# Copyright (C) 2022 Fondries.IO
# SPDX-License-Identifier: MIT

cryptfs_check_pkcs11() {
	[ ! -c /dev/tee0 ] && fatal "Linux OP-TEE device node not found"
}

cryptfs_pre_pkcs11() {
	# Use TEE Identity with user authentication - crypt
	export CKTEEC_LOGIN_TYPE=user

	# tee-supplicant is needed for OP-TEE related operations
	start-stop-daemon -q -S -b /usr/sbin/tee-supplicant
}

cryptfs_post_pkcs11() {
	start-stop-daemon -q -K -x /usr/sbin/tee-supplicant
}

cryptfs_enroll_pkcs11() {
	crypt_dev=$1

	MODULE=/usr/lib/libckteec.so.0
	# We force usage of the second slot (1) to avoid clashes with lmp-device-register
	pkcs11-tool --module $MODULE --init-token --slot 1 --label lmp --so-pin ""
	pkcs11-tool --module $MODULE --token-label lmp --init-pin --so-pin foo --pin user:ef0180a3-13f3-5d1c-b7f5-888c0e21059a
	pkcs11-tool --module $MODULE --token-label lmp --pin foo --keypairgen --key-type rsa:2048 --id 9d --label luks

	mkdir -p /run/crypt
	# Systemd requires a self-signed certificate matching the luks private key
	cat << EOF > /run/crypt/cert.cfg
[req]
distinguished_name = req_distinguished_name
[req_distinguished_name]
EOF
	cat << EOF > /run/crypt/ssl.cfg
openssl_conf = openssl_def
[openssl_def]
engines = engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/engines-3/pkcs11.so
MODULE_PATH = /usr/lib/libckteec.so.0
EOF
	OPENSSL_CONF=/run/crypt/ssl.cfg openssl req -x509 -new -engine pkcs11 -keyform engine -key slot_1-label_luks -passin "pass:foo" -sha256 -config /run/crypt/cert.cfg -subj "/CN=LmP" -days 7300 -out /run/crypt/9d.crt
	pkcs11-tool --module $MODULE --login --pin foo --write-object /run/crypt/9d.crt --type cert --label luks --token-label lmp --id 9d
	rm -rf /run/crypt

	PASSWORD=`cat /run/cryptsetup/passphrase` PIN=foo systemd-cryptenroll ${crypt_dev} --pkcs11-token-uri="pkcs11:token=lmp;object=luks" --wipe-slot=password
}


