/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to network-hooks.d/openvpn

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 08:41:14 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 372.
  • Revision ID: teddy@recompile.se-20190210084114-u91mijrxtifvzra5
Bug fix: Only create TLS key with certtool, and read correct key file

* debian/mandos-client.postinst (create_keys): Remove any bad keys
                                               created by 1.8.0-1.
                                               Only create TLS keys if
                                               certtool succeeds.
* debian/mandos.postinst (configure): Remove any bad keys from
                                      clients.conf, and inform the
                                      user if any were found.
* debian/mandos.templates (mandos/removed_bad_key_ids): New message.
* mandos (MandosServer.handle_ipc): Do not trust a key_id with a known
                                    bad key ID.
* mandos-keygen (keygen): Only create TLS keys if certtool succeeds.
  (password): Bug fix: Generate key_id correctly, and only output
              key_id if TLS key exists.

Show diffs side-by-side

added added

removed removed

Lines of Context:
network-hooks.d/openvpn
6
6
# configuration file(s) should be copied into the
7
7
# /etc/mandos/network-hooks.d directory.
8
8
# 
9
 
# Copyright © 2012 Teddy Hogeborn
10
 
# Copyright © 2012 Björn Påhlsson
 
9
# Copyright © 2012-2018 Teddy Hogeborn
 
10
# Copyright © 2012-2018 Björn Påhlsson
11
11
# 
12
12
# Copying and distribution of this file, with or without modification,
13
13
# are permitted in any medium without royalty provided the copyright
31
31
fi
32
32
 
33
33
# Exit if DEVICE is set and it doesn't match the VPN interface
34
 
if [ -n "$DEVICE" -a "$DEVICE" = "${DEVICE#$VPNDEVICE}" ]; then
35
 
    exit
 
34
if [ -n "$DEVICE" ]; then
 
35
    case "$DEVICE" in
 
36
        *,"$VPNDEVICE"*|"$VPNDEVICE"*) :;;
 
37
        *) exit;;
 
38
    esac
36
39
fi
37
40
 
38
41
openvpn=/usr/sbin/openvpn
39
42
 
40
 
case "$1" in
41
 
    start)
42
 
        "$openvpn" --cd "$MANDOSNETHOOKDIR" \
43
 
            --daemon 'openvpn(Mandos)' --writepid "$PIDFILE" \
44
 
            --config "$CONFIG"
45
 
        sleep "$DELAY"
46
 
        ;;
47
 
    stop)
48
 
        PID="`cat \"$PIDFILE\"`"
49
 
        if [ "$PID" -gt 0 ]; then
50
 
            kill "$PID"
51
 
        fi
 
43
do_start(){
 
44
    "$openvpn" --cd "$MANDOSNETHOOKDIR" --daemon 'openvpn(Mandos)' \
 
45
        --writepid "$PIDFILE" --config "$CONFIG"
 
46
     sleep "$DELAY"
 
47
}
 
48
 
 
49
do_stop(){
 
50
    PID="`cat \"$PIDFILE\"`"
 
51
    if [ "$PID" -gt 0 ]; then
 
52
        kill "$PID"
 
53
    fi
 
54
}
 
55
 
 
56
case "${MODE:-$1}" in
 
57
    start|stop)
 
58
        do_"${MODE:-$1}"
52
59
        ;;
53
60
    files)
54
61
        echo "$openvpn"