nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove CA specific EASYRSA_CA_EXTRA_EXTS, not required.

Browse Source 
* EASYRSA_CA_EXTRA_EXTS: Created to avoid clash with EASYRSA_EXTRA_EXTS

EASYRSA_CA_EXTRA_EXTS was an interim hack to avoid triggering a code
injection buried deep inside easyrsa_openssl(), when building a CA.
Fixed by Commit: 057be57825616199d125dfffbc5abfa9efaae792

Remove EASYRSA_CA_EXTRA_EXTS:
Created by Commit: 6f138abb5b091fe7715fa7c8c6369d7704b6f177

The result is for all extra extensions to be subject to the same code.
The CA no longer has to dodge the code injection.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-04-18 23:58:56 +01:00
parent 7c2dd54214
commit 1b8a1122d3
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
easyrsa3/easyrsa
View File

@ -896,8 +896,6 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
# example: "-addext foo,a:b -addext bah,c:d -addext baz e:f,g"
[ "${EASYRSA_EXTRA_EXTS%% *}" = '-addext' ] || \
die "EASYRSA_EXTRA_EXTS: $EASYRSA_EXTRA_EXTS"
EASYRSA_CA_EXTRA_EXTS="$EASYRSA_EXTRA_EXTS"
unset -v EASYRSA_EXTRA_EXTS
fi
# Choose SSL Library version (1, 2(LibreSSL) or 3) and build CA
@ -972,7 +970,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
# create the CA keypair:
easyrsa_openssl req -utf8 -new \
-key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \
$opts $EASYRSA_CA_EXTRA_EXTS \
$opts $EASYRSA_EXTRA_EXTS \
${crypto_opts:+ "$crypto_opts"} \
${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
${out_key_pass_tmp:+ -passin file:"$out_key_pass_tmp"} \
@ -1041,7 +1039,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
easyrsa_openssl req -utf8 -new \
-key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \
$opts $EASYRSA_CA_EXTRA_EXTS \
$opts $EASYRSA_EXTRA_EXTS \
${crypto_opts:+ "$crypto_opts"} \
${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
${out_key_pass_tmp:+ -passin file:"$out_key_pass_tmp"} \