From 81acd49bd8d5be3a58f5144479c0ed8d0c3e43ed Mon Sep 17 00:00:00 2001
From: florian <florian@openbsd.org>
Date: Sat, 10 Feb 2018 05:56:47 +0000
Subject: [PATCH] Load RFC 7217 key material and generate if it does not
 already exist.

Add soii.key to changelist (pointed out by semarie) and mtree/special
(suggest by Craig Skinner).

OK naddy, sthen, rpe, tb
---
 etc/changelist    | 3 ++-
 etc/mtree/special | 3 ++-
 etc/netstart      | 5 ++++-
 etc/rc            | 8 +++++++-
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/etc/changelist b/etc/changelist
index 7c73d8958c3..dd34303c3b1 100644
--- a/etc/changelist
+++ b/etc/changelist
@@ -1,4 +1,4 @@
-#	$OpenBSD: changelist,v 1.118 2018/01/19 00:19:58 gsoares Exp $
+#	$OpenBSD: changelist,v 1.119 2018/02/10 05:56:47 florian Exp $
 #
 # List of files which the security script backs up and checks
 # for modifications.
@@ -115,6 +115,7 @@
 /etc/services
 /etc/shells
 +/etc/snmpd.conf
++/etc/soii.key
 +/etc/spwd.db
 /etc/ssh/ssh_config
 +/etc/ssh/ssh_host_dsa_key
diff --git a/etc/mtree/special b/etc/mtree/special
index a2eec3e4476..c7712b025ed 100644
--- a/etc/mtree/special
+++ b/etc/mtree/special
@@ -1,4 +1,4 @@
-#	$OpenBSD: special,v 1.124 2017/05/03 11:55:36 gsoares Exp $
+#	$OpenBSD: special,v 1.125 2018/02/10 05:56:47 florian Exp $
 #
 # Hand-crafted mtree specification for the dangerous files.
 #
@@ -94,6 +94,7 @@ shells		type=file mode=0644 uname=root gname=wheel
 skey		type=dir mode=01730 uname=root gname=auth optional
 ..	#skey
 snmpd.conf	type=file mode=0600 uname=root gname=wheel optional
+soii.key	type=file mode=0600 uname=root gname=wheel optional
 spwd.db		type=file mode=0640 uname=root gname=_shadow
 ssh		type=dir mode=0755 uname=root gname=wheel optional
 ssh_config	type=file mode=0644 uname=root gname=wheel
diff --git a/etc/netstart b/etc/netstart
index 09c7dcb2579..820c1607deb 100644
--- a/etc/netstart
+++ b/etc/netstart
@@ -1,6 +1,6 @@
 #!/bin/sh -
 #
-#	$OpenBSD: netstart,v 1.188 2018/02/06 19:53:50 tb Exp $
+#	$OpenBSD: netstart,v 1.189 2018/02/10 05:56:47 florian Exp $
 
 # Turn off Strict Bourne shell mode.
 set +o sh
@@ -194,6 +194,9 @@ if $PRINT_ONLY && (($# == 0)); then
 	exit 1
 fi
 
+$PRINT_ONLY || [[ ! -f /etc/soii.key ]] ||
+	sysctl -q "net.inet6.ip6.soiikey=$(</etc/soii.key)"
+
 # If we were invoked with a list of interface names, just reconfigure these
 # interfaces (or bridges), add default routes and return.
 if (($# > 0)); then
diff --git a/etc/rc b/etc/rc
index c88e13ce7ab..2fa6093a1fa 100644
--- a/etc/rc
+++ b/etc/rc
@@ -1,4 +1,4 @@
-#	$OpenBSD: rc,v 1.523 2017/11/09 11:02:10 tb Exp $
+#	$OpenBSD: rc,v 1.524 2018/02/10 05:56:47 florian Exp $
 
 # System startup script run by init on autoboot or after single-user.
 # Output and error are redirected to console by init, and the console is the
@@ -158,6 +158,12 @@ make_keys() {
 	fi
 
 	ssh-keygen -A
+
+	if [[ ! -f /etc/soii.key ]]; then
+		openssl rand -hex 16 > /etc/soii.key && \
+		    chmod 600 /etc/soii.key && sysctl -q \
+		    "net.inet6.ip6.soiikey=$(</etc/soii.key)"
+	fi
 }
 
 # Re-link libraries, placing the objects in a random order.
-- 
2.20.1