#!/bin/bash

#

# COPYRIGHT (c) International Business Machines Corp. 2020

#

# This program is provided under the terms of the Common Public License,

# version 1.0 (CPL-1.0). Any use, reproduction or distribution for this software

# constitutes recipient's acceptance of CPL-1.0 terms which can be found

# in the file LICENSE file or at https://opensource.org/licenses/cpl1.0.php

# - Requires p11tool (gnutls) and pkcs11-tool (opensc).

# - The PKCSLIB environment must point to your system's libopencryptoki.so.

# - The PKCS11_SO_PIN environment variable must hold the SO pin.

# - The PKCS11_USER_PIN environment variable must hold the user pin.

# - The OCK_CONFDIR environment variable must point to your system's openCryptoki configuration directory.

# - The OCK_DATASTORE environment variable must point to the token's datastore directory.

# - The SLOT environment variable must hold the slot id of the token under test.

# - The PKCS11_TOKEN_URL environment variable must hold the the token url of the token under test.

#

# sodo -E ./migrate.sh

set -x

# tmp files

PKCSCONF_PRE=pkcsconf-pre.out

PKCSCONF_POST=pkcsconf-post.out

P11TOOL_PRE=p11tool-pre.out

P11TOOL_POST=p11tool-post.out

PKCS11_TOOL_PRE=pkcs11-tool-pre.out

PKCS11_TOOL_POST=pkcs11-tool-post.out

P11SAK_PRE=p11sak-pre.out

P11SAK_POST=p11sak-post.out

# set p11tool env vars

export GNUTLS_SO_PIN=$PKCS11_SO_PIN

export GNUTLS_PIN=$PKCS11_USER_PIN

# generate objects

p11tool --provider=$PKCSLIB --login --generate-rsa --bits 2048 --label p11tool-rsa "$PKCS11_TOKEN_URL"

pkcs11-tool --module=$PKCSLIB --slot $SLOT --login --pin $PKCS11_USER_PIN --keypairgen --key-type rsa:2048 --label pkcs11-tool-rsa

p11sak generate-key rsa 2048 --slot $SLOT --pin $PKCS11_USER_PIN --label p11sak-rsa

# list slots/tokens

pkcsconf -i &>> $PKCSCONF_PRE

pkcsconf -s &>> $PKCSCONF_PRE

pkcsconf -t &>> $PKCSCONF_PRE

p11tool --provider=$PKCSLIB --list-tokens &>> $P11TOOL_PRE

pkcs11-tool --module=$PKCSLIB --list-slots &>> $PKCS11_TOOL_PRE

# list objects

p11tool --provider=$PKCSLIB  --list-all "$PKCS11_TOKEN_URL" &>> $P11TOOL_PRE

p11tool --provider=$PKCSLIB  --list-all --login "$PKCS11_TOKEN_URL" &>> $P11TOOL_PRE

pkcs11-tool --module=$PKCSLIB --slot $SLOT -list-objects &>> $PKCS11_TOOL_PRE

pkcs11-tool --module=$PKCSLIB --slot $SLOT --login --pin $PKCS11_USER_PIN --list-objects &>> $PKCS11_TOOL_PRE

p11sak list-key rsa --slot $SLOT --pin $PKCS11_USER_PIN &>> $P11SAK_PRE

# migrate

killall pkcsslotd

echo -e "y\n" | pkcstok_migrate --verbose debug --slot $SLOT --sopin $PKCS11_SO_PIN --userpin $PKCS11_USER_PIN --confdir $OCK_CONFDIR --datastore $OCK_DATASTORE

pkcsslotd

# list slots/tokens

pkcsconf -i &>> $PKCSCONF_POST

pkcsconf -s &>> $PKCSCONF_POST

pkcsconf -t &>> $PKCSCONF_POST

p11tool --provider=$PKCSLIB --list-tokens &>> p11tool-post.out

pkcs11-tool --module=$PKCSLIB --list-slots &>> pkcs11-tool-post.out

# list objects

p11tool --provider=$PKCSLIB --list-all "$PKCS11_TOKEN_URL" &>> $P11TOOL_POST

p11tool --provider=$PKCSLIB --list-all --login "$PKCS11_TOKEN_URL" &>> $P11TOOL_POST

pkcs11-tool --module=$PKCSLIB --slot $SLOT -list-objects &>> $PKCS11_TOOL_POST

pkcs11-tool --module=$PKCSLIB --slot $SLOT --login --pin $PKCS11_USER_PIN --list-objects &>> $PKCS11_TOOL_POST

p11sak list-key rsa --slot $SLOT --pin $PKCS11_USER_PIN &>> $P11SAK_POST

# compare

cmp $PKCSCONF_PRE $PKCSCONF_POST

cmp $P11TOOL_PRE $P11TOOL_POST

cmp $PKCS11_TOOL_PRE $PKCS11_TOOL_POST

cmp $P11SAK_PRE $P11SAK_POST