#!/bin/sh
#  $Id: security_fingerprint.sh 109677 2015-03-31 12:24:31Z pc161604 $
#  Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
#  This software code contains proprietary information 
#  and should be treated as confidential.
#
#  Author: mm161613
#
#  Generates a Certificate fingerprint
#


# Set port numbers. Start by sourcing info/ports.properties.
if [ -r $TTAINSTDIR/var/info/ports.properties ]; then
	. $TTAINSTDIR/var/info/ports.properties
fi

# Use these as defaults for config
tarantella_config_array_externalport=${externalport:-3144}
tarantella_config_array_port=${peerport:-5427}
tarantella_config_array_secureport=${secureport:-5307}
#also include proxiedhttpsurl for firewall traversal
tarantella_config_server_proxiedhttpsurl=${proxiedhttpsurl:-""}
tarantella_config_array_privilegeduser=${privilegeduser:-""}
tarantella_config_array_privilegedgroup=${privilegedgroup:-""}
#also include privileged username for web authentication
tarantella_config_array_webserveruser=${webserveruser:-""}
# Include web auth key refresh
tarantella_config_login_webauth_refreshkeyonrestart=${refreshkeyonrestart:-""}

#Include attribute to tell ttawebtop whether to be verbose or not
tarantella_config_server_cgiverbose=${cgiverbose:-""}

#Include attribute used to modify the archive names
tarantella_config_server_archivemodifier=${archivemodifier:-""}

#Attribute for cgi-bin to tell client to bootstrap from
tarantella_config_server_cgibin_bootscript=${bootscript:-""}

#Attribute passed to client so it knows the route to the server.
tarantella_config_array_netservice_proxy_routes=${routes:-""}

#Attribute passed to client so it knows the correct external name of the server
tarantella_config_server_netservice_proxy_externalnames=${externalnames:-""}

#SHould we use ssl on peer connections? Admin tools need to know
tarantella_config_security_peerssl_enabled=${peerssl:-"0"}

# Use the bootstrap.properties file if we can.
_propfile="$TTAINSTDIR/var/serverconfig/global/bootstrap.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

# Set the values in the expected variables.
externalport=$tarantella_config_array_externalport
secureport=$tarantella_config_array_secureport
peerport=$tarantella_config_array_port

# Set DNS names. Use the bootstrap.properties file if we can.
_propfile="$TTAINSTDIR/var/serverconfig/local/bootstrap.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

# We need defaults if the properties file is unreadable or corrupt.
peerhost=${tarantella_config_server_dns_peer:-`$TTAINSTDIR/bin/bin/ttahostname`}
externalhost="${tarantella_config_server_dns_external:-$peerhost}"
auxhost="$peerhost"

# Get the value of proxiedhttpsurl/cgiverbose/archivemodifier/bootscript from 
# server.properties
_propfile="$TTAINSTDIR/var/serverconfig/local/server.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

# Get the properties from array.properties
_propfile="$TTAINSTDIR/var/serverconfig/global/array.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

# Get web auth properties
_propfile="$TTAINSTDIR/var/serverconfig/global/webauth.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

# Get peerssl properties
_propfile="$TTAINSTDIR/var/serverconfig/global/security.properties"
[ -s "${_propfile}" -a -r "${_propfile}" ] && {
eval `tr -d '\\\\' <"${_propfile}" | egrep -v "^[ 	]*#|'|^tarantella\.config\.(name|type)=" | sed "/=/!d
:dotloop
s/^\([^=]*\)\.\([^=]*=.*\)\$/\1_\2/
tdotloop
s/^\([^=]*\)=\(.*\)/\1='\2'/"`
}

proxiedhttpsurl=$tarantella_config_server_proxiedhttpsurl
privilegeduser=$tarantella_config_array_privilegeduser
privilegedgroup=$tarantella_config_array_privilegedgroup
webauthrefresh=$tarantella_config_login_webauth_refreshkeyonrestart
cgiverbose=$tarantella_config_server_cgiverbose
archivemodifier=$tarantella_config_server_archivemodifier
bootscript=$tarantella_config_server_cgibin_bootscript
routes=$tarantella_config_array_netservice_proxy_routes
externalnames=$tarantella_config_server_netservice_proxy_externalnames
peerssl=$tarantella_config_security_peerssl_enabled
peersslciphers=$tarantella_config_security_peerssl_ciphers
webserveruser=$tarantella_config_array_webserveruser

INSTALLDIR=$TTAINSTDIR
export INSTALLDIR

# be paranoid about the current path
if [ -d /bin ]; then
  PATH=/bin:$PATH
fi
if [ -d /sbin ]; then
  PATH=/sbin:$PATH
fi
if [ -d /usr/bin ]; then
  PATH=/usr/bin:$PATH
fi
if [ -d /usr/sbin ]; then
  PATH=/usr/sbin:$PATH
fi
if [ -d /etc ]; then
  PATH=/etc:$PATH
fi
export PATH

N=""
C=""
if echo -n | grep n > /dev/null
then
  C="\c"
else
  N="-n"
fi
case "$MACHINEARCH" in
i3li*|ppli*) N="$N -e" ;;
esac
_ss_headlines="--------------------------------------------------------------------------"

if [ -f $TTAMSG/common -a -f $TTAMSG/security_fingerprint ]; then
  . $TTAMSG/common
  . $TTAMSG/security_fingerprint
else
  echo "Unable to open message file: $TTAMSG/security_fingerprint"
  exit 1
fi


OPENSSL_BINARY=openssl
TSPDIR="$TTADATADIR/tsp"
CERT_FILE="$TSPDIR/cert.pem"
CA_CERT_FILE="$TSPDIR/ca.pem"
CERT2_FILE="$TTADATADIR/info/certs/external/$peerhost.cert.pem"
CA_CERT2_FILE="$TTADATADIR/info/certs/PeerCAcert.pem"
CONFIG_FILE="$TTAINSTDIR/etc/data/openssl.cnf"

FFILE=""

if [ -f "$CERT_FILE" ]; then
  FFILE="$CA_CERT_FILE"
else
  FFILE="$CA_CERT2_FILE"
fi

if [ -f "$FFILE" ]; then
  echo "$l_fingerprint1$peerhost$l_fingerprint2"
  $OPENSSL_BINARY x509 -inform PEM -outform DER -in "$FFILE" | $OPENSSL_BINARY md5 -c
else
  echo "$l_noca"
fi


exit 0
