along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- $Id: net_setup.c,v 1.1.2.38 2003/07/22 21:13:23 guus Exp $
+ $Id: net_setup.c,v 1.1.2.43 2003/08/14 14:21:35 guus Exp $
*/
#include "system.h"
{
FILE *fp;
char *fname, *key;
+ struct stat s;
cp();
if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname))
asprintf(&fname, "%s/rsa_key.priv", confbase);
- if(is_safe_path(fname)) {
- fp = fopen(fname, "r");
+ fp = fopen(fname, "r");
- if(!fp) {
- logger(LOG_ERR, _("Error reading RSA private key file `%s': %s"),
- fname, strerror(errno));
- free(fname);
- return false;
- }
+ if(!fp) {
+ logger(LOG_ERR, _("Error reading RSA private key file `%s': %s"),
+ fname, strerror(errno));
+ free(fname);
+ return false;
+ }
+#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN)
+ if(fstat(fileno(fp), &s)) {
+ logger(LOG_ERR, _("Could not stat RSA private key file `%s': %s'"),
+ fname, strerror(errno));
free(fname);
- myself->connection->rsa_key =
- PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
- fclose(fp);
+ return false;
+ }
- if(!myself->connection->rsa_key) {
- logger(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"),
- fname, strerror(errno));
- return false;
- }
+ if(s.st_mode & ~0100700)
+ logger(LOG_WARNING, _("Warning: insecure file permissions for RSA private key file `%s'!"), fname);
+#endif
- return true;
+ myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
+ fclose(fp);
+
+ if(!myself->connection->rsa_key) {
+ logger(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"),
+ fname, strerror(errno));
+ free(fname);
+ return false;
}
free(fname);
- return false;
+ return true;
}
/*
char *name, *hostname, *mode, *afname, *cipher, *digest;
char *address = NULL;
char *envp[5];
- struct addrinfo hint, *ai, *aip;
+ struct addrinfo *ai, *aip, hint = {0};
bool choice;
int i, err;
keyexpires = now + keylifetime;
- EVP_CIPHER_CTX_init(&packet_ctx);
- EVP_DecryptInit_ex(&packet_ctx, myself->cipher, NULL, myself->key, myself->key + myself->cipher->key_len);
+ if(myself->cipher) {
+ EVP_CIPHER_CTX_init(&packet_ctx);
+ EVP_DecryptInit_ex(&packet_ctx, myself->cipher, NULL, myself->key, myself->key + myself->cipher->key_len);
+ }
/* Check if we want to use message authentication codes... */
/* Open sockets */
- memset(&hint, 0, sizeof(hint));
-
get_config_string(lookup_config(config_tree, "BindToAddress"), &address);
hint.ai_family = addressfamily;