/dev/null || true; }

# --- skip conditions --------------------------------------------------------
# Test path: no real identity to enrol; leave the open-port boot untouched.
if [ "$(getarg rd.dot1x=)" = "0" ]; then
    exit 0
fi
# Explicit opt-out (e.g. a provisioning-UKI variant handling enrol elsewhere).
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
    info "tpm-enrol: disabled by rd.fleet.enrol=0"
    exit 0
fi

# --- knobs (override on the kernel cmdline) ---------------------------------
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
HANDLE=$(getarg rd.fleet.enrol.handle=); [ -n "$HANDLE" ] || HANDLE=0x81010001
CN=$(getarg rd.fleet.enrol.cn=); [ -n "$CN" ] || CN=fleet-host
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
# Human-approval wait. Generous but bounded: an abandoned enrol must not hang the
# box forever (it drops to emergency, where the missing cert is diagnosable).
WAITTMO=$(getarg rd.fleet.enrol.timeout=); [ -n "$WAITTMO" ] || WAITTMO=1800

# Wait briefly for the TPM resource-manager device so an early settle (before the
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
i=0
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
if [ ! -e /dev/tpmrm0 ]; then
    warn "tpm-enrol: /dev/tpmrm0 absent — no TPM; leaving to the secure path"
    exit 0
fi

# --- 0. already enrolled? then this is a normal boot — get out of the way ----
# A present, non-empty NV cert means identity exists; dot1x-macsec-up.sh (next
# hook) reads it and runs the secure path. Only an EMPTY/undefined NV enrols.
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
   && [ -s /run/dot1x/nvprobe.der ]; then
    info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
    rm -f /run/dot1x/nvprobe.der
    exit 0
fi

# Committed to enrolling — set the once-per-boot lock now.
: > "$STAMP"
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
ply enrol-active
plymsg "TPM enrolment: contacting fleet…"

# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
NIC=$(getarg rd.dot1x.if=)
if [ -z "$NIC" ]; then
    for _dev in /sys/class/net/*; do
        _name=${_dev##*/}
        case "$_name" in lo|macsec*) continue ;; esac
        NIC=$_name; break
    done
fi
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }

# --- 1. persistent TPM signing key (create only if absent) ------------------
if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
    info "tpm-enrol: creating TPM signing key, persisting at $HANDLE"
    if ! { tpm2_createprimary -C o -G ecc -g sha256 -c /run/dot1x/primary.ctx >/dev/null \
        && tpm2_create -C /run/dot1x/primary.ctx -G ecc256:ecdsa-sha256 \
             -u /run/dot1x/key.pub -r /run/dot1x/key.priv >/dev/null \
        && tpm2_load -C /run/dot1x/primary.ctx -u /run/dot1x/key.pub \
             -r /run/dot1x/key.priv -c /run/dot1x/key.ctx >/dev/null \
        && tpm2_evictcontrol -C o -c /run/dot1x/key.ctx "$HANDLE" >/dev/null; }; then
        warn "tpm-enrol: failed to create/persist TPM key at $HANDLE"
        plymsg "TPM enrolment FAILED (key generation)"; exit 1
    fi
else
    info "tpm-enrol: reusing existing persistent key at $HANDLE"
fi

# --- 2. CSR with the TPM key (private key never leaves the TPM) -------------
if ! openssl req -new -provider tpm2 -provider default \
        -key "handle:$HANDLE" -subj "/O=fleet/CN=$CN" \
        -out /run/dot1x/enrol.csr 2>/run/dot1x/enrol.err; then
    warn "tpm-enrol: CSR generation failed (openssl tpm2 provider?): $(cat /run/dot1x/enrol.err 2>/dev/null)"
    plymsg "TPM enrolment FAILED (CSR / tpm2 provider)"; exit 1
fi

# --- 3. pre-auth network on the PHYSICAL NIC --------------------------------
# Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
# but there is no supplicant yet — so explicitly hand the NIC to NM for a
# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
ip link set "$NIC" up 2>/dev/null || true
nmcli device set "$NIC" managed yes 2>/dev/null || true
nmcli -w 0 device connect "$NIC" 2>/dev/null || true
i=0
while [ "$i" -lt "$NETTMO" ]; do
    ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
    sleep 1; i=$((i + 1))
done
if [ "$i" -ge "$NETTMO" ]; then
    warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
    plymsg "TPM enrolment FAILED (no network)"; exit 1
fi
info "tpm-enrol: pre-auth lease on $NIC; reaching broker at $ENROL_URL"

# --- device context (advisory; helps the admin recognise the device) --------
MAC=$(cat "/sys/class/net/$NIC/address" 2>/dev/null)
DMI_UUID=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null)
DMI_SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null)
EK_HASH=""
if tpm2_createek -G ecc -u /run/dot1x/ek.pub -c /run/dot1x/ek.ctx >/dev/null 2>&1; then
    EK_HASH=$(sha256sum /run/dot1x/ek.pub 2>/dev/null | cut -d' ' -f1)
    tpm2_flushcontext /run/dot1x/ek.ctx >/dev/null 2>&1 || true
fi

# --- 4. POST the CSR + context ----------------------------------------------
# JSON body, no jq in the initramfs: escape the PEM (newlines -> \n, quotes) with
# awk and interpolate. curl uses the fleet CA for an https endpoint.
CSR_ESC=$(awk 'BEGIN{ORS=""}{gsub(/\\/,"\\\\");gsub(/"/,"\\\"");printf "%s\\n",$0}' /run/dot1x/enrol.csr)
printf '{"csr":"%s","context":{"mac":"%s","dmi_uuid":"%s","dmi_serial":"%s","ek_hash":"%s"}}' \
    "$CSR_ESC" "$MAC" "$DMI_UUID" "$DMI_SERIAL" "$EK_HASH" > /run/dot1x/enrol-req.json

CURL_TLS=()
case "$ENROL_URL" in https:*) CURL_TLS=(--cacert /etc/dot1x/radius-ca.pem) ;; esac

if ! curl -fsS "${CURL_TLS[@]}" -X POST "$ENROL_URL/request" \
        -H 'Content-Type: application/json' --data @/run/dot1x/enrol-req.json \
        -o /run/dot1x/enrol-resp.json 2>/run/dot1x/enrol.err; then
    warn "tpm-enrol: broker /request failed: $(cat /run/dot1x/enrol.err 2>/dev/null)"
    plymsg "TPM enrolment FAILED (broker unreachable)"; exit 1
fi
ENROL_ID=$(sed -n 's/.*"enrol_id":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
FP=$(sed -n 's/.*"fingerprint":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
if [ -z "$ENROL_ID" ]; then
    warn "tpm-enrol: broker did not return an enrol_id: $(cat /run/dot1x/enrol-resp.json 2>/dev/null)"
    plymsg "TPM enrolment FAILED (bad broker response)"; exit 1
fi
info "tpm-enrol: enrol_id=$ENROL_ID fingerprint=$FP"

# --- 5. show the fingerprint + poll for approval ----------------------------
# The fingerprint is PUBLIC (derived from the CSR public key) — displaying it is
# allowed under invariant #1 (state, not a secret). An admin cross-checks it
# against the broker's pending queue and approves.
ply enrol-wait
plymsg "APPROVE THIS DEVICE — code: $FP"

i=0
while [ "$i" -lt "$WAITTMO" ]; do
    if curl -fsS "${CURL_TLS[@]}" "$ENROL_URL/status/$ENROL_ID" \
            -o /run/dot1x/enrol-status.json 2>/dev/null; then
        STATE=$(sed -n 's/.*"state":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-status.json)
        case "$STATE" in
            approved) break ;;
            denied)   warn "tpm-enrol: enrolment DENIED by admin"
                      plymsg "TPM enrolment DENIED"; exit 1 ;;
            expired)  warn "tpm-enrol: enrolment request expired"
                      plymsg "TPM enrolment EXPIRED — reboot to retry"; exit 1 ;;
        esac
    fi
    sleep 5; i=$((i + 5))
done
if [ "${STATE:-}" != "approved" ]; then
    warn "tpm-enrol: no approval within ${WAITTMO}s"
    plymsg "TPM enrolment TIMED OUT"; exit 1
fi

# --- 6. write the issued cert to NV + reboot into the secure path -----------
ply enrol-done
plymsg "Enrolment approved — installing identity"
# Extract the cert PEM (leaf first if a chain was returned), unescape \n.
CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)","hostnqn":.*/\1/p' /run/dot1x/enrol-status.json)
[ -n "$CERT_ESC" ] || CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)".*/\1/p' /run/dot1x/enrol-status.json)
printf '%b' "$CERT_ESC" > /run/dot1x/enrol-cert.pem
# Keep only the FIRST certificate (the leaf) for NV — the hostnqn/EAP identity.
awk 'BEGIN{n=0} /BEGIN CERTIFICATE/{n++} n==1{print} /END CERTIFICATE/{if(n==1)exit}' \
    /run/dot1x/enrol-cert.pem > /run/dot1x/enrol-leaf.pem
if ! openssl x509 -in /run/dot1x/enrol-leaf.pem -outform DER \
        -out /run/dot1x/enrol-leaf.der 2>/dev/null; then
    warn "tpm-enrol: issued cert is not valid PEM"; plymsg "TPM enrolment FAILED (bad cert)"; exit 1
fi
SZ=$(wc -c < /run/dot1x/enrol-leaf.der)
info "tpm-enrol: writing ${SZ}-byte cert to NV $NVINDEX"
tpm2_nvundefine "$NVINDEX" -C o >/dev/null 2>&1 || true
if ! { tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" \
         -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null \
    && tpm2_nvwrite "$NVINDEX" -C o -i /run/dot1x/enrol-leaf.der >/dev/null; }; then
    warn "tpm-enrol: failed to write cert to NV $NVINDEX (TPM owner auth?)"
    plymsg "TPM enrolment FAILED (NV write)"; exit 1
fi

SERIAL=$(openssl x509 -in /run/dot1x/enrol-leaf.pem -serial -noout 2>/dev/null | cut -d= -f2 | tr 'A-F' 'a-f')
info "tpm-enrol: ENROLLED (cert serial $SERIAL). Rebooting into the secure path."
plymsg "Enrolment complete — rebooting"
sleep 2
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
    { echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
# Do not fall through to the secure path in this (pre-reboot) boot.
exit 0