Don't check for file presence on inline files

PATCH Superseded David Sommerseth 3 participants 4 messages Jan 16, 2012

Share & tools

David Sommerseth

author

2012-01-16 10:31 UTC #0 lore raw

PATCH 1/1 Don't check for file presence on inline files

The configuration file supports inline files for --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth. When this is used, the filename is set to [[INLINE]] (defined by INLINE_FILE_TAG).

If the filename is set to INLINE_FILE_TAG for these options, don't call check_file_access().

Signed-off-by David Sommerseth <[email protected]...>

---
 options.c |   37 ++++++++++++++++++++++++++-----------
 1 files changed, 26 insertions(+), 11 deletions(-)

options.c +26 ~~-11~~

index 562c6f6..573bde5 100644
@@ -2653,24 +2653,39 @@ options_postprocess_filechecks (struct options *options)
 
   /* ** SSL/TLS/crypto related files ** */
 #ifdef USE_SSL
-  errs |= check_file_access (CHKACC_FILE, options->dh_file, R_OK, "--dh");
-  errs |= check_file_access (CHKACC_FILE, options->ca_file, R_OK, "--ca");
+  if( options->dh_file && !streq(options->dh_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->dh_file, R_OK, "--dh");
+
   errs |= check_file_access (CHKACC_FILE, options->ca_path, R_OK, "--capath");
-  errs |= check_file_access (CHKACC_FILE, options->cert_file, R_OK, "--cert");
-  errs |= check_file_access (CHKACC_FILE, options->extra_certs_file, R_OK,
-                             "--extra-certs");
-  errs |= check_file_access (CHKACC_FILE, options->priv_key_file, R_OK,
-                             "--key");
-  errs |= check_file_access (CHKACC_FILE, options->pkcs12_file, R_OK,
-                             "--pkcs12");
+
+  if( options->ca_file && !streq(options->ca_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->ca_file, R_OK, "--ca");
+
+  if( options->cert_file && !streq(options->cert_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->cert_file, R_OK, "--cert");
+
+  if( options->extra_certs_file && !streq(options->extra_certs_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->extra_certs_file, R_OK,
+                               "--extra-certs");
+
+  if( options->priv_key_file && !streq(options->priv_key_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->priv_key_file, R_OK,
+                               "--key");
+
+  if( options->pkcs12_file && !streq(options->pkcs12_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->pkcs12_file, R_OK,
+                               "--pkcs12");
+
   if (options->ssl_flags & SSLF_CRL_VERIFY_DIR)
     errs |= check_file_access (CHKACC_FILE, options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");
   else
     errs |= check_file_access (CHKACC_FILE, options->crl_file, R_OK,
                                "--crl-verify");
-  errs |= check_file_access (CHKACC_FILE, options->tls_auth_file, R_OK,
-                             "--tls-auth");
+
+  if( options->tls_auth_file && !streq(options->tls_auth_file, INLINE_FILE_TAG) )
+    errs |= check_file_access (CHKACC_FILE, options->tls_auth_file, R_OK,
+                               "--tls-auth");
 #endif /* USE_SSL */
 #ifdef USE_CRYPTO
   errs |= check_file_access (CHKACC_FILE, options->shared_secret_file, R_OK,

Signature · 1 line

1.7.4.4

David Sommerseth

author

2012-01-16 11:04 UTC #1 lore raw

PATCH v2 1/1 Don't check for file presence on inline files

If the filename is set to INLINE_FILE_TAG for these options, don't call check_file_access().

[v2 Simplify the code, using a flag to check_file_access()]

Signed-off-by David Sommerseth <[email protected]...>

---
 options.c |   23 +++++++++++++++--------
 1 files changed, 15 insertions(+), 8 deletions(-)

options.c +15 -8

index 562c6f6..e7e6565 100644
@@ -2603,6 +2603,7 @@ options_postprocess_mutate (struct options *o)
 #define CHKACC_FILE (1<<0)       /** Check for a file/directory precense */
 #define CHKACC_DIRPATH (1<<1)    /** Check for directory precense where a file should reside */
 #define CHKACC_FILEXSTWR (1<<2)  /** If file exists, is it writable? */
+#define CHKACC_INLINE (1<<3)     /** File is present if it's an inline file */
 
 static bool
 check_file_access(const int type, const char *file, const int mode, const char *opt)

@@ -2613,6 +2614,10 @@ check_file_access(const int type, const char *file, const int mode, const char *
   if (!file)
       return false;
 
+  /* If this may be an inline file, and the proper inline "filename" is set - no issues */
+  if ((type & CHKACC_INLINE) && streq(file, INLINE_FILE_TAG) )
+    return false;
+
   /* Is the directory path leading to the given file accessible? */
   if (type & CHKACC_DIRPATH)
     {

@@ -2653,27 +2658,29 @@ options_postprocess_filechecks (struct options *options)
 
   /* ** SSL/TLS/crypto related files ** */
 #ifdef USE_SSL
-  errs |= check_file_access (CHKACC_FILE, options->dh_file, R_OK, "--dh");
-  errs |= check_file_access (CHKACC_FILE, options->ca_file, R_OK, "--ca");
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->dh_file, R_OK, "--dh");
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->ca_file, R_OK, "--ca");
   errs |= check_file_access (CHKACC_FILE, options->ca_path, R_OK, "--capath");
-  errs |= check_file_access (CHKACC_FILE, options->cert_file, R_OK, "--cert");
-  errs |= check_file_access (CHKACC_FILE, options->extra_certs_file, R_OK,
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->cert_file, R_OK, "--cert");
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->extra_certs_file, R_OK,
                              "--extra-certs");
-  errs |= check_file_access (CHKACC_FILE, options->priv_key_file, R_OK,
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->priv_key_file, R_OK,
                              "--key");
-  errs |= check_file_access (CHKACC_FILE, options->pkcs12_file, R_OK,
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->pkcs12_file, R_OK,
                              "--pkcs12");
+
   if (options->ssl_flags & SSLF_CRL_VERIFY_DIR)
     errs |= check_file_access (CHKACC_FILE, options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");
   else
     errs |= check_file_access (CHKACC_FILE, options->crl_file, R_OK,
                                "--crl-verify");
-  errs |= check_file_access (CHKACC_FILE, options->tls_auth_file, R_OK,
+
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->tls_auth_file, R_OK,
                              "--tls-auth");
 #endif /* USE_SSL */
 #ifdef USE_CRYPTO
-  errs |= check_file_access (CHKACC_FILE, options->shared_secret_file, R_OK,
+  errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->shared_secret_file, R_OK,
                              "--secret");
   errs |= check_file_access (CHKACC_DIRPATH|CHKACC_FILEXSTWR,
                              options->packet_id_file, R_OK|W_OK, "--replay-persist");

Signature · 1 line

1.7.4.4

Gert Doering

2012-01-16 11:06 UTC #2 lore raw

Hi,

Quoted 8 lines · David Sommerseth

The configuration file supports inline files for --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth. When this is used, the filename is set to [[INLINE]] (defined by INLINE_FILE_TAG).
If the filename is set to INLINE_FILE_TAG for these options, don't call check_file_access().
[v2 Simplify the code, using a flag to check_file_access()]

ACK!

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

2012-01-16 11:15 UTC #3 lore raw

In reply to David Sommerseth

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 5 lines · David Sommerseth

The configuration file supports inline files for --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth. When this is used, the filename is set to [[INLINE]] (defined by INLINE_FILE_TAG).

Quoted 8 lines

If the filename is set to INLINE_FILE_TAG for these options, don't call check_file_access().
[v2 Simplify the code, using a flag to check_file_access()]
Signed-off-by David Sommerseth <[email protected]...> --- options.c | 23
+++++++++++++++-------- 1 files changed, 15 insertions(+), 8 deletions(-)

Applied to master on -testing and -stable trees.

commit 06e781f885125b05de0a731743acd90d4492a435

Author: David Sommerseth <[email protected]...>
Date:   Mon Jan 16 12:00:33 2012 +0100

    Signed-off-by: David Sommerseth <[email protected]...>
    Acked-by: Gert Doering <[email protected]...>

kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8UBugACgkQDC186MBRfrp8cwCfT8dwBmDTEnctTskfPZKCupxF /LkAnA3Yo850ws19VLT0380fJbwI+GhX
=TeDU
-----END PGP SIGNATURE-----