Store the private key with read and write permission for the user only
and not with read permissions for everyone. This converts the
write_file() function from fopen() to open() because open allows to
specify the permission mask of the newly created file. It also adds and
fixes some existing error handling.
OpenSSL does this in the same way already.
With this change it looks like this:
root@OpenWrt:/# ls -al /etc/uhttpd.*
-rw-r--r-- 1 root root 749 Nov 6 23:14 /etc/uhttpd.crt
-rw------- 1 root root 121 Nov 6 23:14 /etc/uhttpd.key
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
include $(TOPDIR)/rules.mk
PKG_NAME:=px5g-wolfssl
include $(TOPDIR)/rules.mk
PKG_NAME:=px5g-wolfssl
PKG_LICENSE:=GPL-2.0-or-later
PKG_BUILD_FLAGS:=no-mips16
PKG_LICENSE:=GPL-2.0-or-later
PKG_BUILD_FLAGS:=no-mips16
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/wolfcrypt/asn_public.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/asn.h>
#include <wolfssl/wolfcrypt/asn_public.h>
-int write_file(byte *buf, int bufSz, char *path) {
- int ret;
- FILE *file;
+int write_file(byte *buf, int bufSz, char *path, bool cert) {
+ mode_t mode = S_IRUSR | S_IWUSR;
+ ssize_t written;
+ int err;
+ int fd;
+
+ if (cert)
+ mode |= S_IRGRP | S_IROTH;
+
- file = fopen(path, "wb");
- if (file == NULL) {
+ fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, mode);
+ if (fd < 0) {
perror("Error opening file");
exit(1);
}
} else {
perror("Error opening file");
exit(1);
}
} else {
- ret = (int)fwrite(buf, 1, bufSz, file);
- if (path) {
- fclose(file);
+ written = write(fd, buf, bufSz);
+ if (written != bufSz) {
+ perror("Error write file");
+ exit(1);
- if (ret > 0) {
- /* ret > 0 indicates a successful file write, set to zero for return */
- ret = 0;
+ err = fsync(fd);
+ if (err < 0) {
+ perror("Error fsync file");
+ exit(1);
+ if (path) {
+ close(fd);
+ }
+ return 0;
}
int write_key(ecc_key *ecKey, RsaKey *rsaKey, int type, int keySz, char *fName,
}
int write_key(ecc_key *ecKey, RsaKey *rsaKey, int type, int keySz, char *fName,
fprintf(stderr, "DER to PEM failed: %d\n", ret);
}
pemSz = ret;
fprintf(stderr, "DER to PEM failed: %d\n", ret);
}
pemSz = ret;
- ret = write_file(pem, pemSz, fName);
+ ret = write_file(pem, pemSz, fName, false);
- ret = write_file(der, derSz, fName);
+ ret = write_file(der, derSz, fName, false);
- ret = write_file(pemBuf, pemSz, certpath);
+ ret = write_file(pemBuf, pemSz, certpath, true);
if (ret != 0) {
fprintf(stderr, "Write Cert failed: %d\n", ret);
return ret;
if (ret != 0) {
fprintf(stderr, "Write Cert failed: %d\n", ret);
return ret;