nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow default CA generation method to be unit-tested

Browse Source 
If 'easyrsa' is being run by the unit-test then allow the default method
for 'build-ca' to be exercised.

The default 'easyrsa' method is to use temp-files, generated by EasyRSA,
to pass the CA passphrase, provided by the user, to the SSL command.

The normal 'unit-test' method to use a passphrase is to configure EasyRSA
ommand line options '--passin' and '--passout'.

The change made here is to simulate user-interaction and to supply a
default passphrase, as a user, to the SSL command.
To NOT use EasyRSA command line options to set any passphrase.
ONLY when being run by the unit-test.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-12-11 22:37:40 +00:00
parent 8ae6bca3dc
commit 0063de0d88
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
easyrsa3/easyrsa
View File

@ -1370,23 +1370,34 @@ Please update openssl-easyrsa.cnf to the latest official release."
: # passphrase defined
else
# Assign passphrase vars and temp file
p=""
q=""
in_key_pass_tmp="$(easyrsa_mktemp)" || \
die "Failed to create temporary file"
out_key_pass_tmp="$(easyrsa_mktemp)" || \
die "Failed to create temporary file"
# Get passphrase
prompt="Enter New CA Key Passphrase: "
get_passphrase p
# Dirty way to unit-test default behavior
if [ "$ERSA_UTEST_VERSION" ]; then
# Prove this works by changing passwords
# use: ERSA_UTEST_VERSION=9 easyrsa build-ca
p="EasyRSA"
q="EasyRSA"
unset -v EASYRSA_PASSIN EASYRSA_PASSOUT
warn "SPECIAL unit-test CA password!"
# Confirm passphrase
prompt="Confirm New CA Key Passphrase: "
get_passphrase q
else
p=""
q=""
# Get passphrase p
prompt="Enter New CA Key Passphrase: "
get_passphrase p
# Confirm passphrase q
prompt="Confirm New CA Key Passphrase: "
get_passphrase q
fi
# Validate passphrase
if [ "$p" = "$q" ]; then
if [ "$p" ] && [ "$p" = "$q" ]; then
printf "%s" "$p" > "$in_key_pass_tmp"
printf "%s" "$p" > "$out_key_pass_tmp"
unset -v p q