#!/usr/bin/env bash
# setup-link.sh <supplicant-nic> <uplink-nic>
#
# Prep one authenticator link before starting hostapd on it. The authenticator is
# a 2-sided node: <supplicant-nic> faces the workstation (hostapd + MACsec runs
# here), <uplink-nic> faces the serving VLAN (DHCP/NVMe/RADIUS). After MKA
# succeeds hostapd creates a macsec iface over <supplicant-nic>; the DECRYPTED
# traffic on that macsec iface must reach the serving network — we bridge it to
# <uplink-nic>.
#
# Run as root on the authenticator node (VM or inline box). BENCH-VERIFY the
# macsec iface name hostapd creates on your build (assumed "macsec0").
set -euo pipefail

SUP=${1:?usage: setup-link.sh <supplicant-nic> <uplink-nic>}
UP=${2:?uplink nic required}
MACSEC=${3:-macsec0}      # iface hostapd creates after MKA (override if different)
BR=${BR:-br-auth}

ip link set "$SUP" up
ip link set "$UP"  up

# Allow EAPOL through any bridge in the path (reserved PAE multicast is dropped
# by default). The supplicant-facing side is a raw NIC for hostapd, so this is
# mainly for the uplink bridge.
ip link add name "$BR" type bridge 2>/dev/null || true
echo 8 > "/sys/class/net/$BR/bridge/group_fwd_mask" 2>/dev/null || true
ip link set "$UP" master "$BR"
ip link set "$BR" up

echo "Authenticator link ready:"
echo "  supplicant NIC : $SUP   (start hostapd here)"
echo "  uplink bridge  : $BR <- $UP   (serving VLAN)"
echo
echo "AFTER hostapd brings MKA up and creates '$MACSEC', bridge it to the uplink:"
echo "  ip link set $MACSEC master $BR && ip link set $MACSEC up"
echo "(Do this once $MACSEC exists; automate with a hostapd 'macsec' up-hook if"
echo " your build supports one.)"