├── tmpl
    ├── Footer.tmpl
    ├── Header.tmpl
    ├── GatewayHost.tmpl
    ├── ServiceGroup.tmpl
    ├── Certificate.tmpl
    ├── URLGroup.tmpl
    ├── IPHostGroup.tmpl
    ├── SiteToSiteServer.tmpl
    ├── SSLVPNPolicy.tmpl
    ├── PPTPConfiguration.tmpl
    ├── FirewallRule.tmpl
    ├── Services.tmpl
    ├── SiteToSiteClient.tmpl
    ├── NAT.tmpl
    ├── SSLTunnelAccessSettings.tmpl
    ├── Host.tmpl
    ├── SophosConnectClient.tmpl
    ├── VPNIPSecConnection.tmpl
    └── VPNProfile.tmpl
├── .gitignore
├── util
    ├── convert_snapshot.pl
    └── backup2json.pl
├── Protocols.pm
├── README.md
├── LICENSE
├── COPYING
└── migrate.pl


/tmpl/Footer.tmpl:
--------------------------------------------------------------------------------
1 | </Configuration>


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | t/*
2 | *.jinja
3 | *.tar
4 | Entities.xml
5 | Makefile
6 | lib/SMU/*
7 | out/
8 | cover_db/
9 | 


--------------------------------------------------------------------------------
/tmpl/Header.tmpl:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <Configuration APIVersion="1905.1" IPS_CAT_VER="0">


--------------------------------------------------------------------------------
/tmpl/GatewayHost.tmpl:
--------------------------------------------------------------------------------
1 | <GatewayHost transactionid="">
2 |     <Name><TMPL_VAR NAME="name"></Name>
3 |     <IPFamily>IPv4</IPFamily>
4 |     <GatewayIP><TMPL_VAR NAME="gateway_ip"></GatewayIP>
5 |     <Interface/>
6 |     <NATPolicy/>
7 |     <Healthcheck>OFF</Healthcheck>
8 |     <MailNotification>OFF</MailNotification>
9 | </GatewayHost>


--------------------------------------------------------------------------------
/tmpl/ServiceGroup.tmpl:
--------------------------------------------------------------------------------
 1 | <ServiceGroup transactionid="">
 2 |   <Name><TMPL_VAR NAME="servicegroup_name"></Name>
 3 |   <Description><TMPL_VAR NAME="description"></Description>
 4 |   <ServiceList>
 5 |       <TMPL_LOOP NAME="services">
 6 |         <Service><TMPL_VAR NAME="name"></Service>
 7 |       </TMPL_LOOP>
 8 |   </ServiceList>
 9 | </ServiceGroup>
10 | 


--------------------------------------------------------------------------------
/tmpl/Certificate.tmpl:
--------------------------------------------------------------------------------
1 | <Certificate>
2 |     <Action>UploadCertificate</Action>
3 |     <Name><TMPL_VAR NAME="name"></Name>
4 |     <Password></Password>
5 |     <CertificateFormat>pem</CertificateFormat>
6 |     <CertificateFile><TMPL_VAR NAME="certificate_file"></CertificateFile>
7 |     <PrivateKeyFile><TMPL_VAR NAME="private_key_file"></PrivateKeyFile>
8 | </Certificate>


--------------------------------------------------------------------------------
/tmpl/URLGroup.tmpl:
--------------------------------------------------------------------------------
1 | <WebFilterURLGroup transactionid="">
2 |     <Name>UTM <TMPL_VAR NAME="type"> list: <TMPL_VAR NAME="trunc_name"></Name>
3 |     <Description>Imported <TMPL_VAR NAME="type"> URLs from UTM - <TMPL_VAR NAME="name"></Description>
4 |     <IsDefault>No</IsDefault>
5 |     <URLlist><TMPL_LOOP NAME="urls">
6 |         <URL><TMPL_VAR NAME="url"></URL></TMPL_LOOP>
7 |     </URLlist>
8 | </WebFilterURLGroup>


--------------------------------------------------------------------------------
/tmpl/IPHostGroup.tmpl:
--------------------------------------------------------------------------------
 1 | <TMPL_IF NAME="group"><IPHostGroup transactionid="">
 2 |     <Name><TMPL_VAR NAME="name"></Name>
 3 |     <Description><TMPL_VAR NAME="description"></Description>
 4 |     <IPFamily><TMPL_VAR NAME="family"></IPFamily>
 5 |     <HostList>
 6 |       <TMPL_LOOP NAME="hosts">
 7 |         <Host><TMPL_VAR NAME="name"></Host>
 8 |       </TMPL_LOOP>
 9 |     </HostList>
10 | </IPHostGroup></TMPL_IF>
11 | 


--------------------------------------------------------------------------------
/tmpl/SiteToSiteServer.tmpl:
--------------------------------------------------------------------------------
 1 | <SiteToSiteServer transactionid="">
 2 |   <Name><TMPL_VAR NAME="name"></Name>
 3 |   <StaticIP>Disable</StaticIP>
 4 |   <LocalNetworks>
 5 |     <TMPL_LOOP NAME="local_networks"><Network><TMPL_VAR NAME="name"></Network></TMPL_LOOP>
 6 |   </LocalNetworks>
 7 |   <RemoteNetworks>
 8 |     <TMPL_LOOP NAME="remote_networks"><Network><TMPL_VAR NAME="name"></Network></TMPL_LOOP>
 9 |   </RemoteNetworks>
10 |   <Description><TMPL_VAR NAME="description"></Description>
11 |   <Status>On</Status>
12 | </SiteToSiteServer>
13 | 


--------------------------------------------------------------------------------
/tmpl/SSLVPNPolicy.tmpl:
--------------------------------------------------------------------------------
 1 | <SSLVPNPolicy transactionid="">
 2 |   <TunnelPolicy>
 3 |     <Name><TMPL_VAR NAME="name"></Name>
 4 |     <Description><TMPL_VAR NAME="description"></Description>
 5 |     <UseAsDefaultGateway><TMPL_VAR NAME="use_as_default_gw"></UseAsDefaultGateway>
 6 |     <PermittedNetworkResourcesIPv4><TMPL_LOOP NAME="permitted_network_resources_ipv4">
 7 |       <Resource><TMPL_VAR NAME="name"></Resource>
 8 |     </TMPL_LOOP></PermittedNetworkResourcesIPv4>
 9 |     <DisconnectIdleClients><TMPL_VAR NAME="disconnect_idle_clients"></DisconnectIdleClients>
10 |     <OverrideGlobalTimeout><TMPL_VAR NAME="override_global_timeout_minutes"></OverrideGlobalTimeout>
11 |   </TunnelPolicy>
12 | </SSLVPNPolicy>


--------------------------------------------------------------------------------
/tmpl/PPTPConfiguration.tmpl:
--------------------------------------------------------------------------------
 1 | <PPTPConfiguration transactionid="">
 2 |   <PPTPSettings>
 3 |     <PPTPGeneralSettings><TMPL_VAR NAME="general_settings"></PPTPGeneralSettings>
 4 |     <AssignIPFrom>
 5 |       <StartIP><TMPL_VAR NAME="start_ip"></StartIP>
 6 |       <EndIP><TMPL_VAR NAME="end_ip"></EndIP>
 7 |     </AssignIPFrom>
 8 |     <LeaseIPFromRadiusServer><TMPL_VAR NAME="lease_ip_from_radius"></LeaseIPFromRadiusServer>
 9 |     <PrimaryDNSServer><TMPL_VAR NAME="primary_dns"></PrimaryDNSServer>
10 |     <SecondaryDNSServer><TMPL_VAR NAME="secondary_dns"></SecondaryDNSServer>
11 |     <PrimaryWINSServer><TMPL_VAR NAME="primary_wins"></PrimaryWINSServer>
12 |     <SecondaryWINSServer><TMPL_VAR NAME="secondary_wins"></SecondaryWINSServer>
13 |   </PPTPSettings>
14 | </PPTPConfiguration>


--------------------------------------------------------------------------------
/util/convert_snapshot.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | #Copyright Sophos Ltd 2023
 3 | #
 4 | #This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
 5 | #This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
 6 | #You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
 7 | 
 8 | use strict;
 9 | use warnings;
10 | use Storable qw(thaw retrieve nstore);
11 | 
12 | my $fn = shift;
13 | 
14 | my $b;
15 | if ($fn =~ /.abf/) {
16 |     my $data = do {
17 |         local $/ = undef;
18 |         open my $fh, '<', $fn or die $!;
19 |         <$fh>
20 |     };
21 |     $b = thaw $data;
22 | } else {
23 |     $b = retrieve $fn;
24 | }
25 | 
26 | nstore $b, $fn . ".nstor"
27 | 


--------------------------------------------------------------------------------
/tmpl/FirewallRule.tmpl:
--------------------------------------------------------------------------------
 1 | <TMPL_IF NAME="rule_name">
 2 | <FirewallRule transactionid="">
 3 |   <Name><TMPL_VAR NAME="rule_name"></Name>
 4 |   <Description><TMPL_VAR NAME="description"></Description>
 5 |   <Status><TMPL_VAR NAME="status"></Status>
 6 |   <Position><TMPL_VAR NAME="position"></Position>
 7 |   <PolicyType>Network</PolicyType>
 8 |   <TMPL_IF NAME="position_name">
 9 |     <After>
10 |       <Name><TMPL_VAR NAME="position_name"></Name>
11 |     </After>
12 |   </TMPL_IF>
13 |   <NetworkPolicy>
14 |     <Action><TMPL_VAR NAME="action"></Action>
15 |     <LogTraffic><TMPL_VAR NAME="logtraffic"></LogTraffic>
16 |     <Services>
17 |       <TMPL_LOOP NAME="services">
18 |         <Service><TMPL_VAR NAME="name"></Service>
19 |       </TMPL_LOOP>
20 |     </Services>
21 |     <SourceNetworks>
22 |       <TMPL_LOOP NAME="sources">
23 |         <Network><TMPL_VAR NAME="name"></Network>
24 |       </TMPL_LOOP>
25 |     </SourceNetworks>
26 |     <DestinationNetworks>
27 |       <TMPL_LOOP NAME="destinations">
28 |         <Network><TMPL_VAR NAME="name"></Network>
29 |       </TMPL_LOOP>
30 |     </DestinationNetworks>
31 |   </NetworkPolicy>
32 | </FirewallRule>
33 | </TMPL_IF>
34 | 


--------------------------------------------------------------------------------
/tmpl/Services.tmpl:
--------------------------------------------------------------------------------
 1 | <Services transactionid="">
 2 |     <Name><TMPL_VAR NAME="name"></Name>
 3 |     <Type><TMPL_VAR NAME="type"></Type>
 4 |     <ServiceDetails>
 5 |     <TMPL_IF name="tcpudp">
 6 |         <TMPL_LOOP NAME="details"><ServiceDetail>
 7 |             <SourcePort><TMPL_VAR name="port_src"></SourcePort>
 8 |             <DestinationPort><TMPL_VAR name="port_dst"></DestinationPort>
 9 |             <Protocol><TMPL_VAR name="protocol"></Protocol>
10 |         </ServiceDetail></TMPL_LOOP>
11 |     </TMPL_IF>
12 |     <TMPL_IF NAME="ip">
13 |         <ServiceDetail>
14 |             <ProtocolName><TMPL_VAR name="protocol_name"></ProtocolName>
15 |         </ServiceDetail>
16 |     </TMPL_IF>
17 |     <TMPL_IF NAME="icmp">
18 |         <ServiceDetail>
19 |             <ICMPType><TMPL_VAR name="icmp_type"></ICMPType>
20 |             <ICMPCode><TMPL_VAR name="icmp_code"></ICMPCode>
21 |         </ServiceDetail>
22 |     </TMPL_IF>
23 |     <TMPL_IF NAME="icmpv6">
24 |         <ServiceDetail>
25 |             <ICMPv6Type><TMPL_VAR name="icmp_type"></ICMPv6Type>
26 |             <ICMPv6Code><TMPL_VAR name="icmp_code"></ICMPv6Code>
27 |         </ServiceDetail>
28 |     </TMPL_IF>
29 |     </ServiceDetails>
30 | </Services>


--------------------------------------------------------------------------------
/tmpl/SiteToSiteClient.tmpl:
--------------------------------------------------------------------------------
 1 | <SiteToSiteClient>
 2 |     <Name><TMPL_VAR NAME="name"></Name>
 3 |     <ServerConfigurationFile><TMPL_VAR NAME="config_filename"></ServerConfigurationFile>
 4 |     <FilePassword><TMPL_VAR NAME="config_password"></FilePassword>
 5 | <TMPL_IF NAME="http_proxy_server_enabled">
 6 |     <HttpProxyServer>Enable</HttpProxyServer>
 7 |     <ProxyServer><TMPL_VAR NAME="http_proxy_server_name"></ProxyServer>
 8 |     <ProxyPort><TMPL_VAR NAME="http_proxy_server_port"></ProxyPort>
 9 | <TMPL_ELSE>
10 |     <HttpProxyServer>Disable</HttpProxyServer>
11 | </TMPL_IF>
12 | <TMPL_IF NAME="http_proxy_server_auth_enabled">
13 |     <ProxyAuthentication>Enable</ProxyAuthentication>
14 |         <Username><TMPL_VAR NAME="http_proxy_server_username"></Username>
15 |         <Password><TMPL_VAR NAME="http_proxy_server_password"></Password>
16 | <TMPL_ELSE>
17 |     <ProxyAuthentication>Disable</ProxyAuthentication>
18 | </TMPL_IF>
19 | <TMPL_IF NAME="peerhost_enabled">
20 |     <PeerHost>Enable</PeerHost>
21 |     <HostName><TMPL_VAR NAME="peerhost_name"></HostName>
22 | <TMPL_ELSE>
23 |     <PeerHost>Disable</PeerHost>
24 | </TMPL_IF>
25 |     <Description>text</Description>
26 |     <Status><TMPL_VAR NAME="status"></Status>
27 | </SiteToSiteClient>


--------------------------------------------------------------------------------
/util/backup2json.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | #Copyright Sophos Ltd 2023
 3 | #
 4 | #This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
 5 | #This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
 6 | #You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
 7 | 
 8 | use v5.10;
 9 | use strict;
10 | use warnings;
11 | 
12 | use Storable;
13 | use Data::Dumper;
14 | use JSON ();
15 | 
16 | binmode STDOUT, ':encoding(utf8)';
17 | 
18 | usage() if (@ARGV != 1) || (! -f $ARGV[0]);
19 | 
20 | sub usage {
21 | 	die "$0 /path/to/snapshot\n"
22 | }
23 | 
24 | sub read_backup {
25 |     my ($fn) = @_;
26 |     -f $fn or die $!;
27 |     retrieve $fn
28 | }
29 | 
30 | sub make_json {
31 |     my ($backup) = @_;
32 |     my $json = JSON->new->pretty;
33 |     $json->encode($backup)
34 | }
35 | 
36 | my $backup = read_backup shift;
37 | say make_json $backup
38 | 


--------------------------------------------------------------------------------
/tmpl/NAT.tmpl:
--------------------------------------------------------------------------------
 1 | <NATRule transactionid="">
 2 |     <Name>#NAT_Default_Network_Policy</Name>
 3 |     <Description/>
 4 |     <IPFamily>IPv4</IPFamily>
 5 |     <Status>Enable</Status>
 6 |     <Position>Top</Position>
 7 |     <LinkedFirewallrule>#Default_Network_Policy</LinkedFirewallrule>
 8 |     <TranslatedDestination>Original</TranslatedDestination>
 9 |     <TranslatedService>Original</TranslatedService>
10 |     <OverrideInterfaceNATPolicy>Disable</OverrideInterfaceNATPolicy>
11 |     <TranslatedSource>MASQ</TranslatedSource>
12 | </NATRule>
13 | <TMPL_LOOP NAME="nat">
14 |     <NATRule transactionid="">
15 |         <Name><TMPL_VAR NAME="name"></Name>
16 |         <Description><TMPL_VAR NAME="description"></Description>
17 |         <IPFamily>IPv4</IPFamily>
18 |         <Status><TMPL_VAR NAME="status"></Status>
19 |         <LinkedFirewallrule>None</LinkedFirewallrule>
20 |         <OriginalServices>
21 |             <Service><TMPL_VAR NAME="orig_service"></Service>
22 |         </OriginalServices>
23 |         <TranslatedService><TMPL_VAR NAME="trans_service"></TranslatedService>
24 |         <TranslatedSource>Original</TranslatedSource>
25 |         <TranslatedDestination><TMPL_VAR NAME="trans_dest"></TranslatedDestination>
26 |         <OverrideInterfaceNATPolicy>Disable</OverrideInterfaceNATPolicy>
27 |         <NATMethod>0</NATMethod>
28 |         <HealthCheck>Disable</HealthCheck>
29 |         <Position>After</Position>
30 |         <After>
31 |             <Name>TODO:???</Name>
32 |         </After>
33 |     </NATRule>
34 | </TMPL_LOOP>
35 | 


--------------------------------------------------------------------------------
/tmpl/SSLTunnelAccessSettings.tmpl:
--------------------------------------------------------------------------------
 1 | <SSLTunnelAccessSettings transactionid="">
 2 |   <Protocol><TMPL_VAR NAME="protocol"></Protocol>
 3 |   <SSLServerCertificate><TMPL_VAR NAME="certificate"></SSLServerCertificate>
 4 |   <OverrideHostName/>
 5 |   <Port><TMPL_VAR NAME="port"></Port>
 6 |   <IPLeaseRange>
 7 |     <StartIP><TMPL_VAR NAME="start_ip"></StartIP>
 8 |   </IPLeaseRange>
 9 |   <SubnetMask><TMPL_VAR NAME="subnet_mask"></SubnetMask>
10 |   <IPv6Lease><TMPL_VAR NAME="ipv6_lease"></IPv6Lease>
11 |   <IPv6Prefix><TMPL_VAR NAME="ipv6_prefix"></IPv6Prefix>
12 |   <LeaseMode><TMPL_VAR NAME="lease_mode"></LeaseMode>
13 |   <PrimaryDNSIPv4/>
14 |   <SecondaryDNSIPv4/>
15 |   <PrimaryWINSIPv4/>
16 |   <SecondaryWINSIPv4/>
17 |   <DomainName/>
18 |   <DisconnectDeadPeerAfter>180</DisconnectDeadPeerAfter>
19 |   <DisconnectIdlePeerAfter>15</DisconnectIdlePeerAfter>
20 |   <EncryptionAlgorithm><TMPL_VAR NAME="encryption_algorithm"></EncryptionAlgorithm>
21 |   <AuthenticationAlgorithm><TMPL_VAR NAME="authentication_algorithm"></AuthenticationAlgorithm>
22 |   <Keysize>2048bit</Keysize>
23 |   <KeyLifetime><TMPL_VAR NAME="key_lifetime"></KeyLifetime>
24 |   <CompressSSLVPNTraffic><TMPL_VAR NAME="compression"></CompressSSLVPNTraffic>
25 |   <DebugMode><TMPL_VAR NAME="debug"></DebugMode>
26 |   <SecurityHeartbeat>Disable</SecurityHeartbeat>
27 |   <SaveCredential>Disable</SaveCredential>
28 |   <TwoFAToken>Disable</TwoFAToken>
29 |   <AdLogon>Disable</AdLogon>
30 |   <AutoConnect>Disable</AutoConnect>
31 |   <HostorDNSName/>
32 |   <StaticIPAddresses>Disable</StaticIPAddresses>
33 | </SSLTunnelAccessSettings>


--------------------------------------------------------------------------------
/tmpl/Host.tmpl:
--------------------------------------------------------------------------------
 1 | <TMPL_IF NAME="iphost"><IPHost transactionid="">
 2 |     <Name><TMPL_VAR NAME="name"></Name>
 3 |     <IPFamily><TMPL_VAR NAME="family"></IPFamily>
 4 |     <IPAddress><TMPL_VAR NAME="address"></IPAddress>
 5 |     <HostType>IP</HostType>
 6 | </IPHost></TMPL_IF>
 7 | <TMPL_IF NAME="range"><IPHost transactionid="">
 8 |     <Name><TMPL_VAR NAME="name"></Name>
 9 |     <IPFamily><TMPL_VAR NAME="family"></IPFamily>
10 |     <StartIPAddress><TMPL_VAR NAME="start_address"></StartIPAddress>
11 |     <EndIPAddress><TMPL_VAR NAME="end_address"></EndIPAddress>
12 |     <HostType>IPRange</HostType>
13 | </IPHost></TMPL_IF>
14 | <TMPL_IF NAME="iplist"><IPHost transactionid="">
15 |     <Name><TMPL_VAR NAME="name"></Name>
16 |     <IPFamily><TMPL_VAR NAME="family"></IPFamily>
17 |     <ListOfIPAddresses><TMPL_VAR NAME="addresses"></ListOfIPAddresses>
18 |     <HostType>IPList</HostType>
19 | </IPHost></TMPL_IF>
20 | <TMPL_IF NAME="maclist"><MACHost transactionid="">
21 |     <Name><TMPL_VAR NAME="name"></Name>
22 |     <Type>MACLIST</Type>
23 |     <MACList><TMPL_LOOP NAME="macs">
24 |         <MACAddress><TMPL_VAR NAME="mac"></MACAddress></TMPL_LOOP>
25 |     </MACList>
26 | </MACHost></TMPL_IF>
27 | <TMPL_IF NAME="network"><IPHost transactionid="">
28 |     <Name><TMPL_VAR NAME="name"></Name>
29 |     <IPFamily><TMPL_VAR NAME="family"></IPFamily>
30 |     <IPAddress><TMPL_VAR NAME="address"></IPAddress>
31 |     <Subnet><TMPL_VAR NAME="subnet"></Subnet>
32 |     <HostType>Network</HostType>
33 | </IPHost></TMPL_IF>
34 | <TMPL_IF NAME="fqdn"><FQDNHost transactionid="">
35 |     <Name><TMPL_VAR NAME="name"></Name>
36 |     <FQDN><TMPL_VAR NAME="address"></FQDN>
37 | </FQDNHost></TMPL_IF>


--------------------------------------------------------------------------------
/tmpl/SophosConnectClient.tmpl:
--------------------------------------------------------------------------------
 1 | <SophosConnectClient transactionid="">
 2 |   <Reset><TMPL_VAR NAME="reset"></Reset>
 3 |   <SophosConnectClientConfiguration><TMPL_VAR NAME="status"></SophosConnectClientConfiguration>
 4 |   <AliasInterface><TMPL_VAR NAME="interface"></AliasInterface>
 5 |   <PolicyID>DefaultRemoteAccess</PolicyID>
 6 |   <Interface><TMPL_VAR NAME="interface"></Interface>
 7 |   <AuthenticationType><TMPL_VAR NAME="auth_type"></AuthenticationType>
 8 |   <LocalIDType><TMPL_VAR NAME="local_id_type"></LocalIDType>
 9 |   <LocalID><TMPL_VAR NAME="local_id"></LocalID>
10 |   <RemoteIDType><TMPL_VAR NAME="remote_id_type"></RemoteIDType>
11 |   <RemoteID><TMPL_VAR NAME="remote_id"></RemoteID>
12 |   <AllowedUsers>
13 |     <User>Guest Group</User>
14 |   </AllowedUsers>
15 |   <Name><TMPL_VAR NAME="name"></Name>
16 |   <AssignIP>
17 |     <StartIP><TMPL_VAR NAME="start_ip"></StartIP>
18 |     <EndIP><TMPL_VAR NAME="end_ip"></EndIP>
19 |   </AssignIP>
20 |   <LeaseIPFromRadiusServer>Disable</LeaseIPFromRadiusServer>
21 |   <DNSServer1><TMPL_VAR NAME="primary_dns"></DNSServer1>
22 |   <DNSServer2><TMPL_VAR NAME="secondary_dns"></DNSServer2>
23 |   <DisconnectOnIdleInterval>444</DisconnectOnIdleInterval>
24 |   <DefaultGateway>Enable</DefaultGateway>
25 |   <SecurityHeartbeat>Disable</SecurityHeartbeat>
26 |   <SaveCredential>Disable</SaveCredential>
27 |   <TwoFAToken>Disable</TwoFAToken>
28 |   <AdLogon>Disable</AdLogon>
29 |   <AutoConnect>Disable</AutoConnect>
30 |   <HostorDNSName/>
31 |   <AssignDNS>Disable</AssignDNS>
32 |   <DomainName/>
33 |   <PermittedNetworkResourcesIPv4><TMPL_LOOP NAME="networks">
34 |     <Resource><TMPL_VAR NAME="name"></Resource>
35 |   </TMPL_LOOP></PermittedNetworkResourcesIPv4>
36 |   <PresharedKey><TMPL_VAR NAME="preshared_key"></PresharedKey>
37 | </SophosConnectClient>


--------------------------------------------------------------------------------
/tmpl/VPNIPSecConnection.tmpl:
--------------------------------------------------------------------------------
 1 | <VPNIPSecConnection transactionid="">
 2 |     <Configuration>
 3 |       <Name><TMPL_VAR NAME="name"></Name>
 4 |       <Description><TMPL_VAR NAME="description"></Description>
 5 |       <ConnectionType><TMPL_VAR NAME="type"></ConnectionType>
 6 |       <Policy><TMPL_VAR NAME="policy"></Policy>
 7 |       <ActionOnVPNRestart>RespondOnly</ActionOnVPNRestart>
 8 |       <AuthenticationType><TMPL_VAR NAME="auth_type"></AuthenticationType>
 9 |       <SubnetFamily>IPv4</SubnetFamily>
10 |       <EndpointFamily>IPv4</EndpointFamily>
11 |       <LocalWANPort><TMPL_VAR NAME="local_gateway"></LocalWANPort>
12 |       <AliasLocalWANPort><TMPL_VAR NAME="local_address"></AliasLocalWANPort>
13 |       <RemoteHost><TMPL_VAR NAME="remote_host"></RemoteHost>
14 |       <NATedLAN/>
15 |       <LocalIDType><TMPL_VAR NAME="local_id_type"></LocalIDType>
16 |       <LocalID><TMPL_VAR NAME="local_id"></LocalID>
17 |       <RemoteNetwork>
18 |         <TMPL_LOOP name="remote_networks"><Network><TMPL_VAR name="name"></Network></TMPL_LOOP>
19 |       </RemoteNetwork>
20 |       <RemoteIDType><TMPL_VAR NAME="remote_id_type"></RemoteIDType>
21 |       <RemoteID><TMPL_VAR NAME="remote_id"></RemoteID>
22 |       <UserAuthenticationMode>Disable</UserAuthenticationMode>
23 |       <AllowedUser>
24 |         <User/>
25 |       </AllowedUser>
26 |       <Protocol>ALL</Protocol>
27 |       <LocalPort/>
28 |       <RemotePort/>
29 |       <DisconnectOnIdleInterval/>
30 |       <Status><TMPL_VAR NAME="status"></Status>
31 |       <TMPL_IF NAME="preshared_key"><PresharedKey><TMPL_VAR NAME="preshared_key"></PresharedKey></TMPL_IF>
32 |       <TMPL_IF NAME="pubkey"><RemoteRSAKey><TMPL_VAR NAME="pubkey"></RemoteRSAKey></TMPL_IF>
33 |       <TMPL_IF NAME="certificate"><DigitalCertificate><TMPL_VAR NAME="certificate" ESCAPE="HTML"></DigitalCertificate></TMPL_IF>
34 |       <Username/>
35 |       <Password/>
36 |       <TMPL_LOOP NAME="local_subnets"><LocalSubnet><TMPL_VAR NAME="name"></LocalSubnet></TMPL_LOOP>
37 |     </Configuration>
38 | </VPNIPSecConnection>
39 | 


--------------------------------------------------------------------------------
/tmpl/VPNProfile.tmpl:
--------------------------------------------------------------------------------
 1 | <VPNProfile transactionid="">
 2 |   <Name><TMPL_VAR NAME="name"></Name>
 3 |   <Description><TMPL_VAR NAME="description"></Description>
 4 |   <KeyingMethod>Automatic</KeyingMethod>
 5 |   <AllowReKeying>Enable</AllowReKeying>
 6 |   <KeyNegotiationTries>5</KeyNegotiationTries>
 7 |   <AuthenticationMode>MainMode</AuthenticationMode>
 8 |   <PassDataInCompressedFormat>Disable</PassDataInCompressedFormat>
 9 |   <Phase1>
10 |     <EncryptionAlgorithm1><TMPL_VAR NAME="phase1_encr1"></EncryptionAlgorithm1>
11 |     <AuthenticationAlgorithm1><TMPL_VAR NAME="phase1_auth1"></AuthenticationAlgorithm1>
12 |     <EncryptionAlgorithm2><TMPL_VAR NAME="phase1_encr2"></EncryptionAlgorithm2>
13 |     <AuthenticationAlgorithm2><TMPL_VAR NAME="phase1_auth2"></AuthenticationAlgorithm2>
14 |     <EncryptionAlgorithm3><TMPL_VAR NAME="phase1_encr3"></EncryptionAlgorithm3>
15 |     <AuthenticationAlgorithm3><TMPL_VAR NAME="phase1_auth3"></AuthenticationAlgorithm3>
16 |     <SupportedDHGroups>
17 |       <TMPL_LOOP NAME="phase1_dh_groups"><DHGroup><TMPL_VAR NAME="name"></DHGroup></TMPL_LOOP>
18 |     </SupportedDHGroups>
19 |     <KeyLife><TMPL_VAR NAME="phase1_key_life"></KeyLife>
20 |     <ReKeyMargin>90 </ReKeyMargin>
21 |     <RandomizeRe-KeyingMarginBy>100</RandomizeRe-KeyingMarginBy>
22 |     <DeadPeerDetection>Enable</DeadPeerDetection>
23 |     <CheckPeerAfterEvery>30</CheckPeerAfterEvery>
24 |     <WaitForResponseUpto>120</WaitForResponseUpto>
25 |     <ActionWhenPeerUnreachable><TMPL_VAR NAME="action_when_unreachable"></ActionWhenPeerUnreachable>
26 |   </Phase1>
27 |   <Phase2>
28 |     <EncryptionAlgorithm1><TMPL_VAR NAME="phase2_encr1"></EncryptionAlgorithm1>
29 |     <AuthenticationAlgorithm1><TMPL_VAR NAME="phase2_auth1"></AuthenticationAlgorithm1>
30 |     <EncryptionAlgorithm2><TMPL_VAR NAME="phase2_encr2"></EncryptionAlgorithm2>
31 |     <AuthenticationAlgorithm2><TMPL_VAR NAME="phase2_auth2"></AuthenticationAlgorithm2>
32 |     <EncryptionAlgorithm3><TMPL_VAR NAME="phase2_encr3"></EncryptionAlgorithm3>
33 |     <AuthenticationAlgorithm3><TMPL_VAR NAME="phase2_auth3"></AuthenticationAlgorithm3>
34 |     <PFSGroup><TMPL_VAR NAME="phase2_pfs_group"></PFSGroup>
35 |     <KeyLife><TMPL_VAR NAME="phase2_key_life"></KeyLife>
36 |   </Phase2>
37 |   <sha2_96_truncate>no</sha2_96_truncate>
38 |   <keyexchange>ikev2</keyexchange>
39 | </VPNProfile>


--------------------------------------------------------------------------------
/Protocols.pm:
--------------------------------------------------------------------------------
  1 | package Protocols;
  2 | #Copyright Sophos Ltd 2023
  3 | #
  4 | #This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
  5 | #This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
  6 | #You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
  7 | 
  8 | use strict;
  9 | use warnings;
 10 | 
 11 | our $VERSION = '0.1';
 12 | 
 13 | use Exporter 'import';
 14 | our @EXPORT = qw/$IP_PROTOS $ICMP4 $ICMP6/;
 15 | 
 16 | our $IP_PROTOS = { qw( 0 HOPOPT 1 ICMP 2 IGMP 3 GGP 4 IP 5 ST 6 TCP 7 CBT 8 EGP 9 IGP 10 BBN-RCC-MON 11 NVP-II
 17 | 12 PUP 13 ARGUS 14 EMCON 15 XNET 16 CHAOS 17 UDP 18 MUX 19 DCN-MEAS 20 HMP 21 PRM 22 XNS-IDP 23 TRUNK-1
 18 | 24 TRUNK-2 25 LEAF-1 26 LEAF-2 27 RDP 28 IRTP 29 ISO-TP4 30 NETBLT 31 MFE-NSP 32 MERIT-INP 33 DCCP 34 3PC
 19 | 35 IDPR 36 XTP 37 DDP 38 IDPR-CMTP 39 TP++ 40 IL 41 IPv6 42 SDRP 43 IPv6-Route 44 IPv6-Frag 45 IDRP 46 RSVP
 20 | 47 GRE 48 DSR 49 BNA 50 ESP 51 AH 52 I-NLSP 53 SWIPE 54 NARP 55 MOBILE 56 TLSP 57 SKIP 58 ICMPv6 59 IPv6-NoNxt
 21 | 60 IPv6-Opts 62 CFTP 64 SAT-EXPAK 65 KRYPTOLAN 66 RVD 67 IPPC 69 SAT-MON 70 VISA 71 IPCV 72 CPNX 73 CPHB
 22 | 74 WSN 75 PVP 76 BR-SAT-MON 77 SUN-ND 78 WB-MON 79 WB-EXPAK 80 ISO-IP 81 VMTP 82 SECURE-VMTP 83 VINES 84 TTP
 23 | 85 NSFNET-IGP 86 DGP 87 TCF 88 EIGRP 89 OSPFIGP 90 Sprite-RPC 91 LARP 92 MTP 93 AX 94 IPIP 95 MICP 96 SCC-SP
 24 | 97 ETHERIP 98 ENCAP 100 GMTP 101 IFMP 102 PNNI 103 PIM 104 ARIS 105 SCPS 106 QNX 107 A/N 108 IPComp 109 SNP
 25 | 110 Compaq-Peer 111 IPX-in-IP 112 VRRP 113 PGM 115 L2TP 116 DDX 117 IATP 118 STP 119 SRP 120 UTI 121 SMP
 26 | 122 SM 123 PTP 124 ISIS 125 FIRE 126 CRTP 127 CRUDP 128 SSCOPMCE 129 IPLT 130 SPS 131 PIPE 132 SCTP 133 FC
 27 | 134 RSVP-E2E-IGNORE 136 UDPLite 137 MPLS-in-IP 138 manet 139 HIP 140 Shim6 141 WESP 142 ROHC ) };
 28 | 
 29 | for (my $i = 0; $i <= 255; $i++) {
 30 | 	$IP_PROTOS->{$i} = "IPProto$i" if ! $IP_PROTOS->{$i};
 31 | }
 32 | 
 33 | #Note: There are some spelling errors, whitespace errors, and capitalization inconsistencies in these definitions.
 34 | #      They are on purpose, as these are the exact strings SFOS is expecting for import.
 35 | #      Modifying them will break the import of that service.
 36 | our $ICMP4 = {
 37 | 	0  => { name => "Echo Reply", 0 => "No Code" },
 38 | 	3  => { name => "Destination Unreachable",
 39 | 		0 => "Hop Limit Exceeded In Transit", 1 => "Host Unreachable", 2 => "Protocol Unreachable",
 40 | 		3 => "Port Unreachable", 4 => "Fragmentation Needed and Don't Fragment was Set",
 41 | 		5 => "Source Route Failed", 6 => "Destination Network Unknown", 7 => "Destination Host Unknown",
 42 | 		8 => "Source Host Isolated", 9 => "Communication with Destination Network is Administratively Prohibited",
 43 | 		10 => "Communication with Destination Host is Administratively Prohibited",
 44 | 		11 => "Destination Network Unreachable for Type of Service",
 45 | 		12 => "Destination Host Unreachable for Type ofService", 13 => "Communication Administratively Prohibited",
 46 | 		14 => "Host Precedence Violation", 15 => "Precedence cutoff in effect"
 47 | 		},
 48 | 	4  => { name => "Source Quench", 0 => "Erroneous Header Field Encountered"},
 49 | 	5  => { name => "Redirect",
 50 | 		0 => "Redirect Datagram for the Network (or subnet)", 1 => "Redirect Datagram for the Host",
 51 | 		2 => "Redirect Datagram for the Type of Service and Network", 3 => "Redirect Datagram for the Type of Service and Host"
 52 | 		},
 53 | 	6  => { name => "Alternate Host Address", 0 => "Alternate Address for Host" },
 54 | 	8  => { name => "Echo", 0 => "No Code" },
 55 | 	9  => { name => "Router Advertisement", 0 => "No Code", 16 => "Any code" }, #16 has no direct mapping
 56 | 	10 => { name => "Router Selection", 0 => "No Code" },
 57 | 	11 => { name => "Time Exceeded", 0 => "Time to Live exceeded in Transit", 1 => "Fragement Reassembly Time Exceeded" },
 58 | 	12 => { name => "Parameter Problem", 0 => "Pointer indicates the error", 1 => "Missing a Required Option", 2 => "Bad Length" },
 59 | 	13 => { name => "Timestamp", 0 => "No Code" },
 60 | 	14 => { name => "Timestamp Reply", 0 => "No Code" },
 61 | 	15 => { name => "Information Request", 0 => "No Code" },
 62 | 	16 => { name => "Information Reply", 0 => "No Code" },
 63 | 	17 => { name => "Address Mask Request", 0 => "No Code" },
 64 | 	18 => { name => "Address Mask Reply", 0 => "No Code" },
 65 | 	30 => { name => "Traceroute", 0 => "No Code" },
 66 | 	31 => { name => "Datagram Conversion Error", 0 => "No Code" },
 67 | 	32 => { name => "Mobile Host Redirect", 0 => "No Code" },
 68 | 	33 => { name => "IPv6 Where-Are-You", 0 => "No Code" },
 69 | 	34 => { name => "IPv6 I-Am-Here", 0 => "No Code" },
 70 | 	35 => { name => "Mobile Registration Request", 0 => "No Code" },
 71 | 	36 => { name => "Mobile Registration Reply", 0 => "No Code" },
 72 | 	39 => { name => "SKIP", 0 => "No Code" },
 73 | 	40 => { name => "Photuris", 0 => "Any code", 1 => "Any code", 2 => "Any code", 3 => "Any code", 4 => "Any code", 5 => "Any code" } #No direct mapping for any codes
 74 | };
 75 | 
 76 | our $ICMP6 = {
 77 | 	1  	=> { name => "Destination Unreachable",
 78 | 		0 => "No Route To Destination", 1 => "Communication With Destination Administratively Prohibited", 2 => "Beyond Scope Of Source Address",
 79 | 		3 => "Address Unreachable", 4 => "Port Unreachable", 5 => "Source Address Failed Ingress/Egress Policy", 6 => "Reject Route To Destination"
 80 | 		},
 81 | 	2  	=> { name => "Packet Too Big", 0 => "No Code"},
 82 | 	3  	=> { name => "Time Exceeded", 0 => "Hop Limit Exceeded In Transit", 1 => "Host Unreachable" },
 83 | 	4  	=> { name => "Parameter Problem", 0 => "Erroneous Header Field Encountered", 1 => "Unrecognized Next Header Type Encountered",
 84 | 		2 => "Unrecognized IPv6 Option Encountered"
 85 | 		},
 86 | 	128 => { name => "Echo Request", 0 => "No Code" },
 87 | 	129 => { name => "Echo Reply", 0 => "No Code" },
 88 | 	130 => { name => "Multicast Listener Query", 0 => "No Code" },
 89 | 	131 => { name => "Multicast Listener Report", 0 => "No Code" },
 90 | 	132 => { name => "Multicast Listener Done", 0 => "No Code" },
 91 | 	133 => { name => "Router Solicitation", 0 => "No Code" },
 92 | 	134 => { name => "Router Advertisement", 0 => "No Code" },
 93 | 	135 => { name => "Neighbor Solicitation", 0 => "No Code" },
 94 | 	136 => { name => "Neighbor Advertisement", 0 => "No Code" },
 95 | 	137 => { name => "Redirect Message", 0 => "No Code" },
 96 | 	138 => { name => "Router Renumbering", 0 => "Router Renumbering Command", 1 => "Router Renumbering Result", 255 => "Sequence Number Reset" },
 97 | 	139 => { name => "ICMP Node Information Query", 0 => "The Data Field Contains An IPv6 Address Which Is The Subject Of This Query.",
 98 | 		1 => "The Data Field Contains A Name Which Is The Subject Of This Query, Or Is Empty, As In The Case Of A NOOP.",
 99 | 		2 => "The Data Field Contains An IPv4 Address Which Is The Subject Of This Query."
100 | 		},
101 | 	140 => { name => "ICMP Node Information Response", 0 => "A Successful Reply.  The Reply Data Field May Or May Not Be Empty.",
102 | 		1 => "The Responder Refuses To Supply The Answer.  The Reply Data Field Will Be Empty.",
103 | 		2 => "The Qtype Of The Query Is Unknown To The Responder.  The Reply Data Field Will Be Empty."
104 | 		},
105 | 	141 => { name => "Inverse Neighbour Discovery Solicitation Message", 0 => "No Code" },
106 | 	142 => { name => "Inverse Neighbour Discovery Advertisement Message", 0 => "No Code" },
107 | 	143 => { name => "Version 2 Multicast Listener Report" },
108 | 	144 => { name => "Home Agent Address Discovery Request Message", 0 => "No Code" },
109 | 	145 => { name => "Home Agent Address Discovery Reply Message", 0 => "No Code" },
110 | 	146 => { name => "Mobile Prefix Solicitation", 0 => "No Code" },
111 | 	147 => { name => "Mobile Prefix Advertisement", 0 => "Any code" }, #UTM's 0 maps to "Any code" here
112 | 	151 => { name => "Multicast Router Advertisement" },
113 | 	152 => { name => "Multicast Router Solicitation" },
114 | 	153 => { name => "Multicast Router Termination" },
115 | 	154 => { name => "FMIPv6 Messages" }
116 | };
117 | 
118 | 1;


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Sophos Migration Utility CLI
  2 | 
  3 | Tool for converting Sophos UTM configuration snapshots to an SFOS 19.5.1+ importable configuration archive.
  4 | 
  5 | ## Installation
  6 | Extract all files to a directory on the target system. UTM will already have all required Perl modules installed.
  7 | 
  8 | ## Usage
  9 | USAGE: ./migrate.pl [-i path/to/snapshot] [-o path/to/Export.tar] [-d]
 10 | 
 11 | - -i - Path to a specific UTM snapshot to be exported. Usually located in /var/confd/var/storage/snapshots/. If -i is not specified, a snapshot of the current UTM configuration will be created and used.
 12 | - -o - Optional export path for the SFOS compatible TAR file. Default: ./Export.tar
 13 | - -d - Optional flag to enable debug output. Default: off
 14 | - -s - Optional path to only export a single template type. For development purposes only.
 15 | - -h - Display this help / usage message.
 16 | - -l - Optional flag to migrate log settings for firewall rules. Default: off
 17 | - -F - Optional flag to disable migration of firewall rules. Default: off
 18 | 
 19 | Important: This tool is meant to be run on Sophos UTM / ASG systems. Usage on other systems may require you to convert the snapshot file (see util/convert_snapshot.pl), and will require the -i option.
 20 | 
 21 | Once you have generated the Export.tar file, copy it to a system with access to the SFOS device Web Admin. On the SFOS UI, navigate to "System" > "Backup & firmware" > "Import export". Choose the file to import, and click "Import". Your objects will be imported after some time.
 22 | 
 23 | ### Examples
 24 | On a Sophos UTM, create a snapshot of the current configuration and export it to Export.tar
 25 | ```
 26 | ./migrate.pl
 27 | ```
 28 | 
 29 | On a Sophos UTM, use a specific snapshot and export it to TestExport.tar
 30 | ```
 31 | ./migrate.pl -i /var/confd/var/storage/snapshots/cfg_11111_11111111 -o TestExport.tar
 32 | ```
 33 | 
 34 | ### Instructions for running on UTM
 35 | The following instructions are one way you can set up your Sophos UTM and run the migration utility on it directly
 36 | 
 37 | #### Set up Shell Access in the Sophos UTM
 38 | To turn on SSH access in Sophos UTM 9, do as follows:
 39 | 1. Log in to the Sophos UTM WebAdmin.
 40 | 2. Go to Management > System Settings > Shell Access.
 41 | 3. Turn on SSH Shell Access.
 42 | 4. Ensure you have working credentials to access the Sophos UTM over SSH.
 43 | 
 44 | **Note**: Sophos UTM allows only two shell accounts, loginuser, and root. If you use a username and password, you must first log in as the less privileged loginuser, then escalate to root privileges using the su command, and enter the root password when prompted. You may also use SSH keys if preferred. It's possible to allow direct login as the root user if you use an SSH key rather than a username and password. If you're unfamiliar with SSH keys, choose strong passwords for the loginuser and root accounts.
 45 | If you don't know the credentials, you can reset the loginuser and root passwords on the Shell Access page.
 46 | 
 47 | #### Migration Instructions
 48 | To migrate your settings, do as follows:
 49 | 1. Access the migration utility at this link, where you can review its source and additional instructions for advanced use cases: https://github.com/sophos/Sophos-Migration-Utility-CLI.
 50 | 2. Download the script and supporting files from https://github.com/sophos/Sophos-Migration-Utility-CLI/archive/refs/heads/master.zip to your computer.
 51 | 3. Extract the downloaded zip file (Sophos-Migration-Utility-CLI-master.zip).
 52 | 4. Use your preferred SCP utility, for example, WinSCP on Microsoft Windows, to transfer all extracted contents from the above download to your Sophos UTM's /home/login folder.
 53 | 5. Authenticate with a username and password. Enter the username as loginuser and enter the password.
 54 | 6. Once logged in as loginuser, enter the following command to switch to root permissions:
 55 | ```
 56 | su -
 57 | <enter the root password>
 58 | ```
 59 | **Note:** Alternatively, you can use root with SSH key authentication. To do this, enter the username as root
 60 | 
 61 | 7. The uploaded files should be in a folder created in the /home/login/ folder. Make a note of the full path of the migrate.pl script. For this example, we'll assume it's in /home/login/sma.cli-master/.
 62 | 8. To run the migration, enter the following commands:
 63 | ```
 64 | cd /home/login/sma.cli-master/
 65 | perl migrate.pl
 66 | ```
 67 | 
 68 | The output should look like this:
 69 | ```
 70 | Using confd snapshot
 71 | /var/confd/var/storage/snapshots/cfg_17202_1680560553
 72 | Exporting objects from
 73 | /var/confd/var/storage/snapshots/cfg_17202_1680560553 to Export.tar
 74 | Exporting to Entities.xml
 75 | Creating output file archive Export.tar
 76 | Export complete
 77 | ```
 78 | 
 79 | 9. SCP copy the Export.tar file from/home/login/sma.cli-master/ to your computer.
 80 | 10. (Optional) SCP copy the Entities.xml file from the same location to your computer.
 81 | 11. (Optional) Review the contents of the Entities.xml file to review what will be imported.
 82 | 12. Log into the SFOS web admin console.
 83 | 13. Go to Backup & firmware > Import export.
 84 | 14. To import the Export.tar file, click Choose File, browse to where it's saved, then click Import.
 85 | **Note:** The import will progress in the background and may take a few minutes, depending on the size of the configuration.
 86 | 
 87 | 15. To monitor the progress of the import, select Log Viewer at the top of the page, then select Admin from the drop-down list.
 88 | You will see objects and settings being imported, and once logs stop appearing, you can check to see that all expected configuration has been imported.
 89 | If the file was manually edited before importing, any formatting errors will appear in this log, which may help you troubleshoot any issues.
 90 | 
 91 | ## Help
 92 | If you need assistance with migration, you can do as follows:
 93 | 
 94 | - Contact your local Sophos Partner
 95 | - Contact the Migration helpdesk
 96 | - Use the Community Forum, where we have a dedicated section for Lifecycle and Migration
 97 | 
 98 | ## Known issues and limitations
 99 | 
100 | 1. Tag and FilterAction List Website -> URL Group export
101 |     - Regexes are not exported (SFOS restriction)
102 |     - CIDR URLs are not exported (SFOS restriction)
103 |     - URLs containing paths are not exported (SFOS restriction)
104 |     - UTM's "include subdomains" is ignored. URL Groups always include subdomains on SFOS
105 |     - SFOS only allows 128 URLs per group. This tool will split them and create multple URL Groups when necessary.
106 | 2. SFOS generally allows shorter names for objects than UTM. Names are truncated where necessary.
107 | 3. DNS Groups -> IPLists is disabled - See DNSGrouptoIPLIST in sub parse_hosts() to re-enable
108 | 4. Gateway hosts -> Gateways only supports IPv4 (SFOS restriction)
109 | 
110 | 5. SFOS validates the VPN connections more strictly than UTM.  Because of this, some configurations that are valid in UTM will be silently rejected by SFOS.
111 | It is not feasible to reimplement all the SFOS validation rules, so this tool will only detect a limited number of issues that may cause problems, as mentioned below.  Please be advised there may be more situations that will cause SFOS to reject the settings.
112 | 
113 |     - Pre-shared key length must be at least 5 characters
114 |     - VPN connections must have well defined networks - can't use "Any" as network definitions
115 | 
116 | 6. This version will import the local ID (usually a hostname) from UTM into SFOS.
117 | 7. Users and groups are not imported.  For VPN definitions, they have to be added manually.
118 | 8. Nested service and network groups are not imported, as they are not supported in SFOS.
119 | 
120 | # Supported exports:
121 |    - Web Filter Action Allow and Block lists -> URL Groups
122 |    - Website tags -> URL Groups
123 |    - TCP, UDP, and TCP/UDP Services -> TCPorUDP Services
124 |    - Service Groups
125 |    - ICMP Services -> ICMP Services
126 |    - ICMPv6 Services -> ICMPv6 Services
127 |    - IP Services -> IP Services
128 |    - Host Definitions -> FQDN Hosts, IP Hosts IPs (IPv4 and IPv6), and MACs
129 |    - Network Groups
130 |    - Network Definitions -> IP Host Networks (IPv4 and IPv6)
131 |    - IP Ranges -> IP Host Ranges (IPv4 and IPv6)
132 |    - DNS Group hostname -> FQDNHost
133 |    - Gateway Hosts -> Gateways (IPv4)
134 |    - VPN Settings - site-to-site
135 |    - VPN Settings - SSL VPN remote access
136 |    - Firewall Rules
137 | 
138 | # Unsupported exports to be considered:
139 |    - Routes
140 |    - VLANs
141 |    - Firewall Rules - Groups
142 | 
143 | ## Copyright and License
144 | Copyright Sophos Ltd 2025
145 | 
146 | This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
147 | This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
148 | You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
149 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 2, June 1991
  3 | 
  4 |  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  5 |  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 |                             Preamble
 10 | 
 11 |   The licenses for most software are designed to take away your
 12 | freedom to share and change it.  By contrast, the GNU General Public
 13 | License is intended to guarantee your freedom to share and change free
 14 | software--to make sure the software is free for all its users.  This
 15 | General Public License applies to most of the Free Software
 16 | Foundation's software and to any other program whose authors commit to
 17 | using it.  (Some other Free Software Foundation software is covered by
 18 | the GNU Lesser General Public License instead.)  You can apply it to
 19 | your programs, too.
 20 | 
 21 |   When we speak of free software, we are referring to freedom, not
 22 | price.  Our General Public Licenses are designed to make sure that you
 23 | have the freedom to distribute copies of free software (and charge for
 24 | this service if you wish), that you receive source code or can get it
 25 | if you want it, that you can change the software or use pieces of it
 26 | in new free programs; and that you know you can do these things.
 27 | 
 28 |   To protect your rights, we need to make restrictions that forbid
 29 | anyone to deny you these rights or to ask you to surrender the rights.
 30 | These restrictions translate to certain responsibilities for you if you
 31 | distribute copies of the software, or if you modify it.
 32 | 
 33 |   For example, if you distribute copies of such a program, whether
 34 | gratis or for a fee, you must give the recipients all the rights that
 35 | you have.  You must make sure that they, too, receive or can get the
 36 | source code.  And you must show them these terms so they know their
 37 | rights.
 38 | 
 39 |   We protect your rights with two steps: (1) copyright the software, and
 40 | (2) offer you this license which gives you legal permission to copy,
 41 | distribute and/or modify the software.
 42 | 
 43 |   Also, for each author's protection and ours, we want to make certain
 44 | that everyone understands that there is no warranty for this free
 45 | software.  If the software is modified by someone else and passed on, we
 46 | want its recipients to know that what they have is not the original, so
 47 | that any problems introduced by others will not reflect on the original
 48 | authors' reputations.
 49 | 
 50 |   Finally, any free program is threatened constantly by software
 51 | patents.  We wish to avoid the danger that redistributors of a free
 52 | program will individually obtain patent licenses, in effect making the
 53 | program proprietary.  To prevent this, we have made it clear that any
 54 | patent must be licensed for everyone's free use or not licensed at all.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                     GNU GENERAL PUBLIC LICENSE
 60 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 61 | 
 62 |   0. This License applies to any program or other work which contains
 63 | a notice placed by the copyright holder saying it may be distributed
 64 | under the terms of this General Public License.  The "Program", below,
 65 | refers to any such program or work, and a "work based on the Program"
 66 | means either the Program or any derivative work under copyright law:
 67 | that is to say, a work containing the Program or a portion of it,
 68 | either verbatim or with modifications and/or translated into another
 69 | language.  (Hereinafter, translation is included without limitation in
 70 | the term "modification".)  Each licensee is addressed as "you".
 71 | 
 72 | Activities other than copying, distribution and modification are not
 73 | covered by this License; they are outside its scope.  The act of
 74 | running the Program is not restricted, and the output from the Program
 75 | is covered only if its contents constitute a work based on the
 76 | Program (independent of having been made by running the Program).
 77 | Whether that is true depends on what the Program does.
 78 | 
 79 |   1. You may copy and distribute verbatim copies of the Program's
 80 | source code as you receive it, in any medium, provided that you
 81 | conspicuously and appropriately publish on each copy an appropriate
 82 | copyright notice and disclaimer of warranty; keep intact all the
 83 | notices that refer to this License and to the absence of any warranty;
 84 | and give any other recipients of the Program a copy of this License
 85 | along with the Program.
 86 | 
 87 | You may charge a fee for the physical act of transferring a copy, and
 88 | you may at your option offer warranty protection in exchange for a fee.
 89 | 
 90 |   2. You may modify your copy or copies of the Program or any portion
 91 | of it, thus forming a work based on the Program, and copy and
 92 | distribute such modifications or work under the terms of Section 1
 93 | above, provided that you also meet all of these conditions:
 94 | 
 95 |     a) You must cause the modified files to carry prominent notices
 96 |     stating that you changed the files and the date of any change.
 97 | 
 98 |     b) You must cause any work that you distribute or publish, that in
 99 |     whole or in part contains or is derived from the Program or any
100 |     part thereof, to be licensed as a whole at no charge to all third
101 |     parties under the terms of this License.
102 | 
103 |     c) If the modified program normally reads commands interactively
104 |     when run, you must cause it, when started running for such
105 |     interactive use in the most ordinary way, to print or display an
106 |     announcement including an appropriate copyright notice and a
107 |     notice that there is no warranty (or else, saying that you provide
108 |     a warranty) and that users may redistribute the program under
109 |     these conditions, and telling the user how to view a copy of this
110 |     License.  (Exception: if the Program itself is interactive but
111 |     does not normally print such an announcement, your work based on
112 |     the Program is not required to print an announcement.)
113 | 
114 | These requirements apply to the modified work as a whole.  If
115 | identifiable sections of that work are not derived from the Program,
116 | and can be reasonably considered independent and separate works in
117 | themselves, then this License, and its terms, do not apply to those
118 | sections when you distribute them as separate works.  But when you
119 | distribute the same sections as part of a whole which is a work based
120 | on the Program, the distribution of the whole must be on the terms of
121 | this License, whose permissions for other licensees extend to the
122 | entire whole, and thus to each and every part regardless of who wrote it.
123 | 
124 | Thus, it is not the intent of this section to claim rights or contest
125 | your rights to work written entirely by you; rather, the intent is to
126 | exercise the right to control the distribution of derivative or
127 | collective works based on the Program.
128 | 
129 | In addition, mere aggregation of another work not based on the Program
130 | with the Program (or with a work based on the Program) on a volume of
131 | a storage or distribution medium does not bring the other work under
132 | the scope of this License.
133 | 
134 |   3. You may copy and distribute the Program (or a work based on it,
135 | under Section 2) in object code or executable form under the terms of
136 | Sections 1 and 2 above provided that you also do one of the following:
137 | 
138 |     a) Accompany it with the complete corresponding machine-readable
139 |     source code, which must be distributed under the terms of Sections
140 |     1 and 2 above on a medium customarily used for software interchange; or,
141 | 
142 |     b) Accompany it with a written offer, valid for at least three
143 |     years, to give any third party, for a charge no more than your
144 |     cost of physically performing source distribution, a complete
145 |     machine-readable copy of the corresponding source code, to be
146 |     distributed under the terms of Sections 1 and 2 above on a medium
147 |     customarily used for software interchange; or,
148 | 
149 |     c) Accompany it with the information you received as to the offer
150 |     to distribute corresponding source code.  (This alternative is
151 |     allowed only for noncommercial distribution and only if you
152 |     received the program in object code or executable form with such
153 |     an offer, in accord with Subsection b above.)
154 | 
155 | The source code for a work means the preferred form of the work for
156 | making modifications to it.  For an executable work, complete source
157 | code means all the source code for all modules it contains, plus any
158 | associated interface definition files, plus the scripts used to
159 | control compilation and installation of the executable.  However, as a
160 | special exception, the source code distributed need not include
161 | anything that is normally distributed (in either source or binary
162 | form) with the major components (compiler, kernel, and so on) of the
163 | operating system on which the executable runs, unless that component
164 | itself accompanies the executable.
165 | 
166 | If distribution of executable or object code is made by offering
167 | access to copy from a designated place, then offering equivalent
168 | access to copy the source code from the same place counts as
169 | distribution of the source code, even though third parties are not
170 | compelled to copy the source along with the object code.
171 | 
172 |   4. You may not copy, modify, sublicense, or distribute the Program
173 | except as expressly provided under this License.  Any attempt
174 | otherwise to copy, modify, sublicense or distribute the Program is
175 | void, and will automatically terminate your rights under this License.
176 | However, parties who have received copies, or rights, from you under
177 | this License will not have their licenses terminated so long as such
178 | parties remain in full compliance.
179 | 
180 |   5. You are not required to accept this License, since you have not
181 | signed it.  However, nothing else grants you permission to modify or
182 | distribute the Program or its derivative works.  These actions are
183 | prohibited by law if you do not accept this License.  Therefore, by
184 | modifying or distributing the Program (or any work based on the
185 | Program), you indicate your acceptance of this License to do so, and
186 | all its terms and conditions for copying, distributing or modifying
187 | the Program or works based on it.
188 | 
189 |   6. Each time you redistribute the Program (or any work based on the
190 | Program), the recipient automatically receives a license from the
191 | original licensor to copy, distribute or modify the Program subject to
192 | these terms and conditions.  You may not impose any further
193 | restrictions on the recipients' exercise of the rights granted herein.
194 | You are not responsible for enforcing compliance by third parties to
195 | this License.
196 | 
197 |   7. If, as a consequence of a court judgment or allegation of patent
198 | infringement or for any other reason (not limited to patent issues),
199 | conditions are imposed on you (whether by court order, agreement or
200 | otherwise) that contradict the conditions of this License, they do not
201 | excuse you from the conditions of this License.  If you cannot
202 | distribute so as to satisfy simultaneously your obligations under this
203 | License and any other pertinent obligations, then as a consequence you
204 | may not distribute the Program at all.  For example, if a patent
205 | license would not permit royalty-free redistribution of the Program by
206 | all those who receive copies directly or indirectly through you, then
207 | the only way you could satisfy both it and this License would be to
208 | refrain entirely from distribution of the Program.
209 | 
210 | If any portion of this section is held invalid or unenforceable under
211 | any particular circumstance, the balance of the section is intended to
212 | apply and the section as a whole is intended to apply in other
213 | circumstances.
214 | 
215 | It is not the purpose of this section to induce you to infringe any
216 | patents or other property right claims or to contest validity of any
217 | such claims; this section has the sole purpose of protecting the
218 | integrity of the free software distribution system, which is
219 | implemented by public license practices.  Many people have made
220 | generous contributions to the wide range of software distributed
221 | through that system in reliance on consistent application of that
222 | system; it is up to the author/donor to decide if he or she is willing
223 | to distribute software through any other system and a licensee cannot
224 | impose that choice.
225 | 
226 | This section is intended to make thoroughly clear what is believed to
227 | be a consequence of the rest of this License.
228 | 
229 |   8. If the distribution and/or use of the Program is restricted in
230 | certain countries either by patents or by copyrighted interfaces, the
231 | original copyright holder who places the Program under this License
232 | may add an explicit geographical distribution limitation excluding
233 | those countries, so that distribution is permitted only in or among
234 | countries not thus excluded.  In such case, this License incorporates
235 | the limitation as if written in the body of this License.
236 | 
237 |   9. The Free Software Foundation may publish revised and/or new versions
238 | of the General Public License from time to time.  Such new versions will
239 | be similar in spirit to the present version, but may differ in detail to
240 | address new problems or concerns.
241 | 
242 | Each version is given a distinguishing version number.  If the Program
243 | specifies a version number of this License which applies to it and "any
244 | later version", you have the option of following the terms and conditions
245 | either of that version or of any later version published by the Free
246 | Software Foundation.  If the Program does not specify a version number of
247 | this License, you may choose any version ever published by the Free Software
248 | Foundation.
249 | 
250 |   10. If you wish to incorporate parts of the Program into other free
251 | programs whose distribution conditions are different, write to the author
252 | to ask for permission.  For software which is copyrighted by the Free
253 | Software Foundation, write to the Free Software Foundation; we sometimes
254 | make exceptions for this.  Our decision will be guided by the two goals
255 | of preserving the free status of all derivatives of our free software and
256 | of promoting the sharing and reuse of software generally.
257 | 
258 |                             NO WARRANTY
259 | 
260 |   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
262 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
263 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
264 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
265 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
266 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
267 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
268 | REPAIR OR CORRECTION.
269 | 
270 |   12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
271 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
272 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
273 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
274 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
275 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
276 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
278 | POSSIBILITY OF SUCH DAMAGES.
279 | 
280 |                      END OF TERMS AND CONDITIONS
281 | 
282 |             How to Apply These Terms to Your New Programs
283 | 
284 |   If you develop a new program, and you want it to be of the greatest
285 | possible use to the public, the best way to achieve this is to make it
286 | free software which everyone can redistribute and change under these terms.
287 | 
288 |   To do so, attach the following notices to the program.  It is safest
289 | to attach them to the start of each source file to most effectively
290 | convey the exclusion of warranty; and each file should have at least
291 | the "copyright" line and a pointer to where the full notice is found.
292 | 
293 |     <one line to give the program's name and a brief idea of what it does.>
294 |     Copyright (C) <year>  <name of author>
295 | 
296 |     This program is free software; you can redistribute it and/or modify
297 |     it under the terms of the GNU General Public License as published by
298 |     the Free Software Foundation; either version 2 of the License, or
299 |     (at your option) any later version.
300 | 
301 |     This program is distributed in the hope that it will be useful,
302 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
303 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
304 |     GNU General Public License for more details.
305 | 
306 |     You should have received a copy of the GNU General Public License along
307 |     with this program; if not, write to the Free Software Foundation, Inc.,
308 |     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
309 | 
310 | Also add information on how to contact you by electronic and paper mail.
311 | 
312 | If the program is interactive, make it output a short notice like this
313 | when it starts in an interactive mode:
314 | 
315 |     Gnomovision version 69, Copyright (C) year name of author
316 |     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
317 |     This is free software, and you are welcome to redistribute it
318 |     under certain conditions; type `show c' for details.
319 | 
320 | The hypothetical commands `show w' and `show c' should show the appropriate
321 | parts of the General Public License.  Of course, the commands you use may
322 | be called something other than `show w' and `show c'; they could even be
323 | mouse-clicks or menu items--whatever suits your program.
324 | 
325 | You should also get your employer (if you work as a programmer) or your
326 | school, if any, to sign a "copyright disclaimer" for the program, if
327 | necessary.  Here is a sample; alter the names:
328 | 
329 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
330 |   `Gnomovision' (which makes passes at compilers) written by James Hacker.
331 | 
332 |   <signature of Ty Coon>, 1 April 1989
333 |   Ty Coon, President of Vice
334 | 
335 | This General Public License does not permit incorporating your program into
336 | proprietary programs.  If your program is a subroutine library, you may
337 | consider it more useful to permit linking proprietary applications with the
338 | library.  If this is what you want to do, use the GNU Lesser General
339 | Public License instead of this License.
340 | 


--------------------------------------------------------------------------------
/COPYING:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 2, June 1991
  3 | 
  4 |  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  5 |  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 |                             Preamble
 10 | 
 11 |   The licenses for most software are designed to take away your
 12 | freedom to share and change it.  By contrast, the GNU General Public
 13 | License is intended to guarantee your freedom to share and change free
 14 | software--to make sure the software is free for all its users.  This
 15 | General Public License applies to most of the Free Software
 16 | Foundation's software and to any other program whose authors commit to
 17 | using it.  (Some other Free Software Foundation software is covered by
 18 | the GNU Lesser General Public License instead.)  You can apply it to
 19 | your programs, too.
 20 | 
 21 |   When we speak of free software, we are referring to freedom, not
 22 | price.  Our General Public Licenses are designed to make sure that you
 23 | have the freedom to distribute copies of free software (and charge for
 24 | this service if you wish), that you receive source code or can get it
 25 | if you want it, that you can change the software or use pieces of it
 26 | in new free programs; and that you know you can do these things.
 27 | 
 28 |   To protect your rights, we need to make restrictions that forbid
 29 | anyone to deny you these rights or to ask you to surrender the rights.
 30 | These restrictions translate to certain responsibilities for you if you
 31 | distribute copies of the software, or if you modify it.
 32 | 
 33 |   For example, if you distribute copies of such a program, whether
 34 | gratis or for a fee, you must give the recipients all the rights that
 35 | you have.  You must make sure that they, too, receive or can get the
 36 | source code.  And you must show them these terms so they know their
 37 | rights.
 38 | 
 39 |   We protect your rights with two steps: (1) copyright the software, and
 40 | (2) offer you this license which gives you legal permission to copy,
 41 | distribute and/or modify the software.
 42 | 
 43 |   Also, for each author's protection and ours, we want to make certain
 44 | that everyone understands that there is no warranty for this free
 45 | software.  If the software is modified by someone else and passed on, we
 46 | want its recipients to know that what they have is not the original, so
 47 | that any problems introduced by others will not reflect on the original
 48 | authors' reputations.
 49 | 
 50 |   Finally, any free program is threatened constantly by software
 51 | patents.  We wish to avoid the danger that redistributors of a free
 52 | program will individually obtain patent licenses, in effect making the
 53 | program proprietary.  To prevent this, we have made it clear that any
 54 | patent must be licensed for everyone's free use or not licensed at all.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                     GNU GENERAL PUBLIC LICENSE
 60 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 61 | 
 62 |   0. This License applies to any program or other work which contains
 63 | a notice placed by the copyright holder saying it may be distributed
 64 | under the terms of this General Public License.  The "Program", below,
 65 | refers to any such program or work, and a "work based on the Program"
 66 | means either the Program or any derivative work under copyright law:
 67 | that is to say, a work containing the Program or a portion of it,
 68 | either verbatim or with modifications and/or translated into another
 69 | language.  (Hereinafter, translation is included without limitation in
 70 | the term "modification".)  Each licensee is addressed as "you".
 71 | 
 72 | Activities other than copying, distribution and modification are not
 73 | covered by this License; they are outside its scope.  The act of
 74 | running the Program is not restricted, and the output from the Program
 75 | is covered only if its contents constitute a work based on the
 76 | Program (independent of having been made by running the Program).
 77 | Whether that is true depends on what the Program does.
 78 | 
 79 |   1. You may copy and distribute verbatim copies of the Program's
 80 | source code as you receive it, in any medium, provided that you
 81 | conspicuously and appropriately publish on each copy an appropriate
 82 | copyright notice and disclaimer of warranty; keep intact all the
 83 | notices that refer to this License and to the absence of any warranty;
 84 | and give any other recipients of the Program a copy of this License
 85 | along with the Program.
 86 | 
 87 | You may charge a fee for the physical act of transferring a copy, and
 88 | you may at your option offer warranty protection in exchange for a fee.
 89 | 
 90 |   2. You may modify your copy or copies of the Program or any portion
 91 | of it, thus forming a work based on the Program, and copy and
 92 | distribute such modifications or work under the terms of Section 1
 93 | above, provided that you also meet all of these conditions:
 94 | 
 95 |     a) You must cause the modified files to carry prominent notices
 96 |     stating that you changed the files and the date of any change.
 97 | 
 98 |     b) You must cause any work that you distribute or publish, that in
 99 |     whole or in part contains or is derived from the Program or any
100 |     part thereof, to be licensed as a whole at no charge to all third
101 |     parties under the terms of this License.
102 | 
103 |     c) If the modified program normally reads commands interactively
104 |     when run, you must cause it, when started running for such
105 |     interactive use in the most ordinary way, to print or display an
106 |     announcement including an appropriate copyright notice and a
107 |     notice that there is no warranty (or else, saying that you provide
108 |     a warranty) and that users may redistribute the program under
109 |     these conditions, and telling the user how to view a copy of this
110 |     License.  (Exception: if the Program itself is interactive but
111 |     does not normally print such an announcement, your work based on
112 |     the Program is not required to print an announcement.)
113 | 
114 | These requirements apply to the modified work as a whole.  If
115 | identifiable sections of that work are not derived from the Program,
116 | and can be reasonably considered independent and separate works in
117 | themselves, then this License, and its terms, do not apply to those
118 | sections when you distribute them as separate works.  But when you
119 | distribute the same sections as part of a whole which is a work based
120 | on the Program, the distribution of the whole must be on the terms of
121 | this License, whose permissions for other licensees extend to the
122 | entire whole, and thus to each and every part regardless of who wrote it.
123 | 
124 | Thus, it is not the intent of this section to claim rights or contest
125 | your rights to work written entirely by you; rather, the intent is to
126 | exercise the right to control the distribution of derivative or
127 | collective works based on the Program.
128 | 
129 | In addition, mere aggregation of another work not based on the Program
130 | with the Program (or with a work based on the Program) on a volume of
131 | a storage or distribution medium does not bring the other work under
132 | the scope of this License.
133 | 
134 |   3. You may copy and distribute the Program (or a work based on it,
135 | under Section 2) in object code or executable form under the terms of
136 | Sections 1 and 2 above provided that you also do one of the following:
137 | 
138 |     a) Accompany it with the complete corresponding machine-readable
139 |     source code, which must be distributed under the terms of Sections
140 |     1 and 2 above on a medium customarily used for software interchange; or,
141 | 
142 |     b) Accompany it with a written offer, valid for at least three
143 |     years, to give any third party, for a charge no more than your
144 |     cost of physically performing source distribution, a complete
145 |     machine-readable copy of the corresponding source code, to be
146 |     distributed under the terms of Sections 1 and 2 above on a medium
147 |     customarily used for software interchange; or,
148 | 
149 |     c) Accompany it with the information you received as to the offer
150 |     to distribute corresponding source code.  (This alternative is
151 |     allowed only for noncommercial distribution and only if you
152 |     received the program in object code or executable form with such
153 |     an offer, in accord with Subsection b above.)
154 | 
155 | The source code for a work means the preferred form of the work for
156 | making modifications to it.  For an executable work, complete source
157 | code means all the source code for all modules it contains, plus any
158 | associated interface definition files, plus the scripts used to
159 | control compilation and installation of the executable.  However, as a
160 | special exception, the source code distributed need not include
161 | anything that is normally distributed (in either source or binary
162 | form) with the major components (compiler, kernel, and so on) of the
163 | operating system on which the executable runs, unless that component
164 | itself accompanies the executable.
165 | 
166 | If distribution of executable or object code is made by offering
167 | access to copy from a designated place, then offering equivalent
168 | access to copy the source code from the same place counts as
169 | distribution of the source code, even though third parties are not
170 | compelled to copy the source along with the object code.
171 | 
172 |   4. You may not copy, modify, sublicense, or distribute the Program
173 | except as expressly provided under this License.  Any attempt
174 | otherwise to copy, modify, sublicense or distribute the Program is
175 | void, and will automatically terminate your rights under this License.
176 | However, parties who have received copies, or rights, from you under
177 | this License will not have their licenses terminated so long as such
178 | parties remain in full compliance.
179 | 
180 |   5. You are not required to accept this License, since you have not
181 | signed it.  However, nothing else grants you permission to modify or
182 | distribute the Program or its derivative works.  These actions are
183 | prohibited by law if you do not accept this License.  Therefore, by
184 | modifying or distributing the Program (or any work based on the
185 | Program), you indicate your acceptance of this License to do so, and
186 | all its terms and conditions for copying, distributing or modifying
187 | the Program or works based on it.
188 | 
189 |   6. Each time you redistribute the Program (or any work based on the
190 | Program), the recipient automatically receives a license from the
191 | original licensor to copy, distribute or modify the Program subject to
192 | these terms and conditions.  You may not impose any further
193 | restrictions on the recipients' exercise of the rights granted herein.
194 | You are not responsible for enforcing compliance by third parties to
195 | this License.
196 | 
197 |   7. If, as a consequence of a court judgment or allegation of patent
198 | infringement or for any other reason (not limited to patent issues),
199 | conditions are imposed on you (whether by court order, agreement or
200 | otherwise) that contradict the conditions of this License, they do not
201 | excuse you from the conditions of this License.  If you cannot
202 | distribute so as to satisfy simultaneously your obligations under this
203 | License and any other pertinent obligations, then as a consequence you
204 | may not distribute the Program at all.  For example, if a patent
205 | license would not permit royalty-free redistribution of the Program by
206 | all those who receive copies directly or indirectly through you, then
207 | the only way you could satisfy both it and this License would be to
208 | refrain entirely from distribution of the Program.
209 | 
210 | If any portion of this section is held invalid or unenforceable under
211 | any particular circumstance, the balance of the section is intended to
212 | apply and the section as a whole is intended to apply in other
213 | circumstances.
214 | 
215 | It is not the purpose of this section to induce you to infringe any
216 | patents or other property right claims or to contest validity of any
217 | such claims; this section has the sole purpose of protecting the
218 | integrity of the free software distribution system, which is
219 | implemented by public license practices.  Many people have made
220 | generous contributions to the wide range of software distributed
221 | through that system in reliance on consistent application of that
222 | system; it is up to the author/donor to decide if he or she is willing
223 | to distribute software through any other system and a licensee cannot
224 | impose that choice.
225 | 
226 | This section is intended to make thoroughly clear what is believed to
227 | be a consequence of the rest of this License.
228 | 
229 |   8. If the distribution and/or use of the Program is restricted in
230 | certain countries either by patents or by copyrighted interfaces, the
231 | original copyright holder who places the Program under this License
232 | may add an explicit geographical distribution limitation excluding
233 | those countries, so that distribution is permitted only in or among
234 | countries not thus excluded.  In such case, this License incorporates
235 | the limitation as if written in the body of this License.
236 | 
237 |   9. The Free Software Foundation may publish revised and/or new versions
238 | of the General Public License from time to time.  Such new versions will
239 | be similar in spirit to the present version, but may differ in detail to
240 | address new problems or concerns.
241 | 
242 | Each version is given a distinguishing version number.  If the Program
243 | specifies a version number of this License which applies to it and "any
244 | later version", you have the option of following the terms and conditions
245 | either of that version or of any later version published by the Free
246 | Software Foundation.  If the Program does not specify a version number of
247 | this License, you may choose any version ever published by the Free Software
248 | Foundation.
249 | 
250 |   10. If you wish to incorporate parts of the Program into other free
251 | programs whose distribution conditions are different, write to the author
252 | to ask for permission.  For software which is copyrighted by the Free
253 | Software Foundation, write to the Free Software Foundation; we sometimes
254 | make exceptions for this.  Our decision will be guided by the two goals
255 | of preserving the free status of all derivatives of our free software and
256 | of promoting the sharing and reuse of software generally.
257 | 
258 |                             NO WARRANTY
259 | 
260 |   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
262 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
263 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
264 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
265 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
266 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
267 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
268 | REPAIR OR CORRECTION.
269 | 
270 |   12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
271 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
272 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
273 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
274 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
275 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
276 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
278 | POSSIBILITY OF SUCH DAMAGES.
279 | 
280 |                      END OF TERMS AND CONDITIONS
281 | 
282 |             How to Apply These Terms to Your New Programs
283 | 
284 |   If you develop a new program, and you want it to be of the greatest
285 | possible use to the public, the best way to achieve this is to make it
286 | free software which everyone can redistribute and change under these terms.
287 | 
288 |   To do so, attach the following notices to the program.  It is safest
289 | to attach them to the start of each source file to most effectively
290 | convey the exclusion of warranty; and each file should have at least
291 | the "copyright" line and a pointer to where the full notice is found.
292 | 
293 |     <one line to give the program's name and a brief idea of what it does.>
294 |     Copyright (C) <year>  <name of author>
295 | 
296 |     This program is free software; you can redistribute it and/or modify
297 |     it under the terms of the GNU General Public License as published by
298 |     the Free Software Foundation; either version 2 of the License, or
299 |     (at your option) any later version.
300 | 
301 |     This program is distributed in the hope that it will be useful,
302 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
303 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
304 |     GNU General Public License for more details.
305 | 
306 |     You should have received a copy of the GNU General Public License along
307 |     with this program; if not, write to the Free Software Foundation, Inc.,
308 |     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
309 | 
310 | Also add information on how to contact you by electronic and paper mail.
311 | 
312 | If the program is interactive, make it output a short notice like this
313 | when it starts in an interactive mode:
314 | 
315 |     Gnomovision version 69, Copyright (C) year name of author
316 |     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
317 |     This is free software, and you are welcome to redistribute it
318 |     under certain conditions; type `show c' for details.
319 | 
320 | The hypothetical commands `show w' and `show c' should show the appropriate
321 | parts of the General Public License.  Of course, the commands you use may
322 | be called something other than `show w' and `show c'; they could even be
323 | mouse-clicks or menu items--whatever suits your program.
324 | 
325 | You should also get your employer (if you work as a programmer) or your
326 | school, if any, to sign a "copyright disclaimer" for the program, if
327 | necessary.  Here is a sample; alter the names:
328 | 
329 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
330 |   `Gnomovision' (which makes passes at compilers) written by James Hacker.
331 | 
332 |   <signature of Ty Coon>, 1 April 1989
333 |   Ty Coon, President of Vice
334 | 
335 | This General Public License does not permit incorporating your program into
336 | proprietary programs.  If your program is a subroutine library, you may
337 | consider it more useful to permit linking proprietary applications with the
338 | library.  If this is what you want to do, use the GNU Lesser General
339 | Public License instead of this License.
340 | 
341 | 


--------------------------------------------------------------------------------
/migrate.pl:
--------------------------------------------------------------------------------
   1 | #!/usr/bin/perl
   2 | #Copyright Sophos Ltd 2025
   3 | #
   4 | #This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
   5 | #This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
   6 | #You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
   7 | 
   8 | package SMU::Migrate;
   9 | 
  10 | use strict;
  11 | use warnings;
  12 | use v5.10.1;
  13 | 
  14 | use Getopt::Std;
  15 | use Storable;
  16 | use HTML::Template;
  17 | use Archive::Tar;
  18 | use JSON;
  19 | use Encode;
  20 | 
  21 | our $VERSION = '0.8';
  22 | # Sophos Migration Utility - CLI
  23 | # Compatible with UTM 9.7xx to SFOS 19.5.1+
  24 | #
  25 | ## Known issues and limitations
  26 | #
  27 | # 1. Tag and FilterAction List Website -> URL Group export
  28 | #     - Regexes are not exported (SFOS restriction)
  29 | #     - CIDR URLs are not exported (SFOS restriction)
  30 | #     - URLs containing paths are not exported (SFOS restriction)
  31 | #     - UTM's "include subdomains" is ignored. URL Groups always include subdomains on SFOS
  32 | #     - SFOS only allows 128 URLs per group. This tool will split them and create multple URL Groups when necessary.
  33 | # 2. SFOS generally allows shorter names for objects than UTM. Names are truncated where necessary.
  34 | # 3. DNS Groups -> IPLists is disabled - See DNSGrouptoIPLIST in sub parse_hosts() to re-enable
  35 | # 4. Gateway hosts -> Gateways only supports IPv4 (SFOS restriction)
  36 | 
  37 | # 5. SFOS validates the VPN connections more strictly than UTM.  Because of this, some configurations that are valid in UTM will be silently rejected by SFOS.
  38 | # It is not feasible to reimplement all the SFOS validation rules, so this tool will only detect a limited number of issues that may cause problems, as mentioned below.  Please be advised there may be more situations that will cause SFOS to reject the settings.
  39 | #     - Pre-shared key length must be at least 5 characters
  40 | #     - VPN connections must have well defined networks - can't use "Any" as network definitions
  41 | 
  42 | # 6. This version will import the local ID (usually a hostname) from UTM into SFOS.
  43 | # 7. Users and groups are not imported.  For VPN definitions, they have to be added manually.
  44 | # 8. Nested service and network groups are not imported, as they are not supported in SFOS.
  45 | #
  46 | ## Supported exports
  47 | #   - Web Filter Action Allow and Block lists -> URL Groups
  48 | #   - Website tags -> URL Groups
  49 | #   - TCP, UDP, and TCP/UDP Services -> TCPorUDP Services
  50 | #   - Service Groups
  51 | #   - ICMP Services -> ICMP Services
  52 | #   - ICMPv6 Services -> ICMPv6 Services
  53 | #   - IP Services -> IP Services
  54 | #   - Host Definitions -> FQDN Hosts, IP Hosts IPs (IPv4 and IPv6), and MACs
  55 | #   - Network Groups
  56 | #   - Network Definitions -> IP Host Networks (IPv4 and IPv6)
  57 | #   - IP Ranges -> IP Host Ranges (IPv4 and IPv6)
  58 | #   - DNS Group hostname -> FQDNHost
  59 | #   - Gateway Hosts -> Gateways (IPv4)
  60 | #   - VPN Settings - site-to-site
  61 | #   - VPN Settings - SSL VPN remote access
  62 | #   - Firewall Rules
  63 | #
  64 | ## Unsupported exports to be considered
  65 | #   - Routes
  66 | #   - VLANs
  67 | #   - Firewall Rules - Groups
  68 | 
  69 | my $DEBUG = 0;
  70 | my $CONFD = "/usr/local/bin/confd-client.plx";
  71 | my $SNAPSHOT_DIR = "/var/confd/var/storage/snapshots/";
  72 | my $HTML_TEMPLATE_DIR = './tmpl/';
  73 | my $DEFAULT_INTERFACE_NAME = 'Port1';
  74 | my $LOG_FIREWALL = 1;
  75 | my $MIGRATE_FIREWALL_RULES = 1;
  76 | 
  77 | use lib '.';
  78 | use Protocols qw/$IP_PROTOS $ICMP4 $ICMP6/;
  79 | 
  80 | our %TEMPLATE_METADATA = (
  81 |     'Header.tmpl' => { },
  82 |     'Footer.tmpl' => { },
  83 |     'GatewayHost.tmpl' => { handler => \&parse_one_gatewayhost, class_types => ['itfparams/primary', 'route/policy'] },
  84 |     'Host.tmpl' => { handler => \&parse_one_host, class_types => ['network/dns_host', 'network/host', 'network/network', 'network/interface_network', 'network/range', 'network/dns_group', 'network/interface_address', 'network/interface_broadcast'] },
  85 |     'URLGroup.tmpl' => { handler => \&parse_one_url_group, class_types => ['http/cff_action'] },
  86 |     'Services.tmpl' => { handler => \&parse_one_service, class_types => ['service/tcp', 'service/udp', 'service/tcpudp', 'service/icmp', 'service/icmpv6', 'service/ip'] },
  87 |     # this is used for both s2s and remote access!
  88 |     'SSLTunnelAccessSettings.tmpl' => { handler => \&parse_ssl_tunnel_access_settings, class_types => [] },
  89 |     'Certificate.tmpl' => { handler => \&parse_one_certificate, class_types => ['ca/host_key_cert'], extra_data_path => 'Files/CertificateFile/0/' },
  90 |     'VPNProfile.tmpl' => { handler => \&parse_one_ipsec_vpn_profile, class_types => ['ipsec/policy'] },
  91 |     'VPNIPSecConnection.tmpl' => { handler => \&parse_one_ipsec_vpn_connection, class_types => ['ipsec_connection/site_to_site'] },
  92 |     'SiteToSiteServer.tmpl' => { handler => \&parse_one_ssl_vpn_server, class_types => ['ssl_vpn/server_connection'] },
  93 |     'SiteToSiteClient.tmpl' => { handler => \&parse_one_ssl_vpn_client, class_types => ['ssl_vpn/client_connection'], extra_data_path => 'Files/ServerConfigurationFile/0/' },
  94 |     'PPTPConfiguration.tmpl' => { handler => \&parse_remote_access_pptp_configuration },
  95 |     'SSLVPNPolicy.tmpl' => { handler => \&parse_remote_access_ssl_vpn, class_types => [ 'ssl_vpn/remote_access_profile' ] },
  96 |     'IPHostGroup.tmpl' => { handler => \&parse_one_host_group, class_types => ['network/group'] },
  97 |     'ServiceGroup.tmpl' => { handler => \&parse_service_group, class_types => ['service/group'] },
  98 |     'FirewallRule.tmpl' => { handler => \&parse_firewall_rule, class_types => ['packetfilter/packetfilter'] },
  99 | );
 100 | 
 101 | our %CLASS_TYPE_TO_TEMPLATE;
 102 | while (my ($template_name, $data) = each %TEMPLATE_METADATA) {
 103 |     my $class_type_list = $data->{class_types};
 104 |     for my $ct (@$class_type_list) {
 105 |         $CLASS_TYPE_TO_TEMPLATE{$ct} = $template_name;
 106 |     }
 107 | }
 108 | 
 109 | my %CLASS_TYPE_HANDLERS = (
 110 |     'http/lsl_tag' => sub { my ($backup, $obj) = @_; return $obj; },
 111 |     'http/local_site' => sub { my ($backup, $obj) = @_; return $obj; },
 112 | );
 113 | 
 114 | my %POST_HANDLERS = (
 115 |     'URLGroup.tmpl' => { handler => \&parse_url_groups_from_tags_and_sites, class_types => ['http/lsl_tag', 'http/local_site'] },
 116 | );
 117 | 
 118 | our @ORDER = (
 119 |     'Header.tmpl',
 120 |     'Host.tmpl',
 121 |     'GatewayHost.tmpl',
 122 |     'Services.tmpl',
 123 |     'URLGroup.tmpl',
 124 |     'Certificate.tmpl',
 125 |     'VPNProfile.tmpl',
 126 |     'VPNIPSecConnection.tmpl',
 127 |     'SSLTunnelAccessSettings.tmpl',
 128 |     'SiteToSiteServer.tmpl',
 129 |     'SiteToSiteClient.tmpl',
 130 |     'PPTPConfiguration.tmpl',
 131 |     'SSLVPNPolicy.tmpl',
 132 |     'SophosConnection.tmpl',
 133 |     'IPHostGroup.tmpl',
 134 |     'ServiceGroup.tmpl',
 135 |     'FirewallRule.tmpl',
 136 |     'Footer.tmpl',
 137 | );
 138 | 
 139 | # helper functions
 140 | 
 141 | sub usage {
 142 |     say STDERR "Sophos Migration Utility CLI for UTM to SFOS - Version $VERSION";
 143 |     say STDERR "USAGE: $0 [-i path/to/snapshot] [-o path/to/Export.tar] [-d]";
 144 |     say STDERR "\t-i\t- Path to a specific UTM snapshot to be exported.\n\t\t  Usually located in /var/confd/var/storage/snapshots/";
 145 |     say STDERR "\t\t  If -i is not specified, a snapshot of the current UTM configuration will be created and used.";
 146 |     say STDERR "\t-o\t- Optional export path for the SFOS compatible TAR file.\n\t\t  Default: ./Export.tar";
 147 |     say STDERR "\t-d\t- Optional flag to enable debug output\n\t\t  Default: off";
 148 |     say STDERR "\t-s\t- Optional path to only export a single template type. For development purposes only.";
 149 |     say STDERR "\t-p\t- Optional SFOS interface name.\n\t\t  Default: $DEFAULT_INTERFACE_NAME";
 150 |     say STDERR "\t-h\t- Display this help / usage message.";
 151 |     say STDERR "\t-l\t- Optional flag to migrate log settings for firewall rules\n\t\t  Default: off";
 152 |     say STDERR "\t-F\t- Optional flag to disable migration of firewall rules\n\t\t  Default: off";
 153 |     say STDERR "Important: This tool is meant to be run on Sophos UTM / ASG systems. Usage on other systems may require you to";
 154 |     say STDERR "convert the snapshot file (see util/convert_snapshot.pl), and will require the -i option.";
 155 |     exit;
 156 | }
 157 | 
 158 | sub read_backup {
 159 |     my ($fn) = @_;
 160 |     -f $fn or die $!;
 161 |     return retrieve $fn;
 162 | }
 163 | 
 164 | sub parse_one_host_group {
 165 | 
 166 |   my ($backup, $obj) = @_;
 167 |   my @ret = ();
 168 |   my @hosts = map { { name => get_network_name($backup, $_)->{name} } } @{$obj->{data}->{members}};
 169 |   push @ret, {
 170 |     name => escape_trunc("Net Group: ".$obj->{data}->{name}),
 171 |     description => $obj->{data}->{comment},
 172 |     group => 1,
 173 |     family => 'IPv4',
 174 |     hosts => \@hosts,
 175 | 
 176 |   };
 177 |   return \@ret;
 178 | }
 179 | 
 180 | sub parse_service_group {
 181 |     my ($backup, $obj) = @_;
 182 |     my @services = map { { name => escape_trunc($backup->{objects}->{$_}->{data}->{name}) } } @{$obj->{data}->{members}};
 183 |     return {
 184 |         servicegroup_name => escape_trunc($obj->{data}->{name}),
 185 |         description => escape_trunc($obj->{data}->{comment}),
 186 |         services => \@services,
 187 |     }
 188 | }
 189 | 
 190 | sub get_firewall_rule_position {
 191 |     my ($backup, $obj) = @_;
 192 |     my $rule_ref = $obj->{ref};
 193 | 
 194 |     my @rules = @{$backup->{main}->{packetfilter}->{rules}};
 195 |     my $idx = -1;
 196 |     for my $i (0 .. $#rules){
 197 |         if ($rules[$i] eq $rule_ref){
 198 |              $idx = $i;
 199 |              last;
 200 |         }
 201 |     }
 202 |     if ($idx == 0) {
 203 |         return {
 204 |             position => 'Bottom',
 205 |             prev => ''
 206 |         };
 207 |     }
 208 | 
 209 |     my $next_ref = $rules[$idx - 1];
 210 |     return {
 211 |         position => 'After',
 212 |         prev => escape_trunc($backup->{objects}->{$next_ref}->{data}->{name}),
 213 |     };
 214 | }
 215 | 
 216 | sub get_network_name {
 217 |     my ($backup, $obj) = @_;
 218 |     my $ref = get_ref($backup, $obj);
 219 |     if ( defined $ref->{data}->{name} && $ref->{data}->{name} eq 'Internet IPv4' ){
 220 |         return { name => 'Internet IPv4 group' };
 221 |     }
 222 |     return network_name($ref);
 223 | }
 224 | 
 225 | sub get_mac_names {
 226 |     my ($backup, $obj) = @_;
 227 |     my $ref = get_ref($backup, $obj);
 228 |     my @mac_names = ();
 229 |     if ($ref->{type} eq 'host') {
 230 |         my @ret = @{parse_one_host_from_host($backup, $ref)};
 231 |         foreach my $host_obj (@ret) {
 232 |             if (exists($host_obj->{maclist}) && $host_obj->{maclist} eq 1) {
 233 |                 push @mac_names, {name => $host_obj->{name}};
 234 |             }
 235 |         }
 236 |      }
 237 |      return \@mac_names;
 238 | }
 239 | 
 240 | sub parse_firewall_rule {
 241 |     if (! $MIGRATE_FIREWALL_RULES) {
 242 |         return {};
 243 |     }
 244 |     my ($backup, $obj) = @_;
 245 |     my $location = get_firewall_rule_position($backup, $obj);
 246 |     my @services = map { { name => $backup->{objects}->{$_}->{data}->{name} } } @{$obj->{data}->{services}};
 247 |     if (grep { $_->{ name } eq 'Any' } @services) {
 248 |         @services = ();
 249 |     }
 250 | 
 251 |     my @sources = ();
 252 |     foreach (@{$obj->{data}->{sources}}) {
 253 | 	my $nameobj = get_network_name($backup, $_);
 254 | 	my $name = $nameobj->{name};
 255 | 	push @sources, { name => $name } if $name;
 256 |     }
 257 | 
 258 |     if ($obj->{data}->{source_mac_addresses}) {
 259 |         my @mac_networks = @{ get_ref($backup, $obj->{data}->{source_mac_addresses})->{data}->{host_list}};
 260 |         foreach my $network_ref (@mac_networks) {
 261 |             my @mac_names = @{get_mac_names($backup, $network_ref)};
 262 |             foreach my $mac_name (@mac_names) {
 263 |                 push @sources, $mac_name;
 264 |             }
 265 |         }
 266 |     }
 267 |     if (grep { (exists $_->{ name } && !defined $_->{name})|| ($_->{ name } eq 'Any') || ($_->{ name } eq 'Any IPv4') } @sources) {
 268 |         @sources = ();
 269 |     }
 270 | 
 271 |     my @destinations = ();
 272 |     foreach (@{$obj->{data}->{destinations}}) {
 273 | 	my $nameobj = get_network_name($backup, $_);
 274 | 	my $name = $nameobj->{name};
 275 | 	push @destinations, { name => $name } if $name;
 276 |     }
 277 | 
 278 |     if (grep { (exists $_->{ name } && !defined $_->{name}) || ($_->{ name } eq 'Any') || ($_->{ name } eq 'Any IPv4') } @destinations) {
 279 |         @destinations = ();
 280 |     }
 281 | 
 282 |     @services = map { { name => escape_trunc($_->{name}) } } @{services};
 283 |     @sources = map { { name => $_->{name} } } @{sources};
 284 |     @destinations = map { { name => $_->{name} } } @{destinations};
 285 | 
 286 |     return {
 287 |         rule_name => escape_trunc($obj->{data}->{name}),
 288 |         description => escape_html($obj->{data}->{comment}),
 289 |         status => ($obj->{data}->{status} ? 'Enable' : 'Disable'),
 290 |         action => $obj->{data}->{action},
 291 |         logtraffic => ($LOG_FIREWALL ? 'Enable' : ($obj->{data}->{log} ? 'Enable' : 'Disable')),
 292 |         position => $location->{position},
 293 |         position_name => ($location->{position} eq 'Bottom' ? undef : $location->{prev}),
 294 |         services => \@services,
 295 |         sources => \@sources,
 296 |         destinations => \@destinations,
 297 |     };
 298 | }
 299 | 
 300 | sub cidr_to_netmask {
 301 |     my ($cidr) = @_;
 302 |     return join '.', unpack 'C4', pack 'N', (2**$cidr-1) << (32 - $cidr);
 303 | }
 304 | 
 305 | sub get_ref {
 306 |     my ($backup, $ref_name) = @_;
 307 |     return $backup->{objects}{$ref_name};
 308 | }
 309 | 
 310 | sub port_range {
 311 |     my ($low, $high) = @_;
 312 |     return $low eq $high ? $low : "$low:$high";
 313 | }
 314 | 
 315 | sub escape_html {
 316 |     my $html = shift;
 317 |     return "" if (!defined $html || $html eq "");
 318 |     $html =~ s/&/&amp;/g;
 319 |     $html =~ s/</&lt;/g;
 320 |     $html =~ s/>/&gt;/g;
 321 |     $html =~ s/"/&quot;/g;
 322 |     return $html;
 323 | }
 324 | 
 325 | sub trunc {
 326 |     my $s  = shift;
 327 |     my $len = shift || 50;
 328 |     return "" if (!defined $s || $s eq "");
 329 |     return substr($s, 0, $len);
 330 | }
 331 | 
 332 | sub escape_trunc {
 333 |     my $s = shift;
 334 |     my $len = shift || 50;
 335 |     return "" if (!defined $s || $s eq "");
 336 |     $s = trunc($s,$len);
 337 |     $s = escape_html($s);
 338 |     return $s;
 339 | }
 340 | 
 341 | sub sanitize_name {
 342 |     my ($name) = @_;
 343 |     $name =~ s/[^a-zA-Z0-9]+/_/g;
 344 |     return $name;
 345 | }
 346 | 
 347 | sub is_any_network {
 348 |     my ($network_obj) = @_;
 349 |     if ($network_obj->{data}->{resolved}) {
 350 |         if ($network_obj->{data}->{address} eq '0.0.0.0'
 351 |                 and $network_obj->{data}->{netmask} == 0) {
 352 |             return 1;
 353 |         }
 354 |     }
 355 |     if ($network_obj->{data}->{resolved6}) {
 356 |         if ($network_obj->{data}->{address6} eq '::'
 357 |                 and $network_obj->{data}->{netmask6} == 0) {
 358 |             return 1;
 359 |         }
 360 |     }
 361 |     return 0;
 362 | }
 363 | 
 364 | sub network_name {
 365 |     my ($network_obj) = @_;
 366 |     my $host = @{ parse_one_host (undef, $network_obj) }[0];
 367 |     if ($host && exists $host->{name}) {
 368 |         return { name => $host->{name} };
 369 |     }
 370 |     if (defined $network_obj->{data}->{members}) {
 371 |         my $group = @{ parse_one_host_group (undef, $network_obj) }[0];
 372 |         if ($group && exists $group->{name}) {
 373 |             return { name => $group->{name} };
 374 |         }
 375 |     }
 376 |     return {};
 377 | }
 378 | 
 379 | sub split_array {
 380 |     # destructive
 381 |     my ($n, $aref) = @_;
 382 |     my @ret;
 383 |     push @ret, [ splice @$aref, 0, $n ] while @$aref;
 384 |     return \@ret;
 385 | }
 386 | 
 387 | sub parse_one_host_from_dns_host {
 388 |     my ($backup, $obj) = @_;
 389 |     my @ret = ();
 390 |     push @ret, {
 391 |         fqdn => 1,
 392 |         name => escape_trunc("DNS Host: ".$obj->{data}->{name}),
 393 |         type => 'FQDN',
 394 |         address => $obj->{data}->{hostname}
 395 |     };
 396 | 
 397 |     if ($obj->{data}->{address} && $obj->{data}->{address} ne "" && $obj->{data}->{address} ne "0.0.0.0") {
 398 |         #DNS Host is resolved, create an IP Host
 399 |         push @ret, {
 400 |             iphost => 1,
 401 |             name => escape_trunc("DNS Host IP: ".$obj->{data}->{name}),
 402 |             type => 'IP',
 403 |             family => 'IPv4',
 404 |             address => $obj->{data}->{address}
 405 |         };
 406 |     }
 407 | 
 408 |     if ($obj->{data}->{address6} && $obj->{data}->{address6} ne "" && $obj->{data}->{address6} ne "::") {
 409 |         push @ret, {
 410 |             iphost => 1,
 411 |             name => escape_trunc("DNS Host IPv6: ".$obj->{data}->{name}),
 412 |             type => 'IP',
 413 |             family => 'IPv6',
 414 |             address => $obj->{data}->{address6}
 415 |         };
 416 |     }
 417 |     return \@ret;
 418 | }
 419 | 
 420 | sub parse_one_host_from_host {
 421 |     my ($backup, $obj) = @_;
 422 |     my @ret = ();
 423 |     if ($obj->{data}->{address} && $obj->{data}->{address} ne "" && $obj->{data}->{address} ne "0.0.0.0") {
 424 |         push @ret, {
 425 |             iphost => 1,
 426 |             name => escape_trunc("Host IP: ".$obj->{data}->{name}),
 427 |             type => 'IP',
 428 |             family => 'IPv4',
 429 |             address => $obj->{data}->{address}
 430 |         };
 431 |     }
 432 | 
 433 |     if ($obj->{data}->{address6} && $obj->{data}->{address6} ne "" && $obj->{data}->{address6} ne "::") {
 434 |         push @ret, {
 435 |             iphost => 1,
 436 |             name => escape_trunc("Host IPv6: ".$obj->{data}->{name}),
 437 |             type => 'IP',
 438 |             family => 'IPv6',
 439 |             address => $obj->{data}->{address6}
 440 |         };
 441 |     }
 442 |     if ($obj->{data}->{hostnames}) {
 443 |         my @hostnames = @{ $obj->{data}->{hostnames} };
 444 |         my $i = 1;
 445 |         foreach my $hostname (@hostnames) {
 446 |             push @ret, {
 447 |                 fqdn => 1,
 448 |                 name => "IP Host DNS: " . escape_trunc($obj->{data}->{name}, 40) . " $i",
 449 |                 type => 'FQDN',
 450 |                 address => $hostname
 451 |             };
 452 |             $i++;
 453 |         }
 454 |     }
 455 |     my @macs;
 456 |     foreach my $mac (@{ $obj->{data}->{macs} }) {
 457 |         push @macs, {mac => $mac};
 458 |     }
 459 |     if (@macs) {
 460 |         push @ret, {
 461 |             maclist => 1,
 462 |             name => escape_trunc("IP Host MACs: ".$obj->{data}->{name}),
 463 |             type => 'MACList',
 464 |             macs => \@macs
 465 |         };
 466 |     }
 467 |     return \@ret;
 468 | }
 469 | 
 470 | sub parse_one_host_from_network {
 471 |     my ($backup, $obj) = @_;
 472 |     my @ret = ();
 473 |     if ($obj->{data}->{address} && $obj->{data}->{address} ne "" && $obj->{data}->{address} ne "0.0.0.0") {
 474 |         push @ret, {
 475 |             network => 1,
 476 |             name => escape_trunc("Network: ".$obj->{data}->{name}),
 477 |             type => 'Network',
 478 |             family => 'IPv4',
 479 |             address => $obj->{data}->{address},
 480 |             subnet => $obj->{data}->{netmask} ? cidr_to_netmask($obj->{data}->{netmask}) : undef
 481 |         };
 482 |     }
 483 |     if ($obj->{data}->{address6} && $obj->{data}->{address6} ne "" && $obj->{data}->{address6} ne "::") {
 484 |         push @ret, {
 485 |             network => 1,
 486 |             name => escape_trunc("Network IPv6: ".$obj->{data}->{name}),
 487 |             type => 'Network',
 488 |             family => 'IPv6',
 489 |             address => $obj->{data}->{address6},
 490 |             subnet => $obj->{data}->{netmask6}
 491 |         };
 492 |     }
 493 |     return \@ret;
 494 | }
 495 | 
 496 | sub parse_one_host_from_range {
 497 |     my ($backup, $obj) = @_;
 498 |     my @ret = ();
 499 |     if ($obj->{data}->{from} && $obj->{data}->{from} ne "") {
 500 |         push @ret, {
 501 |             range => 1,
 502 |             name => escape_trunc("Range: ".$obj->{data}->{name}),
 503 |             type => 'Range',
 504 |             family => 'IPv4',
 505 |             start_address => $obj->{data}->{from},
 506 |             end_address => $obj->{data}->{to}
 507 |         };
 508 |     }
 509 |     if ($obj->{data}->{from6} && $obj->{data}->{from6} ne "") {
 510 |         push @ret, {
 511 |             range => 1,
 512 |             name => escape_trunc("Range IPv6: ".$obj->{data}->{name}),
 513 |             type => 'Range',
 514 |             family => 'IPv6',
 515 |             start_address => $obj->{data}->{from6},
 516 |             end_address => $obj->{data}->{to6}
 517 |         };
 518 |     }
 519 |     return \@ret;
 520 | }
 521 | 
 522 | sub parse_one_host_from_dns_group {
 523 |     my ($backup, $obj) = @_;
 524 |     my @ret = ();
 525 |     push @ret, {
 526 |         fqdn => 1,
 527 |         name => escape_trunc("DNS Group FQDN: ".$obj->{data}->{name}),
 528 |         type => 'FQDN',
 529 |         address => $obj->{data}->{hostname}
 530 |     };
 531 |     # DNSGrouptoIPLIST: Uncomment this section to enable export of resolved DNS Group IPs to an IPList in SFOS
 532 |     #my @addresses = @{ $obj->{data}->{addresses} };
 533 |     #if (@addresses) {
 534 |     #    push @ret, {
 535 |     #        name => escape_trunc("DNS Group: ".$obj->{data}->{hostname}),
 536 |     #        type => 'IPList',
 537 |     #        family => 'IPv4',
 538 |     #        addresses => join(',', @addresses)
 539 |     #    };
 540 |     #}
 541 |     #
 542 |     #my @addresses6 = @{ $obj->{data}->{addresses} };
 543 |     #if (@addresses6) {
 544 |     #    push @ret, {
 545 |     #        name => escape_trunc("DNS Group IPv6: ".$obj->{data}->{hostname}),
 546 |     #        type => 'IPList',
 547 |     #        family => 'IPv6',
 548 |     #        addresses => join(',', @addresses6)
 549 |     #    };
 550 |     #}
 551 |     return \@ret;
 552 | }
 553 | 
 554 | sub parse_one_host {
 555 |     my ($backup, $obj) = @_;
 556 |     my @ret = ();
 557 |     for ($obj->{type}) {
 558 |         if (defined $_ && $_ eq 'dns_host') {
 559 |             return parse_one_host_from_dns_host $backup, $obj;
 560 |         } elsif (defined $_ && ($_ eq 'host' or $_ eq 'interface_address' or $_ eq 'interface_broadcast')) {
 561 |             return parse_one_host_from_host $backup, $obj;
 562 |         } elsif (defined $_ && ($_ eq 'network' or $_ eq 'interface_network')) {
 563 |             return parse_one_host_from_network $backup, $obj;
 564 |         } elsif (defined $_ && $_ eq 'range') {
 565 |             return parse_one_host_from_range $backup, $obj;
 566 |         } elsif (defined $_ && $_ eq 'dns_group') {
 567 |             return parse_one_host_from_dns_group $backup, $obj;
 568 |         }
 569 |     }
 570 |     return \@ret;
 571 | }
 572 | 
 573 | sub parse_one_gatewayhost {
 574 |     my ($backup, $obj) = @_;
 575 |     my $class_type = $obj->{class} . '/' . $obj->{type};
 576 | 
 577 |     if ($class_type eq 'itfparams/primary') {
 578 |         # interface
 579 |         return {
 580 |             name => $obj->{data}->{name},
 581 |             gateway_ip => $obj->{data}->{default_gateway_address},
 582 |         };
 583 |     } elsif ($class_type eq 'route/policy') {
 584 |         # route
 585 |         return {
 586 |             name => $obj->{data}->{name},
 587 |             gateway_ip => get_ref($backup, $obj->{data}->{target})->{address},
 588 |         };
 589 |     }
 590 | }
 591 | 
 592 | sub parse_one_service {
 593 |     my ($backup, $obj) = @_;
 594 |     my $data = $obj->{data};
 595 |     my $type = $obj->{type};
 596 | 
 597 |     my %SERVICE_TYPE_MAP = ( tcp => 'TCPorUDP', udp => 'TCPorUDP', tcpudp => 'TCPorUDP', ip => 'IP', icmp => 'ICMP', icmpv6 => 'ICMPv6' );
 598 | 
 599 |     # SFOS only supports service types TCP, UDP, IP, ICMP, and ICMPv6, so don't bother processing the rest. TCPUDP will be split into two separate services
 600 | 
 601 |     my %service = (
 602 |         name => escape_trunc($data->{name}),
 603 |         type => $SERVICE_TYPE_MAP{$type},
 604 |     );
 605 | 
 606 |     for ($type) {
 607 |         if ($_ eq 'tcp') {
 608 |             $service{tcpudp} = 1;
 609 |             $service{details} = [
 610 |                 {
 611 |                     port_src => port_range( $data->{src_low}, $data->{src_high} ),
 612 |                     port_dst => port_range( $data->{dst_low}, $data->{dst_high} ),
 613 |                     protocol => 'TCP'
 614 |                 }
 615 |             ];
 616 |         }
 617 |         elsif ($_ eq 'udp') {
 618 |             $service{tcpudp} = 1;
 619 |             $service{details} = [
 620 |                 {
 621 |                     port_src => port_range( $data->{src_low}, $data->{src_high} ),
 622 |                     port_dst => port_range( $data->{dst_low}, $data->{dst_high} ),
 623 |                     protocol => 'UDP'
 624 |                 }
 625 |             ];
 626 |         }
 627 |         elsif ($_ eq 'tcpudp') {
 628 |             $service{tcpudp} = 1;
 629 |             $service{details} = [
 630 |                 {
 631 |                     port_src => port_range( $data->{src_low}, $data->{src_high} ),
 632 |                     port_dst => port_range( $data->{dst_low}, $data->{dst_high} ),
 633 |                     protocol => 'TCP'
 634 |                 },
 635 |                 {
 636 |                     port_src => port_range( $data->{src_low}, $data->{src_high} ),
 637 |                     port_dst => port_range( $data->{dst_low}, $data->{dst_high} ),
 638 |                     protocol => 'UDP'
 639 |                 }
 640 |             ];
 641 |         }
 642 |         elsif ($_ eq 'ip') {
 643 |             $service{ip} = 1;
 644 |             $service{protocol_name} = $IP_PROTOS->{ $data->{proto} };
 645 |         }
 646 |         elsif ($_ eq 'icmp') {
 647 |             $service{icmp} = 1;
 648 |             $service{icmp_type} = $ICMP4->{ $data->{type} }->{name};
 649 |             $service{icmp_code} = $ICMP4->{ $data->{type} }->{ $data->{code} } || 'Any code';
 650 |         }
 651 |         elsif ($_ eq 'icmpv6') {
 652 |             $service{icmpv6} = 1;
 653 |             $service{icmp_type} = $ICMP6->{ $data->{type} }->{name};
 654 |             $service{icmp_code} = $ICMP6->{ $data->{type} }->{ $data->{code} } || 'Any code';
 655 |         }
 656 |     }
 657 |     return \%service;
 658 | }
 659 | 
 660 | sub extract_urls_from_domain_refs {
 661 |     my ($backup, $domain_refs) = @_;
 662 |     my @ret;
 663 |     for my $ref (@$domain_refs) {
 664 |         my $obj = get_ref $backup, $ref;
 665 |         push @ret, @{ $obj->{data}->{domain} };
 666 |     }
 667 |     return @ret;
 668 | }
 669 | 
 670 | sub remove_regex_domains {
 671 |     my (@domains) = @_;
 672 |     # SFOS doesn't support regex URL Groups, so we can't import it
 673 |     return grep { ! /[^a-zA-Z0-9.-]/ } @domains;
 674 | }
 675 | 
 676 | sub build_url_group {
 677 |     my ($full_name, $trunc_name, $type, @urls) = @_;
 678 |     return {
 679 |         name => $full_name,
 680 |         trunc_name => $trunc_name,
 681 |         type => $type,
 682 |         urls => [ map { url => $_ }, @urls ]
 683 |     };
 684 | }
 685 | 
 686 | sub split_domain_list_for_url_group {
 687 |     my ($n, $type, $full_name, $trunc_name, @urls) = @_;
 688 | 
 689 |     if (@urls <= $n) {
 690 |         return [ build_url_group $full_name, $trunc_name, $type, @urls ];
 691 |     } else {
 692 | 
 693 |         my $urls_split = split_array($n, \@urls);
 694 |         my @trunc_names = map { $trunc_name . ' ' . $_ } 1 .. @$urls_split;
 695 |         return [
 696 |             map {
 697 |                 build_url_group $full_name, $trunc_names[$_], $type, @{$urls_split->[$_]}
 698 |             } (0..@$urls_split-1)
 699 |         ];
 700 |     }
 701 | }
 702 | 
 703 | sub parse_one_url_group {
 704 |     my ($backup, $obj) = @_;
 705 | 
 706 |     my $full_name = escape_html($obj->{data}->{name});
 707 |     my $trunc_name = trunc($full_name, 30);
 708 | 
 709 |     my @ret;
 710 | 
 711 |     my @allowlist = remove_regex_domains extract_urls_from_domain_refs(
 712 |         $backup, $obj->{data}->{url_whitelist});
 713 | 
 714 |     my @blocklist = remove_regex_domains extract_urls_from_domain_refs(
 715 |         $backup, $obj->{data}->{url_blacklist});
 716 | 
 717 |     if (@allowlist) {
 718 |         push @ret, @{
 719 |             split_domain_list_for_url_group(
 720 |                 128, 'allow', $full_name, $trunc_name, @allowlist)
 721 |         };
 722 |     }
 723 | 
 724 |     if (@blocklist) {
 725 |         push @ret, @{
 726 |             split_domain_list_for_url_group(
 727 |                 128, 'block', $full_name, $trunc_name, @blocklist)
 728 |         };
 729 |     }
 730 | 
 731 |     return \@ret;
 732 | }
 733 | 
 734 | sub parse_one_ipsec_vpn_connection {
 735 |     my ($backup, $obj) = @_;
 736 |     my $data = $obj->{data};
 737 |     my $remote_gateway = get_ref($backup, $data->{remote_gateway});
 738 |     my $policy = get_ref($backup, $data->{policy});
 739 |     my $remote_auth = get_ref($backup, $remote_gateway->{data}->{authentication});
 740 | 
 741 |     die 'auth object is of wrong type' if ($remote_auth->{class} ne 'ipsec_remote_auth');
 742 | 
 743 |     my %vpn_id_types = (
 744 |         ipv4_address => 'IP Address',
 745 |         fqdn => 'DNS',
 746 |         user_fqdn => 'Email',
 747 |         from_certificate => 'DER ASN1 DN (X.509)',
 748 |     );
 749 | 
 750 |     my %auth_types = (
 751 |         psk => 'PresharedKey',
 752 |         rsa => 'RSAKey',
 753 |         x509 => 'DigitalCertificate',
 754 |     );
 755 | 
 756 |     my @any_networks = grep {
 757 |         is_any_network get_ref($backup, $_)
 758 |     } @{$obj->{data}->{networks}}, @{$remote_gateway->{data}->{networks}};
 759 | 
 760 |     if (@any_networks) {
 761 |         warn "Will not export IPSec VPN connection $data->{name}: can't use Any networks - found: @any_networks\n";
 762 |         return;
 763 |     }
 764 | 
 765 |     my $local_subnets = [
 766 |         map { network_name get_ref($backup, $_) } @{$obj->{data}->{networks}}
 767 |     ];
 768 | 
 769 |     my $remote_networks = [
 770 |         map { network_name get_ref($backup, $_) } @{$remote_gateway->{data}->{networks}}
 771 |     ];
 772 | 
 773 |     my $vpn = {
 774 |         name => sanitize_name($data->{name}),
 775 |         type => 'SiteToSite',
 776 |         description => $data->{comment},
 777 |         policy => sanitize_name($policy->{data}->{name}),
 778 |         auth_type => $auth_types{$remote_auth->{type}},
 779 |         # one of: PresharedKey DigitalCertificate RSAKey
 780 |         local_subnets => $local_subnets,
 781 |         remote_networks => $remote_networks,
 782 |         remote_host => get_ref($backup, $remote_gateway->{data}->{host})->{data}->{address},
 783 |         # TODO can we have multiple ipsec remote addresses on utm?
 784 |         status => ($data->{status} ? 'Active' : 'Inactive'),
 785 |         remote_id_type => $vpn_id_types{$remote_auth->{data}->{vpn_id_type}},
 786 |         remote_id => $remote_auth->{data}->{vpn_id},  # TODO fixme for rsa and cert
 787 |         # These should contain the local interface name, but interface names are different between UTM and SFOS!
 788 |         # We will use a global default here.
 789 |         # For the future, the way to get the UTM interface is: `get_ref($backup, $data->{interface})->{data}->{name}`
 790 |         local_address => $DEFAULT_INTERFACE_NAME,
 791 |         local_gateway => $DEFAULT_INTERFACE_NAME,
 792 |     };
 793 | 
 794 |     for ($remote_auth->{type}) {
 795 |         if ($_ eq 'psk') {
 796 |             my $psk = $remote_auth->{data}->{psk};
 797 |             if (length $psk < 5) {
 798 |                 warn "Will not export IPSec VPN connection $data->{name}: PSK too short - must be at least 5 characters\n";
 799 |                 return undef;
 800 |             }
 801 |             $vpn->{auth_type} = 'PresharedKey';
 802 |             $vpn->{preshared_key} = $psk;
 803 |             my $confd_ipsec_advanced = $backup->{main}->{ipsec}->{advanced};
 804 |             $vpn->{local_id_type} = $vpn_id_types{$confd_ipsec_advanced->{psk_vpn_id_type}};
 805 |             $vpn->{local_id} = $confd_ipsec_advanced->{psk_vpn_id};
 806 | 
 807 |         } elsif ($_ eq 'rsa') {
 808 |             $vpn->{auth_type} = 'RSAKey';
 809 |             $vpn->{pubkey} = $remote_auth->{data}->{pubkey};
 810 |             my $local_auth = get_ref($backup, $backup->{main}->{ipsec}->{local_rsa});
 811 |             $vpn->{local_id_type} = $vpn_id_types{$local_auth->{data}->{vpn_id_type}};
 812 |             $vpn->{local_id} = $local_auth->{data}->{vpn_id};
 813 | 
 814 |         } elsif ($_ eq 'x509') {
 815 |             $vpn->{auth_type} = 'DigitalCertificate';
 816 |             my $cert;
 817 |             if ($remote_auth->{data}->{certificate} ne '') {
 818 |                 $cert = get_ref($backup, $remote_auth->{data}->{certificate});
 819 |                 $vpn->{certificate} = $cert->{data}->{certificate};
 820 |             }
 821 |             if ($remote_auth->{data}->{vpn_id_type} eq 'from_certificate') {
 822 |                 my $meta = get_ref($backup, $cert->{data}->{meta});
 823 |                 $vpn->{remote_id_type} = $vpn_id_types{$meta->{data}->{vpn_id_type}};
 824 |                 $vpn->{remote_id} = $meta->{data}->{vpn_id};
 825 |             } else {
 826 |                 $vpn->{remote_id_type} = $vpn_id_types{$remote_auth->{data}->{vpn_id_type}};
 827 |                 $vpn->{remote_id} = $remote_auth->{data}->{vpn_id};
 828 |             }
 829 |             my $confd_ipsec = $backup->{main}->{ipsec};
 830 |             my $local_rsa = get_ref($backup, $confd_ipsec->{local_rsa});
 831 |             $vpn->{local_id_type} = $vpn_id_types{$local_rsa->{data}->{vpn_id_type}};
 832 |             $vpn->{local_id} = $local_rsa->{data}->{vpn_id};
 833 |         }
 834 |     }
 835 | 
 836 |     if (not $vpn->{local_id}) {
 837 |         warn "Will not export IPSec VPN connection $data->{name}: does not have a local ID set!\n";
 838 |         return undef;
 839 |     }
 840 |     if (not $vpn->{remote_id}) {
 841 |         warn "Will not export IPSec VPN connection $data->{name}: does not have a remote ID set!\n";
 842 |         return undef;
 843 |     }
 844 |     return $vpn;
 845 | }
 846 | 
 847 | sub parse_ssl_tunnel_access_settings {
 848 |     my ($backup) = @_;
 849 | 
 850 |     my $s = $backup->{main}->{ssl_vpn};
 851 |     my $ip_assignment_pool = get_ref($backup, $s->{ip_assignment_pool});
 852 |     if ($ip_assignment_pool->{class} ne 'network' or $ip_assignment_pool->{type} ne 'network') {
 853 |         die 'auth object is of wrong type';
 854 |     };
 855 | 
 856 |     my $fn = sanitize_name(get_ref($backup, $s->{certificate})->{data}->{name});
 857 | 
 858 |     my %ret = (
 859 |         protocol => uc($s->{protocol}), # TODO map?
 860 |         certificate => $fn,
 861 |         hostname => undef, # FIXME OverrideHostname or HostorDNSName?
 862 |         port => $s->{port},
 863 |         start_ip => $ip_assignment_pool->{data}->{address},
 864 |         subnet_mask => cidr_to_netmask($ip_assignment_pool->{data}->{netmask}),
 865 |         ipv6_lease => $ip_assignment_pool->{data}->{address6},
 866 |         ipv6_prefix => $ip_assignment_pool->{data}->{netmask6},
 867 |         lease_mode => 'IPv4', # TODO IPv4 or IPv6
 868 |         # TODO where are these defined?
 869 |         primary_dns_ipv4 => undef,
 870 |         secondary_dns_ipv4 => undef,
 871 |         primary_wins_ipv4 => undef,
 872 |         secondary_wins_ipv4 => undef,
 873 |         domain_name => undef,
 874 |         # }}}
 875 |         encryption_algorithm => $s->{encryption_algorithm},
 876 |         authentication_algorithm => $s->{authentication_algorithm},
 877 |         key_lifetime => $s->{datachannel_key_lifetime},
 878 |         compression => ($s->{compression} ? 'Enable' : 'Disable'),
 879 |         debug => ($s->{debug} ? 'Enable' : 'Disable'),
 880 |     );
 881 |     return \%ret;
 882 | }
 883 | 
 884 | sub sanitize_ssl_vpn_server_name {
 885 |     my $name = shift;
 886 |     return "" if (!defined $name || $name eq "");
 887 |     $name =~ s/[^A-Za-z0-9_]/_/g;
 888 |     if ($name =~ /\A[0-9_]/) {
 889 |         $name = "D" . $name;
 890 |     }
 891 |     return trunc($name, 50);
 892 | }
 893 | 
 894 | sub parse_one_ssl_vpn_server {
 895 |     my ($backup, $obj) = @_;
 896 | 
 897 |     my @any_networks = grep {
 898 |         is_any_network get_ref($backup, $_)
 899 |     } @{$obj->{data}->{local_networks}}, @{$obj->{data}->{remote_networks}};
 900 | 
 901 |     if (@any_networks) {
 902 |         warn "Will not export SSL VPN connection $obj->{data}->{name}: can't use Any networks - found: @any_networks\n";
 903 |         return undef;
 904 |     }
 905 | 
 906 |     my @local_networks = map { network_name get_ref($backup, $_) } @{$obj->{data}->{local_networks}};
 907 |     my @remote_networks = map { network_name get_ref($backup, $_) } @{$obj->{data}->{remote_networks}};
 908 | 
 909 |     my $sanitized_name = sanitize_ssl_vpn_server_name($obj->{data}->{name});
 910 | 
 911 |     return {
 912 |         name => $sanitized_name,
 913 |         static_ip => ($obj->{data}->{static_ip_status} ? 'Disable' : 'Enable'),
 914 |         local_networks => \@local_networks,
 915 |         remote_networks => \@remote_networks,
 916 |         status => ($obj->{data}->{status} ? 'On' : 'Off'),
 917 |         description => "Original Name: " . escape_html($obj->{data}->{name}),
 918 |     };
 919 | }
 920 | 
 921 | sub make_ssl_vpn_client_config {
 922 |     my ($backup, $obj) = @_;
 923 |     my $ssl_vpn = $backup->{main}->{ssl_vpn};
 924 |     my $cert = get_ref($backup, $ssl_vpn->{certificate});
 925 |     my $srv_meta = get_ref($backup, $cert->{data}->{meta});
 926 |     my $srv_ca = get_ref($backup, $cert->{data}{ca});
 927 |     my $server_dn = $srv_meta->{data}->{subject};
 928 |     my $uses_gost = $srv_meta->{data}{public_key_algorithm} =~ /GOST/;
 929 | 
 930 |     my $engine = ($uses_gost ? 'gost' : '');
 931 |     my $cert_type = ($uses_gost ? 'x509_cert_gost' : 'x509_cert');
 932 |     my $user = get_ref($backup, $obj->{data}->{username});
 933 |     my $auth = get_ref($backup, $user->{data}{$cert_type});
 934 |     my $x509 = get_ref($backup, $auth->{data}{certificate});
 935 | 
 936 |     $engine = 'gost' if $ssl_vpn->{encryption_algorithm} eq 'gost89'
 937 |         || $ssl_vpn->{authentication_algorithm} eq 'gost-mac';
 938 | 
 939 |     my $hostname = get_ref($backup, $obj->{data}->{server_address})->{data}->{hostname};
 940 | 
 941 |     return {
 942 |         engine => $engine,
 943 |         certificate => $x509->{data}{certificate},
 944 |         key => $x509->{data}{key},
 945 |         ca_cert => $srv_ca->{data}{certificate},
 946 |         username => $user->{data}{name},
 947 |         password => $obj->{data}->{password},
 948 |         protocol => $ssl_vpn->{protocol},
 949 |         server_address => [ $hostname ],
 950 |         server_port => $ssl_vpn->{port},
 951 |         server_dn => $server_dn,
 952 |         compression => $ssl_vpn->{compression},
 953 |         encryption_algorithm => $ssl_vpn->{encryption_algorithm},
 954 |         authentication_algorithm => $ssl_vpn->{authentication_algorithm},
 955 |     };
 956 | }
 957 | 
 958 | sub parse_one_ssl_vpn_client {
 959 |     my ($backup, $obj) = @_;
 960 | 
 961 |     my $data = $obj->{data};
 962 |     my $apc_filename = sanitize_name($data->{name} . '.apc');
 963 | 
 964 |     my $client = {
 965 |         name => $data->{name},
 966 |         config_filename => $apc_filename,
 967 |         config_password => undef,
 968 |         http_proxy_server_enabled => $data->{proxy_status},
 969 |         http_proxy_server_name => $data->{proxy_host},
 970 |         http_proxy_server_port => $data->{proxy_port},
 971 |         http_proxy_server_auth_enabled => $data->{proxy_auth_status},
 972 |         http_proxy_server_username => $data->{proxy_auth_user},
 973 |         http_proxy_server_password => $data->{proxy_auth_pass},
 974 |         peerhost_enabled => undef, # TODO
 975 |         peerhost_name => undef,
 976 |         # description => undef,
 977 |         status => ($data->{status} ? 'On' : 'Off'),
 978 |     };
 979 |     my $apc = make_ssl_vpn_client_config($backup, $obj);
 980 |     my $extra_data = {$apc_filename => JSON->new->utf8->encode($apc)};
 981 |     return ($client, $extra_data);
 982 | }
 983 | 
 984 | sub parse_one_certificate {
 985 |     my ($backup, $obj) = @_;
 986 | 
 987 |     my $name = sanitize_name($obj->{data}->{name});
 988 |     my $cert_name = $name . '.pem';
 989 |     my $key_name = $name . '.key';
 990 | 
 991 |     my $ret = {
 992 |         name => $name,
 993 |         certificate_file => $cert_name,
 994 |         private_key_file => $key_name
 995 |     };
 996 | 
 997 |     my $extra_data = {
 998 |         $cert_name => $obj->{data}->{certificate},
 999 |         $key_name => $obj->{data}->{key} };
1000 | 
1001 |     return $ret, $extra_data;
1002 | }
1003 | 
1004 | sub parse_one_ipsec_vpn_profile {
1005 |     my ($backup, $obj) = @_;
1006 | 
1007 |     my %encr_alg = (
1008 |         null => 'None',
1009 |         des => 'DES',
1010 |         '3des' => '3DES',
1011 |         aes128 => 'AES128',
1012 |         aes192 => 'AES192',
1013 |         aes256 => 'AES256',
1014 |         twofish => 'TwoFish',
1015 |         blowfish => 'BlowFish',
1016 |         serpent => 'Serpent',
1017 |     );
1018 | 
1019 |     my %auth_alg = (
1020 |         md5 => 'MD5',
1021 |         sha1 => 'SHA1',
1022 |         sha2_256 => 'SHA2_256',
1023 |         sha2_384 => 'SHA2_384',
1024 |         sha2_512 => 'SHA2_512',
1025 |         # 'sha2_256_96', 'sha2_384_96', 'sha2_512_96' - unsupported in utm
1026 |     );
1027 | 
1028 |     my %dh_groups = (
1029 |         null => 'None',
1030 |         modp768 => '1(DH768)',
1031 |         modp1024 => '2(DH1024)',
1032 |         modp1536 => '5(DH1536)',
1033 |         modp2048 => '14(DH2048)',
1034 |         modp3072 => '15(DH3072)',
1035 |         modp4096 => '16(DH4096)',
1036 |         # these are not supported by UTM
1037 |         # '17(DH6144)',
1038 |         # '18(DH8192)',
1039 |         # '19(ecp256)',
1040 |         # '20(ecp384)',
1041 |         # '21(ecp521)',
1042 |         # '25(ecp192)',
1043 |         # '26(ecp224)',
1044 |         # '31(curve25519)',
1045 |     );
1046 | 
1047 |     my %pfs_groups = (
1048 |         %dh_groups,
1049 |         0 => 'SameasPhase-I',
1050 |     );
1051 | 
1052 |     return {
1053 |         name => sanitize_name($obj->{data}->{name}),
1054 |         description => $obj->{data}->{comment},
1055 |         compression => ($obj->{data}->{ipsec_compression} ? 'Disable' : 'Enable'),
1056 |         phase1_encr1 => $encr_alg{$obj->{data}->{ike_enc_alg}},
1057 |         phase1_auth1 => $auth_alg{$obj->{data}->{ike_auth_alg}},
1058 |         phase1_encr2 => undef,
1059 |         phase1_auth2 => undef,
1060 |         phase1_encr3 => undef,
1061 |         phase1_auth3 => undef,
1062 |         phase1_dh_groups => [ { name => $dh_groups{$obj->{data}->{ike_dh_group}} } ],
1063 |         phase1_key_life => $obj->{data}->{ike_sa_lifetime},
1064 |         # TODO hardcoded for now - can be one of: Disconnect/Hold/ReInitiate
1065 |         action_when_unreachable => 'Disconnect',
1066 |         phase2_encr1 => $encr_alg{$obj->{data}->{ipsec_enc_alg}},
1067 |         phase2_auth1 => $auth_alg{$obj->{data}->{ipsec_auth_alg}},
1068 |         phase2_encr2 => undef,
1069 |         phase2_auth2 => undef,
1070 |         phase2_encr3 => undef,
1071 |         phase2_auth3 => undef,
1072 |         phase2_key_life => $obj->{data}->{ipsec_sa_lifetime},
1073 |         phase2_pfs_group => $pfs_groups{$obj->{data}->{ipsec_pfs_group}},
1074 |     };
1075 | }
1076 | 
1077 | sub fill_html_template_from_data {
1078 |     my ($template_name, $template_data) = @_;
1079 | 
1080 |     my $filename = $HTML_TEMPLATE_DIR . $template_name;
1081 |     my $template = HTML::Template->new(filename => $filename, utf8 => 1, debug => $DEBUG, die_on_bad_params => 0)
1082 |         or die "Template creation failed";
1083 |     $template->param($template_data);
1084 |     my $output = $template->output;
1085 |     $output =~ s/^\s*(?:\n|$)//mg;
1086 |     chomp $output;
1087 |     return $output;
1088 | }
1089 | 
1090 | sub make_entities {
1091 |     my ($template_name, $template_data) = @_;
1092 |     my @ret;
1093 |     if (ref $template_data ne 'ARRAY') {
1094 |         $template_data = [ $template_data ];
1095 |     }
1096 |     for my $td (@$template_data) {
1097 |         push @ret, fill_html_template_from_data $template_name, $td;
1098 |     }
1099 |     return \@ret;
1100 | }
1101 | 
1102 | sub parse_url_groups_from_tags_and_sites {
1103 |     my ($tag_objs, $site_objs) = @_;
1104 | 
1105 |     my %tags = ();
1106 |     my @ret;
1107 | 
1108 |     for my $tag_obj (@$tag_objs) {
1109 |         $tags{$tag_obj->{ref}} //= {
1110 |             name => $tag_obj->{data}->{name},
1111 |             urls => []
1112 |         };
1113 |     }
1114 | 
1115 |     for my $site_obj (@$site_objs) {
1116 |         my @site_tag_refs = @{ $site_obj->{data}->{tags} };
1117 |         for my $tag_ref (@site_tag_refs) {
1118 |             push @{ $tags{$tag_ref}->{urls} }, $site_obj->{data}->{site};
1119 |         }
1120 |     }
1121 | 
1122 |     for my $tag_ref (keys %tags) {
1123 |         my $full_name = escape_html $tags{$tag_ref}->{name};
1124 |         my $trunc_name = trunc $full_name, 30;
1125 |         my $type = 'tag';
1126 |         my $urls = $tags{$tag_ref}->{urls};
1127 | 
1128 |         push @ret, @{
1129 |             split_domain_list_for_url_group(
1130 |                 128, $type, $full_name, $trunc_name, @$urls)
1131 |         };
1132 |     }
1133 | 
1134 |     return \@ret;
1135 | }
1136 | 
1137 | sub parse_remote_access_pptp_configuration {
1138 |     my ($backup) = @_;
1139 |     # TODO can SFOS auth users against radius?
1140 |     my $remote_access = $backup->{main}->{remote_access};
1141 |     my $pptp = $remote_access->{pptp};
1142 |     my $advanced = $remote_access->{advanced};
1143 |     my $ip_assignment_pool = get_ref($backup, $pptp->{ip_assignment_pool});
1144 | 
1145 |     return {
1146 |         general_settings => 'Enable',
1147 |         # TODO ips can be assigned by radius too - not supported yet
1148 |         ip_assignment_mode => $pptp->{ip_assignment_mode},
1149 |         start_ip => undef,
1150 |         end_ip => undef,
1151 |         lease_ip_from_radius => 'Disable', # Enable Disable
1152 |         primary_dns => $advanced->{msdns1},
1153 |         secondary_dns => $advanced->{msdns2},
1154 |         primary_wins => $advanced->{mswins1},
1155 |         secondary_wins => $advanced->{mswins2},
1156 |     } if !$ip_assignment_pool;
1157 | 
1158 |     my ($start_ip, $end_ip) = calculate_ip_range(
1159 |         $ip_assignment_pool->{data}->{address},
1160 |         cidr_to_netmask($ip_assignment_pool->{data}->{netmask}));
1161 | 
1162 |     return {
1163 |         general_settings => 'Enable',
1164 |         # TODO ips can be assigned by radius too - not supported yet
1165 |         ip_assignment_mode => $pptp->{ip_assignment_mode},
1166 |         start_ip => $start_ip,
1167 |         end_ip => $end_ip,
1168 |         lease_ip_from_radius => 'Disable', # Enable Disable
1169 |         primary_dns => $advanced->{msdns1},
1170 |         secondary_dns => $advanced->{msdns2},
1171 |         primary_wins => $advanced->{mswins1},
1172 |         secondary_wins => $advanced->{mswins2},
1173 |     };
1174 | }
1175 | 
1176 | sub parse_remote_access_ssl_vpn {
1177 |     my ($backup, $obj) = @_;
1178 | 
1179 |     return {
1180 |         name => $obj->{data}->{name},
1181 |         description => $obj->{data}->{comment},
1182 |         use_as_default_gw => 'Off',
1183 |         permitted_network_resources_ipv4 => [
1184 |             map { network_name get_ref($backup, $_) } @{$obj->{data}->{networks}}
1185 |         ],
1186 |         disconnect_idle_clients => 'On',
1187 |         override_global_timeout_minutes => 15
1188 |     };
1189 | }
1190 | 
1191 | sub calculate_ip_range {
1192 |     my ($ip, $netmask) = @_;
1193 |     use Socket qw/inet_aton inet_ntoa/;  # TODO move to top?
1194 |     my $nip = inet_aton $ip;
1195 |     my $nmask = inet_aton $netmask;
1196 |     my $first = inet_ntoa ($nip & $nmask);
1197 |     my $last = inet_ntoa ($nip | ~$nmask);
1198 | 
1199 |     return ($first, $last);
1200 | }
1201 | 
1202 | sub parse_backup {
1203 |     my ($backup, $requested_template) = @_;
1204 |     # if $requested_template is defined, we will only generate entities for it
1205 |     # otherwise, generate everything
1206 | 
1207 |     my %entities = ();
1208 |     my %extra = ();
1209 |     my %data_from_handlers = ();
1210 | 
1211 |     while (my ($name, $obj) = each %{ $backup->{objects} }) {
1212 |         my $key = $obj->{class} . '/' . $obj->{type};
1213 |         next if $key eq 'packetfilter/packetfilter';
1214 |         my $template_name = $CLASS_TYPE_TO_TEMPLATE{$key};
1215 | 
1216 |         if ($template_name) {
1217 |             next if defined $requested_template and $template_name ne $requested_template;
1218 |             my $handler = $TEMPLATE_METADATA{$template_name}->{handler};
1219 |             my ($template_data, $extra_data) = $handler->($backup, $obj);
1220 |             if ($template_data) {
1221 |                 push @{ $entities{$template_name} }, @{ make_entities $template_name, $template_data };
1222 |             }
1223 |             if ($extra_data) {
1224 |                 while (my ($filename, $content) = each %$extra_data) {
1225 |                     $extra{$template_name}->{$filename} = $content;
1226 |                 }
1227 |             }
1228 | 
1229 |         } elsif (defined $CLASS_TYPE_HANDLERS{$key}) {
1230 |             my $handler = $CLASS_TYPE_HANDLERS{$key};
1231 |             push @{$data_from_handlers{$key}}, $handler->($backup, $obj);
1232 | 
1233 |         } else {
1234 |             # class/type not handled
1235 |         }
1236 |     }
1237 |     # Handling the firewall rules separately to maintain their order
1238 |     my @rules = @{$backup->{main}->{packetfilter}->{rules}};
1239 |     my $idx = -1;
1240 |     for my $i (0 .. $#rules){
1241 |         my $obj = $backup->{objects}->{$rules[$i]};
1242 |         my $key = $obj->{class} . '/' . $obj->{type};
1243 |         my $template_name = $CLASS_TYPE_TO_TEMPLATE{$key};
1244 | 
1245 |         if ($template_name) {
1246 |             next if defined $requested_template and $template_name ne $requested_template;
1247 |             my $handler = $TEMPLATE_METADATA{$template_name}->{handler};
1248 |             my ($template_data, $extra_data) = $handler->($backup, $obj);
1249 |             if ($template_data) {
1250 |                 push @{ $entities{$template_name} }, @{ make_entities $template_name, $template_data };
1251 |             }
1252 |         }
1253 |     }
1254 | 
1255 |     # create entities for templates that are not built from confd objects
1256 |     my @rest = grep {
1257 |         not exists $TEMPLATE_METADATA{$_}->{class_types}
1258 |         or scalar @{ $TEMPLATE_METADATA{$_}->{class_types} } == 0
1259 |     } keys %TEMPLATE_METADATA;
1260 | 
1261 |     if ($requested_template) {
1262 |         @rest = grep { $_ eq $requested_template } @rest;
1263 |     }
1264 | 
1265 |     for my $template_name (@rest) {
1266 |         my $metadata = $TEMPLATE_METADATA{$template_name};
1267 |         my ($template_data, $extra_data);
1268 |         if (defined $metadata->{handler}) {
1269 |             ($template_data, $extra_data) = $metadata->{handler}->($backup);
1270 |         }
1271 |         push @{ $entities{$template_name} }, @{ make_entities $template_name, $template_data };
1272 |         if ($extra_data) {
1273 |             while (my ($filename, $content) = each %$extra_data) {
1274 |                 $extra{$template_name}->{$filename} = $content;
1275 |             }
1276 |         }
1277 |     }
1278 | 
1279 |     while (my ($template_name, $metadata) = each %POST_HANDLERS) {
1280 |         # TODO DRY - same logic as for processing backup objects
1281 |         next if defined $requested_template and $template_name ne $requested_template;
1282 |         my @params = map { $data_from_handlers{$_} } @{ $metadata->{class_types} };
1283 |         my ($template_data, $extra_data) = $metadata->{handler}->(@params);
1284 |         push @{ $entities{$template_name} }, @{ make_entities $template_name, $template_data };
1285 |         if ($extra_data) {
1286 |             while (my ($filename, $content) = each %$extra_data) {
1287 |                 $extra{$template_name}->{$filename} = $content;
1288 |             }
1289 |         }
1290 |     };
1291 | 
1292 |     return \%entities, \%extra;
1293 | }
1294 | 
1295 | sub summary {
1296 |     my ($entities, $extra_data) = @_;
1297 | 
1298 |     for my $k (sort keys %$entities) {
1299 |         my $count_entities = scalar @{ $entities->{$k} };
1300 |         my $count_extra_data = 0;
1301 |          if (defined $extra_data->{$k}) {
1302 |             $count_extra_data = scalar keys %{ $extra_data->{$k} };
1303 |         }
1304 |         my $summary = "summary for $k: $count_entities entities";
1305 |         $summary .= ", $count_extra_data extra" if $count_extra_data > 0;
1306 |         say STDERR $summary;
1307 |     }
1308 |     return;
1309 | }
1310 | 
1311 | sub get_xml_from_entities {
1312 |     my ($entities) = @_;
1313 |     my $xml =
1314 |         join "\n",
1315 |         map { join "\n", @{ $entities->{$_} } }
1316 |         grep { @{ $entities->{$_} } }
1317 |         grep { exists $entities->{$_} }
1318 |         @ORDER;
1319 |     return $xml;
1320 | }
1321 | 
1322 | sub make_export_tar {
1323 |     my ($entities, $extra_data) = @_;
1324 |     my $tar = Archive::Tar->new;
1325 |     my $xml = encode("utf-8", get_xml_from_entities ($entities));
1326 |     $tar->add_data('Entities.xml', $xml);
1327 | 
1328 |     for my $template (keys %$extra_data) {
1329 |         my $metadata = $TEMPLATE_METADATA{$template};
1330 |         my $path = $metadata->{extra_data_path};
1331 | 
1332 |         while (my ($filename, $content) = each %{ $extra_data->{$template} } ) {
1333 |             $tar->add_data($path . $filename, $content);
1334 |         }
1335 |     }
1336 |     return $tar;
1337 | }
1338 | 
1339 | sub parse_command_line_args {
1340 |     my $backup_path;
1341 |     my $template_name;
1342 |     my $output_file = 'Export.tar';
1343 |     my %opt;
1344 | 
1345 |     getopts('Flhdi:o:s:', \%opt);
1346 |     usage() if $opt{h};
1347 |     usage() if (defined $opt{i} && ($opt{i} eq '' || ! -f $opt{i}));
1348 |     usage() if (defined $opt{o} && $opt{o} eq '');
1349 |     usage() if (defined $opt{s} && $opt{s} eq '');
1350 |     $template_name = $opt{s} if (defined $opt{s});
1351 |     $output_file = $opt{o} if (defined $opt{o});
1352 |     $backup_path = $opt{i} if (defined $opt{i});
1353 |     $DEBUG = 1 if $opt{d};
1354 |     $LOG_FIREWALL = 0 if (defined $opt{l});
1355 |     $MIGRATE_FIREWALL_RULES = 0 if (defined $opt{F});
1356 | 
1357 |     return ($template_name, $output_file, $backup_path);
1358 | }
1359 | 
1360 | sub main {
1361 |     my ($template_name, $output_file, $backup_path) = parse_command_line_args();
1362 |     if (not $backup_path) {
1363 |         # Generate current snapshot
1364 |         my $snapshot_name = `$CONFD snapshot_create`;
1365 |         $snapshot_name =~ s/\s+$//;
1366 |         $backup_path = "$SNAPSHOT_DIR$snapshot_name";
1367 |     }
1368 | 
1369 |     say STDERR "Using confd snapshot $backup_path";
1370 |     my $backup = read_backup $backup_path;
1371 |     say STDERR 'confd objects in backup: ', scalar keys %{ $backup->{objects} } if $DEBUG;
1372 | 
1373 |     say STDERR "will only output template $template_name" if $template_name;
1374 |     my ($entities, $extra_data) = parse_backup $backup, $template_name;
1375 |     summary($entities, $extra_data);
1376 | 
1377 |     if (defined $template_name) {
1378 |         # Dry run / testing single template output. Print to STDOUT
1379 |         binmode STDOUT, ':encoding(utf8)';
1380 |         local $|=1;
1381 |         for my $entity (@{ $entities->{$template_name} }) {
1382 |             say $entity;
1383 | 
1384 |         }
1385 |     } else {
1386 |         # Full run. Print to $output_file
1387 |         say STDERR "Exporting objects from $backup_path to $output_file";
1388 |         my $tar = make_export_tar $entities, $extra_data, $output_file;
1389 |         $tar->write($output_file);
1390 |         say STDERR "Export complete";
1391 |     }
1392 |     return;
1393 | }
1394 | 
1395 | __PACKAGE__->main(@ARGV) unless caller();
1396 | 


--------------------------------------------------------------------------------