#!/bin/bash
keyring_key()
{
keyctl search @u user "Internal (Software) Token:localhost:password" >/tmp/null 2>&1
}

clear_key()
{
	keyring_key
	if [ $? -eq 0 ]
	then
		keyctl unlink `keyctl search @u user "Internal (Software) Token:localhost:password"` >/tmp/null
	fi
}
cleanup()
{
echo "Clean UP"
dsctl localhost remove --do-it >/tmp/null
clear_key
}
create_instance()
{
echo "Create instance"
dscreate create-template | sed -e 's/;root_password.*$/root_password = Secret123/' -e 's/^;suffix.*$/suffix = dc=example,dc=com/' -e 's/^;create_suffix_entry.*/create_suffix_entry = True/' > /tmp/template
dscreate from-file /tmp/template >/dev/null
}

test_keyring_key()
{
RC=${1:-0}
keyring_key
val=$?
if [ $RC -eq 0 ]
then
        # a success is expected
        #echo "test_keyring_key: expects success"
        if [ $val -eq 0 ]
        then
                echo "test_keyring_key: success"
        else
                echo "test_keyring_key: fail"
        fi
else
        # a failure is expected
        #echo "test_keyring_key: expects fail"
        if [ $val -ne 0 ]
        then
                echo "test_keyring_key: success"
        else
                echo "test_keyring_key: fail"
        fi
fi

}

test_keyring_key_value()
{
        keyring_key
        if [ $? -ne 0 ]
        then
            return
        fi
        keyid=`keyctl search @u user "Internal (Software) Token:localhost:password"`
        VAL="`keyctl pipe $keyid`"
        if [ "`sed 's/^.*Token://' /etc/dirsrv/slapd-localhost/pin.txt.sav`" = "$VAL" ]
        then
                echo "test_keyring_key_value: success"
        else
                echo "test_keyring_key_value: fail"
        fi
}
test_restart_with_pin()
{
    # should restart without prompt as there is a pin.txt file
	systemctl restart dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_with_pin: success"
	else
		echo "test_restart_with_pin: fail"
	fi

    # There is a pin.txt, no reason there is key
    keyring_key
    if [ $? -eq 0 ]
    then
            echo "test_no_keyring_key: fail"
    else
            echo "test_no_keyring_key: success"
    fi
}

test_restart_without_pin()
{
	mv /etc/dirsrv/slapd-localhost/pin.txt /etc/dirsrv/slapd-localhost/pin.txt.sav
	MYTERM=`tty`
	(sleep 5; sed 's/^.*Token://' /etc/dirsrv/slapd-localhost/pin.txt.sav > $MYTERM; echo > $MYTERM) &
	systemctl restart dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_without_pin: success"
	else
		echo "test_restart_without_pin: fail"
	fi

    # now that key should be in keyring
    test_keyring_key
    test_keyring_key_value
}
test_restart_keyring_no-pin_no-security()
{
    echo
    echo
    echo "test_restart_keyring_no-pin_no-security"
    echo
    echo
    echo "step 1: remove security"
	systemctl stop dirsrv@localhost.service
    sed 's/^nsslapd-security.*$/nsslapd-security: off/' /etc/dirsrv/slapd-localhost/dse.ldif > /etc/dirsrv/slapd-localhost/dse.ldif.new
    cp /etc/dirsrv/slapd-localhost/dse.ldif /etc/dirsrv/slapd-localhost/dse.ldif.sav
    mv /etc/dirsrv/slapd-localhost/dse.ldif.new /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldap://localhost:389 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_keyring_no-pin_no-security (389): success"
	else
		echo "test_restart_keyring_no-pin_no-security (389): fail"
	fi
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -ne 0 ]
	then
		echo "test_restart_keyring_no-pin_no-security (636): success"
	else
		echo "test_restart_keyring_no-pin_no-security (636): fail"
	fi

    # now that key should be in keyring
    test_keyring_key
    test_keyring_key_value

    # restore previous setting
	systemctl stop dirsrv@localhost.service
    cp /etc/dirsrv/slapd-localhost/dse.ldif.sav /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
}
test_restart_keyring_pin_no-security()
{
    echo
    echo
    echo "test_restart_keyring_pin_no-security"
    echo
    echo
    echo "step 1 : add pin file"
	cp /etc/dirsrv/slapd-localhost/pin.txt.sav /etc/dirsrv/slapd-localhost/pin.txt

    echo "step 2: remove security"
	systemctl stop dirsrv@localhost.service
    sed 's/^nsslapd-security.*$/nsslapd-security: off/' /etc/dirsrv/slapd-localhost/dse.ldif > /etc/dirsrv/slapd-localhost/dse.ldif.new
    cp /etc/dirsrv/slapd-localhost/dse.ldif /etc/dirsrv/slapd-localhost/dse.ldif.sav
    mv /etc/dirsrv/slapd-localhost/dse.ldif.new /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldap://localhost:389 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_keyring_pin_no-security (389): success"
	else
		echo "test_restart_keyring_pin_no-security (389): fail"
	fi
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -ne 0 ]
	then
		echo "test_restart_keyring_pin_no-security (636): success"
	else
		echo "test_restart_keyring_pin_no-security (636): fail"
	fi

    # now that key should be in keyring
    test_keyring_key
    test_keyring_key_value

    # restore previous setting
	systemctl stop dirsrv@localhost.service
    cp /etc/dirsrv/slapd-localhost/dse.ldif.sav /etc/dirsrv/slapd-localhost/dse.ldif
	mv /etc/dirsrv/slapd-localhost/pin.txt /etc/dirsrv/slapd-localhost/pin.txt.sav
    systemctl start dirsrv@localhost.service
}
test_restart_no-keyring_pin_no-security()
{
    echo
    echo
    echo "test_restart_no-keyring_pin_no-security"
    echo
    echo
    echo "step 1: remove key"
    clear_key

    echo "step 2 : add pin file"
	cp /etc/dirsrv/slapd-localhost/pin.txt.sav /etc/dirsrv/slapd-localhost/pin.txt

    echo "step 3: disable security"
	systemctl stop dirsrv@localhost.service
    sed 's/^nsslapd-security.*$/nsslapd-security: off/' /etc/dirsrv/slapd-localhost/dse.ldif > /etc/dirsrv/slapd-localhost/dse.ldif.new
    cp /etc/dirsrv/slapd-localhost/dse.ldif /etc/dirsrv/slapd-localhost/dse.ldif.sav
    mv /etc/dirsrv/slapd-localhost/dse.ldif.new /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldap://localhost:389 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_no-keyring_pin_no-security (389): success"
	else
		echo "test_restart_no-keyring_pin_no-security (389): fail"
	fi
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -ne 0 ]
	then
		echo "test_restart_no-keyring_pin_no-security (636): success"
	else
		echo "test_restart_no-keyring_pin_no-security (636): fail"
	fi

    # now that key should be in keyring
    test_keyring_key 1 # failure
    test_keyring_key_value

    # restore previous setting
	systemctl stop dirsrv@localhost.service
    cp /etc/dirsrv/slapd-localhost/dse.ldif.sav /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
    rm /etc/dirsrv/slapd-localhost/pin.txt
}
test_restart_no-keyring_no-pin_no-security()
{
    echo
    echo
    echo "test_restart_no-keyring_no-pin_no-security"
    echo
    echo
    echo "step 1: remove key"
    clear_key

    echo "step 2: remove key"
    rm -f /etc/dirsrv/slapd-localhost/pin.txt

    echo "step 3: disable security"
	systemctl stop dirsrv@localhost.service
    sed 's/^nsslapd-security.*$/nsslapd-security: off/' /etc/dirsrv/slapd-localhost/dse.ldif > /etc/dirsrv/slapd-localhost/dse.ldif.new
    cp /etc/dirsrv/slapd-localhost/dse.ldif /etc/dirsrv/slapd-localhost/dse.ldif.sav
    mv /etc/dirsrv/slapd-localhost/dse.ldif.new /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldap://localhost:389 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -eq 0 ]
	then
		echo "test_restart_no-keyring_no-pin_no-security (389): success"
	else
		echo "test_restart_no-keyring_no-pin_no-security (389): fail"
	fi
	LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost/ ldapsearch -x -H ldaps://localhost:636 -D "cn=directory manager" -w Secret123 -LLL -b "" -s base > /dev/null 2>&1
	if [ $? -ne 0 ]
	then
		echo "test_restart_no-keyring_no-pin_no-security (636): success"
	else
		echo "test_restart_no-keyring_no-pin_no-security (636): fail"
	fi

    # now that key should be in keyring
    test_keyring_key 1 # failure
    test_keyring_key_value

    # restore previous setting
	systemctl stop dirsrv@localhost.service
    cp /etc/dirsrv/slapd-localhost/dse.ldif.sav /etc/dirsrv/slapd-localhost/dse.ldif
    systemctl start dirsrv@localhost.service
}

cleanup
create_instance
test_restart_with_pin
test_restart_without_pin
test_restart_keyring_no-pin_no-security
test_restart_keyring_pin_no-security
test_restart_no-keyring_pin_no-security
test_restart_no-keyring_no-pin_no-security