#! /usr/bin/ksh
#
# Script to create CP keystore and truststore
#

# Print usage on stdout
usage() {
    echo "Usage: $0 -n <name> -p <passwd file> [-d <security dir>] [-o <outpout dir>]"
    echo
    echo "       Note: <passwd file> must not contain trailing non-printable characters"
    echo "             like carriage return or line-feed."
    echo "             For example, if the password is foo, then file size must be 3."
    exit 1
}

# do a clean up of unecessary files
clean() {
  # Remove CP certificate request
  rm -f ${OUTPUT_DIR}/certreq.${CP_NAME}

  # Remove exported certificate
  rm -f ${OUTPUT_DIR}/cert.${CP_NAME}

  # Remove CA exported certificate
  rm -f ${SECURITY_DIR}/nss/ca.cert

  # Bugid 6356370
  # Restoring initial umask in case this script is sourced.
  umask ${SAVED_UMASK}
}

# Print error and do a clean up before leaving with exit code 1
error() {
  print "ERROR: " $1
  # Bugid 6356399
  cat ${TMP_OUT}  | sort -u | ${GREP} -v Exception
  clean
  exit 1
}

EXEC_DIR=`dirname $0`

CP_NAME="null"
CP_PASS_FILE="null"
OUTPUT_DIR="null"
SECURITY_DIR="null"

while getopts n:p:d:o: c
do
  case $c in
    n) if [ $CP_NAME = "null" ]
       then
	 CP_NAME=$OPTARG
       else
	 usage
       fi ;;
	 
    p) if [ $CP_PASS_FILE = "null" ]
       then
	 CP_PASS_FILE=$OPTARG
       else
	 usage
       fi ;;
	 
    d) if [ $SECURITY_DIR = "null" ]
       then
	 SECURITY_DIR=$OPTARG
       else
         usage
       fi;;

    o) if [ $OUTPUT_DIR = "null" ]
       then
	 OUTPUT_DIR=$OPTARG
       else
         usage
       fi;;
	    
       \?) usage;;
    esac
done 2> /dev/null

[ $OUTPUT_DIR = "null" ] && OUTPUT_DIR="" ;
[ $SECURITY_DIR = "null" ] && SECURITY_DIR="" ;

. ${EXEC_DIR}/.env

# Bugid 6356370
# Setting umask
umask 022

# Sanity check
if [ ! -d ${SECURITY_DIR} ]
then
  echo "Error: security dir $SECURITY_DIR does not exist."
  exit 1
fi

if [ ! -d ${OUTPUT_DIR} ]
then
  echo "Error: security dir $OUTPUT_DIR does not exist."
  exit 1
fi

[ $CP_NAME = "null" ] && usage;
[ $CP_PASS_FILE = "null" ] && usage;
[ ! -f ${CP_PASS_FILE} ] && { echo "Error: password does not exist" ; exit 1; }
CP_PRIV_ALIAS=${CP_NAME}
CP_KEYSTORE=${OUTPUT_DIR}/keystore.${CP_NAME}

# Remove any previous installed files
rm -f ${CP_KEYSTORE}
rm -f ${OUTPUT_DIR}/certreq.${CP_NAME}
rm -f ${OUTPUT_DIR}/cert.${CP_NAME}

# Read the password from password file
CP_PASSWORD=`cat ${CP_PASS_FILE}`

# Generate the CP private key and the self-signed certificate
rm -f ${TMP_OUT}
print "${CP_PASSWORD}\n${CP_PASSWORD}" | ${KEYTOOL} -genkey \
        -alias ${CP_PRIV_ALIAS} \
	-keyalg $ALGO \
	-keysize $KEYSIZE \
	-sigalg $SIGALGO \
        -keystore ${CP_KEYSTORE} \
	-storetype ${STORETYPE} \
        -dname "$DNAME" \
	-validity $VALIDITY > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "cannot generate $CP_NAME private key."

# Sign the CP certificate with the MFWK CA certificate
# Create the certificate signing request for the agent
rm -f ${TMP_OUT}
print "${CP_PASSWORD}\n${CP_PASSWORD}" | ${KEYTOOL} -certreq \
	-alias ${CP_PRIV_ALIAS} \
	-sigalg $SIGALGO \
	-file ${OUTPUT_DIR}/certreq.${CP_NAME} \
	-keystore ${CP_KEYSTORE} > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "Error: cannot generate CP ($CP_NAME) certificate signing request."

# Sign the CP certificate with the CA 
rm -f ${TMP_OUT}
${CERTUTIL} -C \
	    -i ${OUTPUT_DIR}/certreq.${CP_NAME} \
	    -c mfwk_ca \
	    -v $VALIDITY \
	    -a \
	    -o ${OUTPUT_DIR}/cert.${CP_NAME}  \
	    -d ${SECURITY_DIR}/nss \
	    -f ${AGENT_PASS_FILE} > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "cannot sign agent certificate with CA."

# export MFWK CA self-signed certificate to a file
rm -f ${TMP_OUT}
${CERTUTIL} -L \
	    -n mfwk_ca \
	    -a \
	    -o ${SECURITY_DIR}/nss/ca.cert \
	    -d ${SECURITY_DIR}/nss \
	    -f ${AGENT_PASS_FILE} > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "cannot export CA self-signed certificate"	 

# Import CA certificate in the CP keystore
rm -f ${TMP_OUT}
print "${CP_PASSWORD}\n${CP_PASSWORD}" | ${KEYTOOL} -import \
	    -noprompt \
	    -alias mfwk_ca \
	    -file ${SECURITY_DIR}/nss/ca.cert \
	    -keystore ${CP_KEYSTORE} > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "cannot import CA self-signed certificate into CP ($CP_NAME) keystore"

# Import certificate reply
rm -f ${TMP_OUT}
print "${CP_PASSWORD}\n${CP_PASSWORD}" | ${KEYTOOL} -import \
	 -alias ${CP_PRIV_ALIAS} \
	 -file ${OUTPUT_DIR}/cert.${CP_NAME} \
	 -keystore ${CP_KEYSTORE} > ${TMP_OUT} 2>&1

[ $? -ne 0 ] && error "cannot import agent certificate into agent's keystore"

clean
exit 0