postinstall revision 2eaee53e5b3d4cd48a35cd651c0a8ae149d772c5
4612N/A#! /usr/bin/sh
4612N/A#
4612N/A# CDDL HEADER START
4612N/A#
4612N/A# The contents of this file are subject to the terms of the
4612N/A# Common Development and Distribution License, Version 1.0 only
4612N/A# (the "License"). You may not use this file except in compliance
4612N/A# with the License.
4612N/A#
4612N/A# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
4612N/A# or http://www.opensolaris.org/os/licensing.
4612N/A# See the License for the specific language governing permissions
4612N/A# and limitations under the License.
4612N/A#
4612N/A# When distributing Covered Code, include this CDDL HEADER in each
4612N/A# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
4612N/A# If applicable, add the following below this CDDL HEADER, with the
4612N/A# fields enclosed by brackets "[]" replaced with your own identifying
4612N/A# information: Portions Copyright [yyyy] [name of copyright owner]
4612N/A#
4612N/A# CDDL HEADER END
4612N/A#
4612N/A#
4612N/A#pragma ident "%Z%%M% %I% %E% SMI"
4612N/A#
4612N/A# Copyright 2005 Sun Microsystems, Inc. All rights reserved.
4612N/A# Use is subject to license terms.
4612N/A#
4612N/A
4612N/APATH="/usr/bin:/usr/sbin:${PATH}"
4612N/Aexport PATH
4612N/A
4612N/AIPSECINIT="$BASEDIR/etc/inet/ipsecinit.conf"
4612N/A
4612N/A#
4612N/A# Update IPsec policy configuration file only if installed
4612N/A# on a Sun Fire 15000.
4612N/A#
4612N/Aplatform=`uname -i`
4612N/Astarcat="SUNW,Sun-Fire-15000"
4612N/Aif [ ${platform} != "${starcat}" ]; then
4612N/A exit 0
4612N/Afi
4612N/A
4612N/Aissue_warning=0
4612N/A
4612N/A#
4612N/A# Function to update ipsecinit.conf if necessary.
4612N/A#
4612N/A# Usage:
4612N/A# remove_ipsecinit_entry sport|dport service apply|permit \
4612N/A# auth_algs [sa_state]
4612N/A#
4612N/A# Note: If an entry exists that uses the same (sport|dport)/service
4612N/A# combination that entry is not removed. This is to prevent
4612N/A# the removal of any custom policies that might have been established.
4612N/A#
4612N/Aremove_ipsecinit_entry()
4612N/A{
4612N/A # Build default entries
4612N/A if [ $3 = "permit" ]; then
4612N/A default="{ $1 $2 ulp tcp } $3 { auth_algs $4 }"
4612N/A else
4612N/A default="{ $1 $2 ulp tcp } $3 { auth_algs $4 sa $5 }"
4612N/A fi
4612N/A
4612N/A # Check for a default entry, and remove it
4612N/A grep "$default" $IPSECINIT > /dev/null 2>&1
4612N/A if [ $? -eq 0 ]; then
4612N/A sed "/$default/d" $IPSECINIT > /tmp/ipsec.$$ && \
4612N/A cat /tmp/ipsec.$$ > $IPSECINIT
4612N/A rm -f /tmp/ipsec.$$
4612N/A return
4612N/A fi
4612N/A
4612N/A #
4612N/A # Check the file for an entry that
4612N/A # has a matching (sport|dport)/port pair
4612N/A #
4612N/A nawk " BEGIN { RS=\"}\" }
4612N/A /$1.*$2/ { exit 1 }
4612N/A " $IPSECINIT > /dev/null 2>&1
4612N/A
4612N/A # Found a modified entry, just issue a warning
4612N/A if [ $? -eq 1 ]; then
4612N/A echo "Found a policy for $1 $2 that does not match the" \
4612N/A "default policy"
4612N/A issue_warning=1
4612N/A fi
4612N/A}
4612N/A
4612N/A
4612N/A#
4612N/A# Remove all of our default policies
4612N/A#
4612N/Aremove_ipsecinit_entry dport sun-dr permit md5
4612N/Aremove_ipsecinit_entry sport sun-dr apply md5 unique
4612N/Aremove_ipsecinit_entry dport cvc_hostd permit md5
4612N/Aremove_ipsecinit_entry sport cvc_hostd apply md5 unique
4612N/A
4612N/A
4612N/Aif [ $issue_warning -eq 1 ]; then
4612N/A echo
4612N/A echo "NOTICE: One or more of the default IPsec policies for the"
4612N/A echo "Sun Fire 15000 services has been modified. As a result, the"
4612N/A echo "modified policy for those services was not removed. Please"
4612N/A echo "verify that the /etc/inet/ipsecinit.conf file is correct."
4612N/A echo "For more information, refer to sckmd(1M) and ipsecconf(1M)."
4612N/A echo
4612N/Afi
4612N/A
4612N/Aexit 0
4612N/A