#!/bin/bash
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#   lib.sh of /CoreOS/opencryptoki/Library/token-manipulation
#   Description: provides basic function for token manipulation
#   Author: Karel Srot <ksrot@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#   Copyright (c) 2020 Red Hat, Inc.
#
#   This copyrighted material is made available to anyone wishing
#   to use, modify, copy, or redistribute it subject to the terms
#   and conditions of the GNU General Public License version 2.
#
#   This program is distributed in the hope that it will be
#   useful, but WITHOUT ANY WARRANTY; without even the implied
#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
#   PURPOSE. See the GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public
#   License along with this program; if not, write to the Free
#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
#   Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   library-prefix = pkcs
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

true <<'=cut'
=pod

=head1 NAME

opencryptoki/token-manipulation - provides basic function for token manipulation

=head1 DESCRIPTION

The library provides basic function for manipulation with
opencryptoki tokens, like initialization, cleanup etc.

=cut

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   Variables
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

true <<'=cut'
=pod

=head1 VARIABLES

Below is the list of global variables. When writing a new library,
please make sure that all global variables start with the library
prefix to prevent collisions with other libraries.

=over

=item pkcsUSER_PIN

USER PIN to be used when initializing a token. By default 01234567.

=item pkcsSO_PIN

SO PIN to be used when initializing a token. By default 76543210.

=item pkcsFACTORY_SO_PIN

Default (factory) SO PIN of a token. Initialized as 87654321.

=back

=cut

export pkcsUSER_PIN
[ -n "$pkcsUSER_PIN" ] || pkcsUSER_PIN="01234567"

export pkcsSO_PIN
[ -n "$pkcsSO_PIN" ] || pkcsSO_PIN="76543210"

export pkcsFACTORY_SO_PIN
[ -n "$pkcsFACTORY_SO_PIN" ] || pkcsFACTORY_SO_PIN="87654321"

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   Functions
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

true <<'=cut'
=pod

=head1 FUNCTIONS

=head2 pkcsGetTokenSlot

Return slot number for a token with specified type.

    pkcsGetTokenSlot type

=over

=item type

Token type to be used. Available options are matching
dynamic library suffixes from /etc/opencryptoki/opencryptoki.conf,
in particular : sw, tpm, ica, cca, ep11

=back

Returns 0 when the initialization was successfull, non-zero otherwise.

=cut


pkcsGetTokenSlot() {
    local TYPE=$1
    local CONF=/etc/opencryptoki/opencryptoki.conf
    local SLOT
    [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1
    if grep -q "^stdll = libpkcs11_$TYPE.so" $CONF; then
        SLOT=$( egrep "^(slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' )
	echo $SLOT
    else
        echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF"
        return 1
    fi
}

true <<'=cut'
=pod

=head2 pkcsInitToken

Initialize token specified using slot number and sets up
new SO PIN and USER PIN.

    pkcsInitToken type|slot [CURRENT_SO_PIN]

=over

=item type

Token specification using the token type.
Available options are: sw, tpm, ica, cca, ep11.

=item slot

Token specification using the slot number.


=back

Returns 0 when the initialization was successfull, non-zero otherwise.

=cut

pkcsInitToken() {

    local SLOT
    local LABEL="$2"
    [ -z $1 ] && echo "Error: pkcsInitToken: No token type specified"
    # if token specified using slot number
    if echo "$1" | grep -qE '^[0-9]+$'; then
        SLOT=$1
    else  # specified using token type
        SLOT=$( pkcsGetTokenSlot $1 ) || return 1
    fi
    echo SLOT: $SLOT
    # if label not specified, use the current value
    [ -z "$LABEL" ] && LABEL=`pkcsconf -t -c $SLOT | grep 'Label:' | sed 's/^.*Label: //'`
    echo LABEL: $LABEL
    local SOPIN=$2
    [ -z $SOPIN ] && SOPIN=$pkcsFACTORY_SO_PIN

    echo "pkcsInitToken: Initialize token"
    cat <<EOF | expect
spawn /usr/sbin/pkcsconf -c $SLOT -I
expect "Enter the SO PIN: "
sleep .1
send "${SOPIN}\r"
sleep .1
expect "label: "
sleep .1
send "${LABEL}\r"
sleep .1
expect eof {} \
"Incorrect PIN Entered." {exit 1}
exit 0
EOF

    echo "pkcsInitToken: Changing SO PIN"
    cat <<EOF | expect
spawn /usr/sbin/pkcsconf -c $SLOT -P
expect "Enter the SO PIN: "
sleep .1
send "${SOPIN}\r"
sleep .1
expect "Enter the new SO PIN: "
sleep .1
send "$pkcsSO_PIN\r"
sleep .1
expect "Re-enter the new SO PIN: "
sleep .1
send "$pkcsSO_PIN\r"
sleep .1
expect " " {exit 1}
exit 0
EOF
    if [ $? -eq 0 ]; then
        echo "pkcsInitToken: Succesfully changed SO PIN to $pkcsSO_PIN"
    else
        echo "Error: pkcsInitToken: Failed to change SO PIN"
        return 1
    fi

    echo "pkcsInitToken: Changing USER PIN"
    cat <<EOF | expect
spawn /usr/sbin/pkcsconf -c $SLOT -u
expect "Enter the SO PIN: "
sleep .1
send "$pkcsSO_PIN\r"
sleep .1
expect "Enter the new user PIN: "
sleep .1
send "$pkcsUSER_PIN\r"
sleep .1
expect "Re-enter the new user PIN: "
sleep .1
send "$pkcsUSER_PIN\r"
sleep .1
expect " " {exit 1}
exit 0
EOF
    if [ $? -eq 0 ]; then
        echo "pkcsInitToken: Succesfully changed USER PIN to $pkcsUSER_PIN"
    else
        echo "Error: pkcsInitToken: Failed to change USER PIN"
        return 1
    fi
}

true <<'=cut'
=pod

=head2 pkcsResetTokens

Makes a backup of /var/lib/opencryptoki and resets all tokens 
by removing all files from /var/lib/opencryptoki and shared 
memory files from /dev/shm.

=back

Returns 0 if the backup and removal passed, non-zero otherwise.

=cut


pkcsResetTokens() {
    rlFileBackup --clean --namespace pkcslib /var/lib/opencryptoki && \
    find /var/lib/opencryptoki/ -type f -exec rm {} \; && \
    rm -f /dev/shm/var.lib.opencryptoki.*
}

true <<'=cut'
=pod

=head2 pkcsRestoreTokens

Restores a backup of /var/lib/opencryptoki created in pkcsResetTokens().

=back

Returns 0 if the backup restore passed.

=cut


pkcsRestoreTokens() {
    rlFileRestore --namespace pkcslib
}

true <<'=cut'
=pod

=head1 EXECUTION

This library supports direct execution. When run as a task, phases
provided in the PHASE environment variable will be executed.
Supported phases are:

=over

=item Create

Create a new empty file. Use FILENAME to provide the desired file
name. By default 'foo' is created in the current directory.

=item Test

Run the self test suite.

=back

=cut

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   Verification
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#   This is a verification callback which will be called by
#   rlImport after sourcing the library to make sure everything is
#   all right. It makes sense to perform a basic sanity test and
#   check that all required packages are installed. The function
#   should return 0 only when the library is ready to serve.

pkcsLibraryLoaded() {
    if rpm=$(rpm -q opencryptoki); then
        rlLogDebug "Librar opencryptoki/token-manipulation running with $rpm"
        return 0
    else
        rlLogError "Package opencryptoki not installed"
        return 1
    fi
}

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   Authors
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

true <<'=cut'
=pod

=head1 AUTHORS

=over

=item *

Karel Srot <ksrot@redhat.com>

=back

=cut