pluto: Drop support for legacy PSK format.
Any line in ipsec.secrets starting with " or ' was treated as PSK without ID selectors by pluto. This prevented it from supporting DNs like "C=CH, O=Linux strongSwan, OU=Sales, [email protected]" as ID selectors. PSKs defined in this legacy format can easily be updated by changing "thisIsASecret" into : PSK "thisIsASecret"
This commit is contained in:
+2
-15
@@ -835,14 +835,7 @@ static void process_secret(secret_t *s, int whackfd)
|
|||||||
err_t ugh = NULL;
|
err_t ugh = NULL;
|
||||||
|
|
||||||
s->kind = SECRET_PSK; /* default */
|
s->kind = SECRET_PSK; /* default */
|
||||||
if (*tok == '"' || *tok == '\'')
|
if (tokeqword("psk"))
|
||||||
{
|
|
||||||
log_psk("PSK", s);
|
|
||||||
|
|
||||||
/* old PSK format: just a string */
|
|
||||||
ugh = process_psk_secret(&s->u.preshared_secret);
|
|
||||||
}
|
|
||||||
else if (tokeqword("psk"))
|
|
||||||
{
|
{
|
||||||
log_psk("PSK", s);
|
log_psk("PSK", s);
|
||||||
|
|
||||||
@@ -989,13 +982,7 @@ static void process_secret_records(int whackfd)
|
|||||||
|
|
||||||
for (;;)
|
for (;;)
|
||||||
{
|
{
|
||||||
if (tok[0] == '"' || tok[0] == '\'')
|
if (tokeq(":"))
|
||||||
{
|
|
||||||
/* found key part */
|
|
||||||
process_secret(s, whackfd);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
else if (tokeq(":"))
|
|
||||||
{
|
{
|
||||||
/* found key part */
|
/* found key part */
|
||||||
shift(); /* discard explicit separator */
|
shift(); /* discard explicit separator */
|
||||||
|
|||||||
Reference in New Issue
Block a user