From patchwork Thu Jan 3 13:57:16 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: ummeegge X-Patchwork-Id: 2011 Return-Path: Received: from mail01.ipfire.org (unknown [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 2CFE6852160 for ; Thu, 3 Jan 2019 02:57:33 +0000 (GMT) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 34F392061194; Thu, 3 Jan 2019 02:57:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1546484252; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:list-id:list-unsubscribe:list-subscribe:list-post; bh=EbDi8THX55QTOTWhZLVnUrmLhGsD2rH1LM1LD1pEXWc=; b=IVJKtGImYqOtWAYaJq8xW0f8UoO+QcMJJz6mDDFpHnQAjk+U9rSATDeAKHrdJyFJYUj5Bc d5Oynfges5qp0kHf0IgR0CSsQTaHLmmE4dTDwYBpxfAwBxyYpTdu4sbxVcspbzqmhqrWON TN+SgnV1E7w/RgXyYC9OLHzRhwvNOLo9UVQYcDWQpxjfRPGIK0xXkBpSZevTbjZkcMyfs6 oQdHCESD3IzVYBTCQAI0oT3S5yEgN+2riG+C4Q4GMA9lD0gwkJD+HFlaWedQvm9VjYIAu7 jW6x7nZHD/6k64mxPuylIWpuiqCrH9u+c/QjmphZZzMcP9iWHAO2b8aEHp0mOA== Received: from ipfire-server.local (i59F4FC97.versanet.de [89.244.252.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id B920C21B512D; Thu, 3 Jan 2019 02:57:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1546484248; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=EbDi8THX55QTOTWhZLVnUrmLhGsD2rH1LM1LD1pEXWc=; b=qHVerXKNHRgMfyuUVufJRPsIatbmng0oPBW+M+J/sL4m2kZk0A90hbBm9a1zi2k3HLrjH+ qzOvV1NgsUimunldIk3qmuQ6pnggkEKteHGRzQKMoOX4XtoTw+67tjW1JgMkyCIxB7j0gh zkwiEBM4piH+tDy/NZTga7TLJ44gOEDN1dx+uvhm5w/35TLmUh7NKkdRHDLJhF/XZjlFmV bAISlbCcUIvSKbdZfB6UuberkBBksNU5VvXrKw1KZCNDokor2qwwjAYAlkHkO24T+J15z6 eX2fs8EMESeQqF2xKwbWWFgXvTBN5dLBQ/bqMLNxdDQf2JafyJTK3pX/Yh/yRw== From: Erik Kapfer To: development@lists.ipfire.org Subject: [PATCH] database_attribute: Deliver/create index.txt.attr Date: Thu, 3 Jan 2019 03:57:16 +0100 Message-Id: <20190103025716.18297-1-ummeegge@ipfire.org> X-Mailer: git-send-email 2.12.2 MIME-Version: 1.0 Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=ummeegge smtp.mailfrom=ummeegge@ipfire.org X-Spamd-Result: default: False [-0.09 / 11.00]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; NEURAL_SPAM(2.01)[0.671,0]; DKIM_SIGNED(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; MID_CONTAINS_FROM(1.00)[]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:8881, ipnet:89.244.240.0/20, country:DE]; RCVD_TLS_ALL(0.00)[]; BAYES_HAM(-3.00)[100.00%] X-Spam-Status: No, score=-0.09 X-Rspamd-Server: mail01.i.ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" Fixes #11904 Since OpenSSL-1.1.0x the database attribute file for IPSec and OpenVPN wasn´t created while initial PKI generation. OpenVPN delivered an error message but IPSec did crashed within the first attempt. This problem persists also after X509 deletion and new generation. index.txt.attr will now be delivered by the system but also deleted and recreated while setting up a new x509. --- config/ovpn/certs/index.txt.attr | 0 config/rootfiles/common/configroot | 1 + config/rootfiles/common/openvpn | 1 + html/cgi-bin/ovpnmain.cgi | 9 +++++++++ html/cgi-bin/vpnmain.cgi | 9 +++++++++ lfs/configroot | 2 +- 6 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 config/ovpn/certs/index.txt.attr diff --git a/config/ovpn/certs/index.txt.attr b/config/ovpn/certs/index.txt.attr new file mode 100644 index 000000000..e69de29bb diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index c72768165..6f5d2fe2f 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -19,6 +19,7 @@ var/ipfire/captive/settings var/ipfire/captive/voucher_out var/ipfire/certs #var/ipfire/certs/index.txt +var/ipfire/certs/index.txt.attr #var/ipfire/certs/serial var/ipfire/connscheduler #var/ipfire/connscheduler/connscheduler.conf diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 131d79873..547842db3 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -25,6 +25,7 @@ var/ipfire/ovpn/caconfig var/ipfire/ovpn/ccd #var/ipfire/ovpn/certs var/ipfire/ovpn/certs/index.txt +var/ipfire/ovpn/certs/index.txt.attr var/ipfire/ovpn/certs/serial var/ipfire/ovpn/crls var/ipfire/ovpn/n2nconf diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 976300fc7..4fb234995 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -174,7 +174,12 @@ sub cleanssldatabase print FILE ""; close FILE; } + if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) { + print FILE ""; + close FILE; + } unlink ("${General::swroot}/ovpn/certs/index.txt.old"); + unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old"); unlink ("${General::swroot}/ovpn/certs/serial.old"); unlink ("${General::swroot}/ovpn/certs/01.pem"); } @@ -189,7 +194,11 @@ sub newcleanssldatabase if (! -s ">${General::swroot}/ovpn/certs/index.txt") { system ("touch ${General::swroot}/ovpn/certs/index.txt"); } + if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") { + system ("touch ${General::swroot}/ovpn/certs/index.txt.attr"); + } unlink ("${General::swroot}/ovpn/certs/index.txt.old"); + unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old"); unlink ("${General::swroot}/ovpn/certs/serial.old"); } diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 21fd1f4cd..a5d27c8d8 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -149,7 +149,12 @@ sub cleanssldatabase { print FILE ""; close FILE; } + if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) { + print FILE ""; + close FILE; + } unlink ("${General::swroot}/certs/index.txt.old"); + unlink ("${General::swroot}/certs/index.txt.attr.old"); unlink ("${General::swroot}/certs/serial.old"); unlink ("${General::swroot}/certs/01.pem"); } @@ -162,7 +167,11 @@ sub newcleanssldatabase { if (! -s ">${General::swroot}/certs/index.txt") { system ("touch ${General::swroot}/certs/index.txt"); } + if (! -s ">${General::swroot}/certs/index.txt.attr") { + system ("touch ${General::swroot}/certs/index.txt.attr"); + } unlink ("${General::swroot}/certs/index.txt.old"); + unlink ("${General::swroot}/certs/index.txt.attr.old"); unlink ("${General::swroot}/certs/serial.old"); # unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete } diff --git a/lfs/configroot b/lfs/configroot index 4701d9e39..c66dcdedb 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -62,7 +62,7 @@ $(TARGET) : # Touch empty files for i in auth/users backup/include.user backup/exclude.user \ - captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt ddns/config ddns/settings ddns/ipcache dhcp/settings \ + captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \ dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \ ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \ fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \