#
# Common shell routines for testing security extensions
# Copyright (c) 2012-2014,2017,2022 Red Hat.
#

# get standard environment, filters and checks
. ./common.product
. ./common.filter
. ./common.check

# if no secure_sockets in local libpcp, don't bother
#
_get_libpcp_config
[ "$secure_sockets" = "true" ] || _notrun "Secure sockets not supported"

usersdb=${HOME}/.pki/nssdb
collectordb=$tmp/pki/nssdb
collectorpw=$tmp/pki/nssdb/pass
PCP_SECURE_DB_METHOD=${PCP_SECURE_DB_METHOD-'sql:'}
__certopts="-d $PCP_SECURE_DB_METHOD$collectordb -f $collectorpw -z $tmp.rand"

userid=`id -u`
groupid=`id -g`
username=`id -u -n`
groupname=`id -g -n`

qahost=`_get_fqdn`
hostname=`hostname | sed -e 's/\..*//'`

sasl_notrun_checks()
{
    __gotplugins=false
    which pluginviewer >/dev/null 2>&1 && __gotplugins=true
    if $__gotplugins
    then
	pluginviewer=pluginviewer
    else
	which saslpluginviewer >/dev/null 2>&1 && __gotplugins=true
	pluginviewer=saslpluginviewer
    fi
    $__gotplugins || _notrun "SASL pluginviewer utility unavailable"

    for __helper in $@
    do
	which $__helper >/dev/null 2>&1 || _notrun "SASL $__helper tool unavailable"
    done
}

nss_notrun_checks()
{
    [ -d "$PCP_SECURE_DB_PATH" ] || _notrun "NSS secure DB not installed"
    which certutil >/dev/null 2>&1 || _notrun "certutil not installed (NSS tools)"
    [ -c /dev/urandom ] || _notrun "No random number generator special file found"

    __fips=false	# testing for exposure to Red Hat bug 1035509
    __fipsfile=/proc/sys/crypto/fips_enabled
    if [ -f "$__fipsfile" ]
    then
	test `cat "$__fipsfile"` -ne 0 && __fips=true
    fi
    $__fips && _notrun "FIPS mode interacts badly with system NSS databases"
}

nss_cleanup()
{
    unset PCP_SECURE_SOCKETS
    unset PCP_SECURE_DB_PATH

    # restore any modified pmcd configuration file
    if test -f $PCP_PMCDOPTIONS_PATH.$seq
    then
	_restore_config $PCP_PMCDOPTIONS_PATH
    fi

    # restore user certificate DB from existing installation
    if test -d $usersdb.$seq
    then
	_restore_config $usersdb
    fi
}

# backup pmcd configuration and certificate DBs from existing installation
nss_backup()
{
    for __f in $PCP_PMCDOPTIONS_PATH $usersdb
    do
	[ -e "$__f" ] && _save_config "$__f"
    done
}

nss_filter_pminfo()
{
    sed \
	-e "s/$hostname/HOST/g" \
	-e "s/$qahost/QAHOST/g" \
	-e "/^SHA1 fingerprint is .*/d" \
	-e 's/value [0-9][0-9]*/value NUMBER/' \
	-e "/Cannot connect to PMCD on host/s/Unknown code ___f 13/Peer's Certificate issuer is not recognized./" \
	-e "/Cannot connect to PMCD on host/s/Unknown code ___f 10/Peer's certificate has an invalid signature./"
}

nss_setup_randomness()
{
    dd if=/dev/urandom of=$tmp.rand bs=1 count=10000 >/dev/null 2>&1
}

nss_subject_name()
{
    __fqdn=$1
    __host=$2
    echo $__fqdn | sed -e "s/^$__host\./dc=/g" -e 's/\./,dc=/g'
}

nss_setup_certificates()
{
    __certdomain=`nss_subject_name $qahost $hostname`

    echo "setup_certificates host details:" >>$seq_full
    echo "HOST=$hostname" >>$seq_full
    echo "QAHOST=$qahost" >>$seq_full
    echo "DOMAIN=$__certdomain" >>$seq_full

    # create self-signed (-x) server certificate locally
    echo "== Creating local certificates" | tee -a $seq_full
    $sudo certutil $__certopts -S -x \
	-n "Local CA certificate" -s "CN=\"Local PCP Installation, $__certdomain\""  \
	-t "CT,,"  >>$seq_full 2>&1
    sleep 1 # so that the next cert does not get the same serial number
    $sudo certutil $__certopts -S \
	-n "PCP Collector certificate" -s "CN=\"PCP Collector\"" \
	-c "Local CA certificate" -8 "$qahost,$hostname" \
	-t "P,," >>$seq_full 2>&1
    echo "== Certificate DB and local certificates created" | tee -a $seq_full

    # export ascii copy of the certificate for later use
    $sudo certutil $__certopts -L -n "Local CA certificate" -a > $tmp.cacert.asc
    cat $tmp.cacert.asc >>$seq_full
}

nss_setup_collector()
{
    __withcerts=$1
    __fqdn=$2
    __host=$3
    __force_client_cert=$4

    # prepare new locations for certificates
    $sudo rm -fr $collectordb
    $sudo mkdir -p -m 0755 $collectordb

    # prepare password file for certificates
    echo "$seq.password" > $tmp.password
    $sudo mv $tmp.password $collectorpw

    echo "== Creating empty certificate DB" | tee -a $seq_full
    $sudo certutil $__certopts -N

    $__withcerts && nss_setup_certificates $__fqdn $__host

    if [ -d $collectordb ]
    then
	$sudo chmod -R 0644 $collectordb/*
	$sudo chown -R $PCP_USER:$PCP_GROUP $collectordb
    fi

    if [ -n "$__force_client_cert" ]
    then
	__cert_option="-Q"
    fi

    cat <<End-Of-File >$tmp.options
# Dummy lines added by PCP QA test $seq on `date`
#
-l $tmp.pmcd.log
-C $PCP_SECURE_DB_METHOD$collectordb
-P $collectorpw
$__cert_option
End-Of-File
    $sudo cp $tmp.options $PCP_PMCDOPTIONS_PATH
    __grp=root
    case $PCP_PLATFORM
    in
	freebsd|netbsd|openbsd)
		__grp=wheel
		;;
    esac
    $sudo chown root:$__grp $PCP_PMCDOPTIONS_PATH
    echo "Start pmcd, modified \$PCP_PMCDOPTIONS_PATH (pmcd.options):" | tee -a $seq_full
    if ! _service pmcd restart >$tmp.out 2>&1; then _exit 1; fi \
    | tee -a $seq_full | _filter_pcp_restart
    _wait_for_pmcd || _exit 1
    if ! _service pmlogger restart 2>&1; then _exit 1; fi \
    | tee -a $seq_full | _filter_pcp_restart
    _wait_for_pmlogger || _exit 1
    grep -i 'starting pmcd' $tmp.out | sed -e "s/$$/MYPID/" | _filter_pcp_start
    echo "Checking pmcd.log for unexpected messages" | tee -a $seq_full
    grep -E 'Error:|Info:' $tmp.pmcd.log | sed -e '/PMNS file "DEFAULT" is unchanged/d'
    cat $tmp.pmcd.log >>$seq_full
    echo "--- end of pmcd.log ---" >>$seq_full
}

nss_setup_empty_userdb()
{
    $sudo rm -fr $usersdb
    echo > $tmp.empty
    mkdir -p -m 0755 $usersdb
    certutil -N -d $PCP_SECURE_DB_METHOD$usersdb -f $tmp.empty

    PCP_SECURE_DB_PATH="$usersdb"; export PCP_SECURE_DB_PATH
}

nss_import_cert_userdb()
{
    certutil -A -d $PCP_SECURE_DB_METHOD$usersdb -n "Local CA certificate" -t "CT,," -a -i $tmp.cacert.asc
}

find_users()
{
    __limit=$1
    tail -n $__limit /etc/passwd | $PCP_AWK_PROG -F: '{ print  $1 }'
}

find_groups()
{
    __limit=$1
    tail -n $__limit /etc/group | $PCP_AWK_PROG -F: '{ print  $1 }'
}

# lines like ...
#   [DATETIME] pmdasample(PID) Info: Attribute: ctx=N groupid=999
#   [DATETIME] pmdasample(PID) Info: Attribute: ctx=N userid=999
# for the "user" and "group" belonging to "pcp" are not from the QA
# tests (likely from pmlogger or some other random process fetching
# metrics from the local pmcd) and need to be culled
#
filter_sample_log_credentials()
{
    __pcp_user=`grep '^pcp:' /etc/passwd | $PCP_AWK_PROG -F: '{print $3}'`
    __pcp_group=`grep '^pcp:' /etc/group | $PCP_AWK_PROG -F: '{print $3}'`
    grep Info $PCP_LOG_DIR/pmcd/sample.log \
    | sed \
	-e '/processid=/d' \
        -e '/ctx=[0-9][0-9]*/s//ctx=N/' \
        -e "s/userid=$userid/userid=UID/g" \
        -e "s/groupid=$groupid/groupid=GID/g" \
        -e "s/username=$username/username=USER/g" \
        -e '/pmdasample([0-9][0-9]*)/s//pmdasample(PID)/' \
        -e 's/^\[[A-Z].. [A-Z]..  *[0-9][0-9]* ..:..:..]/[DATETIME]/' \
	-e "/userid=$__pcp_user\$/d" \
	-e "/groupid=$__pcp_group\$/d" \
    # end
}

# check openssl is available and an acceptable version is installed.
#
_check_tls()
{
    if [ -z "$tmp" ]
    then
	echo "_check_tls: Arrgh \$tmp not set, I give up"
	return
    fi

    openssl help 2>/dev/null || _notrun "No openssl binary found"

    if [ -f /etc/lsb-release ]
    then
	. /etc/lsb-release
        # TLS tests fail under Ubuntu 19.10 with a myriad of errors involving
        # the use of uninitialized values.  The code paths vary but typically
        # involve libuv -> libssl -> libcrypto.
	if [ "$DISTRIB_ID" = Ubuntu ]
	then
	    case "$DISTRIB_RELEASE"
	    in
		19.10)
		    _notrun "problems with libuv, libssl, libcrypto and valgrind on $DISTRIB_ID $DISTRIB_RELEASE"
		;;
	    esac
        fi
    fi
}

# creates self-signed (insecure) certificates for QA testing only.
#
_setup_cert()
{
    local __name=$1
    local __cn="$2"
    local __opts="$3"

    if [ -z "$tmp" ]
    then
	echo "_setup_cert: Arrgh \$tmp not set, I give up"
	return
    fi

    local __keyfile=$tmp.tls/${__name}.key
    local __certfile=$tmp.tls/${__name}.crt

    [ -d $tmp.tls ] || mkdir $tmp.tls

    # some versions of openssl babble if this file does not exist
    # with some good "randomness"
    #
    [ -f $HOME/.rnd ] || openssl rand 10240 >$HOME/.rnd

    openssl genrsa -out $__keyfile 2048 >>$tmp.tls/openssl.log 2>&1

    openssl req \
	    -new -sha256 \
	    -subj "/O=PCP QA/CN=$__cn" \
	    -key $__keyfile \
    | openssl x509 -req -sha256 -days 365 $__opts \
	    -CA $tmp.tls/ca.crt \
	    -CAkey $tmp.tls/ca.key \
	    -CAserial $tmp.tls/ca.txt \
	    -CAcreateserial \
	    -out $__certfile >>$tmp.tls/openssl.log 2>&1

    echo "--- openssl.log after _setup_cert() ---" >>$seq_full
    cat $tmp.tls/openssl.log >>$seq_full
    echo "--- end openssl.log ---" >>$seq_full
}

# Configure an /etc/pcp/tls.conf file for secure socket communication
# - used by PMAPI clients, pmcd and pmproxy - caller must ensure that
# a backup of tls.conf has been made, and restore it at end of test.
#
# But first, setup keys and certs where anyone can read 'em.
#
_setup_tls()
{
    if [ -z "$tmp" ]
    then
	echo "_setup_tls: Arrgh \$tmp not set, I give up"
	return
    fi
    if ! mkdir $tmp.tls
    then
	echo "_setup_tls: Arrgh cannot create $tmp.tls dir, I give up"
	return
    fi

    openssl genrsa -out $tmp.tls/ca.key 4096 >>$tmp.tls/openssl.log 2>&1

    openssl req \
	    -x509 -new -nodes -sha256 -days 3650 \
	    -subj "/O=PCP QA/CN=Certificate Authority" \
	    -key $tmp.tls/ca.key \
	    -out $tmp.tls/ca.crt >>$tmp.tls/openssl.log 2>&1

    cat >$tmp.tls/openssl.cnf <<__END__
[ server_cert ]
keyUsage = digitalSignature, keyEncipherment
nsCertType = server

[ client_cert ]
keyUsage = digitalSignature, keyEncipherment
nsCertType = client
__END__

    _setup_cert server "Server-only" "-extfile $tmp.tls/openssl.cnf -extensions server_cert"
    _setup_cert client "Client-only" "-extfile $tmp.tls/openssl.cnf -extensions client_cert"
    _setup_cert pcp "Generic-cert"

    $sudo chown -R $PCP_USER:$PCP_GROUP $tmp.tls
    $sudo chmod ugo+r $tmp.tls/*

    echo >$tmp.tls.conf
    echo "# settings related to TLS certificates and keys" >>$tmp.tls.conf
    echo "# created by QA test $seq" >>$tmp.tls.conf
    echo >>$tmp.tls.conf
    echo "tls-key-file = $tmp.tls/pcp.key" >>$tmp.tls.conf
    echo "tls-cert-file = $tmp.tls/pcp.crt" >>$tmp.tls.conf
    echo "tls-ca-cert-file = $tmp.tls/ca.crt" >>$tmp.tls.conf

    $sudo cp $tmp.tls.conf $PCP_TLSCONF_PATH
    echo "--- new $PCP_TLSCONF_PATH ---" >>$seq_full
    cat $PCP_TLSCONF_PATH >>$seq_full
    echo "--- end $PCP_TLSCONF_PATH ---" >>$seq_full

    echo "--- openssl.log after _setup_tls() ---" >>$seq_full
    cat $tmp.tls/openssl.log >>$seq_full
    echo "--- end openssl.log ---" >>$seq_full
}