#!/bin/bash
# Copyright (c) 2018, 2020, Oracle and/or its affiliates.
#
# This script is run by rpm after the rpm is installed.
# It should do any special setup that needs to be done for the security
# components for an install or an upgrade.
# Usage: postinstall install_flag
# Where install_flag is a number that tells you if this is a fresh installation
# or an upgrade. 
# install_flag == 1 - Initial install
# install_flag == 2 - Upgrade

#
# Exit codes
#
OK=0
FAIL=1

#
# Check we have the necessary arguments.
# 

if [ $# -lt 1 -o $# -gt 1 ]
then
    echo "Usage: $0 install_flag"
    exit $FAIL
fi

if [ -z "${INSTDIR}" ]
then
    echo "INSTDIR not set"
    exit $FAIL
fi

if [ -z "${PRIV_USER}" ]
then 
    echo "PRIV_USER not set"
    exit $FAIL
fi

if [ -z "${PRIV_GROUP}" ]
then
    echo "PRIV_GROUP not set"
    exit $FAIL
fi

INSTALL_FLAG="$1"
export UPGRADE="false"
if [ ${INSTALL_FLAG} -eq 2 ]
then
    UPGRADE="true"
elif [ ${INSTALL_FLAG} -ne 1 ]
then
    echo "Invalid install_flag: ${INSTALL_FLAG}"
    exit $FAIL
fi

# Get PRODUCT_VERSION
# This is a generic product script used to establish an environment
# before starting/stopping a product or component.
# This script was built from shell library
#   $Id$
# This script has to run on every platform we support.  Any suggestions
# for improvement are welcome (but must be portable!)

# Version numbers
PRODUCT_VERSION="5.60.514"
PRODUCT_VERSION_FULL="5.60.514"
PRODUCT_VERSION_MAJOR=5
PRODUCT_VERSION_FEATURE=6
PRODUCT_VERSION_BUG=0
PRODUCT_VERSION_BUILD=514
PRODUCT_VERSION_BUILD_DECIMAL=514
PRODUCT_VERSION_AS_NUMBER=560514
PRODUCT_VERSION_CAB=5,6,0,514
PRODUCT_VERSION_RPM=5.60-514

# Product names
PRODUCT_FULL_NAME="Oracle Secure Global Desktop"
PRODUCT_SHORT_NAME="Secure Global Desktop"
PRODUCT_IDENT="SSGD"
PRODUCT_SHORT_FILENAME="Tarantella"
PRODUCT_LSBSCRIPTNAME="sun.com-sgd-base"
PRODUCT_LSBSCRIPT_RUN_LEVEL="90"
TSP_FULL_NAME="Oracle Secure Global Desktop Security Pack"
TSP_SHORT_NAME="Security Pack"
WCP_FULL_NAME="Oracle Secure Global Desktop Windows Connectivity Pack"
WCP_SHORT_NAME="Windows Connectivity Pack"
TN3270_FULL_NAME="Oracle Secure Global Desktop Mainframe Connectivity Pack"
TN3270_SHORT_NAME="Mainframe Connectivity Pack"
AS400_FULL_NAME="Oracle Secure Global Desktop AS/400 Connectivity Pack"
AS400_SHORT_NAME="AS/400 Connectivity Pack"
S1PSTK_FULL_NAME="Oracle Secure Global Desktop Channel for Sun ONE Portal Server"
S1PSIP_FULL_NAME="Oracle Secure Global Desktop Integration Pack for Sun ONE Portal Server"
S1PSTK_SHORT_NAME="Secure Global Desktop Channel for Sun ONE Portal Server"
S1PSIP_SHORT_NAME="Secure Global Desktop Integration Pack for Sun ONE Portal Server"

OBJECT_MGR_NAME="Object Manager"
ARRAY_MGR_NAME="Array Manager"
NATIVE_WIN16_FULL_NAME="Oracle Secure Global Desktop Native Client for Windows 3.1"
NATIVE_WIN16_SHORT_NAME="Native Client for Windows 3.1"
NATIVE_WIN32_FULL_NAME="Oracle Secure Global Desktop Native Client for Windows 95, 98 and NT"
NATIVE_WIN32_SHORT_NAME="Native Client for Windows 95, 98 and NT"
NATIVE_WYSE_FULL_NAME="Oracle Secure Global Desktop Native Client for Wyse"
NATIVE_WYSE_SHORT_NAME="Native Client for Wyse"
NATIVE_FULL_NAME="Oracle Secure Global Desktop Native Client"
NATIVE_SHORT_NAME="Native Client"
NATIVE_REGISTRY_NAME="Tarantella Native Client"
INTCLI_FULL_NAME="Oracle Secure Global Desktop Client"
INTCLI_SHORT_NAME="Client"
TCC_FULL_NAME="Oracle Secure Global Desktop Client"
TCC_HELPER_NAME="Oracle Secure Global Desktop Client Helper"
TCC_ACTIVEX_NAME="Oracle Secure Global Desktop ActiveX Control"
TCC_PLUGIN_NAME="Oracle Secure Global Desktop Netscape Plug-in"
T3COMPONENT_WIN_NAME="Oracle Secure Global Desktop Enhancement Module for Windows"
T3COMPONENT_UNIX_NAME="Oracle Secure Global Desktop Enhancement Module for UNIX(TM) and Linux Platforms"
T3COMPONENT_SHORT_UNIX_NAME="tem"
T3COMPONENT_NAME="Oracle Secure Global Desktop Enhancement Module"
T3COMPONENT_LSBSCRIPTNAME="sun.com-sgd-em"
T3COMPONENT_LSBSCRIPT_RUN_LEVEL="90"
GWCOMPONENT_UNIX_NAME="Oracle Secure Global Desktop Gateway for UNIX(TM) and Linux Platforms"
GWCOMPONENT_NAME="Oracle Secure Global Desktop Gateway"
GWCOMPONENT_SHORTNAME="SGD Gateway"
GWCOMPONENT_LSBSCRIPTNAME="sun.com-sgd-gw"
GWCOMPONENT_LSBSCRIPT_RUN_LEVEL="91"

# Watch the length of these names: IE refuses to remove packages if
# the name is too long.
ARCHIVE_NAME_ttalw="TCC Helper, version"
ARCHIVE_NAME_asad="3.x Framework Java Archive"
#ARCHIVE_NAME_tta="3.x Java Archive"
#ARCHIVE_NAME_tta="3.x Combined Java Archive"
ARCHIVE_NAME_tta="Client, "
ARCHIVE_NAME_tsp="3.x Security Java Archive"
ARCHIVE_NAME_proxy="3.x Proxy Java Archive"
WEBSTART_JAR_NAME="sgdwscs"
ARCHIVE_SUFFIX="K"

NS_REGKEY="java/download/com/tarantella/tta"

PRODUCT_VENDOR="Oracle Corporation, Inc."
PRODUCT_SHORT_VENDOR="Oracle"

# Capabilities:
# The format for the capabilities required by the client end of a
# connection is: CAPABILITIES_protocol_type_REQUIRED="expression"

# The format for the capabilities provided by the server end of a
# connection is: CAPABILITIES_protocol_type_PROVIDED="c1 c2 ... c3"

# Asad between a webtop client and server:
CAPABILITIES_ASAD_WEBTOPCLIENT_REQUIRED="(1.1 || 1.2)"
CAPABILITIES_ASAD_WEBTOPCLIENT_PROVIDED="1.1 1.2"

# Asad between two peer servers, or an admin tool and a server:
# 1.1 is core E3 array functionality.
# 1.2 is 3.01 array interoperability functionality.
# 2.1 is core Pisa client device mapping functionality (not a requirement)
CAPABILITIES_ASAD_PEER_REQUIRED="(1.1 || 1.2)"
CAPABILITIES_ASAD_PEER_PROVIDED="1.1 1.2 2.1"

# Client versions of server strings; same format, name prefixed by CLIENT
# Asad between a webtop client and server:
CLIENTCAPABILITIES_ASAD_WEBTOPCLIENT_REQUIRED="(1.1 || 1.2)"
CLIENTCAPABILITIES_ASAD_WEBTOPCLIENT_PROVIDED="1.1 1.2"

# Top-level item names in ENS datastore
DEFAULT_ROOT_ENS="organization"
SYSTEM_ROOT_ENS="Tarantella System Objects"
APP_ROOT_ENS="applications"
APPSERVER_ROOT_ENS="appservers"

WEB_SERVICES_VERSION=1.9



DoGenerateSelfSignedCertificates()
{
    T="${INSTDIR}/bin/tarantella"
    TSPDIR="${INSTDIR}/var/tsp"
    CERTDIR="${INSTDIR}/var/info/tspcerts"

    mkdir ${CERTDIR} 2>/dev/null
    chgrp ${PRIV_GROUP} ${CERTDIR} 2>/dev/null
    chown ${PRIV_USER} ${CERTDIR} 2>/dev/null
    chmod 750 ${CERTDIR} 2>/dev/null

    # Make sure certificates don't exist already
    if [ -s "${TSPDIR}/csr.pem" -o -s "${TSPDIR}/cert.pem" -o -s "${TSPDIR}/key.pem" -o -s "${TSPDIR}/key.pending.pem" ]
    then
        return 0
    fi

    # Request certificate
    $T security certrequest \
        --orgname "${PRODUCT_VENDOR}" --country US \
        --state CA </dev/null >>"${INSTDIR}/var/log/setup.log" 2>&1
    ret=$?
    if [ ${ret} -ne 0 ]
    then
        echo "security certrequest failed: status=${ret}"
        exit $FAIL
    fi

    # Self-sign certificate
    $T security selfsign >>"${INSTDIR}/var/log/setup.log" 2>&1
    ret=$?
    if [ ${ret} -ne 0 ]
    then
        echo "security selfsign failed: status=${ret}"
        exit $FAIL
    fi

    # Set certificate as its own root
    $T security customca --rootfile "${TSPDIR}/cert.pem" >>"${INSTDIR}/var/log/setup.log" 2>&1
    ret=$?
    if [ ${ret} -ne 0 ]
    then
        echo "security customca failed: status=${ret}"
        exit $FAIL
    fi

    # Copy certificates and keys with ".ss" extension
    for pem in ca.pem cert.pem csr.pem key.pem key.pending.pem
    do
        if [ -s "${TSPDIR}/${pem}" ]
        then
            cp -p "${TSPDIR}/${pem}" "${CERTDIR}/${pem}.ss"
        fi
    done
}

DoGenerateMobileTLSProfile()
{
    TSPDIR="${INSTDIR}/var/tsp"

    # create h5c configuration profiles and related folders
    profile_dir="${INSTDIR}/var/docroot/certs"

    if [ ! -d "${profile_dir}" ]; then
      mkdir -p "${profile_dir}"
      chgrp ${PRIV_GROUP} "${profile_dir}"
      chmod 750 "${profile_dir}"
    fi

    cert_dir="${TSPDIR}/certs"
    gw_cert_dir="${cert_dir}/gateway"
    sgd_cert_dir="${cert_dir}/array"
    hostname_with_dashes="`echo ${HOSTNAME} | sed 's|\.|-|g'`"

    if [ ! -d "${sgd_cert_dir}" ]
    then
        mkdir -p "${sgd_cert_dir}"
    fi
    if [ ! -d "${gw_cert_dir}" ]
    then
        mkdir -p "${gw_cert_dir}"
    fi

    chmod -R 751 "${cert_dir}"

    if [ -f "${TSPDIR}/cert.pem" ]
    then
        if [ ! -f "${sgd_cert_dir}/${hostname_with_dashes}.pem" ]
        then
            ln -s "${TSPDIR}/cert.pem" "${sgd_cert_dir}/${hostname_with_dashes}.pem"
        fi
    fi

    chown -R ${PRIV_USER} "${cert_dir}"
    chgrp -R ${PRIV_GROUP} "${cert_dir}"

    # Create a mobile profile 
    "${INSTDIR}/bin/scripts/mobile_profile_create.sh" --quiet
}

DoSELinuxConfiguration()
{
  chcon -R -t var_log_t /opt/tarantella/var/log \
                        /opt/tarantella/webserver/apache/default/logs \
                        /opt/tarantella/webserver/tomcat/default/logs
}

if ! ${UPGRADE}
then
    # Create the SGD trust store password file with default password.
    SGDKEYSTOREPASSFILE="${INSTDIR}/var/info/sgdstorepass"
    echo "changeit" > "${SGDKEYSTOREPASSFILE}"
    chmod 440 "${SGDKEYSTOREPASSFILE}"
    chown ${PRIV_USER}:${PRIV_GROUP} "${SGDKEYSTOREPASSFILE}"

    # Generate self-signed TLS certificate and mobile profile
    DoGenerateSelfSignedCertificates
    DoGenerateMobileTLSProfile
fi

# Configure SELinux to allow logrotate access to our log files
DoSELinuxConfiguration

exit $OK
