#!/usr/bin/env bash
set -u

NGINX_BIN="${NGINX_BIN:-/usr/sbin/nginx}"
if [[ ! -x "$NGINX_BIN" ]]; then
    NGINX_BIN="$(command -v nginx)"
fi

failures=0

check() {
    local name="$1"
    shift
    if "$@"; then
        echo "PASS: $name"
    else
        echo "FAIL: $name"
        failures=$((failures + 1))
    fi
}

check "nginx syntax" "$NGINX_BIN" -t
check "sshd syntax" /usr/sbin/sshd -t
check "nginx active" systemctl is-active --quiet nginx
check "sshd active" systemctl is-active --quiet sshd

if iptables -C INPUT -p icmp --icmp-type timestamp-request -j DROP 2>/dev/null && \
   grep -Eq -- '--icmp-type (13|timestamp-request).* -j DROP' /etc/sysconfig/iptables && \
   systemctl is-enabled --quiet iptables; then
    echo "PASS: ICMP timestamp request blocked and persisted"
else
    echo "FAIL: ICMP timestamp request hardening"
    failures=$((failures + 1))
fi

check "ordinary ICMP echo remains available" ping -c 1 -W 2 127.0.0.1

effective_ssh="$(/usr/sbin/sshd -T 2>/dev/null)"

if grep -Eq '^permitrootlogin no$' <<<"$effective_ssh"; then
    echo "PASS: root SSH login disabled"
else
    echo "FAIL: root SSH login policy"
    failures=$((failures + 1))
fi

if grep -Eq '^x11forwarding no$' <<<"$effective_ssh" && \
   grep -Eq '^allowagentforwarding no$' <<<"$effective_ssh"; then
    echo "PASS: X11 and agent forwarding disabled"
else
    echo "FAIL: SSH forwarding hardening"
    failures=$((failures + 1))
fi

if grep -E '^macs ' <<<"$effective_ssh" | grep -Eq 'hmac-sha1|umac-64|-etm@openssh.com'; then
    echo "FAIL: weak or Terrapin-affected SSH MAC still enabled"
    failures=$((failures + 1))
else
    echo "PASS: weak and Terrapin-affected SSH MAC removed"
fi

if grep -E '^ciphers ' <<<"$effective_ssh" | grep -q 'chacha20-poly1305@openssh.com'; then
    echo "FAIL: Terrapin-affected SSH cipher still enabled"
    failures=$((failures + 1))
else
    echo "PASS: Terrapin-affected SSH cipher removed"
fi

if grep -E '^kexalgorithms ' <<<"$effective_ssh" | grep -q 'group14-sha1'; then
    echo "FAIL: weak SSH KEX still enabled"
    failures=$((failures + 1))
else
    echo "PASS: weak SSH KEX removed"
fi

static_rsa_output="$(timeout 8 openssl s_client \
    -connect 127.0.0.1:443 \
    -servername csfzx.yyangpt.cn \
    -tls1_2 -cipher AES256-SHA </dev/null 2>&1 || true)"

if grep -q 'Cipher is AES256-SHA' <<<"$static_rsa_output"; then
    echo "FAIL: TLS static RSA AES256-SHA still accepted"
    failures=$((failures + 1))
else
    echo "PASS: TLS static RSA AES256-SHA rejected"
fi

ecdhe_output="$(timeout 8 openssl s_client \
    -connect 127.0.0.1:443 \
    -servername csfzx.yyangpt.cn \
    -tls1_2 -cipher ECDHE-RSA-AES128-GCM-SHA256 </dev/null 2>&1 || true)"

if grep -q 'Cipher is ECDHE-RSA-AES128-GCM-SHA256' <<<"$ecdhe_output"; then
    echo "PASS: TLS 1.2 ECDHE handshake"
else
    echo "FAIL: TLS 1.2 ECDHE handshake"
    failures=$((failures + 1))
fi

default_cert="$(timeout 8 openssl s_client \
    -connect 127.0.0.1:443 </dev/null 2>/dev/null \
    | openssl x509 -noout -subject -issuer 2>/dev/null || true)"

if grep -q 'CN = \*.yyangpt.cn' <<<"$default_cert" && \
   grep -q 'WoTrus' <<<"$default_cert"; then
    echo "PASS: default HTTPS vhost returns trusted wildcard certificate"
else
    echo "FAIL: default HTTPS certificate"
    printf '%s\n' "$default_cert"
    failures=$((failures + 1))
fi

health="$(curl -sk --resolve csfzx.yyangpt.cn:443:127.0.0.1 \
    --max-time 10 https://csfzx.yyangpt.cn/lb-health || true)"

if [[ "$health" == "ok" ]]; then
    echo "PASS: HTTPS health endpoint"
else
    echo "FAIL: HTTPS health endpoint: $health"
    failures=$((failures + 1))
fi

echo "FAILURES=$failures"
exit "$failures"