fix(sztp): add keys and certs generation

Signed-off-by: Boris Glimcher <[email protected]>

.gitignore

@@ -0,0 +1,2 @@
+sztp/generated-client/
+sztp/generated-server/

sztp/generate.sh

@@ -2,6 +2,40 @@
 
 set -euxo pipefail
 
+MYTMPDIR="$(mktemp -d)"
+trap 'rm -rf -- "$MYTMPDIR"' EXIT
+
+curl -kL https://watsen.net/support/sztpd-simulator-0.0.11.tgz | tar -zxvf - -C ${MYTMPDIR}/
+pushd ${MYTMPDIR}/sztpd-simulator/pki
+echo "DNS.2 = bootstrap" >> sztpd1/sbi/end-entity/openssl.cnf
+echo "DNS.3 = web" >> sztpd1/sbi/end-entity/openssl.cnf
+echo "DNS.4 = redirecter" >> sztpd1/sbi/end-entity/openssl.cnf
+make pki
+# SBI Port certificates
+cat sztpd1/sbi/end-entity/my_cert.pem sztpd1/sbi/intermediate2/my_cert.pem > ${MYTMPDIR}/sztpd-simulator/cert_chain.pem
+openssl crl2pkcs7 -nocrl -certfile ${MYTMPDIR}/sztpd-simulator/cert_chain.pem -outform DER -out ${MYTMPDIR}/sztpd-simulator/cert_chain.cms
+# client cert DevID trust anchors
+cat client/root-ca/my_cert.pem client/intermediate1/my_cert.pem client/intermediate2/my_cert.pem > ${MYTMPDIR}/sztpd-simulator/ta_cert_chain.pem
+openssl crl2pkcs7 -nocrl -certfile ${MYTMPDIR}/sztpd-simulator/ta_cert_chain.pem -outform DER -out ${MYTMPDIR}/sztpd-simulator/ta_cert_chain.cms
+# ???
+cat sztpd1/sbi/root-ca/my_cert.pem sztpd1/sbi/intermediate1/my_cert.pem > ${MYTMPDIR}/sztpd-simulator/opi.pem
+popd
+
+# copy locally for server
+rm -rf ./generated-server
+mkdir -p ./generated-server
+cp ${MYTMPDIR}/sztpd-simulator/pki/sztpd1/sbi/end-entity/private_key.der ./generated-server/
+cp ${MYTMPDIR}/sztpd-simulator/pki/sztpd1/sbi/end-entity/public_key.der ./generated-server/
+cp ${MYTMPDIR}/sztpd-simulator/cert_chain.cms ./generated-server/
+cp ${MYTMPDIR}/sztpd-simulator/ta_cert_chain.cms ./generated-server/
+
+# copy remotely for clients
+rm -rf ./generated-client
+mkdir -p ./generated-client
+cp ${MYTMPDIR}/sztpd-simulator/opi.pem ./generated-client/opi.pem
+cp ${MYTMPDIR}/sztpd-simulator/pki/client/end-entity/my_cert.pem ./generated-client/opi_cert.pem
+cp ${MYTMPDIR}/sztpd-simulator/pki/client/end-entity/private_key.pem ./generated-client/opi_private_key.pem
+
 declare -a names
 
 for vendor in nvidia intel marvell
@@ -17,10 +51,10 @@ do
 done
 
 names+=(SBI_PRI_KEY_B64 SBI_PUB_KEY_B64 SBI_EE_CERT_B64 CLIENT_CERT_TA_B64)
-export SBI_PRI_KEY_B64=$(openssl enc -base64 -A -in         private_key.der)
-export SBI_PUB_KEY_B64=$(openssl enc -base64 -A -in         public_key.der)
-export SBI_EE_CERT_B64=$(openssl enc -base64 -A -in         cert_chain.cms)
-export CLIENT_CERT_TA_B64=$(openssl enc -base64 -A -in      ta_cert_chain.cms)
+export SBI_PRI_KEY_B64=$(openssl enc -base64 -A -in    ./generated-server/private_key.der)
+export SBI_PUB_KEY_B64=$(openssl enc -base64 -A -in    ./generated-server/public_key.der)
+export SBI_EE_CERT_B64=$(openssl enc -base64 -A -in    ./generated-server/cert_chain.cms)
+export CLIENT_CERT_TA_B64=$(openssl enc -base64 -A -in ./generated-server/ta_cert_chain.cms)
 
 names+=(SZTPD_INIT_ADDR SZTPD_INIT_PORT SZTPD_NBI_PORT SZTPD_SBI_PORT)
 export SZTPD_INIT_ADDR=$(awk '/SZTPD_INIT_ADDR:/{print $2}' ../docker-compose.yml)
@@ -30,4 +64,12 @@ export SZTPD_SBI_PORT=$(awk '/SZTPD_SBI_PORT:/{print $2}' ../docker-compose.yml)
 
 envsubst "$(printf '${%s} ' ${names[@]})" < template.json > config.json
 
-diff template.json config.json
+diff template.json config.json || true
+
+echo "Now COPY client files to the remote clients:"
+echo scp ./generated-client/opi*.pem [email protected]:/mnt/
+
+# curl --fail -H Accept:application/yang-data+json http://127.0.0.1:$SZTPD_NBI_PORT/.well-known/host-meta || exit 1
+# curl --fail -i -X GET --user [email protected]:my-secret -H 'Accept:application/yang-data+json' http://bootstrap:"${SZTPD_INIT_PORT}"/restconf/ds/ietf-datastores:running
+# curl --fail -i -X PUT --user [email protected]:my-secret --data @./config.json -H 'Content-Type:application/yang-data+json' http://127.0.0.1:"${SZTPD_INIT_PORT}"/restconf/ds/ietf-datastores:running
+# curl --fail -i -X GET --user [email protected]:my-secret -H 'Accept:application/yang-data+json' http://bootstrap:"${SZTPD_INIT_PORT}"/restconf/ds/ietf-datastores:running