#!/bin/bash
#  Copyright (c) 2008, 2020, Oracle and/or its affiliates.
#  $Id: serverrename.sh 146617 2018-01-12 14:45:05Z matt.dean@oracle.com $
#
#  Author: Bill Weir
#  Utility to rename a Secure Global Server

. "common-env.sh"
source "common.sh"

# Command Exit Codes:
# 0 - Server rename completed successfully.
# 1 - Generic error.
# 2 - No name change detected.
# 3 - DNS Error.
# 4 - Unsupported configuration.
# 5 - Exited on user choice (interactive mode only).

EXIT_SUCCESS=0
EXIT_ERROR=1
EXIT_NOCHANGE=2
EXIT_DNS_ERROR=3
EXIT_UNSUPPORTED=4
EXIT_ON_USER=5

GW_KEYSTORE_PATH="proxy/etc/keystore"
GW_KEYSTORE_CLIENT_PATH="proxy/etc/keystore.client"
GW_KEYSTORE_REFLECTION_PATH="proxy/etc/keystore.reflection"
GW_PASSWORD_PATH="etc/password"
GW_PASSWORD_REFLECTION_PATH="etc/password.reflection"
GW_DEFAULT_KEYTOOL="${SGD_JAVA_DIR}/keytool"
OPENSSL_LIB_PATH="bin/scripts/openssl_lib.sh"

# be paranoid about the current path
if [ -d /bin ]; then
  PATH=/bin:$PATH
fi
if [ -d /sbin ]; then
  PATH=/sbin:$PATH
fi
if [ -d /usr/bin ]; then
  PATH=/usr/bin:$PATH
fi
if [ -d /usr/sbin ]; then
  PATH=/usr/sbin:$PATH
fi
if [ -d /etc ]; then
  PATH=/etc:$PATH
fi
export PATH

N=""
C=""
if echo -n | grep n > /dev/null
then
  C="\c"
else
  N="-n"
fi
case "$MACHINEARCH" in
i3li*|ppli*) N="$N -e" ;;
esac
_ss_headlines="--------------------------------------------------------------------------"

u="`LANG=C LC_ALL=C id | sed 's/.*uid=\([0-9][0-9]*\).*/\1/'`"
if [ "$u" = "0" ]
then
  : # all is okay
else
  echo "You must be root to run this program"
  exit 15
fi

if [ -z "$0" ]; then
  who_i_am=""
else
  who_i_am=`expr "//$0" : '.*/\(.*\)' `
fi

if [ -f $TTAMSG/common -a -f $TTAMSG/tta_serverrename ]; then
  . $TTAMSG/common
  . $TTAMSG/tta_serverrename
else
  echo "Unable to open message file: $TTAMSG/tta_serverrename"
  exit 1
fi

GetPrivUsrGrp()
{
    cat $TTADATADIR/serverconfig/global/array.properties 2>/dev/null | awk -F= \
	'BEGIN { u="ttasys"; wu="ttaserv"; g="ttaserv" }
	$1 == "tarantella.config.array.privilegeduser" { u = $2 }
	$1 == "tarantella.config.array.webserveruser" { wu = $2 }
	$1 == "tarantella.config.array.privilegedgroup" { g = $2 }
	END { print u " " wu " " g }'
}
_privusrgrp=`GetPrivUsrGrp`
privusr=`expr "$_privusrgrp" : '\([^ ]*\) .*'`
webservusr=`expr "$_privusrgrp" : '.* \([^ ]*\) .*'`
privgrp=`expr "$_privusrgrp" : '.* \([^ ]*\)$'`

gwprivusr="sgdgsys"
gwprivgrp="sgdgserv"


case "$trace" in
x) env;set -x
esac


## Setup Java ##
keytoolcmd="${SGD_JAVA_DIR}/keytool"

LOG=var/log/SERVER_RENAMED.log

NEWPEERDNS="" NEWEXTDNS=""

tmp=${TMPDIR:-/tmp}/rename_$$
trap 'rm -f ${tmp} 2>/dev/null; exit' 1 2 3 15

OPENSSL_HELPER=${TTAINSTDIR}/${OPENSSL_LIB_PATH}

cleanexit()
{
    rm -f ${tmp} 2>/dev/null
    exit $1
}

usage()
{
    echo "${lf_usage}" >&2
    cleanexit $1
}

# Delete the old certificate
# Arguments :
# $1 - keytool path
# $2 - the alias of the certificate to delete
# $3 - the keystore to amend
# $4 - the keystore password
deleteCert() {    
    gw_keytool="$1"
    cert_alias="$2"
    keystore="$3"
    keystore_pass="$4"
    
    "${gw_keytool}" \
        -delete \
        -alias "${cert_alias}" \
        -keystore "${keystore}" \
        -storepass "${keystore_pass}"
}

# Create a new certificate
# Arguments :
# $1 - keytool path
# $2 - the alias of the certificate to create
# $3 - the gateway common name
# $4 - the keystore to amend
# $5 - the keystore password
createCert() {
    gw_keytool="$1"
    cert_alias="$2"
    gw_common_name="$3"
    keystore="$4"
    keystore_pass="$5"

    "${gw_keytool}" \
        -genkeypair\
        -alias "${cert_alias}" \
        -dname "cn=${gw_common_name},O=Oracle Corporation Inc,ST=CA,C=US" \
        -keyalg "RSA" \
        -keypass "${keystore_pass}" \
        -keystore "${keystore}" \
        -storepass "${keystore_pass}" \
        -validity 3600
}

# Regenerates password and reflection certificates
# Removes old certificates before adding new ones
# to avoid any errors being reported. 
# Arguments -
# $1 The installation direction for the Gateway
regenGWInternalCerts() {
    gw_install_path="$1"
    keystore="${gw_install_path}/${GW_KEYSTORE_PATH}"
    reflection_keystore="${gw_install_path}/${GW_KEYSTORE_REFLECTION_PATH}"
    read keystore_pass < "${gw_install_path}/${GW_PASSWORD_PATH}"
    read reflection_pass < "${gw_install_path}/${GW_PASSWORD_REFLECTION_PATH}"
    
    gw_common_name="$(${gw_install_path}/bin/bin/ttahostname)"

    source "${gw_install_path}/bin/scripts/common"

    ## Internal Certificate ##
    ## Remove Old Certificate ##
    deleteCert "${GW_DEFAULT_KEYTOOL}" "${OSGD_GW_ALIAS}" \
        "${keystore}" "${keystore_pass}"

    ## Create Certificate ##
    createCert "${GW_DEFAULT_KEYTOOL}" "${OSGD_GW_ALIAS}" "${gw_common_name}" \
        "${keystore}" "${keystore_pass}"

    ## Reflection Certificate ##
    ## Remove Old Certificate ##
    deleteCert "${GW_DEFAULT_KEYTOOL}" "${OSGD_GW_ALIAS}" \
        "${reflection_keystore}" "${reflection_pass}"
    
    ## Create Certificate ##
    createCert "${GW_DEFAULT_KEYTOOL}" "${OSGD_GW_ALIAS}" "${gw_common_name}" \
        "${reflection_keystore}" "${reflection_pass}"
        
    unset keystore_pass reflection_pass
}

# Regenerates External Gateway
# certificates based on new hostname.
# Arguments -
# $1 The installation direction for the Gateway
# $2 The new external DNS
# $3 The path to openssl helper 
regenGWExternalCerts() {
    sgd_install_path="$1"
    gw_install_path="$2"
    new_external_dns="$3"

    tmp_cert="/tmp/tmpcert$$"
    if [ -f "${tmp_cert}" ]
    then
	    rm -f "${tmp_cert}" 2>/dev/null
    fi

    # Check if the gateway's sslcert is self-signed
    "${gw_install_path}/bin/gateway" sslcert export --certfile ${tmp_cert}
    "${sgd_install_path}/${OPENSSL_LIB_PATH}" selfsigned --cert="${tmp_cert}"
    if [ $? -eq 0 ]
    then
        # Current gateway sslcert is self-signed, regenerate it for the new
        # external dns name
        "${gw_install_path}/bin/scripts/regenerate_sslcert.sh" \
            --gatewayname "${new_external_dns}"
    else
        echo "Gateway Certificate not self-signed, no modifications made."
    fi
    
    rm -f "${tmp_cert}"
}

while [ -n "$1" ]; do
    case "$1" in
    --help)
        usage $EXIT_ERROR
	;;
    --peerdns)
	case "$2" in
	"" | -*)
	    echo "${lf_peer_missing}" >&2
	    usage $EXIT_ERROR
	esac
	NEWPEERDNS="$2"
	shift;shift
	;;
    --extdns)
	case "$2" in
	"" | -*)
	    echo "${lf_ext_missing}" >&2
	    usage $EXIT_ERROR
	esac
	NEWEXTDNS="$2"
	shift;shift
	;;
    --quiet)
        quiet=t
        shift
        ;;
    *) 	echo "$lf_badarg $1" >&2
	usage $EXIT_ERROR
    esac
done

## Utilty Function, if quiet option enabled ##
## returns Y otherwise N, setting N will cause User Prompt ##
getAnswer(){
    if [ "${quiet}" == "t" ]
    then
        echo "${a_yes}"
    else
        echo "N"
    fi
}

cd ${TTAINSTDIR}
[ -s bin/scripts/en-us/common ] && . bin/scripts/en-us/common

OLDPEERDNS=`trace="" bin/scripts/getconfig --peerdns`
[ -z "${NEWPEERDNS}" ] && NEWPEERDNS="${OLDPEERDNS}"
OLDEXTDNS=`trace="" bin/scripts/getconfig --extdns`
OLDFULLEXTDNS=`trace="" bin/scripts/getconfig --fullextdns`

[ -n "${NEWEXTDNS}" ] && {
    case "${OLDFULLEXTDNS}" in
    *,*)printf "${lf_config_toohard}" "${OLDFULLEXTDNS}"
	if [ -z "${NEWPEERDNS}" -o "${NEWPEERDNS}" = "${OLDPEERDNS}" ]; then
	    echo "${lf_config_toohard1}"
	    cleanexit $EXIT_UNSUPPORTED
	else
	    [ "${quiet}" != "t" ] && { 
	        answer=N
[ -z "${i18n_yes}" ] && i18n_yes="${a_yes}"
[ -z "${i18n_no}" ] && i18n_no="${a_no}"
[ -z "${i18n_case_yes}" ] && i18n_case_yes="${a_case_yes}"
[ -z "${i18n_case_no}" ] && i18n_case_no="${a_case_no}"
[ -z "${i18n_s_yes}" ] && i18n_s_yes="${s_yes}"
[ -z "${i18n_s_no}" ] && i18n_s_no="${s_no}"
[ "${lf_config_toohard2}" != "NOPROMPT" ] && echo "${lf_config_toohard2}"
echo # blank line between prompt and question
_valid=false
while [ $_valid = false ]
do
  echo $N "${lf_continue} [$answer] $C"
  read _answer
  if [ -z "$_answer" ]
  then
    _answer="$answer"   # default
  fi
  case "$_answer" in
    [${i18n_case_yes}]* )
	    _answer=$i18n_s_yes
	    _valid=true
	    ;;
    [${i18n_case_no}]* )
	    _answer=$i18n_s_no
	    _valid=true
	    ;;
  esac
done
answer="$_answer"

	        case "${answer}" in
	        [${a_case_no}]*) cleanexit $EXIT_ON_USER
	        esac
	    }
	    NEWEXTDNS=""
	fi
    esac
}

noopCount=0
[ -z "${NEWPEERDNS}" -o "${NEWPEERDNS}" = "${OLDPEERDNS}" ] && {
    [ -n "${NEWPEERDNS}" ] && { printf "${lf_peer_same}" "${NEWPEERDNS}"; echo; }
    noopCount=`expr ${noopCount} + 1`
}
[ -z "${NEWEXTDNS}" -o "${NEWEXTDNS}" = "${OLDEXTDNS}" ] && {
    [ -n "${NEWEXTDNS}" ] && { printf "${lf_ext_same}" "${NEWEXTDNS}"; echo; }
    noopCount=`expr ${noopCount} + 1`
}
[ "${noopCount}" -ge 2 ] && {
    echo "${lf_noop}"
    cleanexit $EXIT_NOCHANGE
}

IsColocatedGateway "${GW_INSTALL_PATH}"
COLOCATED_GATEWAY=$?
if [ ${COLOCATED_GATEWAY} -eq 1 ]
then
    # External name should always be the same as the peer
    # when the Gateway is co-located
    GW_NEWEXTDNS="${NEWEXTDNS}"
    NEWEXTDNS="${NEWPEERDNS}"
fi

for name in "${NEWPEERDNS}" "${NEWEXTDNS}"; do
    case "${name}" in
    "") ;;
    *.*) addr="`nslookup ${name} 2>/dev/null | awk '/^Name:[ 	]*'${name}'/ {
	    getline
	    print $0
	    exit
	}'`"
	[ -z "${addr}" ] && {
	    prompt="`printf \"${lf_resolve}\" \"${name}\"`"
  	    [ "${quiet}" != "t" ] && { 
  	        answer=N
[ -z "${i18n_yes}" ] && i18n_yes="${a_yes}"
[ -z "${i18n_no}" ] && i18n_no="${a_no}"
[ -z "${i18n_case_yes}" ] && i18n_case_yes="${a_case_yes}"
[ -z "${i18n_case_no}" ] && i18n_case_no="${a_case_no}"
[ -z "${i18n_s_yes}" ] && i18n_s_yes="${s_yes}"
[ -z "${i18n_s_no}" ] && i18n_s_no="${s_no}"
[ "${prompt}" != "NOPROMPT" ] && echo "${prompt}"
echo # blank line between prompt and question
_valid=false
while [ $_valid = false ]
do
  echo $N "${lf_continue} [$answer] $C"
  read _answer
  if [ -z "$_answer" ]
  then
    _answer="$answer"   # default
  fi
  case "$_answer" in
    [${i18n_case_yes}]* )
	    _answer=$i18n_s_yes
	    _valid=true
	    ;;
    [${i18n_case_no}]* )
	    _answer=$i18n_s_no
	    _valid=true
	    ;;
  esac
done
answer="$_answer"

	        case "${answer}" in
	        [${a_case_no}]*) cleanexit $EXIT_ON_USER
	        esac
	    }
	}
	;;
    *)  printf "${lf_fqdn}" "${name}"; echo
    esac
done

trace="" bin/tarantella status >${tmp}
errMsg=""
[ -z "`egrep \" members \(1\)\" <${tmp}`" -o -n "`egrep \" \(secondary\)\" <${tmp}`" ] && {
    errMsg="${errMsg}
${lf_detach}"
}
[ -n "`egrep \" ${OLDPEERDNS} .*: *Accepting\" <${tmp}`" ] && {
    errMsg="${errMsg}
${lf_stop}"
}
[ -n "${errMsg}" ] && {
    echo "${lf_before}${errMsg}"
    cleanexit $EXIT_UNSUPPORTED
}

## SECURITY ## 
SSL_ENABLED="$(expr $(bin/scripts/getconfig --tarantella.config.server.security.mechanism) : ".*\(ssl\).*")"

## Check for Self-Signed ##
## If self-signed then regenerate otherwise leave for admin ##
[ -n "${SSL_ENABLED}" ] && {
  ssl_regen="N"
  # This command will return 0 for self-signed
  ${OPENSSL_HELPER} selfsigned --cert=var/tsp/cert.pem
  [ $? -eq 0 ] && {
    ssl_regen="yes"
  } || {
    echo "SSL Certificates not updated, not self-signed" >> "${LOG}"
  }
}

## RENAME DEFAULT OBJECTS ##
rename_objects=$(getAnswer)
[ "${quiet}" != "t" ] && {
[ -z "${i18n_yes}" ] && i18n_yes="${a_yes}"
[ -z "${i18n_no}" ] && i18n_no="${a_no}"
[ -z "${i18n_case_yes}" ] && i18n_case_yes="${a_case_yes}"
[ -z "${i18n_case_no}" ] && i18n_case_no="${a_case_no}"
[ -z "${i18n_s_yes}" ] && i18n_s_yes="${s_yes}"
[ -z "${i18n_s_no}" ] && i18n_s_no="${s_no}"
[ "${lf_renamedefault}" != "NOPROMPT" ] && echo "${lf_renamedefault}"
echo # blank line between prompt and question
_valid=false
while [ $_valid = false ]
do
  echo $N "${lf_yesno} [$rename_objects] $C"
  read _answer
  if [ -z "$_answer" ]
  then
    _answer="$rename_objects"   # default
  fi
  case "$_answer" in
    [${i18n_case_yes}]* )
	    _answer=$i18n_s_yes
	    _valid=true
	    ;;
    [${i18n_case_no}]* )
	    _answer=$i18n_s_no
	    _valid=true
	    ;;
  esac
done
rename_objects="$_answer"

}

prompt="${lf_config}"
[ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
    prompt="${prompt}
`printf \"${lf_config_peer}\" ${OLDPEERDNS} ${NEWPEERDNS}`"
}
[ -n "${NEWEXTDNS}" -a "${NEWEXTDNS}" != "${OLDEXTDNS}" ] && {
    prompt="${prompt}
`printf \"${lf_config_ext}\" ${OLDEXTDNS} ${NEWEXTDNS}`"
}
[ "${quiet}" != "t" ] && {
    answer=N
[ -z "${i18n_yes}" ] && i18n_yes="${a_yes}"
[ -z "${i18n_no}" ] && i18n_no="${a_no}"
[ -z "${i18n_case_yes}" ] && i18n_case_yes="${a_case_yes}"
[ -z "${i18n_case_no}" ] && i18n_case_no="${a_case_no}"
[ -z "${i18n_s_yes}" ] && i18n_s_yes="${s_yes}"
[ -z "${i18n_s_no}" ] && i18n_s_no="${s_no}"
[ "${prompt}" != "NOPROMPT" ] && echo "${prompt}"
echo # blank line between prompt and question
_valid=false
while [ $_valid = false ]
do
  echo $N "${lf_confirm} [$answer] $C"
  read _answer
  if [ -z "$_answer" ]
  then
    _answer="$answer"   # default
  fi
  case "$_answer" in
    [${i18n_case_yes}]* )
	    _answer=$i18n_s_yes
	    _valid=true
	    ;;
    [${i18n_case_no}]* )
	    _answer=$i18n_s_no
	    _valid=true
	    ;;
  esac
done
answer="$_answer"

    case "${answer}" in
    [${a_case_no}]*) cleanexit $EXIT_ON_USER
    esac
}

## Update Certificates that change on External DNS ##
## If name changed and ssl regen enabled backup old certs ##
## otherwise leave in place ##
[ -n "${NEWEXTDNS}" -a "${NEWEXTDNS}" != "${OLDEXTDNS}" -a "${ssl_regen}" == "yes" ] && {
    n=0
    while [ "${n}" -lt 100 ]; do
	if [ -d var/tsp.OLD.${n} ]; then
	    n=`expr ${n} + 1`
	else
	    mkdir var/tsp.OLD.${n}
	    chown "${privusr}:${privgrp}" var/tsp.OLD.${n}
	    chmod 700 var/tsp.OLD.${n}
	    cp -p var/tsp/* var/tsp.OLD.${n} >>"${LOG}" 2>&1 && rm -f var/tsp/* 2>/dev/null
	    find var/tsp.OLD.${n} -depth -print -exec chown "${privusr}:${privgrp}" {} \;
	    find var/tsp.OLD.${n} -type f -exec chmod 600 {} \;
	    printf "${lf_certs_saved}" var/tsp.OLD.${n}; echo
	    break
	fi
    done
}

## Peer Certificate Pruning ##
## Only re-arrange peer DNS if changed ##
[ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
    n=0
    CERTFILES="PeerCAcert.pem PeerCAkey.pem PeerServercert.pem PeerServer.csr"
    while [ "${n}" -lt 100 ]; do
        if [ -d var/info/certs.OLD.${n} ]; then
            n=`expr ${n} + 1`
        else
            mkdir var/info/certs.OLD.${n}
            chown "${privusr}:${privgrp}" var/info/certs.OLD.${n}
            chmod 700 var/info/certs.OLD.${n}
            for file in $CERTFILES; do
                cp -p "var/info/certs/$file" var/info/certs.OLD.${n} && rm -f "var/info/certs/$file" 2>/dev/null
                chown "${privusr}:${privgrp}" "var/info/certs.OLD.${n}/${file}"
                chmod 600 "var/info/certs.OLD.${n}/${file}"
            done
            printf "${lf_certs_saved}" var/info/certs.OLD.${n}; echo
            break
        fi
    done

    ## Peer External Certificates ##
    n=0
    while [ "${n}" -lt 100 ]; do
	if [ -d var/info/certs/external.OLD.${n} ]; then
	    n=`expr ${n} + 1`
	else
	    mkdir var/info/certs/external.OLD.${n}
	    cp -p var/info/certs/external/* var/info/certs/external.OLD.${n} && rm -f var/info/certs/external/* 2>/dev/null
	    ##Fix Permissions
	    chown "${privusr}:${privgrp}" var/info/certs/external.OLD.${n}
	    chmod 700 var/info/certs/external.OLD.${n}
	    find var/info/certs/external.OLD.${n} -depth -print -exec chown "${privusr}:${privgrp}" {} \;
	    find var/info/certs/external.OLD.${n} -type f -exec chmod 600 {} \;
	    printf "${lf_certs_saved}" var/info/certs/external.OLD.${n}; echo
	    break
	fi
    done
    
    ## Use Keytool to remove ##
    ## 1) CA Entries for old Peer Name
    ## 2) Intra Array Certificates for old Peer Name
    truststore_file="var/info/certs/truststore"
    keystore_file="var/info/certs/keystore"
    ca_cert_name="${OLDPEERDNS} ca"
    server_cert_name="${OLDPEERDNS} peer server"
    read key < "var/info/key"
    
    # Removes existing PeerCA, and Peer Certificate from truststore, leaving
    # any other certificates intact.
    "${keytoolcmd}" -delete -keystore "${keystore_file}" -storepass "${key}" -alias "${ca_cert_name}" 2>&1 | tee -a "${LOG}"
    "${keytoolcmd}" -delete -keystore "${keystore_file}" -storepass "${key}" -alias "${server_cert_name}" 2>&1 | tee -a "${LOG}"
    "${keytoolcmd}" -delete -keystore "${truststore_file}" -storepass "${key}" -alias "${ca_cert_name}" 2>&1 | tee -a "${LOG}"
    ##Make note of Changes##
    changed="${changed}
  ${TTAINSTDIR}/${keystore_file}
  ${TTAINSTDIR}/${truststore_file}"
}

echo "${OLDPEERDNS}
${OLDEXTDNS}" >var/info/serverrename

newf="var/serverconfig/local/server.properties"
changed="${changed}
  ${TTAINSTDIR}/${newf}"
cp -p ${newf} ${newf}1
bin/bin/ttareseed ${newf}

# Change peer DNS
[ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
    oldf="var/serverconfig/global/${OLDPEERDNS}.properties"
    newf="var/serverconfig/global/${NEWPEERDNS}.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    cp -p ${oldf} ${newf}
    sed "s/^\(tarantella\.config\.host\.master\)=.*/\1=${NEWPEERDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf} && rm -f ${oldf}
    sed "s/^\(tarantella\.config\.host\.dns\.peer\)=.*/\1=${NEWPEERDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    newf="var/serverconfig/local/bootstrap.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "s/^\(tarantella\.config\.server\.dns\.peer\)=.*/\1=${NEWPEERDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    newf="var/serverresources/schema/version"
    # This file might not exist. It is created by the JServer on 'tarantella start'.
    if [ -f "${newf}" ]
    then
        changed="${changed}
  ${TTAINSTDIR}/${newf}"
        sed "s/${OLDPEERDNS}/${NEWPEERDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}
    fi

    newf="var/info/master"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    echo ${NEWPEERDNS} >${newf}

    newf="var/info/primary"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    echo ${NEWPEERDNS} >${newf}

    T_VER=`cat var/info/tomcatversion`
    newf="webserver/tomcat/${T_VER}/shared/classes/sgd_webapp.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "s/${OLDPEERDNS}/${NEWPEERDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}
}

# Change external DNS
[ -n "${NEWEXTDNS}" -a "${NEWEXTDNS}" != "${OLDEXTDNS}" ] && {
    newf="var/serverconfig/global/${NEWPEERDNS}.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "s/^\(tarantella\.config\.host\.dns\.external\)=.*/\1=${NEWEXTDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    newf="var/serverconfig/local/bootstrap.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "s/^\(tarantella\.config\.server\.dns\.external\)=.*/\1=${NEWEXTDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    newf="var/serverconfig/local/nic.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "/^tarantella\.config\.server\.bindaddresses\.external=/s/${OLDEXTDNS}/${NEWEXTDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    newf="var/serverconfig/local/server.properties"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "/^tarantella\.config\.server\.netservice\.proxy\.externalnames=/s/${OLDEXTDNS}/${NEWEXTDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}

    A_VER=`cat var/info/apacheversion`
    newf="webserver/apache/${A_VER}/conf/httpd.conf"
    changed="${changed}
  ${TTAINSTDIR}/${newf}"
    sed "s/${OLDEXTDNS}/${NEWEXTDNS}/" ${newf} >${tmp} && cp ${tmp} ${newf}
}

(printf "${lf_log}" "`date`"; echo) >>"${LOG}"
[ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
    (printf "${lf_config_peer}" ${OLDPEERDNS} ${NEWPEERDNS}; echo) >>"${LOG}"
}
[ -n "${NEWEXTDNS}" -a "${NEWEXTDNS}" != "${OLDEXTDNS}" ] && {
    (printf "${lf_config_ext}" ${OLDEXTDNS} ${NEWEXTDNS}; echo) >>"${LOG}"
}


## Rename Default Objects ##
APP_SERVER_STR=".../_ens/o=appservers/cn=Tarantella server %s"
case "${rename_objects}" in
    [${a_case_yes}]*)
        [ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
            SHORT_OLD_PEER="$(echo ${OLDPEERDNS} | cut -d '.' -f1)"
            SHORT_NEW_PEER="$(echo ${NEWPEERDNS} | cut -d '.' -f1)"
            CURRENT_APPSERVER=$( printf "${APP_SERVER_STR}" "${SHORT_OLD_PEER}" )
            NEW_APPSERVER=$( printf "${APP_SERVER_STR}" "${SHORT_NEW_PEER}" )
            printf "${lf_renamingobject}" "${CURRENT_APPSERVER}" "${NEW_APPSERVER}" | tee -a "${LOG}"
            ./bin/tarantella object rename --name "${CURRENT_APPSERVER}" \
                                           --newname "${NEW_APPSERVER}" >> ${LOG} 2>&1
            ./bin/tarantella object edit --name "${NEW_APPSERVER}" \
                                         --address "${NEWPEERDNS}" >> ${LOG} 2>&1
        }
    ;;
esac

## Peer CA ##
[ -n "${NEWPEERDNS}" -a "${NEWPEERDNS}" != "${OLDPEERDNS}" ] && {
    printf "\nRegenerating Peer Certificates\n" | tee -a "${LOG}"
    ## Peer Name has also changed, update Peer Certificates ##
    rm -f "${TTADATADIR}/tmp/randfile"
    trace="" bin/tarantella security keystoregen --peerca >> "${LOG}" 2>&1
}

## Above will have removed the current SSL stores, regenerate them all here ##
case "${ssl_regen}" in
    [${a_case_yes}]*)
        printf "\nRegenerating SSL Certificates\n" | tee -a "${LOG}"
        ## Preserve FWF settings ##
        FWF="$(./bin/scripts/getconfig --tarantella.config.server.proxiedhttpsurl)"
        [ -n "$FWF" ] && {
            security_options="--firewalltraversal"
        }
        
        trace="" bin/tarantella security_enable  --quiet --norestart "${security_options}" >> "${LOG}" 2>&1
    ;;
esac

# Is there a local Gateway installed ?
if [ ${COLOCATED_GATEWAY} -eq 1 ]
then
    regenGWInternalCerts "${GW_INSTALL_PATH}"
    regenGWExternalCerts "${TTADIR}" "${GW_INSTALL_PATH}" "${GW_NEWEXTDNS}"
    exportSGDCertificates "${TTADIR}" "${GW_INSTALL_PATH}"
    exportGWCertificates "${TTADIR}" "${GW_INSTALL_PATH}"
    gw_https_port="`getGatewayHTTPSPort "${GW_INSTALL_PATH}"`"
    if [ -z "${gw_https_port}" ]
    then
        gw_https_port="${HTTPS_PORT}"
    fi
    joinGW "${TTADIR}" "${GW_INSTALL_PATH}" "${NEWPEERDNS}" "${GW_NEWEXTDNS}" "${gw_https_port}"
fi

echo "${lf_changed}" | tee -a "${LOG}"
echo "${changed}" | LANG=C LC_ALL=C sort -u | tee -a "${LOG}"
echo "${lf_complete}" | tee -a "${LOG}"
printf "${lf_config_peer}\n" "${OLDPEERDNS}" "${NEWPEERDNS}" | tee -a "${LOG}"
# Is there a local Gateway installed ?
if [ ${COLOCATED_GATEWAY} -eq 1 ]
then
    printf "${lf_config_ext}\n" "${OLDEXTDNS}" "${GW_NEWEXTDNS}" | tee -a "${LOG}"
else
    printf "${lf_config_ext}\n" "${OLDEXTDNS}" "${NEWEXTDNS}" | tee -a "${LOG}"
fi
[ -n "${SSL_ENABLED}" -a "${ssl_regen}" == "N" ] && {
printf "SSL enabled, certificates not updated.\n" | tee -a "${LOG}"
}
echo "${lf_next}" | tee -a "${LOG}"

cleanexit $EXIT_SUCCESS
