Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Read certificates from localdata and preserve them during upgrades #97

Merged
merged 2 commits into from
Apr 11, 2024
Merged

Read certificates from localdata and preserve them during upgrades #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
44ac586
Read certificates from localdata and preserve them during upgrades
killenheladagen Apr 11, 2024
544f2a8
Update README.md
killenheladagen Apr 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,26 +122,26 @@ achieve this, for example by using `scp` to copy the files from a remote machine
This can be done by running the following command on the remote machine:

```sh
scp ca.pem server-cert.pem server-key.pem root@<device ip>:/usr/local/packages/dockerdwrapperwithcompose/
scp ca.pem server-cert.pem server-key.pem root@<device ip>:/usr/local/packages/dockerdwrapperwithcompose/localdata/
```

#### The Certificate Authority (CA) certificate

This certificate needs to be present in the dockerdwrapperwithcompose package folder on the
Axis device and be named `ca.pem`. The full path of the file should be
`/usr/local/packages/dockerdwrapperwithcompose/ca.pem`.
`/usr/local/packages/dockerdwrapperwithcompose/localdata/ca.pem`.

#### The server certificate

This certificate needs to be present in the dockerdwrapperwithcompose package folder on the
Axis device and be named `server-cert.pem`. The full path of the file should be
`/usr/local/packages/dockerdwrapperwithcompose/server-cert.pem`.
`/usr/local/packages/dockerdwrapperwithcompose/localdata/server-cert.pem`.

#### The private server key

This key needs to be present in the dockerdwrapperwithcompose package folder on the Axis device
and be named `server-key.pem`. The full path of the file should be
`/usr/local/packages/dockerdwrapperwithcompose/server-key.pem`.
`/usr/local/packages/dockerdwrapperwithcompose/localdata/server-key.pem`.

#### Client key and certificate

Expand Down
26 changes: 11 additions & 15 deletions app/dockerdwrapperwithcompose.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ static const char* ax_parameters[] = {PARAM_APPLICATION_LOG_LEVEL,
PARAM_TCP_SOCKET,
PARAM_USE_TLS};

static const char* tls_cert_path = APP_DIRECTORY;
#define TLS_CERT_PATH APP_LOCALDATA

static const char* tls_certs[] = {"ca.pem", "server-cert.pem", "server-key.pem"};

Expand Down Expand Up @@ -410,9 +410,9 @@ static gboolean get_and_verify_tls_selection(AXParameter* param_handle, bool* us
const bool use_tls = is_parameter_yes(param_handle, PARAM_USE_TLS);
{
if (use_tls) {
char* ca_path = g_strdup_printf("%s/%s", tls_cert_path, tls_certs[0]);
char* cert_path = g_strdup_printf("%s/%s", tls_cert_path, tls_certs[1]);
char* key_path = g_strdup_printf("%s/%s", tls_cert_path, tls_certs[2]);
char* ca_path = g_strdup_printf("%s/%s", TLS_CERT_PATH, tls_certs[0]);
char* cert_path = g_strdup_printf("%s/%s", TLS_CERT_PATH, tls_certs[1]);
char* key_path = g_strdup_printf("%s/%s", TLS_CERT_PATH, tls_certs[2]);

bool ca_exists = access(ca_path, F_OK) == 0;
bool cert_exists = access(cert_path, F_OK) == 0;
Expand Down Expand Up @@ -530,19 +530,15 @@ static bool start_dockerd(const struct settings* settings, struct app_state* app
args_offset +=
g_snprintf(args + args_offset, args_len - args_offset, " -H tcp://0.0.0.0:%d", port);
if (use_tls) {
const char* ca_path = APP_DIRECTORY "/ca.pem";
const char* cert_path = APP_DIRECTORY "/server-cert.pem";
const char* key_path = APP_DIRECTORY "/server-key.pem";
args_offset += g_snprintf(args + args_offset,
args_len - args_offset,
" %s %s %s %s %s %s %s",
"--tlsverify",
"--tlscacert",
ca_path,
"--tlscert",
cert_path,
"--tlskey",
key_path);
" --tlsverify"
" --tlscacert %s/ca.pem"
" --tlscert %s/server-cert.pem"
" --tlskey %s/server-key.pem",
TLS_CERT_PATH,
TLS_CERT_PATH,
TLS_CERT_PATH);
g_strlcat(msg, " in TLS mode", msg_len);
} else {
args_offset += g_snprintf(args + args_offset, args_len - args_offset, " --tls=false");
Expand Down
Loading