← Back to branch summary

~ubuntu-branches/ubuntu/hardy/openswan/hardy-updates

« back to all changes in this revision

Viewing changes to debian/freeswan.postinst

  • Committer: Bazaar Package Importer
  • Author(s): Rene Mayrhofer
  • Date: 2005-01-27 16:10:11 UTC
  • mfrom: (1.1.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20050127161011-idgybmyz3vwhpfiq
Tags: 2.3.0-2
http://bugs.debian.org/292458
http://bugs.debian.org/291143
Urgency HIGH due to security issue and problems with build-deps in sarge.
* Fix the security issue. Please see
  http://www.idefense.com/application/poi/display?id=190&
      type=vulnerabilities&flashstatus=false
  for more details. Thanks to Martin Schulze for informing me about
  this issue.
  Closes: #292458: Openswan XAUTH/PAM Buffer Overflow Vulnerability
* Added a Build-Dependency to lynx.
  Closes: #291143: openswan: FTBFS: Missing build dependency.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/freeswan.postinst
1
 
#! /bin/bash
2
 
# postinst script for freeswan
3
 
#
4
 
# see: dh_installdeb(1)
5
 
 
6
 
set -e
7
 
 
8
 
# summary of how this script can be called:
9
 
#        * <postinst> `configure' <most-recently-configured-version>
10
 
#        * <old-postinst> `abort-upgrade' <new version>
11
 
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
12
 
#          <new-version>
13
 
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
14
 
#          <failed-install-package> <version> `removing'
15
 
#          <conflicting-package> <version>
16
 
# for details, see /usr/share/doc/packaging-manual/
17
 
#
18
 
# quoting from the policy:
19
 
#     Any necessary prompting should almost always be confined to the
20
 
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
21
 
#          <failed-install-package> <version> `removing'
22
 
#          <conflicting-package> <version>
23
 
# for details, see /usr/share/doc/packaging-manual/
24
 
#
25
 
# quoting from the policy:
26
 
#     Any necessary prompting should almost always be confined to the
27
 
#     post-installation script, and should be protected with a conditional
28
 
#     so that unnecessary prompting doesn't happen if a package's
29
 
#     installation fails and the `postinst' is called with `abort-upgrade',
30
 
#     `abort-remove' or `abort-deconfigure'.
31
 
 
32
 
check_private() {
33
 
        if grep -A 2 "$IPSEC_SECRETS_PATTERN_1" /etc/ipsec.secrets |
34
 
          tail --lines=2 |
35
 
          grep -A 1 "$IPSEC_SECRETS_PATTERN_2" |
36
 
          tail --lines=1 |
37
 
          grep "$IPSEC_SECRETS_PATTERN_3" >/dev/null; then
38
 
                cp /etc/ipsec.secrets /etc/ipsec.secrets.orig
39
 
                return 0
40
 
        else
41
 
            echo "/etc/ipsec.secrets already contains a RSA secret key."
42
 
            echo "Not creating a new key. If you want it to be created,"
43
 
            echo "restore /etc/ipsec.secrets to distributed state first."
44
 
            return 1
45
 
        fi
46
 
}
47
 
 
48
 
insert_private_key() {
49
 
        umask 077 ; (
50
 
                sed "/$IPSEC_SECRETS_PATTERN_1/,\$d" /etc/ipsec.secrets
51
 
                echo "$1" ; \
52
 
                sed "1,/$IPSEC_SECRETS_PATTERN_3/d" /etc/ipsec.secrets
53
 
        ) > /etc/ipsec.secrets.tmp
54
 
        mv /etc/ipsec.secrets.tmp /etc/ipsec.secrets
55
 
}
56
 
 
57
 
insert_private_key_filename() {
58
 
        umask 077 ; (
59
 
                sed "/$IPSEC_SECRETS_PATTERN_1/,\$d" /etc/ipsec.secrets
60
 
                echo ": RSA $1"
61
 
                sed "1,/$IPSEC_SECRETS_PATTERN_3/d" /etc/ipsec.secrets
62
 
        ) > /etc/ipsec.secrets.tmp
63
 
        mv /etc/ipsec.secrets.tmp /etc/ipsec.secrets
64
 
}
65
 
 
66
 
. /usr/share/debconf/confmodule
67
 
 
68
 
IPSEC_SECRETS_PATTERN_1=': RSA  {'
69
 
IPSEC_SECRETS_PATTERN_2='\-\- not filled in because ipsec.secrets existed at build time \-\-'
70
 
IPSEC_SECRETS_PATTERN_3='       }'
71
 
 
72
 
case "$1" in
73
 
    configure)
74
 
        if [ ! -e /dev/.devfsd ]; then
75
 
            db_get freeswan/makedev
76
 
            if [ "$RET" = "true" ]; then
77
 
                (cd /dev && MAKEDEV ipsec)
78
 
            fi
79
 
        fi
80
 
 
81
 
        # does the user wish frees/wan to restart?
82
 
        db_get freeswan/restart
83
 
        if [ "$RET" = "true" ]; then
84
 
            /etc/init.d/ipsec restart || true # sure, we'll restart it for you
85
 
        fi
86
 
 
87
 
        db_get freeswan/create_rsa_key
88
 
        if [ "$RET" = "true" ]; then
89
 
            # OK, ipsec.secrets is still untouched
90
 
            db_get freeswan/rsa_key_type
91
 
            if [ "$RET" = "plain" ]; then
92
 
                # a RSA keypair should be created - check if there is one already
93
 
                if check_private; then
94
 
                    # create a plain freeswan keypair
95
 
                    db_get freeswan/rsa_key_length
96
 
                    umask 077
97
 
                    keylength=$RET
98
 
                    privkey=`mktemp /tmp/ipsec-postinst.XXXXXX`
99
 
                    /usr/lib/ipsec/rsasigkey $keylength > $privkey
100
 
                    insert_private_key $privkey
101
 
                    rm $privkey
102
 
                    echo "Successfully created a plain freeswan RSA keypair."
103
 
                fi
104
 
            else
105
 
                host=`hostname`
106
 
                newkeyfile="/etc/ipsec.d/private/${host}Key.pem"
107
 
                        newcertfile="/etc/ipsec.d/${host}Cert.pem"
108
 
                    # extract the key from a x509 certificate
109
 
                    db_get freeswan/existing_x509_certificate
110
 
                    if [ "$RET" = "true" ]; then
111
 
                        if check_private; then
112
 
                                # existing certificate - use it
113
 
                                db_get freeswan/existing_x509_certificate_filename
114
 
                                certfile=$RET
115
 
                                db_get freeswan/existing_x509_key_filename
116
 
                                keyfile=$RET
117
 
                                if [ ! -r $certfile ] || [ ! -r $keyfile ]; then
118
 
                                    echo "Either the certificate or the key file could not be read !"
119
 
                                else
120
 
                                        openssl x509 -in "$certfile" -outform DER -out /etc/x509cert.der
121
 
                                        umask 077
122
 
                                        cp "$keyfile" "$newkeyfile"
123
 
                                        chmod 0600 "$newkeyfile"
124
 
                                        insert_private_key_filename "$newkeyfile"
125
 
                                        echo "Successfully extracted RSA key from existing x509 certificate."
126
 
                                fi
127
 
                        fi
128
 
                    else
129
 
                        if check_private; then
130
 
                                # create a new certificate
131
 
                                db_get freeswan/rsa_key_length
132
 
                                keylength=$RET
133
 
                                db_get freeswan/x509_self_signed
134
 
                                selfsigned=$RET
135
 
                                db_get freeswan/x509_country_code
136
 
                                countrycode=$RET
137
 
                                db_get freeswan/x509_state_name
138
 
                                statename=$RET
139
 
                                db_get freeswan/x509_locality_name
140
 
                                localityname=$RET
141
 
                                db_get freeswan/x509_organization_name
142
 
                                orgname=$RET
143
 
                                db_get freeswan/x509_organizational_unit
144
 
                                orgunit=$RET
145
 
                                db_get freeswan/x509_common_name
146
 
                                commonname=$RET
147
 
                                db_get freeswan/x509_email_address
148
 
                                email=$RET
149
 
                                /usr/lib/ipsec/mkx509cert $keylength 1500 "$newkeyfile" "$newcertfile" "$selfsigned" "$countrycode" "$statename" "$localityname" "$orgname" "$orgunit" "$commonname" "$email"
150
 
                                if [ "$selfsigned" = "true" ]; then
151
 
                                  openssl x509 -in "$newcertfile" -outform DER -out /etc/x509cert.der
152
 
                                fi
153
 
                                chmod 0600 "$newkeyfile"
154
 
                                umask 077
155
 
                                insert_private_key_filename "$newkeyfile"
156
 
                                echo "Successfully created x509 certificate."
157
 
                        fi
158
 
                    fi
159
 
                fi
160
 
        fi
161
 
 
162
 
        update-rc.d ipsec defaults 15 >/dev/null
163
 
        if [ -z "$2" ]; then
164
 
            # no old configured version - start freeswan now
165
 
            /etc/init.d/ipsec start || true
166
 
        fi
167
 
 
168
 
        db_stop
169
 
 
170
 
    ;;
171
 
 
172
 
    abort-upgrade|abort-remove|abort-deconfigure)
173
 
 
174
 
    ;;
175
 
 
176
 
    *)
177
 
        echo "postinst called with unknown argument '$1'" >&2
178
 
        exit 0
179
 
    ;;
180
 
esac
181
 
 
182
 
# dh_installdeb will replace this with shell code automatically
183
 
# generated by other debhelper scripts.
184
 
#DEBHELPER#
185
 
 
186
 
exit 0