[PATCH] fastd: make secret key updatesafe

robert rlanghammer at web.de
So Jan 5 17:55:51 CET 2020


Hi Christian,

das find ich richtig gut. Einen Vorschlag hab ich noch. s. unten.

Am 05.01.20 um 10:10 schrieb Christian Dresel:
> To use a whitelist easy, it is neccessary to make the fastd key updatesafe
> This patch safe the key to uci fff and recover it, if a key is after the update available
>
> Signed-off-by: Christian Dresel <fff at chrisi01.de>
>
> ---
> Changes in v2:
> - use variable in if
> - remove trailing whitespace
> - remove -q
> ---
> ---
>  .../fff/fff-fastd/files/etc/uci-defaults/55_fff-fastd         | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/src/packages/fff/fff-fastd/files/etc/uci-defaults/55_fff-fastd b/src/packages/fff/fff-fastd/files/etc/uci-defaults/55_fff-fastd
> index d53eb43..4bfc316 100644
> --- a/src/packages/fff/fff-fastd/files/etc/uci-defaults/55_fff-fastd
> +++ b/src/packages/fff/fff-fastd/files/etc/uci-defaults/55_fff-fastd
> @@ -15,9 +15,18 @@ uci batch <<EOF
>    set fastd.fff.mtu='1426'
>    set fastd.fff.on_up="/etc/fastd/fff/up.sh"
>    set fastd.fff.secure_handshakes='0'
> -  set fastd.fff.secret="generate"
>  EOF
>  
> +if secretkey=$(uci -q get fff.fastd.secret); then
> +	uci set fastd.fff.secret=$secretkey
> +else
> +	secret=$(/usr/bin/fastd --generate-key --machine-readable)
> +	uci set fastd.fff.secret="$secret"
> +	uci set fff.fastd='fff'
> +	uci set fff.fastd.secret="$secret" && uci commit fff
> +fi
> +uci commit fastd
> +

Nenn doch die Variable, in die das Gleiche rein kommt gleich. secretkey
<-> secret

Es ist auch einiges doppelt. Mein Vorschlag:

if ! secret=$(uci -q get fff.fastd.secret); then
	secret=$(/usr/bin/fastd --generate-key --machine-readable)
	uci set fff.fastd='fff'
	uci set fff.fastd.secret="$secret"
fi
uci set fastd.fff.secret="$secret"
# optional uci commit 

Viele Grüße
Robert

>  [ ! -d /etc/fastd/fff ] &&  mkdir -p /etc/fastd/fff
>  ln -s /tmp/fastd_fff_peers /etc/fastd/fff/peers
>  echo "#!/bin/sh" > /etc/fastd/fff/up.sh



Mehr Informationen über die Mailingliste franken-dev