From: Arne Schwabe <[email protected]>
This is useful for features that can use enither a persistent
or an ephemeral key.
Patch V2: Move the functionality of generating a random key into a
separate function that acts as wrapper for pem_read_key_file
---
src/openvpn/crypto.c | 22 ++++++++++++++++++++++
src/openvpn/crypto.h | 15 +++++++++++++++
2 files changed, 37 insertions(+)
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index eb56421b..0e17c351 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -1892,6 +1892,28 @@ cleanup:
return;
}
+bool
+load_pem_file_or_ephemeral_key(struct buffer *key, const char *pem_name,
+ const char *key_file, const char *key_inline)
+{
+ if (key_file == NULL)
+ {
+ msg(M_INFO, "Using random %s.", pem_name);
+ uint8_t rand[BCAP(key)];
+ if (!rand_bytes(rand, BCAP(key)))
+ {
+ msg(M_WARN, "ERROR: could not generate random key");
+ return false;
+ }
+ buf_write(key, rand, BCAP(key));
+ return true;
+ }
+ else
+ {
+ return read_pem_key_file(key, pem_name, key_file, key_inline);
+ }
+}
+
bool
read_pem_key_file(struct buffer *key, const char *pem_name,
const char *key_file, const char *key_inline)
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index c5947483..4ae02571 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -430,6 +430,21 @@ unsigned int crypto_max_overhead(void);
void
write_pem_key_file(const char *filename, const char *pem_name);
+/**
+ * Read key material from a PEM encoded files into the key structure or if
+ * the filename is not passed generate a ephemeral key
+ *
+ * @param key the key structure that will hold the key material
+ * @param pem_name the name used in the pem encoding start/end lines
+ * @param key_file name of the file to read or NULL if an ephermal key
+ * should be generated
+ * @param key_inline a string holding the data in case of an inline key
+ * @return true if reading into key was successful or generated
+ */
+bool
+load_pem_file_or_ephemeral_key(struct buffer *key, const char *pem_name,
+ const char *key_file, const char *key_inline);
+
/**
* Read key material from a PEM encoded files into the key structure
* @param key the key structure that will hold the key material
--
2.21.0
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
