starter: Remove IPsec stack detection

Checking specifically for /proc/net/pfkey is not ideal as af_key will
eventually be removed in Linux kernels.  Support for KLIPS is long gone.
The detection also wasn't used for anything anymore (failures were just
ignored since the ports to BSD-based systems).  And modprobing doesn't seem
to be necessary either (charon-systemd doesn't do that, for instance).

diff --git a/src/starter/Android.mk b/src/starter/Android.mk
index e882cc7e20ab89493f8acd9d1dd049cd673f5ca5..a399f6cd2161b5ea8c653a1ad3907fd4440c4c4c 100644 (file)
--- a/src/starter/Android.mk
+++ b/src/starter/Android.mk
@@ -6,8 +6,7 @@ starter_SOURCES := \
 starter.c files.h \
 parser/parser.c parser/lexer.c parser/conf_parser.c parser/conf_parser.h \
 args.c args.h confread.c confread.h keywords.c keywords.h cmp.c cmp.h \
-invokecharon.c invokecharon.h starterstroke.c starterstroke.h \
-netkey.c netkey.h klips.c klips.h
+invokecharon.c invokecharon.h starterstroke.c starterstroke.h
 
 LOCAL_SRC_FILES := $(filter %.c,$(starter_SOURCES))
 

diff --git a/src/starter/Makefile.am b/src/starter/Makefile.am
index 457c0650e045ccf1f0b079fee87697beb868f333..759d179d3ea64ea3edd8732cfb4733a0fc9f9413 100644 (file)
--- a/src/starter/Makefile.am
+++ b/src/starter/Makefile.am
@@ -4,8 +4,7 @@ ipsec_PROGRAMS = starter
 starter_SOURCES = \
 starter.c files.h \
 args.c args.h confread.c confread.h keywords.c keywords.h cmp.c cmp.h \
-invokecharon.c invokecharon.h starterstroke.c starterstroke.h \
-netkey.c netkey.h klips.c klips.h
+invokecharon.c invokecharon.h starterstroke.c starterstroke.h
 
 # parser is also used by tests
 noinst_LTLIBRARIES = libstarter.la

diff --git a/src/starter/files.h b/src/starter/files.h
index 76cdaa986379dfbd5cc06cae7e1c46e121a927d8..f2f8225355c0a82a4c0b32a52a54c75a5406b90a 100644 (file)
--- a/src/starter/files.h
+++ b/src/starter/files.h
@@ -15,10 +15,6 @@
 #ifndef _STARTER_FILES_H_
 #define _STARTER_FILES_H_
 
-#define PROC_NETKEY             "/proc/net/pfkey"
-#define PROC_KLIPS              "/proc/net/pf_key"
-#define PROC_MODULES    "/proc/modules"
-
 #define CONFIG_FILE     IPSEC_CONFDIR "/ipsec.conf"
 #define SECRETS_FILE    IPSEC_CONFDIR "/ipsec.secrets"
 
@@ -28,7 +24,4 @@ extern char *daemon_name;
 extern char *cmd;
 extern char *pid_file;
 
-#define DYNIP_DIR       IPSEC_PIDDIR "/dynip"
-
 #endif /* _STARTER_FILES_H_ */
-

diff --git a/src/starter/klips.c b/src/starter/klips.c
deleted file mode 100644 (file)
index 2216546..0000000
--- a/src/starter/klips.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/* strongSwan KLIPS starter
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <stdlib.h>
-
-#include <library.h>
-#include <utils/debug.h>
-
-#include "files.h"
-
-bool starter_klips_init(void)
-{
-       struct stat stb;
-
-       if (stat(PROC_KLIPS, &stb) != 0)
-       {
-               /* ipsec module makes the pf_key proc interface visible */
-               if (stat(PROC_MODULES, &stb) == 0)
-               {
-                       ignore_result(system("modprobe -qv ipsec"));
-               }
-
-               /* now test again */
-               if (stat(PROC_KLIPS, &stb) != 0)
-               {
-                       DBG2(DBG_APP, "kernel appears to lack the KLIPS IPsec stack");
-                       return FALSE;
-               }
-       }
-
-       /* load crypto algorithm modules */
-       ignore_result(system("modprobe -qv ipsec_aes"));
-       ignore_result(system("modprobe -qv ipsec_blowfish"));
-       ignore_result(system("modprobe -qv ipsec_sha2"));
-
-       DBG2(DBG_APP, "found KLIPS IPsec stack");
-       return TRUE;
-}
-
-void starter_klips_cleanup(void)
-{
-       if (system("type eroute > /dev/null 2>&1") == 0)
-       {
-               ignore_result(system("spi --clear"));
-               ignore_result(system("eroute --clear"));
-       }
-       else if (system("type setkey > /dev/null 2>&1") == 0)
-       {
-               ignore_result(system("setkey -F"));
-               ignore_result(system("setkey -FP"));
-       }
-       else
-       {
-               DBG1(DBG_APP, "WARNING: cannot flush IPsec state/policy database");
-       }
-}
-

diff --git a/src/starter/klips.h b/src/starter/klips.h
deleted file mode 100644 (file)
index 1a527d1..0000000
--- a/src/starter/klips.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/* strongSwan KLIPS initialization and cleanup
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_KLIPS_H_
-#define _STARTER_KLIPS_H_
-
-extern bool starter_klips_init (void);
-extern void starter_klips_cleanup (void);
-
-#endif /* _STARTER_KLIPS_H_ */
-

diff --git a/src/starter/netkey.c b/src/starter/netkey.c
deleted file mode 100644 (file)
index b150d3e..0000000
--- a/src/starter/netkey.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/* strongSwan netkey starter
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <stdlib.h>
-
-#include <library.h>
-#include <utils/debug.h>
-
-#include "files.h"
-
-bool starter_netkey_init(void)
-{
-       struct stat stb;
-
-       if (stat(PROC_NETKEY, &stb) != 0)
-       {
-               /* af_key module makes the netkey proc interface visible */
-               if (stat(PROC_MODULES, &stb) == 0)
-               {
-                       ignore_result(system("modprobe -qv af_key"));
-               }
-
-               /* now test again */
-               if (stat(PROC_NETKEY, &stb) != 0)
-               {
-                       DBG2(DBG_APP, "kernel appears to lack the native netkey IPsec stack");
-                       return FALSE;
-               }
-       }
-
-       /* make sure that all required IPsec modules are loaded */
-       if (stat(PROC_MODULES, &stb) == 0)
-       {
-               ignore_result(system("modprobe -qv ah4"));
-               ignore_result(system("modprobe -qv esp4"));
-               ignore_result(system("modprobe -qv ipcomp"));
-               ignore_result(system("modprobe -qv xfrm4_tunnel"));
-               ignore_result(system("modprobe -qv xfrm_user"));
-       }
-
-       DBG2(DBG_APP, "found netkey IPsec stack");
-       return TRUE;
-}

diff --git a/src/starter/netkey.h b/src/starter/netkey.h
deleted file mode 100644 (file)
index bc71af2..0000000
--- a/src/starter/netkey.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* strongSwan netkey initialization and cleanup
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_NETKEY_H_
-#define _STARTER_NETKEY_H_
-
-extern bool starter_netkey_init (void);
-
-#endif /* _STARTER_NETKEY_H_ */
-

diff --git a/src/starter/starter.c b/src/starter/starter.c
index 5038429bd11fa9468622b388d6fc0107396667b2..506fe47e2305fcbb7283cb768abb74862596d62e 100644 (file)
--- a/src/starter/starter.c
+++ b/src/starter/starter.c
@@ -41,8 +41,6 @@
 #include "files.h"
 #include "starterstroke.h"
 #include "invokecharon.h"
-#include "netkey.h"
-#include "klips.h"
 #include "cmp.h"
 
 #ifndef LOG_AUTHPRIV
@@ -522,19 +520,6 @@ int main (int argc, char **argv)
                exit(LSB_RC_INVALID_ARGUMENT);
        }
 
-#ifndef SKIP_KERNEL_IPSEC_MODPROBES
-       /* determine if we have a native netkey IPsec stack */
-       if (!starter_netkey_init())
-       {
-               DBG1(DBG_APP, "no netkey IPsec stack detected");
-               if (!starter_klips_init())
-               {
-                       DBG1(DBG_APP, "no KLIPS IPsec stack detected");
-                       DBG1(DBG_APP, "no known IPsec stack detected, ignoring!");
-               }
-       }
-#endif
-
        last_reload = time_monotonic(NULL);
 
        if (check_pid(starter_pid_file))