#!/bin/sh
# This script can be called in the following ways:
#
# After the package was installed:
#       <postinst> configure <old-version>
#
#
# If prerm fails during upgrade or fails on failed upgrade:
#       <old-postinst> abort-upgrade <new-version>
#
# If prerm fails during deconfiguration of a package:
#       <postinst> abort-deconfigure in-favour <new-package> <version>
#                  removing <old-package> <version>
#
# If prerm fails during replacement due to conflict:
#       <postinst> abort-remove in-favour <new-package> <version>

. /usr/share/debconf/confmodule

set -e

# Update the initial RAM file system image
update_initramfs()
{
    if command -v update-initramfs >/dev/null; then
	update-initramfs -k all -u 1>&2
    elif command -v dracut >/dev/null; then
	dracut_version="`dpkg-query --showformat='${Version}' --show dracut`"
	if dpkg --compare-versions "$dracut_version" lt 043-1 \
		&& bash -c '. /etc/dracut.conf; . /etc/dracut.conf.d/*; [ "$hostonly" != yes ]'; then
	    echo 'Dracut is not configured to use hostonly mode!' >&2
	    return 1
	fi
	# Logic taken from dracut.postinst
	for kernel in /boot/vmlinu[xz]-*; do
	    kversion="${kernel#/boot/vmlinu[xz]-}"
	    # Dracut preserves old permissions of initramfs image
	    # files, so we adjust permissions before creating new
	    # initramfs image containing secret keys.
	    if [ -e /boot/initrd.img-"$kversion" ]; then
		chmod go-r /boot/initrd.img-"$kversion"
	    else
		# An initrd image has not yet been created for this
		# kernel, possibly because this new kernel is about to
		# be, but has not yet been, installed.  In this case,
		# we create an empty file with the right permissions
		# so that Dracut will preserve those permissions when
		# it creates the real, new initrd image for this
		# kernel.
		install --mode=u=rw /dev/null \
			/boot/initrd.img-"$kversion"
	    fi
	    if [ "$kversion" != "*" ]; then
		/etc/kernel/postinst.d/dracut "$kversion" 1>&2
	    fi
	done
    fi
    
    if dpkg --compare-versions "$2" lt-nl "1.0.10-1"; then
        # Make old initrd.img files unreadable too, in case they were
        # created with mandos-client 1.0.8 or older.
	find /boot -maxdepth 1 -type f -name "initrd.img-*.bak" \
	    -print0 | xargs --null --no-run-if-empty chmod o-r
    fi
}

# Add user and group
add_mandos_user(){
    # Rename old "mandos" user and group
    if dpkg --compare-versions "$2" lt "1.0.3-1"; then
	case "`getent passwd mandos`" in
	    *:Mandos\ password\ system,,,:/nonexistent:/bin/false)
		usermod --login _mandos mandos 1>&2
		groupmod --new-name _mandos mandos 1>&2
		return
		;;
	esac
    fi
    # Create new user and group
    if ! getent passwd _mandos >/dev/null; then
	adduser --system --force-badname --quiet --home /nonexistent \
	    --no-create-home --group --disabled-password \
	    --gecos "Mandos password system" _mandos 1>&2
    fi
}

# Create client key pairs
create_keys(){
    # If the OpenPGP key files do not exist, generate all keys using
    # mandos-keygen
    if ! [ -r /etc/keys/mandos/pubkey.txt \
	      -a -r /etc/keys/mandos/seckey.txt ]; then
	mandos-keygen 1>&2
	gpg-connect-agent KILLAGENT /bye 1>&2 || :
	return 0
    fi

    # Remove any bad TLS keys by 1.8.0-1
    if dpkg --compare-versions "$2" eq "1.8.0-1" \
       || dpkg --compare-versions "$2" eq "1.8.0-1~bpo9+1"; then
	# Is the key bad?
	if ! certtool --password='' \
	     --load-privkey=/etc/keys/mandos/tls-privkey.pem \
	     --outfile=/dev/null --pubkey-info --no-text \
	      1>&2 2>/dev/null; then
	    shred --remove -- /etc/keys/mandos/tls-privkey.pem \
		  2>/dev/null || :
	    rm --force -- /etc/keys/mandos/tls-pubkey.pem
	fi
    fi

    # If the TLS keys already exists, do nothing
    if [ -r /etc/keys/mandos/tls-privkey.pem \
	    -a -r /etc/keys/mandos/tls-pubkey.pem ]; then
	return 0
    fi

    # Try to create the TLS keys

    TLS_PRIVKEYTMP="`mktemp -t mandos-client-privkey.XXXXXXXXXX`"

    if certtool --generate-privkey --password='' \
		--outfile "$TLS_PRIVKEYTMP" --sec-param ultra \
		--key-type=ed25519 --pkcs8 --no-text 1>&2 \
		2>/dev/null; then

	local umask=$(umask)
	umask 077
	cp --archive "$TLS_PRIVKEYTMP" /etc/keys/mandos/tls-privkey.pem
	shred --remove -- "$TLS_PRIVKEYTMP" 2>/dev/null || :

	# First try certtool from GnuTLS
	if ! certtool --password='' \
	     --load-privkey=/etc/keys/mandos/tls-privkey.pem \
	     --outfile=/etc/keys/mandos/tls-pubkey.pem --pubkey-info \
	     --no-text 1>&2 2>/dev/null; then
	    # Otherwise try OpenSSL
	    if ! openssl pkey -in /etc/keys/mandos/tls-privkey.pem \
		 -out /etc/keys/mandos/tls-pubkey.pem -pubout \
		 1>&2; then
		rm --force /etc/keys/mandos/tls-pubkey.pem
		# None of the commands succeded; give up
		umask $umask
		return 1
	    fi
	fi
	umask $umask

	key_id=$(mandos-keygen --passfile=/dev/null \
		     | grep --regexp="^key_id[ =]")

	db_version 2.0
	db_fset mandos-client/key_id seen false
	db_reset mandos-client/key_id
	db_subst mandos-client/key_id key_id $key_id
	db_input critical mandos-client/key_id || true
	db_go
	db_stop
    else
	shred --remove -- "$TLS_PRIVKEYTMP" 2>/dev/null || :
    fi
}

create_dh_params(){
    if [ -r /etc/keys/mandos/dhparams.pem ]; then
	return 0
    fi
    # Create a Diffe-Hellman parameters file
    DHFILE="`mktemp -t mandos-client-dh-parameters.XXXXXXXXXX.pem`"
    # First try certtool from GnuTLS
    if ! certtool --generate-dh-params --sec-param high \
	 --outfile "$DHFILE" 1>&2; then
	# Otherwise try OpenSSL
	if ! openssl genpkey -genparam -algorithm DH -out "$DHFILE" \
	     -pkeyopt dh_paramgen_prime_len:3072 1>&2; then
	    # None of the commands succeded; give up
	    rm --force -- "$DHFILE"
	    return 1
	fi
    fi
    sed --in-place --expression='0,/^-----BEGIN DH PARAMETERS-----$/d' \
	"$DHFILE"
    sed --in-place --expression='1i-----BEGIN DH PARAMETERS-----' \
	    "$DHFILE"
    cp --archive "$DHFILE" /etc/keys/mandos/dhparams.pem
    rm --force -- "$DHFILE"
}

case "$1" in
    configure)
	add_mandos_user "$@"
	create_keys "$@"
	create_dh_params "$@" || :
	update_initramfs "$@"
	if dpkg --compare-versions "$2" lt-nl "1.7.10-1"; then
	    PLUGINHELPERDIR=/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null)/mandos/plugin-helpers
	    if ! dpkg-statoverride --list "$PLUGINHELPERDIR" \
		 >/dev/null 2>&1; then
		chmod u=rwx,go= -- "$PLUGINHELPERDIR"
	    fi
	    if ! dpkg-statoverride --list /etc/mandos/plugin-helpers \
		 >/dev/null 2>&1; then
		chmod u=rwx,go= -- /etc/mandos/plugin-helpers
	    fi
	fi
	;;
    abort-upgrade|abort-deconfigure|abort-remove)
	;;

    *)
	echo "$0 called with unknown argument '$1'" 1>&2
	exit 1
	;;
esac

#DEBHELPER#

exit 0