From 1b8a1122d37fbed937014e2d0ba8febb30030a9c Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Mon, 18 Apr 2022 23:58:56 +0100 Subject: [PATCH] Remove CA specific EASYRSA_CA_EXTRA_EXTS, not required. * EASYRSA_CA_EXTRA_EXTS: Created to avoid clash with EASYRSA_EXTRA_EXTS EASYRSA_CA_EXTRA_EXTS was an interim hack to avoid triggering a code injection buried deep inside easyrsa_openssl(), when building a CA. Fixed by Commit: 057be57825616199d125dfffbc5abfa9efaae792 Remove EASYRSA_CA_EXTRA_EXTS: Created by Commit: 6f138abb5b091fe7715fa7c8c6369d7704b6f177 The result is for all extra extensions to be subject to the same code. The CA no longer has to dodge the code injection. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 1cd7e0a..ca7ba10 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -896,8 +896,6 @@ current CA keypair. If you intended to start a new CA, run init-pki first." # example: "-addext foo,a:b -addext bah,c:d -addext baz e:f,g" [ "${EASYRSA_EXTRA_EXTS%% *}" = '-addext' ] || \ die "EASYRSA_EXTRA_EXTS: $EASYRSA_EXTRA_EXTS" - EASYRSA_CA_EXTRA_EXTS="$EASYRSA_EXTRA_EXTS" - unset -v EASYRSA_EXTRA_EXTS fi # Choose SSL Library version (1, 2(LibreSSL) or 3) and build CA @@ -972,7 +970,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first." # create the CA keypair: easyrsa_openssl req -utf8 -new \ -key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \ - $opts $EASYRSA_CA_EXTRA_EXTS \ + $opts $EASYRSA_EXTRA_EXTS \ ${crypto_opts:+ "$crypto_opts"} \ ${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \ ${out_key_pass_tmp:+ -passin file:"$out_key_pass_tmp"} \ @@ -1041,7 +1039,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first." easyrsa_openssl req -utf8 -new \ -key "$out_key_tmp" -keyout "$out_key_tmp" -out "$out_file_tmp" \ - $opts $EASYRSA_CA_EXTRA_EXTS \ + $opts $EASYRSA_EXTRA_EXTS \ ${crypto_opts:+ "$crypto_opts"} \ ${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \ ${out_key_pass_tmp:+ -passin file:"$out_key_pass_tmp"} \