#!/bin/sh
#
#pragma ident "@(#)install_skip_keys.sh	1.32 99/07/15"
#
# Script to install the issued key package or SUN ICG key package
# onto an End-system SKIP node


CATGETS=/usr/lib/skip/catgets
set_num=19	#  SI_admin
LS()		# localize a string
{
	msg_num=$1; shift
	if [ -x ${CATGETS} ]
	then ${CATGETS} $set_num $msg_num "$*"
	else echo "$*"
	fi
}

bombout(){
	echo $* `LS 200 "- Exiting...."`
	exit 1
}

install_icg_keys(){
	if [ $# -lt 1 ]
	then
		echo "$0 -icg [dirname]"
		exit 1
	fi

	dirname=$1
	if [ ! -d $dirname ]
	then
		echo $0 `LS 201 "- directory does not exist:"` $dirname
		exit 1;
	fi

	if [  -f "$dirname/dh.key" ]
	then
		KEYFILE=$dirname/dh.key
	else
		if [ -f "$dirname/DH.KEY" ]
		then
			KEYFILE=$dirname/DH.KEY
		else
			bombout `LS 202 "File dh.key is missing from"` $dirname
		fi
	fi

	if [ -f "$dirname/dh.crt" ]
	then
		CRTFILE=$dirname/dh.crt
	else
		if [ -f "$dirname/DH.CRT" ]
		then
			CRTFILE=$dirname/DH.CRT
		else
			bombout `LS 203 "File dh.crt is missing from"` $dirname
		fi
	fi

	if [ -f "$dirname/sunicg_c" ]
	then
		CAFILE=$dirname/sunicg_c
	else
		if [ -f "$dirname/SUNICG_C" ]
		then
			CAFILE=$dirname/SUNICG_C
		else
			bombout `LS 204 "File sunicg_c is missing from"` $dirname
		fi
	fi

	skipca -a -c $CAFILE
	if [ $? -eq 1 ]
	then
		bombout `LS 205 "Unable to add Trusted CA"`
	elsif [ $? -eq 2]
		echo `LS 206 "Non-fatal error, continuing..."`
	fi

	if [ -f $dirname/secret_i ]
	then
		sf=$dirname/secret_i
		so=-z

	elif [ -f $dirname/SECRET_I ]
	then
		sf=$dirname/SECRET_I
		so=-z

	elif [ -f $dirname/dh.key ]
		then
			sf=$dirname/dh.key
			so=-Z
	elif [ -f $dirname/DH.KEY ]
		then
			sf=$dirname/DH.KEY
			so=-Z
	else
		bombout `LS 207 "Unable to find my own key"`
	fi


	skiplocal -a $so $sf -c $CRTFILE  -t x509 -T soft -n 1
	if [ $? -eq 1 ]
	then
		bombout `LS 208 "Unable to create local identity"`
	fi

	skipdb -a -n 1 -t x509 -c $CRTFILE
	if [ $? -eq 1 ]
	then 
		bombout `LS 209 "Unable to add my own certificate to the database"`
	fi
}

install_pkg_keys(){
	filename=$1
	DIR=/tmp/skip$$
	mkdir $DIR
	cp $1 $DIR/tempfile
	cd $DIR
	
	if (grep 'begin' tempfile >/dev/null)
	then
		echo "$0: uudecode..."
		uudecode <tempfile
	elif (grep 'BEGIN PGP MESSAGE' tempfile >/dev/null)
	then
		echo $0 `LS 210 ": running PGP to decrypt..."`
		cat tempfile | pgp -f >keys.tar
	else
		bombout $0 `LS 211 ": file does not appear to be key file."`
	fi
	
	tar -xf keys.tar

#	Disgusto hack so that old ZA CA certificates will be understood
	if [ -f my_X509_cert ]
	then
		md5 my_X509_cert my_secret_i ZeroAssurance_Cert > md5.newsums
	else
		md5 dh_params my_dh_cert my_dh_secret my_secret_i ZeroAssurance_Cert > md5.newsums
	fi
	
	echo `LS 212 "Comparing MD5 checksums..."`
	diff md5.newsums md5.sums 
	
	if [ $? -ne 0 ]
	then
		bombout $0 `LS 213 ": md5 sums do not match!!!"`
	fi
	echo $0 `LS 214 ": checksums are good."`
	echo $0 `LS 215 ": Moving files into place...."`
	
	skipca -a -c ZeroAssurance_Cert
	if [ $? -eq 1 ]
	then
		bombout `LS 216 "Unable to add CA certificate"`
	fi

#	Disgusto hack so that old ZA CA certificates will be understood
	if [ -f my_X509_cert ]
	then
		skiplocal -a -z my_secret_i -c my_X509_cert -t x509 -T soft -n 1
		if [ $? -eq 1 ]
		then
			bombout `LS 208 "Unable to create local identity"`
		fi
		
		skipdb -a -n 1 -t x509 -c my_X509_cert	
		if [ $? -eq 1 ]
		then
			bombout `LS 217 "Couldn't add my own certificate to the DB"`
		fi
	else
		skiplocal -a -z my_secret_i -c my_dh_cert -t x509 -T soft -n 1
		if [ $? -eq 1 ]
		then
			bombout `LS 208 "Unable to create local identity"`
		fi
		skipdb -a -n 1 -t x509 -c my_dh_cert	
		if [ $? -eq 1 ]
		then
			bombout `LS 217 "Couldn't add my own certificate to the DB"`
		fi
	fi
	cd /tmp
	rm -rf $DIR
}


SUNOS=`uname -r | sed 's/\..*//g'`
if [ $SUNOS = 5 ]; then
	SKIP_BIN=/usr/sbin
	SKIP_ETC=/etc/skip/
else
	SKIP_BIN=/usr/bin
	SKIP_ETC=/etc/skip
fi

SKIP_PATH=${SKIP_PATH-$SKIP_BIN}
PATH=${SKIP_PATH}:/bin:/usr/ucb:$PATH export PATH

if [ $# -lt 1 ]
then
	echo $0 `LS 218 "certificate-file | floppy-path "`
	exit 1
fi
USER=`whoami`

if [ $USER != "root" ]
then
	echo $0 `LS 219 ": you must be root to run this command."`
	exit 1
fi

if [ ! -d $SKIP_PATH ]; then
	echo $0 `LS 220 ": SKIP not installed: cannot find"` $SKIP_PATH
	exit 1
fi

if [ ! -d $SKIP_ETC ]; then
	echo $0 `LS 221 ": : SKIP not installed: cannot find"` $SKIP_ETC
	exit 1
fi

skiplocal -i -q
skipca -i -q

if [ "$1" = "-icg" ]
then
	shift
	if [ -f $1 ]
	then
		bombout `LS 222 "Path is not a directory.  Did you want to use -icg?"`
	fi
	if [ -d $1 ]
	then
		install_icg_keys $*
	else
		bombout `LS 223 "Directory does not exist:"` $1
	fi
else
	if [ -d $1 ]
	then
		bombout `LS 224 "Path is a directory.  Did you want to use -icg?"`
	fi
	if [ -f $1 ]
	then
		install_pkg_keys $*
	else 
		bombout `LS 225 "File does not exist:"`	$1
	fi
fi
	

[ "$EFS_INSTALL" ] || echo $0 `LS 226 ": you should now reboot the machine to initialize SKIP."`

exit 0
