#!/bin/sh

# This test generates a self-signed certificate using the pkcs11prov provider
# from libp11 and a software-based "smart card" (softhsm2). It's based on
# https://github.com/OpenSC/libp11/blob/master/README.md#using-p11tool-and-openssl-from-the-command-line

set -e

PIN="1234"
SO_PIN="12341234"
URI="pkcs11:model=SoftHSM%20v2"
SUBJECT="CN=libp11-DEP8"

workdir=$(mktemp -d)
ssl_cnf="${workdir}/ssl.cnf"
req_pem="${workdir}/req.pem"
cert_pem="${workdir}/cert.pem"
DEB_BUILD_MULTIARCH="$(dpkg-architecture -q DEB_BUILD_MULTIARCH)"

cleanup() {
    if [ -n "${workdir}" -a -d "${workdir}" ]; then
        rm -rf "${workdir}"
    fi
    rm -rf /var/lib/softhsm/tokens/*
}

trap cleanup EXIT

cat > ${ssl_cnf} <<EOF
HOME = .
openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect

[default_sect]
activate = 1

[pkcs11_sect]
identity = pkcs11prov
module = /usr/lib/${DEB_BUILD_MULTIARCH}/ossl-modules/pkcs11prov.so
pkcs11_module = /usr/lib/${DEB_BUILD_MULTIARCH}/softhsm/libsofthsm2.so
activate = 1
EOF

echo "Initializing softhsm2"
softhsm2-util --init-token --free --label test-token --pin ${PIN} --so-pin ${SO_PIN}

echo "Generating RSA key in the softhsm2 token"
p11tool \
    --provider /usr/lib/${DEB_BUILD_MULTIARCH}/softhsm/libsofthsm2.so \
    --login --generate-rsa --bits 1024 --label test-key --set-pin ${PIN} \
    --outfile /dev/stdout "${URI}"

echo "Listing generated private key"
p11tool \
    --provider /usr/lib/${DEB_BUILD_MULTIARCH}/softhsm/libsofthsm2.so \
    --list-privkeys --login --set-pin ${PIN} "${URI}"

echo "With pkcs11prov provider, generate a certificate request with the RSA key in the softhsm2 token"
OPENSSL_CONF="${ssl_cnf}" openssl \
    req -new -key "${URI};object=test-key;pin-value=${PIN}" \
    -out ${req_pem} -text -x509 -subj "/${SUBJECT}" \
    -provider pkcs11prov -provider default

echo "Sign the request with the RSA key"
OPENSSL_CONF="${ssl_cnf}" openssl \
    x509 -signkey "${URI};object=test-key;pin-value=${PIN}" \
    -in ${req_pem} -out ${cert_pem} \
    -provider pkcs11prov -provider default

echo "Confirm the generated certificate is valid and has the subject we specified"
s=$(openssl x509 -in ${cert_pem} -noout -subject | sed -r 's,^subject=,,' | tr -d ' ')
test "${s}" = "${SUBJECT}"
