#!/bin/sh
#  $Id: security_disable.sh 144933 2017-02-08 09:50:25Z justin.carveley@oracle.com $
#  Copyright (c) 2008, 2018, Oracle and/or its affiliates. All rights reserved.
#  This software code contains proprietary information
#  and should be treated as confidential.
#
#  Author: Bill Weir
#
#  Undoes the effect of a previous "security enable" operation.

N=""
C=""
if echo -n | grep n > /dev/null
then
  C="\c"
else
  N="-n"
fi
case "$MACHINEARCH" in
i3li*|ppli*) N="$N -e" ;;
esac
_ss_headlines="--------------------------------------------------------------------------"

u="`LANG=C LC_ALL=C id | sed 's/.*uid=\([0-9][0-9]*\).*/\1/'`"
if [ "$u" = "0" ]
then
  : # all is okay
else
  echo "You must be root to run this program"
  exit 15
fi

if [ -f $TTAMSG/common -a -f $TTAMSG/security_disable ]; then
  . $TTAMSG/common
  . $TTAMSG/security_disable
else
  echo "Unable to open message file: $TTAMSG/security_disable"
  exit 1
fi


case "$trace" in x|X) set -x;; esac

tmp="${TMPDIR:-/tmp}/ttasecure$$"
rm -rf "${tmp}" 2>/dev/null
trap 'rm -f ${tmp} 2>/dev/null; exit' 1 2 3 15

cleanexit() {
    rm -f ${tmp} 2>/dev/null
    exit $1
}

usage()
{
    echo "${lf_disable_usage}" >&2
}

short_usage() {
    echo "$1
${sf_disable_usage}" >&2
}

# Parse command-line parameters
quiet=''
while [ -n "$1" ]; do
    case "$1" in
    --quiet) quiet='t';;
    --help) usage; cleanexit 0;;
    *) short_usage "${l_invalid_arg1}$1${l_invalid_arg2}" ; cleanexit 1
    esac
    [ -n "$1" ] && shift
done

T="${TTADIR}/bin/tarantella"
TSPDIR="${TTADIR}/var/tsp"
CERTDIR="${TTADIR}/var/info/tspcerts"
HOSTNAME=`${TTADIR}/bin/bin/ttahostname 2>/dev/null`
A_VER=`cat ${TTADIR}/var/info/apacheversion 2>/dev/null`; A_DIR="${TTADIR}/webserver/apache/${A_VER}"
T_VER=`cat ${TTADIR}/var/info/tomcatversion 2>/dev/null`; T_DIR="${TTADIR}/webserver/tomcat/${T_VER}"
OLDPEERDNS=`trace='' ${TTADIR}/bin/scripts/getconfig --peerdns`

# Sanity check: make sure we can find everything we need
[ -x "$T" -a -n "${HOSTNAME}" -a -n "${A_VER}" -a -n "${T_VER}" ] || {
    printf "${pf1_cant_find}" ${TTADIR} >&2; cleanexit 1
}

# Tell them that we'll be doing a restart
[ -z "${quiet}" ] && {
    echo "${lf_warnrestart}"
    while :; do
	echo $N "${lf_confirm}$C"
	read reply
	case "${reply}" in
	[yY]*) break;;
	[nN]*) echo "${lf_nochanges}"; cleanexit 0;;
	esac
    done
}

# Make sure we're not in an array
trace='' $T status >${tmp}
cat ${tmp}
echo
errMsg=''
[ -z "`egrep \" members \(1\)\" <${tmp}`" -o -n "`egrep \" \(secondary\)\" <${tmp}`" ] && {
    errMsg="${errMsg}
${lf_detach}"
}
[ -n "${errMsg}" ] && {
    echo "${lf_before}${errMsg}"
    cleanexit 3
}

# Undo all the other stuff we did during "security enable"
trace='' $T security stop
trace='' $T config edit --array --security-firewallurl ''
[ -s "${TTADIR}/var/info/array-port-encrypted.orig" ] && ArrayPortEncrypted=`cat ${TTADIR}/var/info/array-port-encrypted.orig` || ArrayPortEncrypted="5307"
trace='' $T config edit --array-port-encrypted ${ArrayPortEncrypted}
rm -f ${TTADIR}/var/info/array-port-encrypted.orig 2>/dev/null

# If the "security enable" command was using self-signed certificates, delete them
for pem in ca.pem cert.pem csr.pem key.pem key.pending.pem; do
    [ -s ${TSPDIR}/${pem} ] && cmp -s ${TSPDIR}/${pem} ${CERTDIR}/${pem}.ss && rm -f ${TSPDIR}/${pem} ${CERTDIR}/${pem}.ss 2>/dev/null
done

# delete h5c configuration profiles and related folders
profile_dir="${A_DIR}/htdocs/certs"

if [ -d "${profile_dir}" ]; then
  rm -rf "${profile_dir}"
fi

cert_dir="${TSPDIR}/certs"
gw_cert_dir="${cert_dir}/gateway"
sgd_cert_dir="${cert_dir}/array"
hostname_with_dashes="`echo ${HOSTNAME} | sed 's|\.|-|g'`"

# Only delete the certificate directories if they are empty (excluding the symlink to this servers certificate we created ourselves)
if [ -L "${sgd_cert_dir}/${hostname_with_dashes}.pem" ]; then
  rm -f "${sgd_cert_dir}/${hostname_with_dashes}.pem"
fi 
if [ -L "${sgd_cert_dir}/CA-${hostname_with_dashes}.pem" ]; then
  rm -f "${sgd_cert_dir}/CA-${hostname_with_dashes}.pem"
fi 

if [ -d "${sgd_cert_dir}" -a -z "`ls -A ${sgd_cert_dir}`" ]; then
  rm -rf "${sgd_cert_dir}"
fi

if [ -d "${gw_cert_dir}" -a -z "`ls -A ${gw_cert_dir}`" ]; then
  rm -rf "${gw_cert_dir}"
fi

if [ -d "${cert_dir}" -a -z "`ls -A ${cert_dir}`" ]; then
  rm -rf "${cert_dir}"
fi

# Restart the webserver and SGD server
echo y | trace='' $T restart --quiet --http --servlet

cleanexit 0
