From: Erik Kapfer <ummeegge@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] database_attribute: Deliver/create index.txt.attr
Date: Thu, 03 Jan 2019 03:57:16 +0100 [thread overview]
Message-ID: <20190103025716.18297-1-ummeegge@ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 5164 bytes --]
Fixes #11904
Since OpenSSL-1.1.0x the database attribute file for IPSec and OpenVPN wasn´t created while initial PKI generation.
OpenVPN delivered an error message but IPSec did crashed within the first attempt.
This problem persists also after X509 deletion and new generation.
index.txt.attr will now be delivered by the system but also deleted and recreated while setting up a new x509.
---
config/ovpn/certs/index.txt.attr | 0
config/rootfiles/common/configroot | 1 +
config/rootfiles/common/openvpn | 1 +
html/cgi-bin/ovpnmain.cgi | 9 +++++++++
html/cgi-bin/vpnmain.cgi | 9 +++++++++
lfs/configroot | 2 +-
6 files changed, 21 insertions(+), 1 deletion(-)
create mode 100644 config/ovpn/certs/index.txt.attr
diff --git a/config/ovpn/certs/index.txt.attr b/config/ovpn/certs/index.txt.attr
new file mode 100644
index 000000000..e69de29bb
diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot
index c72768165..6f5d2fe2f 100644
--- a/config/rootfiles/common/configroot
+++ b/config/rootfiles/common/configroot
@@ -19,6 +19,7 @@ var/ipfire/captive/settings
var/ipfire/captive/voucher_out
var/ipfire/certs
#var/ipfire/certs/index.txt
+var/ipfire/certs/index.txt.attr
#var/ipfire/certs/serial
var/ipfire/connscheduler
#var/ipfire/connscheduler/connscheduler.conf
diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn
index 131d79873..547842db3 100644
--- a/config/rootfiles/common/openvpn
+++ b/config/rootfiles/common/openvpn
@@ -25,6 +25,7 @@ var/ipfire/ovpn/caconfig
var/ipfire/ovpn/ccd
#var/ipfire/ovpn/certs
var/ipfire/ovpn/certs/index.txt
+var/ipfire/ovpn/certs/index.txt.attr
var/ipfire/ovpn/certs/serial
var/ipfire/ovpn/crls
var/ipfire/ovpn/n2nconf
diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 976300fc7..4fb234995 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -174,7 +174,12 @@ sub cleanssldatabase
print FILE "";
close FILE;
}
+ if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
+ print FILE "";
+ close FILE;
+ }
unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+ unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
unlink ("${General::swroot}/ovpn/certs/serial.old");
unlink ("${General::swroot}/ovpn/certs/01.pem");
}
@@ -189,7 +194,11 @@ sub newcleanssldatabase
if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
system ("touch ${General::swroot}/ovpn/certs/index.txt");
}
+ if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
+ system ("touch ${General::swroot}/ovpn/certs/index.txt.attr");
+ }
unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+ unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
unlink ("${General::swroot}/ovpn/certs/serial.old");
}
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 21fd1f4cd..a5d27c8d8 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -149,7 +149,12 @@ sub cleanssldatabase {
print FILE "";
close FILE;
}
+ if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) {
+ print FILE "";
+ close FILE;
+ }
unlink ("${General::swroot}/certs/index.txt.old");
+ unlink ("${General::swroot}/certs/index.txt.attr.old");
unlink ("${General::swroot}/certs/serial.old");
unlink ("${General::swroot}/certs/01.pem");
}
@@ -162,7 +167,11 @@ sub newcleanssldatabase {
if (! -s ">${General::swroot}/certs/index.txt") {
system ("touch ${General::swroot}/certs/index.txt");
}
+ if (! -s ">${General::swroot}/certs/index.txt.attr") {
+ system ("touch ${General::swroot}/certs/index.txt.attr");
+ }
unlink ("${General::swroot}/certs/index.txt.old");
+ unlink ("${General::swroot}/certs/index.txt.attr.old");
unlink ("${General::swroot}/certs/serial.old");
# unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete
}
diff --git a/lfs/configroot b/lfs/configroot
index 4701d9e39..c66dcdedb 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -62,7 +62,7 @@ $(TARGET) :
# Touch empty files
for i in auth/users backup/include.user backup/exclude.user \
- captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt ddns/config ddns/settings ddns/ipcache dhcp/settings \
+ captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \
--
2.12.2
next reply other threads:[~2019-01-03 2:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-03 2:57 Erik Kapfer [this message]
2019-01-03 15:32 ` Michael Tremer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190103025716.18297-1-ummeegge@ipfire.org \
--to=ummeegge@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox