#!/usr/bin/env bash
# ==============================================================================
# /usr/local/bin/verify-zero-leak.sh
# Homelab Zero-Leak Empiric Verification Test Battery
# Run on: ThinkPad T490 (Ubuntu Server 24.04 / Debian 12)
# ==============================================================================
set -euo pipefail

if [ "$EUID" -ne 0 ]; then
    echo "❌ Error: This test script must be run as root (use sudo bash $0)" >&2
    exit 1
fi

WLAN_IF="${1:-wlan0}"
TRANSIT_NET="172.16.100.0/24"
VM_NET="192.168.45.0/24"

echo "======================================================================"
echo "Homelab Zero-Leak Verification Battery — Interface: ${WLAN_IF}"
echo "Testing: Rogue DHCP, Un-NATed IPs, mDNS/SSDP, ARP, ICMP Redirects"
echo "======================================================================"

PASSED=0
FAILED=0

# Test 1: Rogue DHCP
echo -n "[TEST 1/5] Checking for Rogue DHCP on Wi-Fi (${WLAN_IF})... "
DHCP_LEAK=$(timeout 4 tcpdump -i "${WLAN_IF}" -nn "port 67 or port 68" 2>/dev/null | grep -v "10.0.0." || true)
if [ -z "$DHCP_LEAK" ]; then
    echo "✅ [PASS] No rogue DHCP server responses on Wi-Fi."
    PASSED=$((PASSED + 1))
else
    echo "❌ [FAIL] Rogue DHCP detected leaking to Wi-Fi!"
    FAILED=$((FAILED + 1))
fi

# Test 2: Un-NATed Private IPs
echo -n "[TEST 2/5] Checking for Un-NATed Private IP frames on Wi-Fi... "
NAT_LEAK=$(timeout 4 tcpdump -i "${WLAN_IF}" -nn "src net ${TRANSIT_NET} or src net ${VM_NET}" 2>/dev/null || true)
if [ -z "$NAT_LEAK" ]; then
    echo "✅ [PASS] 100% of internal packets are cleanly masqueraded."
    PASSED=$((PASSED + 1))
else
    echo "❌ [FAIL] Un-NATed internal IP packets detected on Wi-Fi!"
    FAILED=$((FAILED + 1))
fi

# Test 3: Discovery & Multicast Bleed
echo -n "[TEST 3/5] Checking for mDNS / LLMNR / SSDP / NetBIOS broadcasts... "
DISC_LEAK=$(timeout 4 tcpdump -i "${WLAN_IF}" -nn "udp port 5353 or udp port 5355 or udp port 1900 or udp port 137 or udp port 138 or ip broadcast or ip multicast" 2>/dev/null || true)
if [ -z "$DISC_LEAK" ]; then
    echo "✅ [PASS] Zero discovery / multicast frames escaping on Wi-Fi."
    PASSED=$((PASSED + 1))
else
    echo "❌ [FAIL] Discovery broadcasts escaping onto Wi-Fi!"
    FAILED=$((FAILED + 1))
fi

# Test 4: ICMP Redirects
echo -n "[TEST 4/5] Checking for ICMP Type-5 Redirect generation... "
ICMP_LEAK=$(timeout 4 tcpdump -i "${WLAN_IF}" -nn "icmp[icmptype] == icmp-redirect" 2>/dev/null || true)
if [ -z "$ICMP_LEAK" ]; then
    echo "✅ [PASS] Zero ICMP redirect packets emitted."
    PASSED=$((PASSED + 1))
else
    echo "❌ [FAIL] ICMP redirects detected!"
    FAILED=$((FAILED + 1))
fi

# Test 5: Forwarding Status
echo -n "[TEST 5/5] Checking Linux kernel routing & nftables state... "
FWD_STATUS=$(sysctl -n net.ipv4.ip_forward)
NFT_STATUS=$(systemctl is-active nftables || true)
if [ "$FWD_STATUS" = "1" ] && [ "$NFT_STATUS" = "active" ]; then
    echo "✅ [PASS] Kernel routing enabled and nftables engine active."
    PASSED=$((PASSED + 1))
else
    echo "❌ [FAIL] Routing is disabled or nftables is inactive!"
    FAILED=$((FAILED + 1))
fi

echo "======================================================================"
echo "Verification Summary: ${PASSED} Passed, ${FAILED} Failed."
if [ "$FAILED" -eq 0 ]; then
    echo "🎉 ALL ZERO-LEAK TESTS PASSED: Gateway is 100% isolated & invisible."
else
    echo "⚠️ ONE OR MORE CHECKS FAILED: Review nftables and sysctl configuration."
fi
echo "======================================================================"