#!/bin/sh 
#
# Copyright 1996 Sun Microsystems, Inc. All Rights Reserved
#
# "@(#)local.sh	3.2 99/02/03 Sun Microsystems, Inc."
#
# Install script for bootstrapping SunScreen EFS after a
# fresh installation of SKIP and SunScreen EFS.
# This script is for configuration when the Administration is LOCAL
#
# For this script to work the following must be completed:
#    1. SKIP packages are installed
#    2. SunScreen EFS packages are installed
#    3. the machine was rebooted (to start SKIP)
#
# Exit Codes:
#    0       success
#    2       missing packages
#    3       bad argument
#    4       invalid security level selected
#    5       error occured during compilation
#    6       error occured activating the configuration
#

read SUNSCREEN_BASE <${SUNSCREEN_ETC:-/etc/opt/SUNWicg/SunScreen}/location
. $SUNSCREEN_BASE/bin/.ssenv.profile

PATH="/opt/SUNWicg/bin:$BIN_DIR:/usr/bin:/bin"
export PATH

#
# Defaults
#
CONFIG_NAME="Initial"
CERT_TYPE="UDH"
LOCAL_ONLY=""
ROUTING=""
CERT_DISC=""
SECURITY_LEVEL="$1"
NAME_SERVICE_TYPE="$2"

#
# Find the valid interface names and set the default admin
#
INTERFACE_LIST=`ss_interfaces default list | awk '{ printf("%s ",$1) }'`
#

if [ "$CERT_DISC" = "" ] ; then
  CERT_DISC="ON"
fi

if [ $SECURITY_LEVEL -eq 1 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="OFF"
  fi
elif [ $SECURITY_LEVEL -eq 2 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="ON"
    echo "$ROUTING"
  fi
elif [ $SECURITY_LEVEL -eq 3 ] ; then
  if [ "$ROUTING" = "" ] ; then
    ROUTING="ON"
  fi
fi

#
# Initialize 'vars' database
#
$LIB_DIR/init_vars

#
# Initialize 'authuser' & 'proxyuser' databases
#
$LIB_DIR/init_users

#
# Initialize 'logmacro' databases
#
$LIB_DIR/init_logmacro
#
# Create a base configuration
#	
#ss_configuration default add $CONFIG_NAME  > /dev/null 2>&1
ss_configuration default add $CONFIG_NAME  

#
#	Add addresses for each interface, and for smtp-server (smtp proxy)
#
for INTERFACE in $INTERFACE_LIST ; do
  ss_address default add $INTERFACE LIST { } { } ""
done

ss_address default add smtp-server HOST 1.1.1.1 ""

# add placeholder for HA hosts
ss_address default add HA_HOSTS LIST { "*" } { } ""

#
# enable and plumb all interfaces 
#
for INTERFACE in $INTERFACE_LIST ; do
	echo "Enabling interface $INTERFACE"
	ss_interfaces default add $INTERFACE EFS $INTERFACE LOG_NONE SNMP_NONE ICMP_PORT_UNREACHABLE
#	ss_interfaces default list
#	ss_plumb_interface -d default `eval echo $INTERFACE`
#	ss_default_drop -d default `eval echo $INTERFACE`
done


ss_admin default add Routing $ROUTING
ss_admin default add Name_Service $NAME_SERVICE_TYPE
ss_admin default add Certificate_Discovery $CERT_DISC

# Add ALL access for local GUI administartion for user admin
ss_access default add USER "admin" ALL

#
# Add common service rule
#
if [ $SECURITY_LEVEL -eq 2 ] ; then
  ss_rule default $CONFIG_NAME add "common services" "localhost" "*" ALLOW \( LOG_NONE SNMP_NONE \)
  ss_rule default $CONFIG_NAME add "rip" "*" "*" ALLOW \( LOG_NONE SNMP_NONE \)
elif [ $SECURITY_LEVEL -eq 3 ] ; then
  ss_rule default $CONFIG_NAME add "common services" "*" "*" ALLOW \( LOG_NONE SNMP_NONE \)
fi

#
# compile and activate configuration
#
echo "Compiling configuration"
ss_compile default $CONFIG_NAME 2>&1

#
# Activate the configuration only if the compile succeeded
#
if [ "$?" = "0" ] ; then
    echo "Activating configuration"
    ss_activate default $CONFIG_NAME 2>&1
else
    echo "An error occurred while compiling the configuration."
    echo "The configuration has not been activated."
    exit 5
fi

#
# disable all interfaces if the activate config fials
#
if [ "$?" != "0" ] ; then
    echo "An error occurred activating the configuration."
    echo "The interfaces are being disabled to avoid hosing your machine."
    for INTERFACE in $INTERFACE_LIST ; do
	echo "Disabling interface $INTERFACE"
	ss_interfaces default add $INTERFACE DISABLED $INTERFACE
    done
    exit 6
fi

#
# Now the machine must be rebooted
#
echo ""
exit 0 
