#!/bin/sh
#  $Id: security_selfsign.sh 145455 2017-06-15 14:40:42Z mike.mcewen@oracle.com $
#  Copyright (c) 2008, 2020, Oracle and/or its affiliates.
#
#  Author: Roger Binns
#
#  Generates a certificate from a CSR, signs it and installs it.
#

. "common-env.sh"

# be paranoid about the current path
if [ -d /bin ]; then
  PATH=/bin:$PATH
fi
if [ -d /sbin ]; then
  PATH=/sbin:$PATH
fi
if [ -d /usr/bin ]; then
  PATH=/usr/bin:$PATH
fi
if [ -d /usr/sbin ]; then
  PATH=/usr/sbin:$PATH
fi
if [ -d /etc ]; then
  PATH=/etc:$PATH
fi
export PATH

N=""
C=""
if echo -n | grep n > /dev/null
then
  C="\c"
else
  N="-n"
fi
case "$MACHINEARCH" in
i3li*|ppli*) N="$N -e" ;;
esac
_ss_headlines="--------------------------------------------------------------------------"

if [ -f $TTAMSG/common -a -f $TTAMSG/security_selfsign ]; then
  . $TTAMSG/common
  . $TTAMSG/security_selfsign
else
  echo "Unable to open message file: $TTAMSG/security_selfsign"
  exit 1
fi

GetPrivUsrGrp()
{
    cat $TTADATADIR/serverconfig/global/array.properties 2>/dev/null | awk -F= \
	'BEGIN { u="ttasys"; wu="ttaserv"; g="ttaserv" }
	$1 == "tarantella.config.array.privilegeduser" { u = $2 }
	$1 == "tarantella.config.array.webserveruser" { wu = $2 }
	$1 == "tarantella.config.array.privilegedgroup" { g = $2 }
	END { print u " " wu " " g }'
}
_privusrgrp=`GetPrivUsrGrp`
privusr=`expr "$_privusrgrp" : '\([^ ]*\) .*'`
webservusr=`expr "$_privusrgrp" : '.* \([^ ]*\) .*'`
privgrp=`expr "$_privusrgrp" : '.* \([^ ]*\)$'`



OPENSSL_BINARY=openssl
CONFIG_FILE=$TTAINSTDIR/etc/data/openssl.cnf
TTARANDOM_BINARY=$TTAINSTDIR/bin/bin/ttarandom

TSPDIR=$TTADATADIR/tsp
TTAKEY_FILE=$TSPDIR/key.pem
TTAKEY_PENDING_FILE=$TSPDIR/key.pending.pem
TTACERT_FILE=$TSPDIR/cert.pem
TTACSR_FILE=$TSPDIR/csr.pem
TTACA_FILE=$TSPDIR/ca.pem
TTAPKCS12_FILE=$TSPDIR/cert.pkcs12
TTAKEYSTORE_FILE=$TSPDIR/keystore.jks.https
TTAKEYSTORE_PASSWORD_FILE=$TSPDIR/password.jks.https

TMP_KEY=./tmp.pem
csrfile=""
certfile=""
keyfile=""
validateopt=""
noargs=0

usage() 
{
  echo "$lf_selfsign_usage"
}


#
# Does a quick check on a certificate file and exits if it's not valid. The
# error message depends on $2 which is only filled in if the certificate
# is in a file and NOT from stdin
#
validate_cert()
{
  grep "BEGIN.*CERTIFICATE" $1 >/dev/null 2>/dev/null
  if [ $? != 0 ];then
    if [ -n "$2" ];then
      echo "$l_invalid_cert_1$2$l_invalid_cert_2"
    else
      echo "$l_invalid_cert_3"
    fi
    exit 1
  fi
}

#
# Validate the key file similarly. A key can only come in a file so we don't
# need to customise the error for the stdin case
#
validate_key()
{
  grep "BEGIN.*PRIVATE KEY" $1 >/dev/null 2>/dev/null
  if [ $? != 0 ];then
    echo "$l_invalid_key_1"
    exit 1
  fi
}

#
# Validate the CSR file similarly. 
#
validate_csr()
{
  grep "BEGIN.*REQUEST" $1 >/dev/null 2>/dev/null
  if [ $? != 0 ];then
    echo "$l_invalid_csr_1$2$l_invalid_csr_2"
    exit 1
  fi
}

#
# Parse command-line parameters
#
while [ -n "$1" ]; do
    noargs=1
    case $1 in
	--help ) usage ; exit 1;;
        * ) exit 1;;
    esac
done

umask 077

if [ ! -f "$TTACSR_FILE" ]; then
        echo "$TTACSR_FILE$l_not_found"
        echo $l_do_cert_request
        exit 15
fi

if [ ! -f "$TTAKEY_PENDING_FILE" ]; then
        echo "$TTAKEY_PENDING_FILE$l_not_found"
        echo $l_do_cert_request
        exit 15
fi

if [ -f "$TTACERT_FILE" ]; then
        echo "$TTACERT_FILE$l_already_exists"
        echo "$l_already_exists_msg"
        exit 15
fi

$OPENSSL_BINARY x509 -req -extensions v3_ca -extfile "$CONFIG_FILE" -days 365 -in "$TTACSR_FILE" -signkey "$TTAKEY_PENDING_FILE" -out "$TTACERT_FILE" >/dev/null 2>/dev/null

errcode=$?

if [ $errcode -eq 0 ]; then
    mv "$TTAKEY_PENDING_FILE" "$TTAKEY_FILE"
    if [ -z "${TTA_SECURITY_ENABLE}" ]; then
        echo "${l_created_msg1}${l_created_msg3}${l_created_msg4}${TTACERT_FILE}${l_created_msg2}"
    else
        echo "${l_created_msg1}${l_created_msg2}"
    fi

    if [ ! -f "$TTAKEYSTORE_PASSWORD_FILE" ]; then
        # Create a password for the Grizzly keystore
        new_password=`"$TTARANDOM_BINARY" --keysize 20 --printable`
        echo "${new_password}" > "$TTAKEYSTORE_PASSWORD_FILE"
        # Set permissions
        chmod 600 "$TTAKEYSTORE_PASSWORD_FILE"
        chown $privusr:$privgrp "$TTAKEYSTORE_PASSWORD_FILE"

        RANDFILE=$TSPDIR/ttarnd.$$
        export RANDFILE

        # Create the keystore used by Grizzly 
        $OPENSSL_BINARY pkcs12 -export -out "$TTAPKCS12_FILE" \
            -password "pass:$new_password" -in "$TTACERT_FILE" \
            -inkey "$TTAKEY_FILE" -name "grizzly"

        rm -f $RANDFILE

        # Make sure there is no Grizzly keystore before running the keytool
        # command that creates it.
        if [ -f "${TTAKEYSTORE_FILE}" ]
        then
            rm "${TTAKEYSTORE_FILE}"
        fi

        ${SGD_JAVA_DIR}/keytool -importkeystore \
            -srckeystore "$TTAPKCS12_FILE" \
            -srcstoretype "PKCS12" \
            -srcstorepass "$new_password" \
            -destkeystore "$TTAKEYSTORE_FILE" \
            -deststoretype "JKS" \
            -deststorepass "$new_password" \
            -destkeypass "$new_password" \
            -alias "grizzly"
    fi
else
    echo "$l_failed"
fi

# Set file owners
chown -R $privusr $TSPDIR
chgrp -R $privgrp $TSPDIR


exit $errcode 
