nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Wrap long lines for code close by to status report functions

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-12-09 22:48:11 +00:00
parent abad51a4f3
commit 01ded61201
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 66 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

108
easyrsa3/easyrsa
View File

@ -3447,7 +3447,7 @@ fixed_cert_dates() {
# Check offset range # Check offset range
if [ 1 -gt "$start_fix_day_n" ] || [ 365 -lt "$start_fix_day_n" ] if [ 1 -gt "$start_fix_day_n" ] || [ 365 -lt "$start_fix_day_n" ]
then then
die "Fixed off-set out of range [1-365 days]: $start_fix_day_n" die "Fixed off-set range [1-365 days]: $start_fix_day_n"
fi fi
# Set the end fixed day-number of the Year # Set the end fixed day-number of the Year
@ -3478,8 +3478,12 @@ The fixed date will be rolled backward by one year."
busybox date -u -d "${this_year_n}01010000.01" '+%s' busybox date -u -d "${this_year_n}01010000.01" '+%s'
)" )"
start_fix_day_s="$(( New_Year_day_s + start_fix_day_n * 86400 ))" start_fix_day_s="$((
end_fix_day_s="$(( start_fix_day_s + EASYRSA_CERT_EXPIRE * 86400 ))" New_Year_day_s + start_fix_day_n * 86400
))"
end_fix_day_s="$((
start_fix_day_s + EASYRSA_CERT_EXPIRE * 86400
))"
# Convert to date-stamps for SSL input # Convert to date-stamps for SSL input
start_fix_day_d="$( start_fix_day_d="$(
@ -3525,8 +3529,7 @@ The fixed date will be rolled backward by one year."
"$New_Year_day_d" +%s "$New_Year_day_d" +%s
)" )"
# Linux and Windows # Linux and Windows: date.exe does not allow +%s as input
# Windows date.exe does not support format +%s as input
# MacPorts GNU date # MacPorts GNU date
elif this_year_n="$(date -u +%y)"; then elif this_year_n="$(date -u +%y)"; then
@ -3546,15 +3549,18 @@ The fixed date will be rolled backward by one year."
# New Years day date # New Years day date
New_Year_day_d="$( New_Year_day_d="$(
date -u -d "${this_year_n}-01-01 00:00:01Z" '+%Y-%m-%d %H:%M:%SZ' date -u -d "${this_year_n}-01-01 00:00:01Z" \
'+%Y-%m-%d %H:%M:%SZ'
)" )"
# Convert to date-stamps for SSL input # Convert to date-stamps for SSL input
start_fix_day_d="$( start_fix_day_d="$(
date -u -d "$New_Year_day_d +${start_fix_day_n}days" +%Y%m%d%H%M%SZ date -u -d "$New_Year_day_d +${start_fix_day_n}days" \
+%Y%m%d%H%M%SZ
)" )"
end_fix_day_d="$( end_fix_day_d="$(
date -u -d "$New_Year_day_d +${end_fix_day_n}days" +%Y%m%d%H%M%SZ date -u -d "$New_Year_day_d +${end_fix_day_n}days" \
+%Y%m%d%H%M%SZ
)" )"
end_fix_day_s="$( end_fix_day_s="$(
date -u -d "$New_Year_day_d +${end_fix_day_n}days" +%s date -u -d "$New_Year_day_d +${end_fix_day_n}days" +%s
@ -3590,7 +3596,7 @@ cert_date_to_timestamp_s() {
then return then return
# OS dependencies # OS dependencies
# Linux and Windows (FTR: date.exe does not support format +%s as input) # Linux and Windows: date.exe does not allow +%s as input
# MacPorts GNU date # MacPorts GNU date
elif timestamp_s="$( elif timestamp_s="$(
date -d "$in_date" +%s \ date -d "$in_date" +%s \
@ -3606,7 +3612,7 @@ cert_date_to_timestamp_s:
fi fi
} # => cert_date_to_timestamp_s() } # => cert_date_to_timestamp_s()
# Convert system date/time to X509 certificate style date/time (+)offset # Convert system date to X509 certificate style date (+)offset
# TODO minus (-)offset # TODO minus (-)offset
offset_days_to_cert_date() { offset_days_to_cert_date() {
@ -3616,9 +3622,9 @@ offset_days_to_cert_date() {
if busybox date --help > /dev/null 2>&1 if busybox date --help > /dev/null 2>&1
then then
cert_type_date="$( cert_type_date="$(
busybox date -u -d "@$(( $(busybox date +%s) + offset * 86400 ))" \ busybox date -u -d \
"+%b %d %H:%M:%S %Y %Z" \ "@$(( $(busybox date +%s) + offset * 86400 ))" \
2>/dev/null "+%b %d %H:%M:%S %Y %Z" 2>/dev/null
)" )"
return return
@ -3630,7 +3636,7 @@ offset_days_to_cert_date() {
then return then return
# OS dependencies # OS dependencies
# Linux and Windows (FTR: date.exe does not support format +%s as input) # Linux and Windows: date.exe does not allow +%s as input
# MacPorts GNU date # MacPorts GNU date
elif cert_type_date="$( elif cert_type_date="$(
date -u -d "+${offset}days" "+%b %d %H:%M:%S %Y %Z" \ date -u -d "+${offset}days" "+%b %d %H:%M:%S %Y %Z" \
@ -3735,9 +3741,9 @@ ssl_cert_not_before_date() {
fn_ssl_out="$( fn_ssl_out="$(
unset -v EASYRSA_DEBUG unset -v EASYRSA_DEBUG
easyrsa_openssl x509 -in "$1" -noout -startdate easyrsa_openssl x509 -in "$1" -noout -startdate
)" || die "ssl_cert_not_before_date - failed to get startdate" )" || die "ssl_cert_not_before_date - failed: -startdate"
# 'cert_not_before_date' is *not* used, at this time.. # 'cert_not_before_date' is *not* used, at this time..
# disable #shellcheck disable=SC2034 # Prefer to keep the warning # disable #shellcheck disable=SC2034 # Prefer to keep warning
cert_not_before_date="${fn_ssl_out#*=}" cert_not_before_date="${fn_ssl_out#*=}"
unset -v fn_ssl_out unset -v fn_ssl_out
} # => ssl_cert_not_before_date() } # => ssl_cert_not_before_date()
@ -3748,15 +3754,15 @@ ssl_cert_not_after_date() {
fn_ssl_out="$( fn_ssl_out="$(
unset -v EASYRSA_DEBUG unset -v EASYRSA_DEBUG
easyrsa_openssl x509 -in "$1" -noout -enddate easyrsa_openssl x509 -in "$1" -noout -enddate
)" || die "ssl_cert_not_after_date - failed to get enddate" )" || die "ssl_cert_not_after_date - failed: -enddate"
cert_not_after_date="${fn_ssl_out#*=}" cert_not_after_date="${fn_ssl_out#*=}"
unset -v fn_ssl_out unset -v fn_ssl_out
} # => ssl_cert_not_after_date() } # => ssl_cert_not_after_date()
# SC2295: (info): Expansions inside ${..} need to be quoted separately, # SC2295: Expansion inside ${..} need to be quoted separately,
# otherwise they match as patterns. (what-ever that means .. ;-) # otherwise they match as patterns. (what-ever that means ;-)
# Unfortunately, Windows sh.exe has an absolutely ridiculous bug. # Unfortunately, Windows sh.exe has an weird bug.
# Try this in sh.exe: t=' '; s="a${t}b${t}c"; echo "${s%%"${t}"*}" # Try in sh.exe: t=' '; s="a${t}b${t}c"; echo "${s%%"${t}"*}"
# Read db # Read db
# shellcheck disable=SC2295 # shellcheck disable=SC2295
@ -3904,17 +3910,21 @@ revoke_status() {
# Use db translated date # Use db translated date
cert_revoke_date="$cert_type_date" cert_revoke_date="$cert_type_date"
printf '%s%s\n' "$db_status | Serial: $db_serial | " \ printf '%s%s%s\n' \
"Revoked: $cert_revoke_date | Reason: $db_reason | CN: $db_cn" "$db_status | Serial: $db_serial | " \
"Revoked: $cert_revoke_date | " \
"Reason: $db_reason | CN: $db_cn"
} # => revoke_status() } # => revoke_status()
# Renewed status # Renewed status
# renewed certs only remain in the renewed folder until they are revoked # renewed certs only remain in the renewed folder until revoked
# Only ONE renewed cert with unique CN can exist in the renewed folder # Only ONE renewed cert with unique CN can exist in renewed folder
renew_status() { renew_status() {
# Does a Renewed cert exist ? # Does a Renewed cert exist ?
# files in issued are CommonName, files by serial are SerialNumber # files in issued are file name, or in serial are SerialNumber
unset -v cert_file_in cert_is_issued cert_is_serial renew_is_old unset -v cert_file_in cert_is_issued cert_is_serial renew_is_old
# Find renewed/issued/CN # Find renewed/issued/CN
if [ -e "$cert_r_issued" ]; then if [ -e "$cert_r_issued" ]; then
cert_file_in="$cert_r_issued" cert_file_in="$cert_r_issued"
@ -3929,15 +3939,17 @@ renew_status() {
fi fi
# Both should not exist # Both should not exist
[ "$cert_is_issued" ] && [ "$cert_is_serial" ] && die "Too many certs" if [ "$cert_is_issued" ] && [ "$cert_is_serial" ]; then
die "Too many certs"
fi
# If a renewed cert exists # If a renewed cert exists
if [ "$cert_file_in" ]; then if [ "$cert_file_in" ]; then
# get the serial number of the certificate # get the serial number of the certificate
ssl_cert_serial "$cert_file_in" cert_serial ssl_cert_serial "$cert_file_in" cert_serial
# db serial must match certificate serial, otherwise this # db serial must match certificate serial, otherwise
# is an issued cert that replaces a renewed cert # this is an issued cert that replaces a renewed cert
if [ "$db_serial" != "$cert_serial" ]; then if [ "$db_serial" != "$cert_serial" ]; then
information "\ information "\
serial mismatch: serial mismatch:
@ -3948,14 +3960,17 @@ serial mismatch:
fi fi
# Use cert date # Use cert date
ssl_cert_not_after_date "$cert_file_in" # Assigns cert_not_after_date # Assigns cert_not_after_date
ssl_cert_not_after_date "$cert_file_in"
# Highlight renewed/cert_by_serial # Highlight renewed/cert_by_serial
if [ "$renew_is_old" ]; then if [ "$renew_is_old" ]; then
printf '%s%s\n' "*** $db_status | Serial: $db_serial | " \ printf '%s%s\n' \
"*** $db_status | Serial: $db_serial | " \
"Expires: $cert_not_after_date | CN: $db_cn" "Expires: $cert_not_after_date | CN: $db_cn"
else else
printf '%s%s\n' "$db_status | Serial: $db_serial | " \ printf '%s%s\n' \
"$db_status | Serial: $db_serial | " \
"Expires: $cert_not_after_date | CN: $db_cn" "Expires: $cert_not_after_date | CN: $db_cn"
fi fi
@ -3974,7 +3989,7 @@ status() {
verify_ca_init verify_ca_init
# This does not build certs, so do not need support for fixed dates # This does not build certs, so do not need fixed dates
unset -v EASYRSA_FIX_OFFSET EASYRSA_BATCH EASYRSA_SILENT unset -v EASYRSA_FIX_OFFSET EASYRSA_BATCH EASYRSA_SILENT
# If no target file then add Notice # If no target file then add Notice
@ -3994,7 +4009,8 @@ $EASYRSA_CERT_RENEW days (--days):"
notice "\ notice "\
* Showing certificates which have been renewed but NOT revoked: * Showing certificates which have been renewed but NOT revoked:
*** Marks those which require 'rewind-renew' before they can be revoked." *** Marks those which require 'rewind-renew' \
before they can be revoked."
;; ;;
*) warn "Unrecognised report: $report" *) warn "Unrecognised report: $report"
esac esac
@ -4060,8 +4076,11 @@ detect_host() {
[ "${OS}" ] && easyrsa_host_test="${OS}" [ "${OS}" ] && easyrsa_host_test="${OS}"
# shellcheck disable=SC2016 # expansion inside '' blah # shellcheck disable=SC2016 # expansion inside '' blah
easyrsa_ksh='@(#)MIRBSD KSH R39-w32-beta14 $Date: 2013/06/28 21:28:57 $' easyrsa_ksh=\
[ "${KSH_VERSION}" = "${easyrsa_ksh}" ] && easyrsa_host_test="${easyrsa_ksh}" '@(#)MIRBSD KSH R39-w32-beta14 $Date: 2013/06/28 21:28:57 $'
[ "${KSH_VERSION}" = "${easyrsa_ksh}" ] && \
easyrsa_host_test="${easyrsa_ksh}"
unset -v easyrsa_ksh unset -v easyrsa_ksh
# If not Windows then nix # If not Windows then nix
@ -4074,7 +4093,8 @@ detect_host() {
easyrsa_shell="$SHELL (Git)" easyrsa_shell="$SHELL (Git)"
easyrsa_win_git_bash="${EXEPATH}" easyrsa_win_git_bash="${EXEPATH}"
# If found then set openssl NOW! # If found then set openssl NOW!
#[ -e /usr/bin/openssl ] && set_var EASYRSA_OPENSSL /usr/bin/openssl #[ -e /usr/bin/openssl ] && \
# set_var EASYRSA_OPENSSL /usr/bin/openssl
fi fi
else else
easyrsa_host_os=nix easyrsa_host_os=nix
@ -4089,8 +4109,10 @@ detect_host() {
host_out="Host: dev" host_out="Host: dev"
fi fi
host_out="${host_out} | $easyrsa_host_os | $easyrsa_uname | $easyrsa_shell" host_out="\
host_out="${host_out}${easyrsa_win_git_bash+ | "$easyrsa_win_git_bash"}" ${host_out} | $easyrsa_host_os | $easyrsa_uname | $easyrsa_shell"
host_out="\
${host_out}${easyrsa_win_git_bash+ | "$easyrsa_win_git_bash"}"
unset -v easyrsa_ver_test easyrsa_host_test unset -v easyrsa_ver_test easyrsa_host_test
} # => detect_host() } # => detect_host()
@ -4127,10 +4149,12 @@ $EASYRSA_ALGO_PARAMS"
;; ;;
ed) ed)
# Verify Edwards curve # Verify Edwards curve
easyrsa_openssl genpkey -algorithm "$EASYRSA_CURVE" > /dev/null \ easyrsa_openssl genpkey -algorithm "$EASYRSA_CURVE" \
|| die "Edwards Curve $EASYRSA_CURVE not found." > /dev/null || \
die "Edwards Curve $EASYRSA_CURVE not found."
;; ;;
*) die "Alg '$EASYRSA_ALGO' is invalid: must be 'rsa', 'ec' or 'ed'" *) die "\
Alg '$EASYRSA_ALGO' is invalid: must be 'rsa', 'ec' or 'ed'"
esac esac
} # => verify_algo_params() } # => verify_algo_params()