#!/bin/sh
# wg-mgmt-diagnose.sh — READ-ONLY diagnosis of the WG mgmt tunnel on the bench router.
# Run ON THE ROUTER over LAN:  ssh root@192.168.8.1  (pw kitPLANE1!!), then: sh wg-mgmt-diagnose.sh
# Safe: only reads state + captures packets. Mutates nothing.
# Context: docs/handoff/2026-07-01-wg-mgmt-incident-and-resume.md
set +e
HUB_WG=10.88.0.1
MGMT_SRC=10.88.0.2
HUB_PUB=167.172.237.162

echo "===== A. FULL WG state (THE missing datapoint — check persistent-keepalive + allowed-ips) ====="
wg show
echo
echo "===== routing / policy (should steer mgmt-sourced traffic into table 1001) ====="
echo "-- ip rule --";                 ip rule
echo "-- table 1001 --";             ip route show table 1001
echo "-- default routes --";         ip route show | grep -E '^default'
echo "-- underlay path to hub --";   ip route get "$HUB_PUB"
echo "-- mgmt-sourced return path --"; ip route get "$HUB_WG" from "$MGMT_SRC" 2>/dev/null
echo "-- rp_filter (expect 0; NOT the cause) --"
for f in /proc/sys/net/ipv4/conf/all/rp_filter /proc/sys/net/ipv4/conf/eth0/rp_filter \
         /proc/sys/net/ipv4/conf/rmnet_mhi0/rp_filter /proc/sys/net/ipv4/conf/wgclient1/rp_filter; do
  [ -f "$f" ] && echo "  $f = $(cat "$f")"
done
echo "-- iface MTUs --"
for i in eth0 rmnet_mhi0 wgclient1; do ip link show "$i" 2>/dev/null | sed -n 's/.*\(mtu [0-9]*\).*/  '"$i"': \1/p'; done

echo
echo "===== B. Live capture: watch fiber(eth0) WG + decrypted(wgclient1) while pinging the hub ====="
echo "     [eth0] = encrypted WG on the fiber underlay ; [wg] = decrypted inner packets"
( timeout 12 tcpdump -ni eth0 udp port 51820 2>/dev/null | sed 's/^/[eth0] /' & )
( timeout 12 tcpdump -ni wgclient1 2>/dev/null        | sed 's/^/[wg]   /' & )
sleep 1
ping -c 8 -W 2 -I "$MGMT_SRC" "$HUB_WG"
echo "ping rc=$?"
wait 2>/dev/null

echo
echo "===== INTERPRET ====="
cat <<'EOF'
  * wg show 'persistent keepalive: (none)'      -> hypothesis #1 (NAT mapping expiry). Fix: keepalive.
  * hub-peer 'allowed ips' lacks 10.88.0.1       -> hypothesis #2. Replies get cryptokey-dropped.
  * [eth0] shows OUTBOUND + INBOUND :51820        -> hub replies DO arrive on fiber -> decrypt/inner issue.
  * [eth0] shows OUTBOUND only                     -> router pkts not leaving OR hub not returning -> coordinate hub capture.
  * [wg] shows echo-request but no echo-reply      -> confirms replies not reaching inner iface.
  Next: apply scripts/diag/wg-mgmt-fix.sh  (keepalive first). See the handoff doc.
EOF