denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

starter: Only create self-signed certificate if scepclient is built.

Browse Source
This commit is contained in:
Tobias Brunner
2011-10-12 16:37:21 +02:00
parent e9f23d6264
commit aa82ae3aa4
2 changed files with 49 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/Makefile.am
+4
View File
@@ -46,6 +46,10 @@ if USE_LOAD_WARNING
AM_CFLAGS += -DLOAD_WARNING AM_CFLAGS += -DLOAD_WARNING
endif endif
if USE_TOOLS
AM_CFLAGS += -DGENERATE_SELFCERT
endif
keywords.c: $(srcdir)/keywords.txt $(srcdir)/keywords.h keywords.c: $(srcdir)/keywords.txt $(srcdir)/keywords.h
$(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@ $(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@
src/starter/starter.c
+45 -41
View File
@@ -161,61 +161,63 @@ static void fsig(int signal)
} }
} }
#ifdef GENERATE_SELFCERT
static void generate_selfcert() static void generate_selfcert()
{ {
struct stat stb; struct stat stb;
/* if ipsec.secrets file is missing then generate RSA default key pair */ /* if ipsec.secrets file is missing then generate RSA default key pair */
if (stat(SECRETS_FILE, &stb) != 0) if (stat(SECRETS_FILE, &stb) != 0)
{ {
mode_t oldmask; mode_t oldmask;
FILE *f; FILE *f;
uid_t uid = 0; uid_t uid = 0;
gid_t gid = 0; gid_t gid = 0;
#ifdef IPSEC_GROUP #ifdef IPSEC_GROUP
{ {
char buf[1024]; char buf[1024];
struct group group, *grp; struct group group, *grp;
if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 && grp) if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 && grp)
{ {
gid = grp->gr_gid; gid = grp->gr_gid;
}
} }
}
#endif #endif
#ifdef IPSEC_USER #ifdef IPSEC_USER
{
char buf[1024];
struct passwd passwd, *pwp;
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 && pwp)
{ {
char buf[1024]; uid = pwp->pw_uid;
struct passwd passwd, *pwp;
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 && pwp)
{
uid = pwp->pw_uid;
}
} }
#endif
setegid(gid);
seteuid(uid);
ignore_result(system("ipsec scepclient --out pkcs1 --out cert-self --quiet"));
seteuid(0);
setegid(0);
/* ipsec.secrets is root readable only */
oldmask = umask(0066);
f = fopen(SECRETS_FILE, "w");
if (f)
{
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
fprintf(f, "\n");
fprintf(f, ": RSA myKey.der\n");
fclose(f);
}
ignore_result(chown(SECRETS_FILE, uid, gid));
umask(oldmask);
} }
#endif
setegid(gid);
seteuid(uid);
ignore_result(system("ipsec scepclient --out pkcs1 --out cert-self --quiet"));
seteuid(0);
setegid(0);
/* ipsec.secrets is root readable only */
oldmask = umask(0066);
f = fopen(SECRETS_FILE, "w");
if (f)
{
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
fprintf(f, "\n");
fprintf(f, ": RSA myKey.der\n");
fclose(f);
}
ignore_result(chown(SECRETS_FILE, uid, gid));
umask(oldmask);
}
} }
#endif /* GENERATE_SELFCERT */
static bool check_pid(char *pid_file) static bool check_pid(char *pid_file)
{ {
@@ -414,7 +416,9 @@ int main (int argc, char **argv)
exit(LSB_RC_SUCCESS); exit(LSB_RC_SUCCESS);
} }
#ifdef GENERATE_SELFCERT
generate_selfcert(); generate_selfcert();
#endif
/* fork if we're not debugging stuff */ /* fork if we're not debugging stuff */
if (!no_fork) if (!no_fork)