#! /bin/sh
# Copyright Sun Microsystems, Inc. 1999
#
# @(#)spf2efs.sh	1.7 - upgrade an SPF-200 configuration file, 
#            gathered via "configs2" on the SPF-200
#
# modified version of "upgrade.sh" for SPF upgrades.
#
#pragma ident "@(#)spf2efs.sh	1.7 99/04/14 Sun Microsystems, Inc."

unset SSADM_ISATTY

PATH=/opt/SUNWicg/SunScreen/bin:/opt/SUNWicg/SunScreen/lib:/opt/SUNWicg/bin:$PATH
export PATH


SPF_FILES="/etc/opt/SUNWicg/SunScreen/interfaces           \
           /etc/opt/SUNWicg/SunScreen/Nat                  \
           /etc/opt/SUNWicg/SunScreen/networks             \
           /etc/opt/SUNWicg/SunScreen/routers       \
           /etc/opt/SUNWicg/SunScreen/configs/SS_Defaults.in \
           /etc/opt/SUNWicg/SunScreen/configs/Admin.in  \
           /etc/opt/SUNWicg/SunScreen/configs/default/Address.in \
           /etc/opt/SUNWicg/SunScreen/access \
           /etc/opt/SUNWicg/SunScreen/configs/Action.in "

MORE_SPF_FILES="/etc/opt/SUNWicg/SunScreen/configs/default/*.cfg \
                /etc/opt/SUNWicg/SunScreen/Certificates/* \
                /etc/opt/SUNWicg/skip/localid/[1-9]*.* \
                /etc/opt/SUNWicg/skip/CAs/[1-9]*.*"


SPECIAL_20_FILES="/etc/opt/SUNWicg/SunScreen/configs/StateEngine.in \
		 /etc/opt/SUNWicg/SunScreen/configs/ProxyServer.in \
		/etc/opt/SUNWicg/SunScreen/configs/HA \
		/etc/opt/SUNWicg/SunScreen/configs/hash \
		/etc/opt/SUNWicg/SunScreen/configs/sigs \
		/etc/opt/SUNWicg/SunScreen/configs/spam"
		
# read in the tar file that contains the SPF-200 configuration.
echo "### Reading in 200config.tar"
cat > /tmp/200config.tar


# on slower machines, nice to confirm we're doing something
echo "### SunScreen spf2efs: checking system..."

# 
# verify that the spf config file is on the screen
#

if [ -f /tmp/200config.tar ]
then
    :
else
    echo "### SunScreen spf2efs: ERROR: could not locate original SPF-200 configuration file."
    echo "### Please consult the manual for proper upgrade procedures."
    exit 1
fi


#
# grab arch, will need it later
#
thearch=`arch`
if [ $thearch = "i86pc" ] ; then
	myarch="i386"
elif [ $thearch = "sun4" ] ; then
	myarch="sparc"
else
	echo "### SunScreen spf2efs: ERROR: could not determine system architecture."
	echo "### The arch command returned $thearch for this system (`uname -n`)."
	echo "### Please check the system".
	exit 1
fi

#
# if not at Solaris 2.6 or above, bail
#
os=`/bin/uname -r 2>/dev/null`
major_os=`expr $os : '\(.\)'`
minor_os=`expr $os : '..\(.\)'`
if [ $minor_os -lt 6 ] ; then
	echo "### SunScreen EFS 3.0 is supported on Solaris 2.6 and 7."
	echo "### This system (`uname -n`) is running Solaris $os."
	echo "### To run SunScreen EFS 3.0, please upgrade this system to Solaris 2.6 or 7."
	exit 1
fi


echo "### Upgrading from SunScreen SPF-200 to EFS 3.0"
echo " "


#
# determine whether we've got enough free space;
# the packaging tools try to do this, but they don't know how much the
# SunScreen configurations will take, and upgrade must
# maintain backup copies of all of these
#
echo "### Checking available disk space."
FreeSpace=`df -b /opt | tail -1 | awk '{print $NF}'`
SpaceNeeded=`du -sk /opt/SUNWicg /etc/opt/SUNWicg /tmp/200config.tar | \
		awk '{s += $1} END {print s}'`

if [ $FreeSpace -lt $SpaceNeeded ] ; then
    echo "### Error: insufficient free space for SunScreen upgrade."
    echo "### You have $FreeSpace Kbytes; you need $SpaceNeeded Kbytes."
    echo "### Please free up sufficient disk space, then run upgrade again."
    exit 1
fi

# 
# backup certificate and access information before running
# 1.1 -> 2.0 upgrade
#
echo "### Backing up EFS 3.0 administration information."
eval ssadm edit -P Initial -c \"list Certificate\" > /tmp/spf2efs1
eval ssadm edit -P Initial -c \"list AccessRemote\" > /tmp/spf2efs2

# turn into command structure we can use

sed 's/./add_nocheck Certificate &/' /tmp/spf2efs1 > /tmp/spf2efs1.new
sed 's/./insert AccessRemote & /' /tmp/spf2efs2 > /tmp/spf2efs2.new
echo save >> /tmp/spf2efs1.new
echo save >> /tmp/spf2efs2.new

# untar SPF-200 configuration.  Should put files back into place
# automaticly.
if [ -f /tmp/200config.tar  ]
then
    # found SPF-200 config.  untar
    tar -xf /tmp/200config.tar
fi

#
# if special file doesn't exist, just make an empty file
#
for file in $SPF_FILES
do
    if [ -f $file ] ; then
	:
    else
	touch $file
	chmod a-w $file
    fi
done

#
# Need to make empty EFS 2.0 files that won't be there in this
# type of upgrade.
#
for file in $SPECIAL_20_FILES
do
    touch $file
    chmod a-w $file
done


#
# run the conversion tool
#
echo "### Converting SunScreen SPF-200 configurations to EFS 2.0 format"
/opt/SUNWicg/SunScreen/lib/ss_upgrade
echo ""



#
# now run the 2.0 -> 3.0 conversion tool
#
read machineName < /etc/opt/SUNWicg/SunScreen/name

echo "### Converting SunScreen EFS 2.0 format configurations to EFS 3.0 format"
/opt/SUNWicg/SunScreen/lib/efs2to3 -s${machineName} -c${machineName}.admin
echo ""

#
# readd certificate and access information for remote administration
#

echo "### Readding the EFS 3.0 administration information"
echo ""

ssadm edit Initial < /tmp/spf2efs1.new
ssadm edit Initial < /tmp/spf2efs2.new


#
#remove unneeded 2.0 data files
#
echo "### Removing unneeded 2.0 data files"
rm /etc/opt/SUNWicg/SunScreen/configs/default/HA
rm /etc/opt/SUNWicg/SunScreen/configs/default/hash
rm /etc/opt/SUNWicg/SunScreen/configs/default/sigs
rm /etc/opt/SUNWicg/SunScreen/configs/default/spam
echo ""


#
# and finally copy SKIP certs into new place
#
if [ -d /etc/skip ] ; then
	:
else
	mkdir /etc/skip
	chmod 700 /etc/skip
fi
cp -rp /etc/opt/SUNWicg/skip/* /etc/skip

#
# remind user to recompile the active configuration
#
echo "### Upgrade complete.  Reboot the system now."
echo "### On reboot, ignore any messages about \"interfaces not found\"."
echo ""
echo "### After system has booted, verify that your configurations"
echo "### have been migrated as desired.  Pay special attention to filtering"
echo "### rules, since EFS 3.0 includes ordered rules.  If you were using NAT"
echo "### in SPF-200, you will need to modify your NAT mappings before"
echo "### activating any of your migrated configurations, since NAT has"
echo "### changed significantly and it is not possible to accurately migrate"
echo "### your old NAT mappings."
echo ""
echo "### After you have verified your configurations, and updated any NAT"
echo "### mappings, activate the desired EFS 3.0 configuration."

