#!/bin/sh
#  $Id: security_peerca.sh 109677 2015-03-31 12:24:31Z pc161604 $
#  Copyright (c) 2007, 2019, Oracle and/or its affiliates. All rights reserved.
#  This software code contains proprietary information 
#  and should be treated as confidential.
#
#  Component:
#  Author: mikemc
# 
#  This script is used to view and import the peer CA certificate. The
#  peer CA certificate is used to verify peer certificates used for
#  intra array communication. 

. "common-env.sh"

# be paranoid about the current path
if [ -d /bin ]; then
  PATH=/bin:$PATH
fi
if [ -d /sbin ]; then
  PATH=/sbin:$PATH
fi
if [ -d /usr/bin ]; then
  PATH=/usr/bin:$PATH
fi
if [ -d /usr/sbin ]; then
  PATH=/usr/sbin:$PATH
fi
if [ -d /etc ]; then
  PATH=/etc:$PATH
fi
export PATH

N=""
C=""
if echo -n | grep n > /dev/null
then
  C="\c"
else
  N="-n"
fi
case "$MACHINEARCH" in
i3li*|ppli*) N="$N -e" ;;
esac
_ss_headlines="--------------------------------------------------------------------------"

if [ -f $TTAMSG/common -a -f $TTAMSG/security_peerca ]; then
  . $TTAMSG/common
  . $TTAMSG/security_peerca
else
  echo "Unable to open message file: $TTAMSG/security_peerca"
  exit 1
fi

GetPrivUsrGrp()
{
    cat $TTADATADIR/serverconfig/global/array.properties 2>/dev/null | awk -F= \
	'BEGIN { u="ttasys"; wu="ttaserv"; g="ttaserv" }
	$1 == "tarantella.config.array.privilegeduser" { u = $2 }
	$1 == "tarantella.config.array.webserveruser" { wu = $2 }
	$1 == "tarantella.config.array.privilegedgroup" { g = $2 }
	END { print u " " wu " " g }'
}
_privusrgrp=`GetPrivUsrGrp`
privusr=`expr "$_privusrgrp" : '\([^ ]*\) .*'`
webservusr=`expr "$_privusrgrp" : '.* \([^ ]*\) .*'`
privgrp=`expr "$_privusrgrp" : '.* \([^ ]*\)$'`


OPENSSL_BINARY=openssl
KEYTOOL="${SGD_JAVA_DIR}/keytool"
KEYSTOREDIR="$TTADATADIR/info/certs"
KEYSTORE="$KEYSTOREDIR/keystore"
TRUSTSTORE="$KEYSTOREDIR/truststore"
CACERT_FILE="$KEYSTOREDIR/PeerCAcert.pem"
CAKEY_FILE="$KEYSTOREDIR/PeerCAkey.pem"
CSR_FILE="$KEYSTOREDIR/PeerServer.csr"
PEERCERT_FILE="$TTADATADIR/info/certs/PeerServercert.pem"
CASERIAL_FILE="$KEYSTOREDIR/PeerCA.srl"
CAFILETEMP="$KEYSTOREDIR/peerca.tmp"


hostname=`$TTABINDIR/scripts/getconfig --peerdns`

CADN="/CN=$hostname CA Cert"
PEERDN="CN=$hostname"
CAALIAS="$hostname CA"
PEERALIAS="$hostname Peer Server"
VALIDITY="180"
KEYALG="RSA"
STOREPASS=`cat $TTADATADIR/info/key`
KEYPASS="$STOREPASS"
KEYLEN="2048"

usage()
{
  echo "$lf_peerca_usage" 1>&2
}

short_usage() {
    echo "$1" 1>&2
    echo "$sf_peerca_usage" 1>&2
}

ca_export() {
  ${KEYTOOL} -list -alias "${CAALIAS}" -rfc -keystore "${TRUSTSTORE}" -storepass "${STOREPASS}" 
}

ca_import() {
  # Remove any tempfile
  rm "$CAFILETEMP" &> /dev/null
  cat > "$CAFILETEMP"

  # Delete old CA cert
  ${KEYTOOL} -delete -alias "${CAALIAS}" -storepass "${STOREPASS}" -noprompt -keystore "${TRUSTSTORE}" &> /dev/null

  # Add new cert
  ${KEYTOOL} -import -alias "${CAALIAS}" -file "${CAFILETEMP}" -storepass "${STOREPASS}" -noprompt -keystore "${TRUSTSTORE}"
}

ca_show() {
  ${KEYTOOL} -list -alias "${CAALIAS}" -v -keystore "${TRUSTSTORE}" -storepass "${STOREPASS}"
}

if [ ! -d "${KEYSTOREDIR}" ]; then
  echo 1>&2 "$l_peercanocertdir"
  exit 1
fi

#
# Parse command-line parameters
#
cashow=""
import=""
caexport=""
while [ -n "$1" ]; do
    case $1 in
        --show ) cashow=1; shift;;
        --import ) import=1; if [ "$#" != "2" ]; then usage; exit 1; fi;  CAALIAS="$2 CA"; shift; shift;;
        --export ) caexport=1; shift;;
        --help ) usage; exit 0;;
  * ) short_usage "$l_invalid_arg1$1$l_invalid_arg2"; exit 1;;
    esac
done

# Show ca cert by default
if [ -z "$cashow" -a -z "$import" -a -z "$caexport" ]; then
  cashow=1
fi

if [ ! -z "$cashow" ]; then
  if [ ! -z "$import" ]; then
    usage
    exit 1
  fi 
fi
  
if [ ! -z "$caexport" ]; then
  ca_export
  exit 0
fi

if [ ! -z "$cashow" ]; then
  ca_show
  exit 0
fi

if [ ! -z "$import" ]; then
  ca_import
  exit 0
fi

usage
exit 1

