1baafe
#!/bin/sh
1baafe
#
1baafe
# This script will initialise token storage of softhsm PKCS11 provider
1baafe
# in custom location. Is useful to store tokens in non-standard location.
1baafe
#
1baafe
# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
1baafe
# Quotes around eval are mandatory!
1baafe
# Recommended use:
1baafe
# eval "$(bash setup-named-softhsm.sh -A)"
1baafe
#
1baafe
1baafe
SOFTHSM2_CONF="$1"
1baafe
TOKENPATH="$2"
1baafe
GROUPNAME="$3"
1baafe
# Do not use this script for real keys worth protection
1baafe
# This is intended for crypto accelerators using PKCS11 interface.
1baafe
# Uninitialized token would fail any crypto operation.
1baafe
PIN=1234
1baafe
SO_PIN=1234
1baafe
LABEL=rpm
1baafe
1baafe
set -e
1baafe
1baafe
echo_i()
1baafe
{
1baafe
	echo "#" $@
1baafe
}
1baafe
1baafe
random()
1baafe
{
1baafe
	if [ -x "$(which openssl 2>/dev/null)" ]; then
1baafe
		openssl rand -base64 $1
1baafe
	else
1baafe
		dd if=/dev/urandom bs=1c count=$1 | base64
1baafe
	fi
1baafe
}
1baafe
1baafe
usage()
1baafe
{
1baafe
	echo "Usage: $0 -A [token directory] [group]"
1baafe
	echo "   or: $0 <config file> <token directory> [group]"
1baafe
}
1baafe
1baafe
if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
1baafe
	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
1baafe
fi
1baafe
1baafe
if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
1baafe
	usage >&2
1baafe
	exit 1
1baafe
fi
1baafe
1baafe
if [ "$SOFTHSM2_CONF" = "-A" ]; then
1baafe
	# Automagic mode instead
1baafe
	MODE=secure
1baafe
	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
1baafe
	PIN_SOURCE="$TOKENPATH/pin"
1baafe
	SOPIN_SOURCE="$TOKENPATH/so-pin"
1baafe
	TOKENPATH="$TOKENPATH/tokens"
1baafe
else
1baafe
	MODE=legacy
1baafe
fi
1baafe
1baafe
[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
1baafe
1baafe
umask 0022
1baafe
1baafe
if ! [ -f "$SOFTHSM2_CONF" ]; then
1baafe
cat  << SED > "$SOFTHSM2_CONF"
1baafe
# SoftHSM v2 configuration file
1baafe
1baafe
directories.tokendir = ${TOKENPATH}
1baafe
objectstore.backend = file
1baafe
1baafe
# ERROR, WARNING, INFO, DEBUG
1baafe
log.level = ERROR
1baafe
1baafe
# If CKF_REMOVABLE_DEVICE flag should be set
1baafe
slots.removable = false
1baafe
SED
1baafe
else
1baafe
	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
1baafe
fi
1baafe
1baafe
if [ -n "$PIN_SOURCE" ]; then
1baafe
	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
1baafe
	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
1baafe
	if [ -n "$GROUPNAME" ]; then
1baafe
		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
1baafe
		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
1baafe
	fi
1baafe
fi
1baafe
1baafe
export SOFTHSM2_CONF
1baafe
1baafe
if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
1baafe
then
1baafe
	echo_i "Token in ${TOKENPATH} is already initialized" >&2
1baafe
1baafe
	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
1baafe
	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
1baafe
else
1baafe
	PIN=$(random 6)
1baafe
	SO_PIN=$(random 18)
1baafe
	if [ -n "$PIN_SOURCE" ]; then
1baafe
		echo -n "$PIN" > "$PIN_SOURCE"
1baafe
		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
1baafe
	fi
1baafe
1baafe
	echo_i "Initializing tokens to ${TOKENPATH}..."
1baafe
	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
1baafe
1baafe
	if [ -n "$GROUPNAME" ]; then
1baafe
		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
1baafe
		chmod -R -- g=rX,o= "$TOKENPATH"
1baafe
	fi
1baafe
fi
1baafe
1baafe
echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
1baafe
echo "export PIN_SOURCE=\"$PIN_SOURCE\""
1baafe
echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
1baafe
# These are intentionaly not exported
1baafe
echo "PIN=\"$PIN\""
1baafe
echo "SO_PIN=\"$SO_PIN\""