database_attribute: Deliver/create index.txt.attr

Fixes #11904

Since OpenSSL-1.1.0x the database attribute file for IPSec and OpenVPN wasn´t created while initial PKI generation.
OpenVPN delivered an error message but IPSec did crashed within the first attempt.
This problem persists also after X509 deletion and new generation.

index.txt.attr will now be delivered by the system but also deleted and recreated while setting up a new x509.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/ovpn/certs/index.txt.attr b/config/ovpn/certs/index.txt.attr
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot
index c7276816564e497a221476f895ccb1c86975612e..6f5d2fe2f84b581672c0eb397543fcc29bf42da4 100644 (file)
--- a/config/rootfiles/common/configroot
+++ b/config/rootfiles/common/configroot
@@ -19,6 +19,7 @@ var/ipfire/captive/settings
 var/ipfire/captive/voucher_out
 var/ipfire/certs
 #var/ipfire/certs/index.txt
+var/ipfire/certs/index.txt.attr
 #var/ipfire/certs/serial
 var/ipfire/connscheduler
 #var/ipfire/connscheduler/connscheduler.conf

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn
index 131d79873efc8c0a1bc7cb889a275969f7cd4ad6..547842db3d1d6e8c1a86a71b48cd3edbb27673ad 100644 (file)
--- a/config/rootfiles/common/openvpn
+++ b/config/rootfiles/common/openvpn
@@ -25,6 +25,7 @@ var/ipfire/ovpn/caconfig
 var/ipfire/ovpn/ccd
 #var/ipfire/ovpn/certs
 var/ipfire/ovpn/certs/index.txt
+var/ipfire/ovpn/certs/index.txt.attr
 var/ipfire/ovpn/certs/serial
 var/ipfire/ovpn/crls
 var/ipfire/ovpn/n2nconf

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 976300fc72e77dd3e23e26bca243dc61faaa4606..4fb2349956f538739767e689d3a79a01e783b3c8 100644 (file)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -174,7 +174,12 @@ sub cleanssldatabase
        print FILE "";
        close FILE;
     }
+    if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
+      print FILE "";
+      close FILE;
+    }
     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+    unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
     unlink ("${General::swroot}/ovpn/certs/serial.old");
     unlink ("${General::swroot}/ovpn/certs/01.pem");
 }
@@ -189,7 +194,11 @@ sub newcleanssldatabase
     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
        system ("touch ${General::swroot}/ovpn/certs/index.txt");
     }
+    if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
+      system ("touch ${General::swroot}/ovpn/certs/index.txt.attr");
+    }
     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+    unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
     unlink ("${General::swroot}/ovpn/certs/serial.old");
 }
 

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 21fd1f4cd6061c80ddb2067527427122c7e348d1..a5d27c8d83f7de0b614bdbe8083596f02a312bbd 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -149,7 +149,12 @@ sub cleanssldatabase {
                print FILE "";
                close FILE;
        }
+       if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) {
+               print FILE "";
+               close FILE;
+       }
        unlink ("${General::swroot}/certs/index.txt.old");
+       unlink ("${General::swroot}/certs/index.txt.attr.old");
        unlink ("${General::swroot}/certs/serial.old");
        unlink ("${General::swroot}/certs/01.pem");
 }
@@ -162,7 +167,11 @@ sub newcleanssldatabase {
        if (! -s ">${General::swroot}/certs/index.txt") {
                system ("touch ${General::swroot}/certs/index.txt");
        }
+       if (! -s ">${General::swroot}/certs/index.txt.attr") {
+               system ("touch ${General::swroot}/certs/index.txt.attr");
+       }
        unlink ("${General::swroot}/certs/index.txt.old");
+       unlink ("${General::swroot}/certs/index.txt.attr.old");
        unlink ("${General::swroot}/certs/serial.old");
 #      unlink ("${General::swroot}/certs/01.pem");             numbering evolves. Wrong place to delete
 }

diff --git a/lfs/configroot b/lfs/configroot
index 4701d9e39701ff5ab26bdb58a89b630e128168fd..c66dcdedb2df9ee0c67a7717b7f403faa5a2eb98 100644 (file)
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -62,7 +62,7 @@ $(TARGET) :
 
        # Touch empty files
        for i in auth/users backup/include.user backup/exclude.user \
-           captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt ddns/config ddns/settings ddns/ipcache dhcp/settings \
+           captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
            dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
            ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
            fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \