#!/bin/sh
# Copyright (c) 2009, 2019, Oracle and/or its affiliates. All rights reserved.
#
# Script that handles the certificate management commands in the gateway.
#

. "${INSTDIR}/bin/scripts/common"

[ "${trace}" = "x" ] && set -x

[ -s "${INSTDIR}/etc/version" ] && . ${INSTDIR}/etc/version

usage_certexport() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_certexportusage_gw}"
    exit 1
}

usage_sslcert() {
    echo "${i18n_sslcertusage10_gw}"
    exit 1
}

usage_sslcertexport() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_sslcertexportusage_gw}"
    exit 1
}

usage_sslcertprint() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_sslcertprintusage_gw}"
    exit 1
}

usage_keyimport() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_keyimportusage_gw}"
    exit 1
}

usage_sslkey() {
    echo "${i18n_sslkeyusage10_gw}"
    exit 1
}

usage_sslkeyimport() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_sslkeyimportusage_gw}"
    exit 1
}

usage_sslkeyexport() {
    case "$1" in '' | --help) ;; *) printf "${i18n_badarg01_gw}" "$1" ;; esac
    echo "${i18n_sslkeyexportusage_gw}"
    exit 1
}

get_password() {
    cat ${INSTDIR}/etc/password
    return 0
}

cert_export()
{
    USAGE="$1" KEYSTORE="${INSTDIR}/proxy/etc/$2"
    shift; shift
    CERTFILE="" 
    while [ -n "$1" ]; do
	case "$1" in
	--certfile)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}
	    esac
	    CERTFILE="$2"
	    case "${CERTFILE}" in /*) ;; *) CERTFILE="${ORIGDIR}/${CERTFILE}" ;; esac
	    ;;
	*)  ${USAGE} "$1"
	esac
	shift; shift
    done
    
    [ -z "${CERTFILE}" ] && ${USAGE}
	
	if [ -z "${OSGD_GW_ALIAS}" ]
	then
		echo "Environment Missing OSGD_GW_ALIAS" 1>&2
		return 1
	fi

    PASSWORD=`get_password`
    ${GW_JAVA_DIR}/keytool \
	-keystore "${KEYSTORE}" \
	-storepass "${PASSWORD}" \
	-exportcert \
	-alias "${OSGD_GW_ALIAS}" \
	-file "${CERTFILE}" \
	-rfc
    x=$?
    [ "$x" -ne 0 ] && printf "${i18n_certexportfailed01_gw}" "$x"
    chmod 400 "${CERTFILE}"
    return $x
}

sslcert_print() {
    [ -n "$1" ] && usage_sslcertprint
	
	if [ -z "${OSGD_GW_ALIAS}" ]
	then
		echo "Environment Missing OSGD_GW_ALIAS" 1>&2
		return 1
	fi

    PASSWORD=`get_password`
    tmp="${TMPDIR:-/tmp}/SUNWsgdg.$$"
    rm -rf ${tmp} 2>/dev/null
    ${GW_JAVA_DIR}/keytool \
	-keystore ${INSTDIR}/proxy/etc/keystore.client \
	-storepass "${PASSWORD}" \
	-exportcert \
	-alias "${OSGD_GW_ALIAS}" \
	-file ${tmp} 2>/dev/null
    x=$?
    if [ "$x" -ne 0 ]; then
	printf "${i18n_printfailed01_gw}" "$x"
    else
	${GW_JAVA_DIR}/keytool \
	    -printcert \
	    -file ${tmp}
	x=$?
	[ "$x" -ne 0 ] && printf "${i18n_printfailed01_gw}" "$x"
    fi
    rm -f ${tmp} 2>/dev/null
    return $x
}

key_import() {
    USAGE="$1" KEYSTORE="${INSTDIR}/proxy/etc/$2"
    shift; shift
    KEYFILE="" KEYALG="" CERTFILE="" CACERTFILE="" ALWAYSOVERWRITE=""
    while [ -n "$1" ]; do
	case "$1" in
	--keyfile)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}
	    esac
	    KEYFILE="$2"
	    case "${KEYFILE}" in /*) ;; *) KEYFILE="${ORIGDIR}/${KEYFILE}" ;; esac
	    [ ! -s "${KEYFILE}" ] && { printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}; }
	    shift
	    ;;
	--keyalg)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}
	    esac
	    KEYALG="$1 $2"
	    shift
	    ;;
	--certfile)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}
	    esac
	    CERTFILE="$2"
	    case "${CERTFILE}" in /*) ;; *) CERTFILE="${ORIGDIR}/${CERTFILE}" ;; esac
	    [ ! -s "${CERTFILE}" ] && { printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}; }
	    shift
	    ;;
	--cacertfile)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}
	    esac
	    CACERTFILE="$2"
	    case "${CACERTFILE}" in /*) ;; *) CACERTFILE="${ORIGDIR}/${CACERTFILE}" ;; esac
	    [ ! -s "${CACERTFILE}" ] && { printf "${i18n_invalidarg01_gw}" "$1"; ${USAGE}; }
	    shift
	    ;;
	--alwaysoverwrite)
	    ALWAYSOVERWRITE="$1"
	    ;;
    --keypass)
	    KEYPASS="$1"
	    ;;
	*)  ${USAGE} "$1"
	esac
	shift
    done
    PASSWORD=`get_password` 
    [ -z "${KEYFILE}" -o -z "${CERTFILE}" ] && ${USAGE}
    
	if [ -z "${OSGD_GW_ALIAS}" ]
	then
		echo "Environment Missing OSGD_GW_ALIAS" 1>&2
		return 1
	fi

    #deal with password protected key files. 
    if [ -z "${KEYPASS}" ]; then
        TMP_KEY="${TMPDIR:-/tmp}/SUNWsgdg2.$$"
        rm -rf ${TMP_KEY}
        #prompt for password on stdin, we could pass it in as var but it would show in ps
        openssl rsa -in ${KEYFILE} -out ${TMP_KEY}
        KEYFILE=${TMP_KEY}
    fi

    
    TMP_PK8="${TMPDIR:-/tmp}/SUNWsgdg.$$"
    TMP_CHAIN="${TMPDIR:-/tmp}/SUNWsgdg1.$$"
    rm -rf ${TMP_PK8} ${TMP_CHAIN} 2>/dev/null
    openssl pkcs8 -topk8 -inform PEM -outform PEM -in "${KEYFILE}" -out ${TMP_PK8} -nocrypt
    x=$?
    if [ "$x" -ne 0 ]; then
	printf "${i18n_convfailed02_gw}" "${KEYFILE}" "$x"
    else
	[ -n "${CACERTFILE}" ] && {
	    openssl crl2pkcs7 -nocrl -inform PEM -outform PEM -certfile "${CERTFILE}" -certfile "${CACERTFILE}" -out ${TMP_CHAIN}
	    x=$?
	    if [ "$x" -ne 0 ]; then
		printf "${i18n_chainfailed03_gw}" "${CERTFILE}" "${CACERTFILE}" "$x"
	    else
		CERTFILE=${TMP_CHAIN}
	    fi
	}
	[ "$x" -eq 0 ] && {
	    ${GW_JAVA_DIR}/java \
		-jar ${INSTDIR}/proxy/KeyManager.jar \
		import \
		--certfile "${CERTFILE}" \
		--keyfile ${TMP_PK8} \
		--keyalias "${OSGD_GW_ALIAS}" \
		${KEYALG} \
		${ALWAYSOVERWRITE} \
		--keystore "${KEYSTORE}" \
		--storepass "${PASSWORD}"
	    x=$?
	    [ "$x" -ne 0 ] && printf "${i18n_keyimportfailed01_gw}" "$x"
	}
    fi
    rm -f ${TMP_PK8} ${TMP_CHAIN} ${TMP_KEY}2>/dev/null
    [ "$x" -eq 0 ] && {
	echo; echo "${i18n_needrestart10_gw}"
    }
    return $x
}

sslkey_export() {
    KEYFILE="" KEYPASS=""
    while [ -n "$1" ]; do
	case "$1" in
	--keyfile)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; usage_sslkeyexport
	    esac
	    KEYFILE="$2"
	    case "${KEYFILE}" in /*) ;; *) KEYFILE="${ORIGDIR}/${KEYFILE}" ;; esac
	    ;;
	--keypass)
	    case "$2" in
	    "" | --*) printf "${i18n_invalidarg01_gw}" "$1"; usage_sslkeyexport
	    esac
	    KEYPASS="$1 $2"
	    ;;
	*)  usage_sslkeyexport "$1"
	esac
	shift; shift
    done
    PASSWORD=`get_password`
    [ -z "${KEYFILE}" ] && usage_sslkeyexport
	
	if [ -z "${OSGD_GW_ALIAS}" ]
	then
		echo "Environment Missing OSGD_GW_ALIAS" 1>&2
		return 1
	fi
    
	${GW_JAVA_DIR}/java \
	-jar ${INSTDIR}/proxy/KeyManager.jar \
	export \
	--keyfile "${KEYFILE}" \
	--keyalias "${OSGD_GW_ALIAS}" \
	${KEYPASS} \
	--keystore "${INSTDIR}/proxy/etc/keystore.client" \
	--storepass "${PASSWORD}"
    x=$?
    [ "$x" -ne 0 ] && printf "${i18n_keyexportfailed01_gw}" "$x"
    printf "${i18n_keyexportsuccess_gw}\n" "${KEYFILE}"
    chmod 400 "${KEYFILE}"
    return $x
}

x=0

case "$1" in
cert)
    case "$2" in
    export)
	shift; shift
	cert_export usage_certexport keystore "$@"
	;;
    *)	usage_certexport
    esac
    ;;
sslcert)
    case "$2" in
    export)
	shift; shift
	cert_export usage_sslcertexport keystore.client "$@"
	;;
    print)
	shift; shift
	sslcert_print "$@"
	;;
    *)	usage_sslcert
    esac
    ;;
key)
    case "$2" in
    import)
	shift; shift
	key_import usage_keyimport keystore "$@"
	;;
    *)	usage_keyimport
    esac
    ;;
sslkey)
    case "$2" in
    export)
	shift; shift
	sslkey_export "$@"
	;;
    import)
	shift; shift
	key_import usage_sslkeyimport keystore.client "$@"
	;;
    *)	usage_sslkey
    esac
    ;;
esac

exit $x
