1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
#!@@SHELL_BINARY@@
# -*- mode: sh; sh-shell: sh -*-
#
# generate new key for this host
#
# Copyright (C) 2001, 2002 Henry Spencer.
# Copyright (C) 2014-2020 Paul Wouters <pwouters@redhat.com>
# Copyright (C) 2014, 2016 Tuomo Soini <tis@foobar.fi>
# Copyright (C) 2016, Andrew Cagney <cagney@gnu.org>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <https://www.gnu.org/licenses/gpl2.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
me="ipsec newhostkey"
usage="Usage:
$me [--seeddev device] [--keytype rsa] [--bits n]
$me [--seeddev device] --keytype ecdsa [--curve curve]
other options: [--quiet] [--hostname host] [--nssdir @@IPSEC_NSSDIR@@] \\
[--password password]"
bits=
curve=
keytype=rsa
verbose=
host=
seeddev="--seeddev /dev/random"
nssdir="@@IPSEC_NSSDIR@@"
password=
while [ $# != 0 ] ; do
case "$1" in
--bits)
bits="${2}"
shift
;;
--curve)
curve="${2}"
shift
;;
--keytype)
keytype="${2}"
shift
;;
--quiet)
verbose=
;;
--verbose)
verbose="--verbose"
;;
--version)
echo "${me} $IPSEC_VERSION"
exit 0
;;
--seeddev)
seeddev="--seeddev ${2}"
shift
;;
--nssdir)
nssdir="${2}"
shift
;;
--password)
password="--password ${2}"
shift
;;
--help)
echo "$usage"
exit 0
;;
--)
shift
break
;;
-*)
echo "${me}: unknown option \`$1'" >&2
exit 2
;;
*)
break
;;
esac
shift
done
if [ -n "$bits" ] && [ -n "$curve" ]; then
echo "${me}: --bits and --curve are mutually exclusive"
exit 2
fi
case "$keytype" in
rsa)
if [ -n "$curve" ]; then
echo "${me}: --curve and --keytype rsa are mutually exclusive"
fi
;;
ecdsa)
if [ -n "$bits" ]; then
echo "${me}: --bits and --keytype ecdsa are mutually exclusive"
fi
;;
*)
echo "${me}: unknown key type \`$keytype'" >&2
exit 2
;;
esac
if [ ! -d ${nssdir} ]; then
echo "No such directory: ${nssdir}"
exit 255
fi
certutil -L -d "sql:${nssdir}" >/dev/null 2>/dev/null
RETVAL=$?
if [ ${RETVAL} -eq 255 ]; then
echo "NSS database in ${nssdir} not initialized."
echo " Please run 'ipsec initnss --nssdir ${nssdir}'"
exit 255
fi
case "$keytype" in
rsa)
key=$(ipsec rsasigkey ${verbose} ${seeddev} --nssdir ${nssdir} ${password} ${host} ${bits})
;;
ecdsa)
key=$(ipsec ecdsasigkey ${verbose} ${seeddev} --nssdir ${nssdir} ${password} ${host} ${curve})
;;
esac
RETVAL=$?
if [ ${RETVAL} -ne 0 ]; then
exit ${RETVAL}
fi
|
