merge: uhttpd: update cert generation to match system defaults

[openwrt/staging/chunkeey.git] / package / network / services / uhttpd / files / uhttpd.init

diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
index add09243ecd6c04a61fdf9e14de589938d0f8edd..47270bcc159dad477b566f84ceb11c68148bcbb2 100755 (executable)
--- a/package/network/services/uhttpd/files/uhttpd.init
+++ b/package/network/services/uhttpd/files/uhttpd.init
@@ -7,6 +7,7 @@ USE_PROCD=1
 
 UHTTPD_BIN="/usr/sbin/uhttpd"
 PX5G_BIN="/usr/sbin/px5g"
+OPENSSL_BIN="/usr/bin/openssl"
 
 append_arg() {
        local cfg="$1"
@@ -43,16 +44,36 @@ generate_keys() {
        config_get location   "$cfg" location
        config_get commonname "$cfg" commonname
 
-       [ -x "$PX5G_BIN" ] && {
-               $PX5G_BIN selfsigned -der \
-                       -days ${days:-730} -newkey rsa:${bits:-1024} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
-                       -subj /C="${country:-DE}"/ST="${state:-Saxony}"/L="${location:-Leipzig}"/CN="${commonname:-OpenWrt}"
+       # Prefer px5g for certificate generation (existence evaluated last)
+       local GENKEY_CMD=""
+       local UNIQUEID=$(dd if=/dev/urandom bs=1 count=4 | hexdump -e '1/1 "%02x"')
+       [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform der -nodes"
+       [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -der"
+       [ -n "$GENKEY_CMD" ] && {
+               $GENKEY_CMD \
+                       -days ${days:-730} -newkey rsa:${bits:-2048} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
+                       -subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${commonname:-OpenWrt}$UNIQUEID"/CN="${commonname:-OpenWrt}"
                sync
                mv "${UHTTPD_KEY}.new" "${UHTTPD_KEY}"
                mv "${UHTTPD_CERT}.new" "${UHTTPD_CERT}"
        }
 }
 
+create_httpauth() {
+       local cfg="$1"
+       local prefix username password
+
+       config_get prefix "$cfg" prefix
+       config_get username "$cfg" username
+       config_get password "$cfg" password
+
+       if [ -z "$prefix" ] || [ -z "$username" ] || [ -z "$password" ]; then
+               return
+       fi
+       echo "${prefix}:${username}:${password}" >>$httpdconf
+       haveauth=1
+}
+
 start_instance()
 {
        UHTTPD_CERT=""
@@ -60,13 +81,25 @@ start_instance()
 
        local cfg="$1"
        local realm="$(uci_get system.@system[0].hostname)"
-       local listen http https interpreter indexes path handler
+       local listen http https interpreter indexes path handler httpdconf haveauth
 
        procd_open_instance
        procd_set_param respawn
        procd_set_param stderr 1
        procd_set_param command "$UHTTPD_BIN" -f
 
+       config_get config "$cfg" config
+       if [ -z "$config" ]; then
+               mkdir -p /var/etc/uhttpd
+               httpdconf="/var/etc/uhttpd/httpd.${cfg}.conf"
+               rm -f ${httpdconf}
+               config_list_foreach "$cfg" httpauth create_httpauth
+               if [ "$haveauth" = "1" ]; then
+                       procd_append_param command -c ${httpdconf}
+                       [ -r /etc/httpd.conf ] && cat /etc/httpd.conf >>/var/etc/uhttpd/httpd.${cfg}.conf
+               fi
+       fi
+
        append_arg "$cfg" home "-h"
        append_arg "$cfg" realm "-r" "${realm:-OpenWrt}"
        append_arg "$cfg" config "-c"