#!/usr/bin/sh
# -*- mode: sh; sh-shell: sh -*-
#
# generate new key for this host
#
# Copyright (C) 2001, 2002  Henry Spencer.
# Copyright (C) 2014-2020 Paul Wouters <[email protected]>
# Copyright (C) 2014, 2016 Tuomo Soini <[email protected]>
# Copyright (C) 2016, Andrew Cagney <[email protected]>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <https://www.gnu.org/licenses/gpl2.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#

me="ipsec newhostkey"
usage="Usage:
	$me [--seeddev device] [--keytype rsa] [--bits n]
	$me [--seeddev device] --keytype ecdsa [--curve curve]

	other options: [--quiet] [--hostname host] [--nssdir /etc/ipsec.d] \\
		[--password password]"

bits=
curve=
keytype=rsa
verbose=
host=
seeddev="--seeddev /dev/random"
nssdir="/etc/ipsec.d"
password=
while [ $# != 0 ] ; do
    case "$1" in
	--bits)
	    bits="${2}"
	    shift
	    ;;
	--curve)
	    curve="${2}"
	    shift
	    ;;
	--keytype)
	    keytype="${2}"
	    shift
	    ;;
	--quiet)
	    verbose=
	    ;;
	--verbose)
	    verbose="--verbose"
	    ;;
	--version)
	    echo "${me} $IPSEC_VERSION"
	    exit 0
	    ;;
	--seeddev)
	    seeddev="--seeddev ${2}"
	    shift
	    ;;
	--nssdir)
	    nssdir="${2}"
	    shift
	    ;;
	--password)
	    password="--password ${2}"
	    shift
	    ;;
	--help)
	    echo "$usage"
	    exit 0
	    ;;
	--)
	    shift
	    break
	    ;;
	-*)
	    echo "${me}: unknown option \`$1'" >&2
	    exit 2
	    ;;
	*)
	    break
	    ;;
    esac
    shift
done

if [ -n "$bits" ] && [ -n "$curve" ]; then
    echo "${me}: --bits and --curve are mutually exclusive"
    exit 2
fi

case "$keytype" in
    rsa)
	if [ -n "$curve" ]; then
	    echo "${me}: --curve and --keytype rsa are mutually exclusive"
	fi
	;;
    ecdsa)
	if [ -n "$bits" ]; then
	    echo "${me}: --bits and --keytype ecdsa are mutually exclusive"
	fi
	;;
    *)
	echo "${me}: unknown key type \`$keytype'" >&2
	exit 2
	;;
esac

if [ ! -d ${nssdir} ]; then
    echo "No such directory: ${nssdir}"
    exit 255
fi

certutil -L -d "sql:${nssdir}" >/dev/null 2>/dev/null
RETVAL=$?
if [ ${RETVAL} -eq 255 ]; then
    echo "NSS database in ${nssdir} not initialized."
    echo "    Please run 'ipsec initnss --nssdir ${nssdir}'"
    exit 255
fi

case "$keytype" in
    rsa)
	key=$(ipsec rsasigkey ${verbose} ${seeddev} --nssdir ${nssdir} ${password} ${host} ${bits})
	;;
    ecdsa)
	key=$(ipsec ecdsasigkey ${verbose} ${seeddev} --nssdir ${nssdir} ${password} ${host} ${curve})
	;;
esac

RETVAL=$?
if [ ${RETVAL} -ne 0 ]; then
    exit ${RETVAL}
fi