I'm not writing any isakmpd.policy(5) file.  I don't know anybody sane
we do.  I'd like to enforce some policy based on what I write in
ipsec.conf(5)...  So I don't understand why I have to pass '-K' in
every of the machine I setup.  If I don't specify any policy file, then
I'd assume isakmpd(8) would do the right thing.

Diff below makes '-K' the default if isakmpd.policy doesn't exist AND
you didn't specify a "Policy-file".

ok?

Index: conf.c
===================================================================
RCS file: /cvs/src/sbin/isakmpd/conf.c,v
retrieving revision 1.107
diff -u -p -r1.107 conf.c
--- conf.c      27 Oct 2017 08:29:32 -0000      1.107
+++ conf.c      4 Jan 2018 11:41:25 -0000
@@ -514,7 +514,6 @@ conf_load_defaults(int tr)
        conf_set(tr, "General", "Exchange-max-time", CONF_DFLT_EXCH_MAX_TIME,
            0, 1);
        conf_set(tr, "General", "Use-Keynote", CONF_DFLT_USE_KEYNOTE, 0, 1);
-       conf_set(tr, "General", "Policy-file", CONF_DFLT_POLICY_FILE, 0, 1);
        conf_set(tr, "General", "Pubkey-directory", CONF_DFLT_PUBKEY_DIR, 0,
            1);
 
Index: policy.c
===================================================================
RCS file: /cvs/src/sbin/isakmpd/policy.c,v
retrieving revision 1.97
diff -u -p -r1.97 policy.c
--- policy.c    22 Nov 2013 04:12:47 -0000      1.97
+++ policy.c    4 Jan 2018 11:42:07 -0000
@@ -1937,14 +1937,18 @@ policy_init(void)
 
        /* Get policy file from configuration.  */
        policy_file = conf_get_str("General", "Policy-file");
-       if (!policy_file)
-               policy_file = CONF_DFLT_POLICY_FILE;
-
-       /* Open policy file.  */
-       fd = monitor_open(policy_file, O_RDONLY, 0);
-       if (fd == -1)
-               log_fatal("policy_init: open (\"%s\", O_RDONLY) failed",
-                   policy_file);
+       if (!policy_file) {
+               /* Try to open default policy file.  */
+               fd = monitor_open(CONF_DFLT_POLICY_FILE, O_RDONLY, 0);
+               if (fd == -1)
+                       return;
+       } else {
+               /* Open policy file.  */
+               fd = monitor_open(policy_file, O_RDONLY, 0);
+               if (fd == -1)
+                       log_fatal("policy_init: open (\"%s\", O_RDONLY) failed",
+                           policy_file);
+       }
 
        /* Check file modes and collect file size */
        if (check_file_secrecy_fd(fd, policy_file, &sz)) {

Reply via email to