#!/bin/sh
#
#    Broadcom Proprietary and Confidential.
#    Copyright © 1996-2020 Broadcom.
#    All Rights Reserved.
#    The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
#
#    static CCM postplay script to resolve FOS configuration compability issues from firmware upgrade
#    /etc/fabos/config/scripts/postplay
#

PROGRAM='postplay'
cfgutil="/etc/fabos/config/scripts/cfgutil"

TTY=$(tty)
if [ "$TTY" = "not a tty" ]
then
    TTY="/dev/null"
fi

PATH=/fabos/link_bin:/bin:/usr/bin:/sbin:/usr/sbin:/fabos/link_abin:/fabos/link_sbin:/fabos/link_rbin:/fabos/factory:/fabos/xtool

#export CHASSIS_ROLEID=0
#export ROLE_ID=root
#export HOME=/root
#export LOGNAME=root
#export PWD=/root
#export LOGIN_ID=root

## Security specific default configs for password config management
## Modify here, if any of these default config's value are changed in newer releases
PWCFG_MINLENGTH="8"
PWCFG_LOWERCASE="0"
PWCFG_UPPERCASE="0"
PWCFG_CHARSET="0"
PWCFG_ALLOWUSER="Yes"
PWCFG_DIGITS="0"
PWCFG_PUNCT="0"
PWCFG_HIST="1"
PWCFG_MINPASS="0"
PWCFG_MAXPASS="0"
PWCFG_WARN="0"
PWCFG_REPEAT="1"
PWCFG_SEQ="1"
PWCFG_REV="0"
PWCFG_MINDIFF="0"

#
#include cfg utility
#
if [ -e "$cfgutil" ]
then
    . $cfgutil
    rc=$?
    if [ $rc -ne 0 ]
    then
      echo "Error -- $cfgutil err=$rc"
      exit 3
    fi
else
    echo "Error -- could not locate configuration common library $cfgutil"
    exit 3
fi

# not defined yet
if [ "$TO_VERSION" == "" ]; then
  CCM_VERSION="/etc/fabos/config/scripts/ccm_version.conf"

  if [ -f "$CCM_VERSION" ]; then
    TO_MAJOR=`cat $CCM_VERSION  | grep "TO" | /bin/awk '{print $2}'`
    TO_MINOR=`cat $CCM_VERSION | grep "TO" | /bin/awk '{print $3}'`
    TO_PATCH=`cat $CCM_VERSION | grep "TO" | /bin/awk '{print $4}'`
    TO_RELEASE=`cat  $CCM_VERSION | grep "TO" | /bin/awk '{print $5}'`

    FROM_MAJOR=`cat $CCM_VERSION | grep "FROM" | /bin/awk '{print $2}'`
    FROM_MINOR=`cat $CCM_VERSION | grep "FROM" | /bin/awk '{print $3}'`
    FROM_PATCH=`cat $CCM_VERSION | grep "FROM" | /bin/awk '{print $4}'`
    FROM_RELEASE=`cat $CCM_VERSION | grep "FROM" | /bin/awk '{print $5}'`
    /bin/chmod 644 $CCM_VERSION
  fi

  TO_VERSION="$TO_MAJOR$TO_MINOR$TO_PATCH$TO_RELEASE"
  FROM_VERSION="$FROM_MAJOR$FROM_MINOR$FROM_PATCH$FROM_RELEASE"
  /bin/chmod 644 $CCM_VERSION
fi

ntp_authentication_handling() {
	
	#Upgrade handling
	#Add new config keys: ts.clockServerAuthSpec and ts.clockServerLegacyMode if NTP auth supported
	authspec_mode=`/fabos/cliexec/config get ts.clockServerAuthSpec 2`
	legacy_mode=`/fabos/cliexec/config get ts.clockServerLegacyMode 2`
	if [ -z "$authspec_mode" ]; then
		#if empty, add config with default values
		cfgkey="ts.clockServerAuthSpec"
    	cfgkey_type=2
    	cfgkey_value=0
		$SWITCHCMD -1 /fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value
	fi
	if [ -z "$legacy_mode" ]; then
		#if empty, add config with default values
		cfgkey="ts.clockServerLegacyMode"
    	cfgkey_type=2
    	cfgkey_value=1
		$SWITCHCMD -1 /fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value
	fi
}

root_account_disable_handling() {
	
	PASSWD_FILE="/etc/passwd"
	MNT_PASSWD_FILE="/mnt/etc/passwd"
	TMP_PASSWD="/tmp/passwd"
	SHADOW_FILE="/etc/shadow"
	MNT_SHADOW_FILE="/mnt/etc/shadow"
	TMP_SHADOW="/tmp/shadow"
	
	# Upgrade to 9.1 handling
	# Convert /etc/passwd root entry to /bin/false shell
	/bin/sed 's+root:/root:/bin/sh+root:/root:/bin/false+g' $PASSWD_FILE > $TMP_PASSWD
	/bin/mv $TMP_PASSWD $PASSWD_FILE
	/bin/chmod 600 $PASSWD_FILE
	/bin/sed 's+root:/root:/bin/sh+root:/root:/bin/false+g' $MNT_PASSWD_FILE > $TMP_PASSWD
	/bin/mv $TMP_PASSWD $MNT_PASSWD_FILE
	/bin/chmod 600 $MNT_PASSWD_FILE
	
	# Disable root account in 9.1
	/bin/awk -F: '{ if ($1 == "root") $8="0";}1' OFS=: $SHADOW_FILE > $TMP_SHADOW
	/bin/mv $TMP_SHADOW $SHADOW_FILE
	/bin/chmod 600 $SHADOW_FILE
	/bin/awk -F: '{ if ($1 == "root") $8="0";}1' OFS=: $MNT_SHADOW_FILE > $TMP_SHADOW
	/bin/mv $TMP_SHADOW $MNT_SHADOW_FILE
	/bin/chmod 600 $MNT_SHADOW_FILE
	
	# Change root account password to new default in shadow for 9.1
	/bin/awk -F: '{ if ($1 == "root") $2="1804289383INVALIDACCOUNT1714636915";}1' OFS=: $SHADOW_FILE > $TMP_SHADOW
	/bin/mv $TMP_SHADOW $SHADOW_FILE
	/bin/chmod 600 $SHADOW_FILE
	/bin/awk -F: '{ if ($1 == "root") $2="1804289383INVALIDACCOUNT1714636915";}1' OFS=:  $MNT_SHADOW_FILE > $TMP_SHADOW
	/bin/mv $TMP_SHADOW $MNT_SHADOW_FILE
	/bin/chmod 600 $MNT_SHADOW_FILE	 
}

LDAP_CONF_FILE="/etc/fabos/ldap.conf"
LDAP_CONF_FILE_MNT="/mnt/etc/fabos/ldap.conf"
LDAP_MAP_FILE="/etc/fabos/ldap.map"
LDAP_MAP_FILE_MNT="/mnt/etc/fabos/ldap.map"

correct_ldap_conf_file_permission()
{
	# Change file permission to 640
	/bin/chmod 640 $LDAP_CONF_FILE
	/bin/chmod 640 $LDAP_CONF_FILE_MNT
	/bin/chmod 640 $LDAP_MAP_FILE
	/bin/chmod 640 $LDAP_MAP_FILE_MNT

	# Change file uid/gid to root/maintenance
	/bin/chgrp maintenance $LDAP_CONF_FILE
	/bin/chgrp maintenance $LDAP_CONF_FILE_MNT
	/bin/chgrp maintenance $LDAP_MAP_FILE
	/bin/chgrp maintenance $LDAP_MAP_FILE_MNT
}

correct_security_file_executable_handling() {
	
	CERT_DIR="/etc/fabos/certs"
	MNT_CERT_DIR="/mnt/etc/fabos/certs"
	SYSLOG_CERT_DIR="/etc/syslog-ng/ca.d"
	MNT_SYSLOG_CERT_DIR="/mnt//etc/syslog-ng/ca.d"
	TPL_DIR="/etc/fabos/templates/"
	MNT_TPL_DIR="/mnt//etc/fabos/templates/"
	
	# Upgrade to 9.1 handling
	# Remove all executable bits from all files under certs and templates directories
	find $CERT_DIR -type f -exec /bin/chmod -x -- {} +
	find $MNT_CERT_DIR -type f -exec /bin/chmod -x -- {} +
	find $SYSLOG_CERT_DIR -type f -exec /bin/chmod -x -- {} +
	find $MNT_SYSLOG_CERT_DIR -type f -exec /bin/chmod -x -- {} +
	find $TPL_DIR -type f -exec /bin/chmod -x -- {} +
	find $MNT_TPL_DIR -type f -exec /bin/chmod -x -- {} +
}
#MAIN
# Get the command-line options
$CFGLOGD "$PROGRAM $@"
$CFGLOG "CURRENT_VF=$CURRENT_VF FABOS_SWITCHNO=$FABOS_SWITCHNO"

#setcontext chassis
#value=`/fabos/cliexec/config get cfgut.debug 2`
#if [ ! -z ${value+x} ]; then
#    CFGCMD="cfgcmd"
#fi  

do_910 ()
{
  setcontext chassis  
  # if unit test is enabled
  cfgut_enable=`/fabos/cliexec/config get cfgut.enable 2`
  if [ $cfgut_enable ]; then

    # add 9.1 new chassis config key
    # config set 9.1 chasis key
    cfgkey="cfgut.CH.9.1key.1"
    cfgkey_type=2
    cfgkey_value=1
    $CHASSISCMD /fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value

    # add 9.1 new LS config key
    # config set 9.1 LS key
    cfgkey="cfgut.SW.9.1key.4"
    cfgkey_type=2
    cfgkey_value=4
    $SWITCHCMD -1 /fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value
    
    setcontext chassis  
    # change 9.0.1 config key value
    cfgkey="cfgut.CH.9.0key.4"
    cfgkey_type=2
    evalue=8
    value=`/fabos/cliexec/config get $cfgkey $cfgkey_type`
    if [ ! -z ${value+x} ]; then
	if [[ "$value" < "$evalue" ]]; then
	    $CFGLOG "set $cfgkey to $evalue"
	    /fabos/cliexec/config set $cfgkey $cfgkey_type $evalue
	fi
    else
	$ECHO "postplay fail to get $cfgkey to $evalue"
    fi

    setcontext 128
    # add syslog ip as 9.1 default
    $CFGCMD syslogadmin --set -ip 1.2.3.4

    # change 9.1 syslog faciity default value
    $CFGCMD syslogadmin --set -facility 5

    # file operation

  fi

  # add 9.1 ntp auth config keys
  ntp_authentication_handling

  # Disable root account in 9.1
  root_account_disable_handling
}

passwdcfg_status_field_handling()
{
	FABOS_SWITCHNO_TEMP=$FABOS_SWITCHNO
	FABOS_SWITCHNO=0

	pwcfg_status=`/fabos/cliexec/config get passwdcfg.status 2`
	pwcfg_lockoutthreshold=`/fabos/cliexec/config get passwdcfg.lockoutthreshold 2`
	pwcfg_adminlockout=`/fabos/cliexec/config get passwdcfg.adminlockout 2`
	pwcfg_lockoutduration=`/fabos/cliexec/config get passwdcfg.lockoutduration 2`
	pwcfg_adminlockoutconsoleaccess=`/fabos/cliexec/config get passwdcfg.adminlockoutconsoleaccess 2`
	cfgkey_value=-1

	$CFGLOG "postplay: initial values: status: $pwcfg_status pwcfg_lockoutthreshold=$pwcfg_lockoutthreshold pwcfg_adminlockout=$pwcfg_adminlockout pwcfg_lockoutduration=$pwcfg_lockoutduration pwcfg_adminlockoutconsoleaccess=$pwcfg_adminlockoutconsoleaccess"

	# If adminlockout is disabled in pre-920 and after upgrade to 920,adminlockoutconsoleaccess should not take default value[1].
	# Disable adminlockoutconsoleaccess after upgrade to avoid inconsistency between lockout and consoleaccess.
	# Consoleaccess takes default value only during upgrade to 920 from a netinstalled pre-920 firmware.

	if [[ "$pwcfg_adminlockout" -ne "1" && "$pwcfg_adminlockoutconsoleaccess" -eq "1" ]]; then
		cfgkey="passwdcfg.adminlockoutconsoleaccess"
		cfgkey_type=2
		cfgkey_value=0
		$CFGLOG "setting pwcfg_adminlockoutconsoleaccess=0"
		/fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value
	fi

	# If these values are not at FOS-9.2.0 default, then
	# change status=1 (non default value present)
	if [[ "$pwcfg_lockoutthreshold" -ne "3" || "$pwcfg_adminlockout" -ne "1" || "$pwcfg_lockoutduration" -ne "5" ]]; then
		if [ "$pwcfg_status" -eq "0" ]; then
			cfgkey_value=1
			$CFGLOG "setting pwcfg_status=1"
		fi
	elif [[ "$pwcfg_lockoutthreshold" -eq "3" && "$pwcfg_adminlockout" -eq "1" && "$pwcfg_adminlockoutconsoleaccess" -eq "1" && \
		"$pwcfg_lockoutduration" -eq "5" && "$pwcfg_status" -eq "1" ]]; then

		# If above values are at 92 default and remaining passwdcfg values are 
		# also at 920 default, then set status to 0.

		pwcfg_minlen=`/fabos/cliexec/config get passwdcfg.minlength 2`
		pwcfg_lowercase=`/fabos/cliexec/config get passwdcfg.lowercase 2`
		pwcfg_uppercase=`/fabos/cliexec/config get passwdcfg.uppercase 2`
		pwcfg_charset=`/fabos/cliexec/config get passwdcfg.charset 2`
		pwcfg_allowuser=`/fabos/cliexec/config get passwdcfg.allowuser 5`
		pwcfg_digits=`/fabos/cliexec/config get passwdcfg.digits 2`
		pwcfg_punct=`/fabos/cliexec/config get passwdcfg.punctuation 2`
		pwcfg_hist=`/fabos/cliexec/config get 'passwdcfg.history' 2`
		pwcfg_minpass=`/fabos/cliexec/config get passwdcfg.minpasswordage 2`
		pwcfg_maxpass=`/fabos/cliexec/config get passwdcfg.maxpasswordage 2`
		pwcfg_warn=`/fabos/cliexec/config get passwdcfg.warning 2`
		pwcfg_repeat=`/fabos/cliexec/config get passwdcfg.repeat 2`
		pwcfg_seq=`/fabos/cliexec/config get passwdcfg.sequence 2`
		pwcfg_rev=`/fabos/cliexec/config get passwdcfg.reverse 2`
		pwcfg_mindif=`/fabos/cliexec/config get passwdcfg.minDiff 2`

		if [ "$pwcfg_minlen" -eq "$PWCFG_MINLENGTH" ] && [ "$pwcfg_lowercase" -eq "$PWCFG_LOWERCASE" ] && \
			[ "$pwcfg_uppercase" -eq "$PWCFG_UPPERCASE" ] && [ "$pwcfg_charset" -eq "$PWCFG_CHARSET" ] && \
			[ "$pwcfg_allowuser" == "$PWCFG_ALLOWUSER" ] && [ "$pwcfg_digits" -eq "$PWCFG_DIGITS" ] && \
			[ "$pwcfg_punct" -eq "$PWCFG_PUNCT" ] && [ "$pwcfg_hist" -eq "$PWCFG_HIST" ] && \
			[ "$pwcfg_minpass" -eq "$PWCFG_MINPASS" ] && [ "$pwcfg_maxpass" -eq "$PWCFG_MAXPASS" ] && \
			[ "$pwcfg_warn" -eq "$PWCFG_WARN" ] && [ "$pwcfg_repeat" -eq "$PWCFG_REPEAT" ] && \
			[ "$pwcfg_seq" -eq "$PWCFG_SEQ" ] && [ "$pwcfg_rev" -eq "$PWCFG_REV" ] && \
			[ "$pwcfg_mindif" -eq "$PWCFG_MINDIFF" ];then

			cfgkey_value=0
			$CFGLOG "setting pwcfg_status=0"
		fi
	fi

	if [ "$cfgkey_value" -ne "-1" ]; then
			cfgkey="passwdcfg.status"
			cfgkey_type=2

			/fabos/cliexec/config set $cfgkey $cfgkey_type $cfgkey_value
	fi

	pwcfg_status=`/fabos/cliexec/config get passwdcfg.status 2`

	$CFGLOG "postplay: final values: status: $pwcfg_status"
	FABOS_SWITCHNO=$FABOS_SWITCHNO_TEMP
}

do_920()
{
  #Add IP Filter default strong policies
  correct_ldap_conf_file_permission
  #Remove executable bits from Security files
  correct_security_file_executable_handling
  # We should be running in FOS 9.2.0 code now.
  # Default values of following parameters got changed in FOS 9.2.0:
  # passwdcfg.lockoutthreshold: from 0 -> 3
  # passwdcfg.adminlockout from 0-> 1
  # passwdcfg.adminlockoutconsoleaccess from 0-> 1
  # passwdcfg.lockoutduration from 30->5
  # So make sure that passwdcfg.status value is set to 1 in case the above
  # values from previous firmware are not same as FOS-9.2.0 defaults
  passwdcfg_status_field_handling
}

$CFGLOG "FWDL $FROM_VERSION to $TO_VERSION"

# upgrade from pre-9.1 to 9.1.x
if [[ "$FROM_VERSION" < "910" ]]; then
    if [[ "$TO_VERSION" > "910" ]] || [[ "$TO_VERSION" == "910" ]]; then
      # build 901a sring to ivoke do_910 if from < 910
      $CFGLOG "ccm postplay 91x"
      do_910
    fi
fi

# upgrade from pre-9.2 to 9.2
if [[ "$FROM_VERSION" < "920" ]]; then
    if [[ "$TO_VERSION" > "920" ]] || [[ "$TO_VERSION" == "920" ]]; then
      # build 901a sring to ivoke do_910 if from < 910
      $CFGLOG "ccm postplay 92x"
      do_920
    fi
fi

$CFGLOGD "$PROGRAM Exit"
exit 0
