#!/bin/sh
#
# Generate certificates for Maia SDR and store them in JFFS2 if they don't exist
# already
#

case "$1" in
    start)
        # ensure that JFFS2 partition on /dev/mtd2 is mounted; otherwise format it
        # and mount it
        mount | grep mtd2 > /dev/null || (flash_erase -j /dev/mtd2 0 0 && mount /mnt/jffs2)
        if [ -f /mnt/jffs2/maia-sdr-ca.crt ]; then
            # do nothing if the certificates are already present
            exit 0
        fi
        printf "Generating Maia SDR certificates: "
        # obtain pluto serial number
        serial=$(dmesg | grep SPI-NOR-UniqueID)
        serial=${serial#*SPI-NOR-UniqueID }
        # generate CA certificate and key
        openssl req -x509 -nodes -days 36500 -newkey rsa:2048 \
                -subj "/O=Maia SDR/OU=Maia SDR CA/CN=Maia SDR CA serial ${serial}" \
	        -keyout /tmp/maia-sdr-ca.key -out /mnt/jffs2/maia-sdr-ca.crt \
                -reqexts v3_req -extensions v3_ca
        # generate maia-httpd key and CSR
        openssl req -new -nodes -newkey rsa:2048 \
                -subj "/O=Maia SDR/OU=maia-httpd/CN=maia-httpd plutosdr-fw serial ${serial}" \
	        -keyout /mnt/jffs2/maia-httpd.key -out /tmp/maia-httpd.csr
        # sign maia-httpd certificate
        openssl x509 -req -days 36500 \
	        -in /tmp/maia-httpd.csr -CA /mnt/jffs2/maia-sdr-ca.crt -CAkey /tmp/maia-sdr-ca.key \
                -extfile /etc/ssl/maia-httpd-extfile \
	        -CAcreateserial -CAserial /tmp/maia-sdr-ca.srl -out /mnt/jffs2/maia-httpd.crt
        # remove CA key, CSR and serial
        rm -f /tmp/maia-sdr-ca.key /tmp/maia-httpd.csr /tmp/maia-sdr-ca.srl
        [ $? = 0 ] && echo "OK" || echo "FAIL"
        ;;
    stop)
        ;;
    restart|reload)
        ;;
    *)
        echo "Usage: $0 {start|stop|restart}"
        exit 1
esac

exit $?
