pass TNCC_SHA256 and TNCC_HOSTNAME environment variables to wrapper script (just...

TNCC_SHA256 will allow a future version to validate the server certificate
fingerprint (like csd-post.sh already does).

TNCC_HOSTNAME passes along the *local* hostname override from OpenConnect
(set with `--local-hostname` or `openconnect_set_localname`) to the TNCC
wrapper script.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

diff --git a/auth-juniper.c b/auth-juniper.c
index 8a81317e4b43a048a00e13be7e769fa38f821502..69a870813e8e637a85b243801cf5147c26b58424 100644 (file)
--- a/auth-juniper.c
+++ b/auth-juniper.c
@@ -400,7 +400,13 @@ static int tncc_preauth(struct openconnect_info *vpninfo)
                for (i = 3; i < 1024 ; i++)
                        close(i);
 
+               if (setenv("TNCC_SHA256", openconnect_get_peer_cert_hash(vpninfo)+11, 1))  /* remove initial 'pin-sha256:' */
+                       goto out;
+               if (setenv("TNCC_HOSTNAME", vpninfo->localname, 1))
+                       goto out;
+
                execl(vpninfo->csd_wrapper, vpninfo->csd_wrapper, vpninfo->hostname, NULL);
+       out:
                fprintf(stderr, _("Failed to exec TNCC script %s: %s\n"),
                        vpninfo->csd_wrapper, strerror(errno));
                exit(1);