denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

starter: Don't generate a key/certificate if ipsec.secrets does not exist

Browse Source
This commit is contained in:
Tobias Brunner
2016-10-04 10:13:32 +02:00
parent b27663399b
commit 120729f3f4
2 changed files with 0 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/Makefile.am
-4
View File
@@ -47,10 +47,6 @@ if USE_LOAD_WARNING
AM_CPPFLAGS += -DLOAD_WARNING
endif
if USE_SCEPCLIENT
AM_CPPFLAGS += -DGENERATE_SELFCERT
endif
keywords.c: $(srcdir)/keywords.txt $(srcdir)/keywords.h
$(AM_V_GEN) \
$(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@
src/starter/starter.c
-66
View File
@@ -257,68 +257,6 @@ static void fatal_signal_handler(int signal)
abort();
}
#ifdef GENERATE_SELFCERT
static void generate_selfcert()
{
const char *secrets_file;
struct stat stb;
secrets_file = lib->settings->get_str(lib->settings,
"charon.plugins.stroke.secrets_file", SECRETS_FILE);
/* if ipsec.secrets file is missing then generate RSA default key pair */
if (stat(secrets_file, &stb) != 0)
{
mode_t oldmask;
FILE *f;
uid_t uid = 0;
gid_t gid = 0;
#ifdef IPSEC_GROUP
{
char buf[1024];
struct group group, *grp;
if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 && grp)
{
gid = grp->gr_gid;
}
}
#endif
#ifdef IPSEC_USER
{
char buf[1024];
struct passwd passwd, *pwp;
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 && pwp)
{
uid = pwp->pw_uid;
}
}
#endif
ignore_result(setegid(gid));
ignore_result(seteuid(uid));
ignore_result(system(IPSEC_SCRIPT " scepclient --out pkcs1 --out cert-self --quiet"));
ignore_result(seteuid(0));
ignore_result(setegid(0));
/* ipsec.secrets is root readable only */
oldmask = umask(0066);
f = fopen(secrets_file, "w");
if (f)
{
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
fprintf(f, "\n");
fprintf(f, ": RSA myKey.der\n");
fclose(f);
}
ignore_result(chown(secrets_file, uid, gid));
umask(oldmask);
}
}
#endif /* GENERATE_SELFCERT */
static bool check_pid(char *pid_file)
{
struct stat stb;
@@ -604,10 +542,6 @@ int main (int argc, char **argv)
exit(LSB_RC_SUCCESS);
}
#ifdef GENERATE_SELFCERT
generate_selfcert();
#endif
/* fork if we're not debugging stuff */
if (!no_fork)
{