Index: base/ca/shared/conf/CS.cfg
===================================================================
--- base/ca/shared/conf/CS.cfg	(revision 2539)
+++ base/ca/shared/conf/CS.cfg	(working copy)
@@ -17,7 +17,7 @@
 installDate=[INSTALL_TIME]
 preop.wizard.name=CA Setup Wizard
 preop.product.name=CS
-preop.product.version=
+cms.product.version=
 preop.system.name=CA
 preop.system.fullname=Certificate Authority
 cs.state._000=##
Index: base/migrate/80To81/common.pm
===================================================================
--- base/migrate/80To81/common.pm	(revision 2539)
+++ base/migrate/80To81/common.pm	(working copy)
@@ -3,6 +3,8 @@
 use warnings;
 
 use Exporter;
+use XML::LibXML;
+
 our @ISA = qw(Exporter);
 our @EXPORT = qw(
  $verbose $dry_run $overwrite
@@ -22,6 +24,7 @@
  perform_file_actions check_for_customizations
  perform_cs_actions list_values_equal
  find_directory_changes
+ get_release_number
  );
 
 use File::Find;
@@ -65,6 +68,10 @@
 my $SECURITY_LIBRARIES     = "SECURITY_LIBRARIES";
 my $SERVER_NAME            = "SERVER_NAME";
 my $SERVER_ROOT            = "SERVER_ROOT";
+my $PKI_AGENT_MACHINE_NAME = "PKI_AGENT_MACHINE_NAME";
+my $PKI_EE_MACHINE_NAME    = "PKI_EE_MACHINE_NAME";
+my $PKI_EE_CLIENT_AUTH_MACHINE_NAME = "PKI_EE_CLIENT_AUTH_MACHINE_NAME";
+my $PKI_ADMIN_MACHINE_NAME = "PKI_ADMIN_MACHINE_NAME";
 my $SUBSYSTEM_TYPE         = "SUBSYSTEM_TYPE";
 my $SYSTEM_LIBRARIES       = "SYSTEM_LIBRARIES";
 my $SYSTEM_USER_LIBRARIES  = "SYSTEM_USER_LIBRARIES";
@@ -419,6 +426,77 @@
     return $valid;
 }
 
+##############################################################
+# Version subroutines
+##############################################################
+# for version 8.1.3 for example
+# this returns 3
+sub get_release_number
+{
+    my ($cfg) = @_;
+    if (defined $cfg->{'cms.product.version'}) {
+        my $product_version = $cfg->{'cms.product.version'};
+        my ($a, $b, $c) = ($product_version =~ /(.*)\.(.*)\.(.*)/);
+        return $c;
+    }
+    return 0;
+}
+
+###############################################################
+# XML processing subroutines
+###############################################################
+
+# remove a node
+#
+# arg0 doc node
+# arg1 string with xpath of node to be removed
+# Return None
+sub remove_node
+{
+    my ($doc, $q) = @_;
+    my $nodes = $doc->findnodes($q);
+    if (defined $nodes and $nodes->size()>0) {
+        foreach my $node ($nodes->get_nodelist) {
+            my $parent = $node->parentNode;
+            $parent->removeChild($node);
+        }
+    }
+}
+
+# add a node
+#
+# arg0 doc node
+# arg1 parser
+# arg2 string with xpath of node to be added
+# arg3 string with xpath of parent node
+# arg4 string with xml data for the node to be added
+# Return None
+sub add_node
+{
+    my ($doc, $parser, $q, $parent_q, $xmldata) = @_;
+    my $nodes = $doc->findnodes($q);
+    if (!defined $nodes or $nodes->size() == 0) {
+        my $node = $parser->parse_balanced_chunk($xmldata);
+        foreach my $parent ($doc->findnodes($parent_q)) {
+            $parent->appendChild($node);
+        }
+    }
+}
+
+# change text in a node
+#
+# arg0 doc node
+# arg1 string with xpath of node to be modified
+# arg2 string with text to be inserted
+# Return None
+sub update_node_text
+{
+    my ($doc, $q, $text) = @_;
+    foreach my $node ($doc->findnodes($q)) {
+        $node->setData($text);
+    }
+}
+
 ################################################################
 # Template Subroutines
 ###############################################################
@@ -529,6 +607,25 @@
     my $admin_secure_port = $cfg->{'pkicreate.admin_secure_port'};
     my $tomcat_server_port = $cfg->{'pkicreate.tomcat_server_port'};
 
+    #hosts
+    my $agentMachineName = $host;
+    if (exists $cfg->{'agentMachineName'} and defined $cfg->{'agentMachineName'}) {
+        $agentMachineName=$cfg->{'agentMachineName'};
+    }
+
+    my $eeMachineName = $host;
+    if (exists $cfg->{'eeMachineName'} and defined $cfg->{'eeMachineName'}) {
+        $agentMachineName=$cfg->{'eeMachineName'};
+    }
+    my $eecaMachineName = $host;
+    if (exists $cfg->{'eecaMachineName'} and defined $cfg->{'eecaMachineName'}) {
+        $agentMachineName=$cfg->{'eecaMachineName'};
+    }
+    my $adminMachineName = $host;
+    if (exists $cfg->{'adminMachineName'} and defined $cfg->{'adminMachineName'}) {
+        $agentMachineName=$cfg->{'adminMachineName'};
+    }
+
     #paths
     my $pki_instance_path = "$pki_instance_root/$pki_instance_name";
     my $pki_instance_conf_path = "$pki_instance_path/conf";
@@ -607,6 +704,11 @@
         $slot_hash{$NON_CLIENTAUTH_SECURE_PORT} = $non_clientauth_secure_port;
         $slot_hash{$SECURITY_LIBRARIES}    = $default_security_libraries;
         $slot_hash{$SERVER_NAME}           = $host;
+        $slot_hash{$PKI_AGENT_MACHINE_NAME} = $agentMachineName;
+        $slot_hash{$PKI_EE_MACHINE_NAME}    = $eeMachineName;
+        $slot_hash{$PKI_EE_CLIENT_AUTH_MACHINE_NAME} = $eecaMachineName;
+        $slot_hash{$PKI_ADMIN_MACHINE_NAME} = $adminMachineName;
+
         $slot_hash{$SERVER_ROOT}           = $pki_instance_path;
         $slot_hash{$SUBSYSTEM_TYPE}        = $subsystem_type;
         $slot_hash{$SYSTEM_LIBRARIES}      = $default_system_libraries;
Index: base/migrate/80To81/upgrade_config.pl
===================================================================
--- base/migrate/80To81/upgrade_config.pl	(revision 2539)
+++ base/migrate/80To81/upgrade_config.pl	(working copy)
@@ -29,8 +29,8 @@
 
 
 ##############################################################
-# This script is upgrade the UI files for a given PKI subsystem
-# instance from one version of the UI rpm to a later version.
+# This script is upgrade the config files for a given PKI subsystem
+# instance from one version of the config rpm to a later version.
 #
 # Sample Invocation (for CA):
 #
@@ -70,6 +70,46 @@
 
 my $pki_subsystem_common_area = "/usr/share/pki";
 
+my $updateDomainServletData =
+"<servlet>
+     <servlet-name>  caUpdateDomainXML-admin  </servlet-name>
+     <servlet-class> com.netscape.cms.servlet.csadmin.UpdateDomainXML  </servlet-class>
+     <init-param>
+         <param-name>  GetClientCert  </param-name>
+         <param-value> true       </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  authority   </param-name>
+         <param-value> ca          </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  ID          </param-name>
+         <param-value> caUpdateDomainXML </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  interface   </param-name>
+         <param-value> agent          </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  AuthMgr     </param-name>
+         <param-value> certUserDBAuthMgr </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  AuthzMgr    </param-name>
+         <param-value> BasicAclAuthz </param-value>
+     </init-param>
+     <init-param>
+         <param-name>  resourceID  </param-name>
+         <param-value> certServer.securitydomain.domainxml </param-value>
+     </init-param>
+ </servlet>";
+
+my $updateDomainMappingData =
+"<servlet-mapping>
+     <servlet-name>  caUpdateDomainXML-admin </servlet-name>
+     <url-pattern>   /admin/ca/updateDomainXML  </url-pattern>
+ </servlet-mapping>";
+
 ##############################################################
 # Local Data Structures
 ##############################################################
@@ -379,6 +419,9 @@
     # in any case)
     if (($subsystem_type eq $CA) || ($subsystem_type eq $KRA) || ($subsystem_type eq $OCSP) ||
         ($subsystem_type eq $TKS)) {
+        if ($cs_cfg->{'cms.version'} >= 8.1) {
+            return 1;
+        }
         my $listname = lc($subsystem_type) . ".cert.list";
         my $certlist = $changes_ref->{$listname}{new_s};
         foreach my $tag (split(",", $certlist)) {
@@ -423,7 +466,104 @@
     return 1;
 }
 
+# arg0 web_xml - path to web.xml file
+# arg1 subsystem_type - subsystem type
+# This is required for update from 8.1 to 8.1.errata
+sub modify_web_xml
+{
+    my ($web_xml, $subsystem_type) = @_;
+    my $parser = XML::LibXML->new();
+    my $doc    = $parser->parse_file($web_xml);
+    my $top_path = "/web-app";
 
+    if ($subsystem_type eq $CA) {
+        # change caUpdateNumberRange
+        my $q = "//servlet[normalize-space(servlet-name) = 'caUpdateNumberRange']";
+        foreach my $servlet ($doc->findnodes($q)) {
+            my $q1 = "./init-param[normalize-space(param-name)='interface']" .
+                     "/param-value/text()";
+            &update_node_text($servlet, $q1, 'admin');
+        }
+
+        #modify servlet mapping for caUpdateNumberRange
+        $q = "//servlet-mapping[normalize-space(servlet-name) = " .
+             "'caUpdateNumberRange']/url-pattern/text()";
+        &update_node_text($doc, $q, '/admin/ca/updateNumberRange');
+
+        # remove getTokenInfo
+        $q = "//servlet[normalize-space(servlet-name) = 'caGetTokenInfo']";
+        &remove_node($doc, $q);
+
+        # remove getTokenInfo servlet mapping
+        $q = "//servlet-mapping[normalize-space(servlet-name) = 'caGetTokenInfo']";
+        &remove_node($doc, $q);
+
+        #add caUpdateDomainXML-admin
+        $q = "//servlet[normalize-space(servlet-name) = 'caUpdateDomainXML-admin']";
+        &add_node($doc, $parser, $q, $top_path, $updateDomainServletData);
+
+        #add caUpdateDomainXML-admin servlet mapping
+        $q = "//servlet-mapping[normalize-space(servlet-name) = " .
+             "'caUpdateDomainXML-admin']";
+        &add_node($doc,$parser, $q, $top_path, $updateDomainMappingData);
+    } elsif ($subsystem_type eq $KRA) {
+        # change kraUpdateNumberRange
+        my $q = "//servlet[normalize-space(servlet-name) = 'kraUpdateNumberRange']";
+        foreach my $servlet ($doc->findnodes($q)) {
+            my $q1 = "./init-param[normalize-space(param-name)='interface']" .
+                     "/param-value/text()";
+            &update_node_text($servlet, $q1, 'admin');
+        }
+
+        #modify servlet mapping for kraUpdateNumberRange
+        $q = "//servlet-mapping[normalize-space(servlet-name) = " .
+             "'kraUpdateNumberRange']/url-pattern/text()";
+        &update_node_text($doc, $q, '/admin/kra/updateNumberRange');
+
+        # remove getTokenInfo
+        $q = "//servlet[normalize-space(servlet-name) = 'kraGetTokenInfo']";
+        &remove_node($doc, $q);
+
+        # remove getTokenInfo servlet mapping
+        $q = "//servlet-mapping[normalize-space(servlet-name) = 'kraGetTokenInfo']";
+        &remove_node($doc, $q);
+    } elsif ($subsystem_type eq $OCSP) {
+        # remove getTokenInfo
+        my $q = "//servlet[normalize-space(servlet-name) = 'ocspGetTokenInfo']";
+        &remove_node($doc, $q);
+
+        # remove getTokenInfo servlet mapping
+        $q = "//servlet-mapping[normalize-space(servlet-name) = 'ocspGetTokenInfo']";
+        &remove_node($doc, $q);
+    } elsif ($subsystem_type eq $TKS) {
+        # remove getTokenInfo
+        my $q = "//servlet[normalize-space(servlet-name) = 'tksGetTokenInfo']";
+        &remove_node($doc, $q);
+
+        # remove getTokenInfo servlet mapping
+        $q = "//servlet-mapping[normalize-space(servlet-name) = 'tksGetTokenInfo']";
+        &remove_node($doc, $q);
+    }
+
+    if (!$dry_run) {
+        my $backup_fname = "$web_xml.backup_$$";
+        emit("Backing up $web_xml to $backup_fname");
+        copy_file($web_xml, $backup_fname, $default_file_permissions, $pki_user, $pki_group);
+
+        if (! open(INST, ">", $web_xml)) {
+            emit("can not open $web_xml for writing", "error");
+            return 0;
+        }
+
+        emit("Writing new $web_xml");
+        print INST $doc->toString;
+        close(INST);
+    }
+
+    return 1;
+}
+
+
 ##############################################################
 # Main Program
 ##############################################################
@@ -460,6 +600,8 @@
     my %cs_cfg = ();
     exit 255 if !read_cfg("$pki_instance_path/conf/CS.cfg", \%cs_cfg);
 
+    my $release_number = get_release_number(\%cs_cfg);
+
     ##################################
     # General File Processing
     ##################################
@@ -510,6 +652,7 @@
     exit 255 if !populate_hash_values("$new_subs_dir/conf/CS.cfg", 0, "new_s", 
                                       \%cs_cfg_changes_hash);
     exit 255 if !add_new_config_values(\%cs_cfg, \%cs_cfg_changes_hash);
+
     exit 255 if !check_for_customizations(\%cs_cfg_changes_hash, \%cfg_actions, 0, \@ignore);
     exit 255 if !perform_cs_actions($inst_cs_cfg, \%cs_cfg_changes_hash, \%cfg_actions);
 
@@ -580,8 +723,19 @@
             $default_exe_permissions);
     }
 
-   set_permissions("/etc/init.d/${pki_instance_name}", $default_exe_permissions);
+    set_permissions("/etc/init.d/${pki_instance_name}", $default_exe_permissions);
 
+    ########################################
+    # For errata 1, modify the web.xml
+    ########################################
+    if (($release_number == 0 ) && 
+       (($subsystem_type eq $CA) || ($subsystem_type eq $KRA) || ($subsystem_type eq $OCSP) ||
+        ($subsystem_type eq $TKS))) {
+        return 255 if ! modify_web_xml(
+            "/var/lib/${pki_instance_name}/webapps/${subsystem_type}/WEB-INF/web.xml",
+            $subsystem_type);
+    }
+
     ################################
     # Cleanup
     ################################
Index: base/migrate/80To81/81schema.ldif
===================================================================
--- base/migrate/80To81/81schema.ldif	(revision 0)
+++ base/migrate/80To81/81schema.ldif	(revision 0)
@@ -0,0 +1,60 @@
+dn: cn=schema
+changetype: modify
+add: attributeTypes
+attributeTypes: ( AgentHost-oid NAME 'AgentHost' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
+
+dn: cn=schema
+changetype: modify
+add: attributeTypes
+attributeTypes: ( EEHost-oid NAME 'EEHost'  
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
+
+dn: cn=schema
+changetype: modify
+add: attributeTypes
+attributeTypes: ( AdminHost-oid NAME 'AdminHost' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
+
+dn: cn=schema
+changetype: modify
+add: attributeTypes
+attributeTypes: ( EEClientAuthHost-oid NAME 'EEClientAuthHost' 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
+
+dn: cn=schema
+changetype: modify
+delete: objectClasses
+objectClasses: ( pkiSubsystem-oid NAME 'pkiSubsystem' DESC 'CMS defined class' SUP top STRUCTURAL
+ MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) 
+ MAY ( DomainManager $ SecureAgentPort $ SecureAdminPort 
+ $SecureEEClientAuthPort $ UnSecurePort ) X-ORIGIN 'user defined' )
+-
+add: objectClasses
+objectClasses: ( pkiSubsystem-oid NAME 'pkiSubsystem' DESC 'CMS defined class' SUP top STRUCTURAL
+ MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) 
+ MAY ( DomainManager $ SecureAgentPort $ SecureAdminPort $ 
+ SecureEEClientAuthPort $ UnSecurePort $ AgentHost $ EEHost $ 
+ AdminHost $ EEClientAuthHost ) X-ORIGIN 'user defined' ) 
+-
+
+dn: cn=aclResources,{rootSuffix}
+changetype: modify
+delete: resourceACLS
+resourceACLS: certServer.securitydomain.domainxml:read,modify:allow (read) 
+ user="anybody";allow (modify) group="Subsystem Group":Anybody is allowed 
+ to read domain.xml but only Subsystem group is allowed to modify the 
+ domain.xml
+-
+add: resourceACLS
+resourceACLS: certServer.securitydomain.domainxml:read,modify:allow (read) 
+ user="anybody";allow (modify) group="Subsystem Group" || 
+ group="Enterprise CA Administrators" || 
+ group="Enterprise KRA Administrators" || 
+ group="Enterprise RA Administrators" || 
+ group="Enterprise OCSP Administrators" || 
+ group="Enterprise TKS Administrators" || 
+ group="Enterprise TPS Administrators":Anybody is allowed to read domain.xml 
+ but only Subsystem group and Enterprise Administrators are allowed to 
+ modify the domain.xml
+-
Index: base/common/src/com/netscape/cms/servlet/csadmin/WelcomePanel.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/csadmin/WelcomePanel.java	(revision 2539)
+++ base/common/src/com/netscape/cms/servlet/csadmin/WelcomePanel.java	(working copy)
@@ -88,7 +88,7 @@
             context.put("productname",
                     cs.getString("preop.product.name"));
             context.put("productversion",
-                    cs.getString("preop.product.version"));
+                    cs.getString("cms.product.version"));
         } catch (EBaseException e) {}
         context.put("panel", "admin/console/config/welcomepanel.vm");
     }
Index: base/tks/shared/conf/CS.cfg
===================================================================
--- base/tks/shared/conf/CS.cfg	(revision 2539)
+++ base/tks/shared/conf/CS.cfg	(working copy)
@@ -23,7 +23,7 @@
 preop.wizard.name=TKS Setup Wizard
 preop.system.name=TKS
 preop.product.name=CS
-preop.product.version=
+cms.product.version=
 preop.system.fullname=Token Key Service
 tks.cert.list=sslserver,subsystem,audit_signing
 tks.cert.sslserver.certusage=SSLServer
Index: base/ra/doc/CS.cfg
===================================================================
--- base/ra/doc/CS.cfg	(revision 2539)
+++ base/ra/doc/CS.cfg	(working copy)
@@ -189,7 +189,7 @@
 conn.ca1.SSLOn=true
 conn.ca1.keepAlive=true
 preop.pin=[PKI_RANDOM_NUMBER]
-preop.product.version=
+cms.product.version=
 preop.cert._000=#########################################
 preop.cert._001=# Installation configuration "preop" certs parameters
 preop.cert._002=#########################################
Index: base/ra/lib/perl/PKI/RA/wizard.pm
===================================================================
--- base/ra/lib/perl/PKI/RA/wizard.pm	(revision 2539)
+++ base/ra/lib/perl/PKI/RA/wizard.pm	(working copy)
@@ -291,7 +291,7 @@
     }
     $symbol{p}        = $panelnum;
     $symbol{subpanelno}        = $panelnum+1;
-    $symbol{productversion}    =  $::config->get("preop.product.version");
+    $symbol{productversion}    =  $::config->get("cms.product.version");
     $symbol{csstate}        = "1";
 
 #    $symbol{urls}        = [ "cert1", "cert2" ];  #createsubsystem
Index: base/ocsp/shared/conf/CS.cfg
===================================================================
--- base/ocsp/shared/conf/CS.cfg	(revision 2539)
+++ base/ocsp/shared/conf/CS.cfg	(working copy)
@@ -23,7 +23,7 @@
 preop.securitydomain.admin_url=https://[PKI_MACHINE_NAME]:9445
 preop.wizard.name=OCSP Setup Wizard
 preop.product.name=CS
-preop.product.version=
+cms.product.version=
 preop.system.name=OCSP
 preop.system.fullname=OCSP Responder
 preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module
Index: base/tps/doc/CS.cfg
===================================================================
--- base/tps/doc/CS.cfg	(revision 2539)
+++ base/tps/doc/CS.cfg	(working copy)
@@ -369,7 +369,7 @@
 #            * channel.appletMemorySize=5000
 #
 preop.pin=[PKI_RANDOM_NUMBER]
-preop.product.version=
+cms.product.version=
 preop.cert._000=#########################################
 preop.cert._001=# Installation configuration "preop" certs parameters
 preop.cert._002=#########################################
Index: base/tps/lib/perl/PKI/TPS/wizard.pm
===================================================================
--- base/tps/lib/perl/PKI/TPS/wizard.pm	(revision 2539)
+++ base/tps/lib/perl/PKI/TPS/wizard.pm	(working copy)
@@ -296,7 +296,7 @@
     }
     $symbol{p}        = $panelnum;
     $symbol{subpanelno}        = $panelnum+1;
-    $symbol{productversion}    =  $::config->get("preop.product.version");
+    $symbol{productversion}    =  $::config->get("cms.product.version");
     $symbol{csstate}        = "1";
 
 #    $symbol{urls}        = [ "cert1", "cert2" ];  #createsubsystem
Index: base/kra/shared/conf/CS.cfg
===================================================================
--- base/kra/shared/conf/CS.cfg	(revision 2539)
+++ base/kra/shared/conf/CS.cfg	(working copy)
@@ -16,7 +16,7 @@
 installDate=[INSTALL_TIME]
 preop.wizard.name=DRM Setup Wizard
 preop.product.name=CS
-preop.product.version=
+cms.product.version=
 preop.system.name=DRM
 preop.system.fullname=Data Recovery Manager
 cs.state=0
