Skip to content

Commit

Permalink
Change openssl PKA engine loading
Browse files Browse the repository at this point in the history
Change openssl PKA engine loading by removing the global openssl configuration
file that loads the PKA engine (openssl.cnf.mlnx) and loading the engine in the
openssl engine code

Signed-off-by: Feras Bisharat <fbisharat@nvidia.com>
  • Loading branch information
ferasbi committed Jan 4, 2024
1 parent 5737988 commit f515b7b
Show file tree
Hide file tree
Showing 16 changed files with 11 additions and 2,669 deletions.
1 change: 0 additions & 1 deletion debian/strongswan.postinst
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
#!/bin/sh
set -e

cp -f /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf.orig
# Use the new strongswan.service instead of the legacy strongswan-starter
# systemctl unmask strongswan-starter.service
# systemctl enable strongswan-starter.service
Expand Down
1 change: 0 additions & 1 deletion debian/strongswan.prerm
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
#!/bin/sh
set -e

cp -f /etc/ssl/openssl.cnf.orig /etc/ssl/openssl.cnf
systemctl disable strongswan-starter.service
systemctl disable strongswan.service

Expand Down
3 changes: 0 additions & 3 deletions init/systemd/strongswan.service.in
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,7 @@ After=network-online.target

[Service]
Type=notify
ExecStartPre=/bin/cp -f /etc/ssl/openssl.cnf.orig /etc/ssl/openssl.cnf
ExecStart=@SBINDIR@/charon-systemd
ExecStartPost=/bin/sleep 2
ExecStartPost=/bin/bash -c 'if lscpu | grep Flags | grep sha1 | grep sha2 | grep -q aes 2>/dev/null; then /bin/cp -f /etc/ssl/openssl.cnf.mlnx /etc/ssl/openssl.cnf; fi'
ExecStartPost=@SBINDIR@/swanctl --load-all --noprompt
ExecReload=@SBINDIR@/swanctl --reload
ExecReload=@SBINDIR@/swanctl --load-all --noprompt
Expand Down
13 changes: 0 additions & 13 deletions install-config
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,5 @@ set -e
OS=$(lsb_release -i -s)
UV=$(lsb_release -r -s)

if [ "$OS" = "Ubuntu" ]
then
if [ "$UV" = "22.04" ]
then
cp -f openssl-conf/Ubuntu22_04/openssl.cnf debian/strongswan/etc/ssl/openssl.cnf.mlnx
else
cp -f openssl-conf/Ubuntu20_04/openssl.cnf debian/strongswan/etc/ssl/openssl.cnf.mlnx
fi
elif [ "$OS" = "Debian" ]
then
cp -f openssl-conf/Debian10/openssl.cnf debian/strongswan/etc/ssl/openssl.cnf.mlnx
fi

cp -f mlnx-conf/BFL.swanctl.conf debian/strongswan/etc/swanctl/conf.d
cp -f mlnx-conf/BFR.swanctl.conf debian/strongswan/etc/swanctl/conf.d
Loading

0 comments on commit f515b7b

Please sign in to comment.