starter: Don't generate a key/certificate if ipsec.secrets does not exist

diff --git a/src/starter/Makefile.am b/src/starter/Makefile.am
index 873c20acedb389a5a8492ef8edb435062628bbf4..70efcd85461155f88616aae31acfb6209cf04ab6 100644 (file)
--- a/src/starter/Makefile.am
+++ b/src/starter/Makefile.am
@@ -47,10 +47,6 @@ if USE_LOAD_WARNING
   AM_CPPFLAGS += -DLOAD_WARNING
 endif
 
-if USE_SCEPCLIENT
-  AM_CPPFLAGS += -DGENERATE_SELFCERT
-endif
-
 keywords.c:    $(srcdir)/keywords.txt $(srcdir)/keywords.h
                $(AM_V_GEN) \
                $(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@

diff --git a/src/starter/starter.c b/src/starter/starter.c
index 45c28d3cc933dc62b5c619798f43ac6947aeb709..51a42a504cb9c00bc0c56f8aa907816856c3aa90 100644 (file)
--- a/src/starter/starter.c
+++ b/src/starter/starter.c
@@ -257,68 +257,6 @@ static void fatal_signal_handler(int signal)
        abort();
 }
 
-#ifdef GENERATE_SELFCERT
-static void generate_selfcert()
-{
-       const char *secrets_file;
-       struct stat stb;
-
-       secrets_file = lib->settings->get_str(lib->settings,
-                                                       "charon.plugins.stroke.secrets_file", SECRETS_FILE);
-
-       /* if ipsec.secrets file is missing then generate RSA default key pair */
-       if (stat(secrets_file, &stb) != 0)
-       {
-               mode_t oldmask;
-               FILE *f;
-               uid_t uid = 0;
-               gid_t gid = 0;
-
-#ifdef IPSEC_GROUP
-               {
-                       char buf[1024];
-                       struct group group, *grp;
-
-                       if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 &&     grp)
-                       {
-                               gid = grp->gr_gid;
-                       }
-               }
-#endif
-#ifdef IPSEC_USER
-               {
-                       char buf[1024];
-                       struct passwd passwd, *pwp;
-
-                       if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 &&     pwp)
-                       {
-                               uid = pwp->pw_uid;
-                       }
-               }
-#endif
-               ignore_result(setegid(gid));
-               ignore_result(seteuid(uid));
-               ignore_result(system(IPSEC_SCRIPT " scepclient --out pkcs1 --out cert-self --quiet"));
-               ignore_result(seteuid(0));
-               ignore_result(setegid(0));
-
-               /* ipsec.secrets is root readable only */
-               oldmask = umask(0066);
-
-               f = fopen(secrets_file, "w");
-               if (f)
-               {
-                       fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
-                       fprintf(f, "\n");
-                       fprintf(f, ": RSA myKey.der\n");
-                       fclose(f);
-               }
-               ignore_result(chown(secrets_file, uid, gid));
-               umask(oldmask);
-       }
-}
-#endif /* GENERATE_SELFCERT */
-
 static bool check_pid(char *pid_file)
 {
        struct stat stb;
@@ -604,10 +542,6 @@ int main (int argc, char **argv)
                exit(LSB_RC_SUCCESS);
        }
 
-#ifdef GENERATE_SELFCERT
-       generate_selfcert();
-#endif
-
        /* fork if we're not debugging stuff */
        if (!no_fork)
        {