#

# Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.

#

# ident  "@(#)migration.pl	1.5 03/06/26 SMI"

#

# $Id: masfcnv,v 1.3 2004/01/09 14:04:14 rr144420 Exp $

=head1 NAME

masfcnv - SNMP configuration migration script

=head1 SYNOPSIS

masfcnv S<[ -cimnrs ]> S<[ -l agent|master ]> S<[ -p enable|disable|error ]>

S<[ -t none|add ]> S<[ -u agent|master|error ]> S<[ -y agent|master|error ]>

masfcnv [ -V ]

masfcnv [ -? ]

=head1 DESCRIPTION

The masfcnv script is used to assist the system administrator in migrating an

existing set of configuration files for the Sun SNMP Management Agent for Sun

Fire and Netra Systems (MASF) to the Systems Management Agent (SMA).

The script accepts as input the currently installed set of MASF and SMA

configuration files and outputs a new set of SMA configuration files. Existing

SMA configuration files are backed up by appending ".bak" to the filename. The

administrator may choose to output the new configuration to the standard output

instead of replacing the current configuration by specifying the -n option.

The migration script must be run as the superuser and failure to do so will

cause the script to exit with an error message. Before running the script the

administrator should ensure that both the SMA and MASF agents are not running.

If the agents are running they will be shut down by the script.

The migration script will install a new startup script for the MASF agent in

/etc/init.d and backup the old script. During migration, MASF will be

configured as an AgentX subagent of SMA. All migration settings will be

migrated to the SMA configuration file.

The migration script will abort if any unrecognised directives are found in

either the MASF configuration files or the SMA configuration files. This may

be overridden with the -i option. If this option is selected, the behaviour is

to retain unrecognised directives which were present in the SMA configuration,

but remove those present in the MASF configuration.

The migration script will then proceed to migrate access control and trap

configuration. As a side-effect of running the migration script, the following

directives may be expanded by the script into multiple directives with

an equivalent interpretation:

=over

=item rwcommunity

=item rocommunity

=item rwuser

=item rouser

=item trapcommunity

=item trapsink

=item trap2sink

=item informsink

=back

=head2 Access Control Migration

Access control directives will be expanded into the equivalent com2sec, group,

access and view directives. Existing group names will be renamed by prepending

a prefix to avoid conflict with any which may already be defined in SMA.

When migrating SNMPv1 or v2c access control, a conflict may occur if both MASF

and SMA configuration files have defined access permissions for the same

community and source address. The default behaviour is to abort with a

message, unless the -y option specifies otherwise. If "-y agent" was specified

then the MASF configuration will take precedence. If "-y master" was specified

then the SMA configuration will be retained.

When migrating USM configuration (SNMPv3), a conflict may occur if both SMA

and MASF configurations define a user with the same securityName. If this

occurs then the behaviour of the script is determined by the -u option.

If "-u agent" has been selected then the configuration of the user defined in

the MASF configuration files will be the one that is retained. Otherwise, if

the "-u master" option has been selected, the one defined in the SMA

configuration files will be retained.

The migration script will by default attempt to migrate USM users from MASF to

SMA. The script will determine whether there are any existing SNMPv3 users

present in the SMA configuration and whether or not the default engineID has

been overridden in the SMA configuration files. If neither of these are found to

be the case then the any usmUser statements containing localised

authentication keys can be migrated to SMA, along with the MASF engineID. This

will result in the engineID of SMA master agent changing.

If the script determines that there are existing SNMPv3 users or a manually

configured engineID present in the SMA configuration, then only those users

defined in createUser statements will be transferred. Those users which were

defined in usmUser statements will be transferred but will have their

passwords reset to a random value. The administrator is advised to notify

their users of their new password and/or reset the password themselves by

editing the newly-generated configuration file themselves.

=head2 Trap/Inform Migration

The migration script will perform a check to determine whether a trap

destination defined for MASF is already specified in an existing SMA trapsink,

trap2sink or informsink directive. If this is the case then the directive in

the MASF configuration will be discarded to avoid duplicate traps/informs being

received.

trapsink, trap2sink and informsink directives specified in the existing SMA

configuration are considered valid destinations for MASF traps/informs and will

receive them from the MASF subagent after migration.

If the "-t none" option was specified on the command line, then the migration

script will carry over any remaining MASF trap/inform directives without

modification.

If the "-t add" option was specified (the default), then the migration script

will expand any trapsink, trap2sink or informsink directives to use the

TARGET-MIB and NOTIFICATION-MIB. The TARGET-MIB specifies targets using IP

addresses, so it may be desirable to use the "-t none" option if, for example,

the network allocates IP addresses to hostnames dynamically via DHCP.

The expanded directives will define filters specific to the MASF agent so that

traps from other subagents will not be received by migrated trap destinations.

Existing filters present in the SMA configuration will by default not be

modified and may or may not receive MASF traps depending upon the filters

which were originally defined for them.

If the -l option is specified, then any filters already defined in the

TARGET-MIB and the NOTIFICATION-MIB for SMA will be extended to include traps

from MASF. In the event that a trap destination is already configured in the

TARGET-MIB with the same target address and community as an existing MASF

trap/inform sink, a conflict will arise. 

If "-l agent" was specified and a conflict arises, then the migration script

will use the target SNMP parameters (i.e. SNMP version and choise of

trap/inform) defined by the MASF trap/informsink directive to send traps to

this destination. Otherwise if the "-l master" option was specified, then the

conflict will be resolved using the target SNMP parameters specified in the

SMA configuration.

=head2 Miscellaneous

If the migration script encounters any of the following directives in the MASF

configuration file and they are either not present or differ in the SMA

configuration, the script will log a warning message:

=over

=item syslocation

=item syscontact

=item sysname

=item sysservices

=item agentgroup

=item agentuser

=item authtrapenable

=back

=head1 OPTIONS

=over

=item B<-?>

=item B<--help>

Displays usage information.

=item B<-c>

=item B<--no-community>

Do not transfer v1/v2c communities

=item B<-i>

=item B<--ignore-unrecognized-directives>

Continue processing if unrecognised directives are present.

=item B<-l> I<agent|master>

=item B<--master-trap-target>=I<agent|master>

If 'agent' is specified then the existing SMA trap targets will be configured

to receive traps that were previously sent to destinations for the Sun Fire

SNMP agent. If 'master' is specified then the targets will be configured to

receive Sun Fire SNMP traps but existing SNMP target parameters will be used.

=item B<-m>

=item B<--no-usmuser>

Do not transfer usm (v3) users

=item B<-n>

=item B<--dry-run>

Run the migration without modifying any files. If any error arises then

continue processing. This can be used to determine the likely migration issues.

=item B<-p> I<enable|disable|error>

=item B<--use-agent-port>=I<enable|disable|error>

Indicates whether the port originally used by the Sun Fire SNMP agent should be

used by the SMA agent after migration (if the two agents are using different

ports). If 'enable' is specified then the port used by the Sun Fire SNMP agent

will also be used by the SMA agent after migration. If 'disable' is specified

then the ports used by SMA will not be updated by the migration tool.  If

the 'error' option is specified and the SMA agent is not already using the same

ports as those used by the original Sun Fire SNMP agent then an error will be

reported and the migration process will be terminated. If no option is

specified the default behaviour is equivalent to the 'error' flag.

=item B<-r>

=item B<--no-trap>

Do not transfer trap destinations

=item B<-s>

=item B<--skip-user>

If a user is found in the MASF configuration file that cannot be created in the

new configuration due to a change in the engine ID, then output a message

indicating that the user could not be migrated (needs to be manually recreated)

and continue processing. If this option is not present then the migration tool

will consider such a situation as an error and abort.

=item B<-t> I<none|add>

=item B<--trap-filter>=I<none|add>

If 'none' is specified then the script will copy trap directives directly. The

administrator may need to manually update the configuration file to ensure

traps are only delivered to their intended destinations.  If 'add' is specifed

then trap filters will be constructed so that traps originating from the

original Sun Fire SNMP agent are only delivered to the destinations that

originally received them. 'add' is the default behaviour.

=item B<-u> I<agent|master|error>

=item B<--select-user>=I<agent|master|error>

Specifies that if a user with the same name is found in both configuration

files that the conflict is to be resolved using the specified configuration

file as input.  Selecting a user from a particular will also cause the group

declaration for that user to be taken from the same file. If 'agent' is

specified then the user will be taken from the configuration file for the Sun

Fire SNMP Agent. If 'master' is specified then the user will be taken from the

SMA configuration.  Otherwise if 'error' is given, the script will terminate.

If this option is not present then the default behaviour is equivalent to

the 'error' flag.

=item B<-V>

=item B<--version>

Display the version of this script.

=item B<-y> I<agent|master|error>

=item B<--select-community>=I<agent|master|error>

Specifies that if a community and source (hostname, IP addr or range of IP

addresses) is found to be conflicting in the two configurations, which

combination should be selected when mapping to a security name.  If 'agent' is

specified then the community and source information will be taken from the

configuration for the Sun Fire SNMP agent.  If 'master' is specified it will be

taken from the SMA agent.  Otherwise if 'error' is specified an error will be

reported and the migration will terminate.  If this option is not present then

the default behaviour is equivalent to the 'error' flag.

=back

=head1 EXIT STATUS

The script will exit with 0 if migration was successful, non-zero if a problem

occurred during migration.

=head1 EXAMPLES

For a simple migration which will fail if there are any potential conflicts:

masfcnv

To migrate the MASF configuration such that it will always succeed, MASF

settings will override in the event of a conflict with SMA and access will

still be provided on the original MASF port:

masfcnv -is -l agent -p enable -u agent -y agent

To attempt a dry run and migrate the configuration such that any conflicts

will be resolved by retaining existing SMA settings:

masfcnv -l master -u master -y master

=head1 FILES

=over

=item /etc/sma/snmp/snmpd.conf

=item /var/sma_snmp/snmpd.conf

SMA configuration files

=back

=over

=item /etc/opt/SUNWmasf/conf/snmpd.conf

=item /var/opt/SUNWmasf/snmpd.dat

MASF configuration files

=back

=over

=item /tmp/sma_migration.log

masfcnv log file

=back

=cut

use strict;

# Text::ParseWords requires 5.005

require 5.005;

use Getopt::Long 2.17;

use Text::ParseWords;

use Net::hostent;

use Socket;

use Data::Dumper;

use File::Copy;

use Text::Wrap;

##############################################################################

# global defaults

# storage for new lines

%::ADDED_CONFIGS = ('prepend'=>[],

	'append'=>[]);

use vars qw ($INTERNET_OID

    $LOG_FILE

    $DATA_DIR

    $FILTER_TYPE_INCLUDED

    $FILTER_TYPE_EXCLUDED

    $ENTITY_MIB_OID

    $SUNPLAT_MIB_OID

    $SNMP_UDP_DOMAIN

    $DEFAULT_ROW_STATUS

    $DEFAULT_STORAGE_TYPE

    $MPMODEL_SNMPV1

    $MPMODEL_SNMPV2C

    $MPMODEL_SNMPV2U

    $MPMODEL_SNMPV3

    $SECURITY_MODEL_ANY

    $SECURITY_MODEL_SNMPV1

    $SECURITY_MODEL_SNMPV2C

    $SECURITY_MODEL_USM

    $SECURITY_LEVEL_NOAUTHNOPRIV

    $SECURITY_LEVEL_AUTHNOPRIV

    $SECURITY_LEVEL_AUTHPRIV

    $NOTIFY_TYPE_TRAP

    $NOTIFY_TYPE_INFORM);

# location where template files, etc. are stored.

*LOG_FILE = \"/tmp/sma_migration.log";

*INTERNET_OID = \".1.3.6.1";

*DATA_DIR = \"/usr/lib/net_snmp";

*FILTER_TYPE_INCLUDED = \1;

*FILTER_TYPE_EXCLUDED = \2;

*ENTITY_MIB_OID = \".1.3.6.1.2.1.47";

*SUNPLAT_MIB_OID = \".1.3.6.1.4.1.42.2.70.101";

*SNMP_UDP_DOMAIN = \".1.3.6.1.6.1.1";

*DEFAULT_ROW_STATUS = \1;

*DEFAULT_STORAGE_TYPE = \3;

*MPMODEL_SNMPV1 = \0;

*MPMODEL_SNMPV2C = \1;

*MPMODEL_SNMPV2U = \2;

*MPMODEL_SNMPV3 = \3;

*SECURITY_MODEL_ANY = \0;

*SECURITY_MODEL_SNMPV1 = \1;

*SECURITY_MODEL_SNMPV2C = \2;

*SECURITY_MODEL_USM = \3;

*SECURITY_LEVEL_NOAUTHNOPRIV = \1;

*SECURITY_LEVEL_AUTHNOPRIV = \2;

*SECURITY_LEVEL_AUTHPRIV = \3;

*NOTIFY_TYPE_TRAP = \1;

*NOTIFY_TYPE_INFORM = \2;

##############################################################################

# misc functions

sub log_message

{

	my ($msg, $line) = @_;

	if (defined $line && exists $line->{'file'} && exists

		$line->{'lineno'}) {

		$msg = $line->{'file'}.', line '.($line->{'lineno'} + 1).

		    ': '.$msg;

	}

	$msg = wrap('', '', $msg);

	if ($::AUTOMATED) {

	  open (LOG, ">> $LOG_FILE") || 

	  	die "Couldn't open log file $LOG_FILE\n";

	  print LOG $msg;

	  print STDERR $msg;

	  close LOG;

	} else {

		print STDERR $msg;

	}

}

sub get_backup_filename

{

    my ($fname) = @_;

    if ( -e $fname.'.bak') {

	my ($i) = 0;

	while ( -e $fname.".bak.$i" ) {

	    $i++;

	}

	return $fname.".bak.$i";

    }

    return $fname.".bak";

}

sub backup_files

{

    log_message "Backing up original files\n";

    my ($f, $newf);

    for $f (@::MASF_CONFIG_FILES, $::MASF_PERSISTENT_FILE, @::SMA_CONFIG_FILES,

	    $::SMA_PERSISTENT_FILE) {

	if (! -e $f) {

	    next;

	}

	$newf = get_backup_filename($f);

	log_message "Backing up $f to $newf\n";

	if (0 == copy $f, $newf) {

	    log_message "Couldn't backup $f - aborting\n";

	    exit 1;

	}

    }

}

sub remove_masf_persistent_file

{

    if (! -e $::MASF_PERSISTENT_FILE) {

	return;

    }

    log_message "Removing $::MASF_PERSISTENT_FILE\n";

    if (0 == unlink $::MASF_PERSISTENT_FILE) {

	log_message "Couldn't remove MASF persistent storage file\n".

	"$::MASF_PERSISTENT_FILE - Aborting\n";

	exit 1;

    }

}

sub version

{

    my ($rev) = '$Revision: 1.3 $';

    $rev=~s/^\$Revision: //;

    $rev=~s/ \$$//;

    print STDERR "$0 $rev\n".

	"Copyright 2003 Sun Microsystems, Inc.\n".

	"All rights reserved.\n".

	"Use is subject to license terms.\n";

    exit 0;

}

sub stop_sma_running

{

    `/etc/init.d/init.sma stop`;

}

sub stop_masf_running

{

    `/etc/init.d/masfd stop`;

    if (($? >> 8) > 0) {

	log_message "Couldn't stop the MASF agent\n";

	exit 1;

    }

}

sub set_umask

{

    # only root should be able to read the config file

    umask 0077;

}

sub install_new_wrapper_script

{

    log_message "Installing new MASF startup script\n";

    my $pkgInstance='SUNWmasfr';

    my @commands=("/usr/sbin/installf $pkgInstance /etc/init.d/masfd f 744 root sys",

    "/usr/sbin/installf $pkgInstance /etc/rc0.d/K40masfd=/etc/init.d/masfd l",

    "/usr/sbin/installf $pkgInstance /etc/rc1.d/K40masfd=/etc/init.d/masfd l",

    "/usr/sbin/installf $pkgInstance /etc/rc2.d/K40masfd=/etc/init.d/masfd l",

    "/usr/sbin/installf $pkgInstance /etc/rc3.d/S90masfd=/etc/init.d/masfd l",

    "/usr/sbin/installf $pkgInstance /etc/rcS.d/K40masfd=/etc/init.d/masfd l",

    "/usr/sbin/install -f /etc/init.d -m 0744 -u root -g sys $DATA_DIR/masfd",