postinst is in openswan 1:2.6.37-1.
This file is a maintainer script. It is executed when installing (*inst) or removing (*rm) the package.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 | #! /bin/bash
# postinst script for openswan
#
# see: dh_installdeb(1)
set -e
# summary of how this script can be called:
# * <postinst> `configure' <most-recently-configured-version>
# * <old-postinst> `abort-upgrade' <new version>
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
# <new-version>
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
# <failed-install-package> <version> `removing'
# <conflicting-package> <version>
# for details, see /usr/share/doc/packaging-manual/
#
# quoting from the policy:
# Any necessary prompting should almost always be confined to the
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
# <failed-install-package> <version> `removing'
# <conflicting-package> <version>
# for details, see /usr/share/doc/packaging-manual/
#
# quoting from the policy:
# Any necessary prompting should almost always be confined to the
# post-installation script, and should be protected with a conditional
# so that unnecessary prompting doesn't happen if a package's
# installation fails and the `postinst' is called with `abort-upgrade',
# `abort-remove' or `abort-deconfigure'.
SECRETS_INC_DIR=/var/lib/openswan
SECRETS_INC_FILE="$SECRETS_INC_DIR"/ipsec.secrets.inc
Warn ()
{
echo "$*" >&2
}
Error ()
{
Warn "Error: $*"
}
insert_private_key_filename() {
if ! ( [ -e $SECRETS_INC_FILE ] && egrep -q ": RSA $1" $SECRETS_INC_FILE ); then
echo ": RSA $1" >> $SECRETS_INC_FILE
fi
}
make_x509_cert() {
if [ $# -ne 12 ]; then
echo "Error in creating X.509 certificate"
exit 1
fi
case $5 in
false)
certreq=$4.req
selfsigned=""
;;
true)
certreq=$4
selfsigned="-x509"
;;
*)
echo "Error in creating X.509 certificate"
exit 1
;;
esac
echo -e "$6\n$7\n$8\n$9\n${10}\n${11}\n${12}\n\n\n" | \
/usr/bin/openssl req -new -outform PEM -out $certreq \
-newkey rsa:$1 -nodes -keyout $3 -keyform PEM \
-days $2 $selfsigned >/dev/null
}
. /usr/share/debconf/confmodule
case "$1" in
configure)
# if SECRETS_INC_FILE is not there we touch it to avoid error messages
if [ ! -f "$SECRETS_INC_FILE" ]; then
touch $SECRETS_INC_FILE
fi
# now we fix permissions of SECRETS_INC_DIR and SECRETS_INC_FILE (if the admin did not specify different ones)
if [ "`dpkg-statoverride --list $SECRETS_INC_DIR`" ] || [ "`find $SECRETS_INC_DIR ! -perm 0700`" ]; then
chmod 0700 $SECRETS_INC_DIR
fi
if [ "`dpkg-statoverride --list $SECRETS_INC_FILE`" ] || [ "`find $SECRETS_INC_FILE ! -perm 0700`" ]; then
chmod 0600 $SECRETS_INC_FILE
fi
db_get openswan/install_x509_certificate
if [ "$RET" = "true" ]; then
db_get openswan/how_to_get_x509_certificate
if [ "$RET" = "create" ]; then
# extract the key from a (newly created) x509 certificate
host=`hostname`
newkeyfile="/etc/ipsec.d/private/${host}Key.pem"
newcertfile="/etc/ipsec.d/certs/${host}Cert.pem"
if [ -e $newcertfile -o -e $newkeyfile ]; then
Error "$newcertfile or $newkeyfile already exists."
Error "Please remove them first an then re-run dpkg-reconfigure to create a new keypair."
else
# create a new certificate
db_get openswan/rsa_key_length
keylength=$RET
db_get openswan/x509_self_signed
selfsigned=$RET
db_get openswan/x509_country_code
countrycode=$RET
if [ -z "$countrycode" ]; then countrycode="."; fi
db_get openswan/x509_state_name
statename=$RET
if [ -z "$statename" ]; then statename="."; fi
db_get openswan/x509_locality_name
localityname=$RET
if [ -z "$localityname" ]; then localityname="."; fi
db_get openswan/x509_organization_name
orgname=$RET
if [ -z "$orgname" ]; then orgname="."; fi
db_get openswan/x509_organizational_unit
orgunit=$RET
if [ -z "$orgunit" ]; then orgunit="."; fi
db_get openswan/x509_common_name
commonname=$RET
if [ -z "$commonname" ]; then commonname="."; fi
db_get openswan/x509_email_address
email=$RET
if [ -z "$email" ]; then email="."; fi
make_x509_cert $keylength 1500 "$newkeyfile" "$newcertfile" "$selfsigned" "$countrycode" "$statename" "$localityname" "$orgname" "$orgunit" "$commonname" "$email"
chmod 0600 "$newkeyfile"
insert_private_key_filename "$newkeyfile"
echo "Successfully created x509 certificate."
fi
elif [ "$RET" = "import" ]; then
# existing certificate - use it
db_get openswan/existing_x509_certificate_filename
certfile=$RET
db_get openswan/existing_x509_key_filename
keyfile=$RET
db_get openswan/existing_x509_rootca_filename
cafile=$RET
if [ ! "$certfile" ] || [ ! "$keyfile" ]; then
Error "Either the certificate or the key filename is not specified."
elif ! ( ( [ -f "$certfile" ] || [ -L "$certfile" ] ) && ( [ -f "$keyfile" ] || [ -L "$keyfile" ] ) && ( [ "$cafile" = "" ] || ( [ -f "$cafile" ] || [ -L "$cafile" ] ) ) ); then
Error "Either the certificate or the key"${cafile:+ or the rootca}" file is not a regular file or symbolic link."
elif [ ! "`grep 'BEGIN CERTIFICATE' $certfile`" ] || [ ! "`grep 'BEGIN RSA PRIVATE KEY' $keyfile`" ] || ( [ "$cafile" != "" ] && [ ! "`grep 'BEGIN CERTIFICATE' $cafile`" ] ); then
Error "Either the certificate or the key"${cafile:+ or the rootca}" file is not a valid PEM type file."
elif [ "$cafile" ] && ( [ "$certfile" = "$cafile" ] || [ "$keyfile" = "$cafile" ]); then
Error "The certificate or the key file contains the rootca - unable to import automatically."
elif [ "`grep 'BEGIN CERTIFICATE' $certfile | wc -l`" -gt 1 ]; then
Error "The certificate file contains more than one certificate - unable to import automatically."
elif [ "`grep 'ENCRYPTED' $keyfile`" ]; then
Error "The key file contains an encrypted key - unable to import automatically."
else
newcertfile="/etc/ipsec.d/certs/$(basename "$certfile")"
newkeyfile="/etc/ipsec.d/private/$(basename "$keyfile")"
if [ "$cafile" ]; then
newcafile="/etc/ipsec.d/private/$(basename "$cafile")"
else
newcafile=""
fi
if [ -e "$newcertfile" ] || [ -e "$newkeyfile" ] || ( [ "$newcafile" != "" ] && [ -e "$newcafile" ] ); then
Error "$newcertfile or $newkeyfile"${newcafile:+ or $newcafile}" already exists."
Error "Please remove them first and then re-run dpkg-reconfigure to extract an existing keypair"${newcafile:+ and a rootca}"."
else
openssl x509 -in $certfile -out $newcertfile 2>/dev/null
openssl rsa -passin pass:"" -in $keyfile -out $newkeyfile 2>/dev/null
chmod 0600 "$newkeyfile"
insert_private_key_filename "$newkeyfile"
cp "$cafile" /etc/ipsec.d/cacerts
echo "Successfully integrated existing x509 certificate."
fi
fi
fi
db_set openswan/install_x509_certificate false
fi
# scheduled for removal 2012-02
if egrep -q "^include /etc/ipsec.d/examples/no_oe.conf$" /etc/ipsec.conf; then
db_fset openswan/no-oe_include_file seen false
db_input high openswan/no-oe_include_file || true
db_go
cat /etc/ipsec.conf | grep -v "^#Disable Opportunistic Encryption$" | grep -v "^include /etc/ipsec.d/examples/no_oe.conf$" > /etc/ipsec.conf.tmp
mv /etc/ipsec.conf.tmp /etc/ipsec.conf
fi
# scheduled for removal 2011-03
runlevels=`find /etc/rc*.d -type l -a -name "*ipsec" -a -lname "../init.d/ipsec" -print0 | sed 's/\/etc\/rc//g' | sed 's/\.d\///g' | sed 's/ipsec//g'`
# lets see if we are already using dependency based booting or the correct runlevel parameters
if ! ( [ "`find /etc/init.d/ -name '.depend.*'`" ] || [ "$runlevels" = "0K841K842S163S164S165S166K84" ] ); then
db_fset openswan/runlevel_changes seen false
db_input high openswan/runlevel_changes || true
db_go
# if the admin did not change the runlevels which got installed by older packages we can modify them
if [ "$runlevels" = "0K346K34SS41" ] || [ "$runlevels" = "0K301K302S153S154S155S156K30" ] || [ "$runlevels" = "0K191K192S213S214S215S216K19" ]; then
update-rc.d -f ipsec remove
fi
update-rc.d ipsec defaults 16 84 > /dev/null
fi
if [ -z "$2" ]; then
# no old configured version - start openswan now
invoke-rc.d ipsec start || true
else
# does the user wish openswan to restart?
db_get openswan/restart
if [ "$RET" = "true" ]; then
invoke-rc.d ipsec restart || true # sure, we'll restart it for you
fi
fi
db_stop
;;
abort-upgrade|abort-remove|abort-deconfigure)
;;
*)
echo "postinst called with unknown argument '$1'" >&2
exit 0
;;
esac
# dh_installdeb will replace this with shell code automatically
exit 0
|