#!/usr/bin/env bash
# ssh-pkcs11 -- Wrapper which allows directly using PKCS#11 modules with tools
# that rely on ssh-agent (such as `ssh-keygen -Y sign`).
#
# Note: ssh-keygen supports -D and -I options when signing certificates using a
# CA key, but oddly not when signing data via -Y.

. lib.bash || exit

dirs=(/usr/lib/pkcs11 /usr/lib)
#lib='p11-kit-proxy.so'
lib='libtpm2_pkcs11.so'
do_add=0
do_del=0

while getopts "ad" OPT; do
	case $OPT in
	a) do_add=1;;
	d) do_del=1;;
	*) exit 2;;
	esac
done; shift $((OPTIND-1))

if [[ ! $_SSH_PKCS11_MOD ]]; then
	if [[ $lib != */* ]]; then
		for dir in "${dirs[@]}"; do
			if [[ -e $dir/$lib ]]; then
				lib=$dir/$lib
				break
			fi
		done
	fi
	if [[ $lib != */* ]]; then
		vdie "could not find PKCS#11 library '$lib'"
	fi
	if (( do_add || do_del )); then
		if [[ $SSH_AUTH_SOCK == "$XDG_RUNTIME_DIR"/ssh-tpm-agent.sock* ]]; then
			# work around go-ssh-agent rejecting the operations
			SSH_AUTH_SOCK=$(pgrep -U $UID -x ssh-tpm-agent -a | sed -En 's/.*-A ([^ ]*)( .*)?/\1/p')
			vmsg "using socket $SSH_AUTH_SOCK instead"
		fi
		if (( do_del )); then
			vmsg "removing module $lib"
			ssh-add -e "$lib"
		fi
		if (( do_add )); then
			vmsg "adding module $lib"
			ssh-add -s "$lib"
		fi
	else
		export _SSH_PKCS11_MOD=$lib
		exec ssh-agent "$0" "$@"
	fi
else
	ssh-add -s "$_SSH_PKCS11_MOD" &&
	exec "$@" || exit
fi
