easyrsa_mktemp(): Increase the number of test-temp-files (Squashed)
commit df0a19e7ebaba5cb6fd2787ce4747d6338447a0a
Merge: e3e9f9e a7e58dd
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 14:30:46 2023 +0100
Merge branch 'easyrsa_mktemp-increase-depth' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-easyrsa_mktemp-increase-depth
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit a7e58dd70cb2aeb06ebee39c6b2c438e9ac76cdc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 02:43:20 2023 +0100
verify_algo_params(): Edwards Curve, call OpenSSL directly
This allows the output to be discarded via /dev/null, because
there is no use of temp-files and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d64dfcc16676b1e1b3fda7090667aea76bd718fc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 02:13:29 2023 +0100
easyrsa_mktemp(): Windows, 'set -o noclobber' to control 'mv.exe'
Currently, mv.exe will always prompt before over-writing a file.
When creating temp-files, mv.exe must NEVER prompt but silently
fail and try again with a new, sequentially numbered, file-name.
Using 'set -o noclobber' causes mv.exe to behave correctly here.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 948e1a1fbb338a32cf9b42d6fe9801b0fe7bfde9
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 01:22:47 2023 +0100
easyrsa_mktemp(): Allow nine (9) test files
Use of easyrsa_openssl() creates temp-files by default
and is used in subshells. This requires maximum of (7)
seven test files to move the shot-file to. (Currently)
Raise the the number of test-files to maximum nine (9).
Status reports, read_db(): Recreate temporary session
directory for each record. 'easyrsa' is designed to run
one command and then exit, removing the temp session.
Status reports run 'easyrsa' for the number of records
in the database, before exiting. Therefore, the temp
session MUST be reset for eash record read.
Add verbose output to help debug easyrsa_mktemp problems.
Improve comments.
Complete renaming of
- EASYRSA_CERT_RENEW -to- EASYRSA_PRE_EXPIRY_WINDOW
Split vars_setup(), add verify_working_env()
- vars_setup() now only processes vars file.
- verify_working_env() does the rest.
The split does not change any of the enclosed code.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme
parent
e3e9f9e08c
commit
1f18f19555
112
easyrsa3/easyrsa
112
easyrsa3/easyrsa
@ -546,7 +546,7 @@ $1
|
||||
# This is a debug function for status-reports and date
|
||||
verbose() {
|
||||
[ "$EASYRSA_VERBOSE" ] || return 0
|
||||
printf '%s\n' " > Verbose: $*"
|
||||
printf '%s\n' " > Verbose: $*"
|
||||
} # => verbose()
|
||||
|
||||
# non-fatal warning output
|
||||
@ -634,13 +634,20 @@ secure_session() {
|
||||
)" || die "secure_session - session"
|
||||
|
||||
secured_session="${EASYRSA_TEMP_DIR}/${session}"
|
||||
verbose "\
|
||||
Create session: secured_session=$secured_session"
|
||||
# atomic:
|
||||
mkdir "$secured_session" && return
|
||||
if mkdir "$secured_session"; then
|
||||
return
|
||||
fi
|
||||
done
|
||||
die "secure_session failed"
|
||||
} # => secure_session()
|
||||
|
||||
# Create temp-file atomically or fail
|
||||
# WARNING: Running easyrsa_openssl in a subshell
|
||||
# will hide error message and verbose messages
|
||||
# from easyrsa_mktemp()
|
||||
easyrsa_mktemp() {
|
||||
[ "$#" = 1 ] || die "\
|
||||
easyrsa_mktemp - input error"
|
||||
@ -655,22 +662,57 @@ easyrsa_mktemp - Temporary session undefined"
|
||||
# Assign internal temp-file name
|
||||
t="${secured_session}/temp.${mktemp_counter}"
|
||||
|
||||
# Create temp-file or die
|
||||
for i in x y z; do
|
||||
shotfile="${t}.0"
|
||||
target="${t}.${i}"
|
||||
# Create shotfile
|
||||
verbose "\
|
||||
easyrsa_mktemp: Create temp-file for: $1"
|
||||
for h in x y x; do
|
||||
shotfile="${t}.${h}"
|
||||
if [ -e "$shotfile" ]; then
|
||||
break
|
||||
verbose "\
|
||||
easyrsa_mktemp: shot-file EXISTS: $shotfile"
|
||||
continue
|
||||
else
|
||||
printf "" > "$shotfile" || break
|
||||
# atomic:
|
||||
if mv "$shotfile" "$target"; then
|
||||
# Assign external temp-file name
|
||||
force_set_var "$1" "$target" && return
|
||||
fi
|
||||
printf "" > "$shotfile" || die "\
|
||||
easyrsa_mktemp: create shotfile failed (1) $1"
|
||||
verbose "\
|
||||
easyrsa_mktemp: shot-file created: $shotfile"
|
||||
|
||||
# Create temp-file or die
|
||||
# subshells do not update mktemp_counter,
|
||||
# which is why this extension is required.
|
||||
# Current max required is 7 deep
|
||||
for i in 1 2 3 4 5 6 7 8 9; do
|
||||
target="${t}.${i}"
|
||||
if [ -e "$target" ]; then
|
||||
verbose "\
|
||||
easyrsa_mktemp: temp-file EXISTS: $target"
|
||||
continue
|
||||
else
|
||||
# atomic:
|
||||
[ "$easyrsa_host_os" = win ] && \
|
||||
set -o noclobber
|
||||
|
||||
if mv "$shotfile" "$target"; then
|
||||
verbose "\
|
||||
easyrsa_mktemp: atomic: Create temp-file OK: $target"
|
||||
# Assign external temp-file name
|
||||
if force_set_var "$1" "$target"; then
|
||||
[ "$easyrsa_host_os" = win ] && \
|
||||
set +o noclobber
|
||||
return 0
|
||||
else
|
||||
die "\
|
||||
easyrsa_mktemp - force_set_var $1 failed"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
done
|
||||
die "easyrsa_mktemp failed"
|
||||
|
||||
die "\
|
||||
easyrsa_mktemp - failed for: $1 @ depth=$i
|
||||
target: $target"
|
||||
} # => easyrsa_mktemp()
|
||||
|
||||
# remove temp files and do terminal cleanups
|
||||
@ -843,6 +885,8 @@ easyrsa_rewrite_ssl_config () {
|
||||
} # => easyrsa_rewrite_ssl_config()
|
||||
|
||||
# Easy-RSA meta-wrapper for SSL
|
||||
# WARNING: Running easyrsa_openssl in a subshell
|
||||
# will hide error message and verbose messages
|
||||
easyrsa_openssl() {
|
||||
openssl_command="$1"; shift
|
||||
|
||||
@ -1782,14 +1826,17 @@ sign_req() {
|
||||
# Always errors out - Do not capture error
|
||||
# unset EASYRSA_SILENT_SSL to capure all output
|
||||
check_serial="$(
|
||||
EASYRSA_SILENT_SSL='' \
|
||||
easyrsa_openssl ca -status "$serial" 2>&1
|
||||
unset -v EASYRSA_SILENT_SSL
|
||||
easyrsa_openssl ca -status "$serial" 2>&1
|
||||
)" || :
|
||||
|
||||
case "$check_serial" in
|
||||
*"not present in db"*)
|
||||
unique_serial=1
|
||||
break
|
||||
;;
|
||||
*)
|
||||
verbose "check_serial: $check_serial"
|
||||
esac
|
||||
done
|
||||
|
||||
@ -2426,7 +2473,7 @@ Cannot renew this certificate, a conflicting file exists:
|
||||
easyrsa_openssl x509 -in "$crt_in" -noout -text | sed -n \
|
||||
"/X509v3 Subject Alternative Name:\
|
||||
/{n;s/IP Address:/IP:/g;s/ //g;p;}"
|
||||
)"
|
||||
)" || die "renew - san: easyrsa_openssl subshell"
|
||||
|
||||
[ "$san" ] && export EASYRSA_EXTRA_EXTS="\
|
||||
$EASYRSA_EXTRA_EXTS
|
||||
@ -4202,6 +4249,13 @@ read_db() {
|
||||
|
||||
verbose "***** Read next record *****"
|
||||
|
||||
# Recreate temp session
|
||||
rm -rf "$secured_session"
|
||||
unset -v secured_session
|
||||
secure_session || \
|
||||
die "Recreate secure-session failed."
|
||||
mktemp_counter=0
|
||||
|
||||
# Interpret the db/certificate record
|
||||
unset -v db_serial db_cn db_revoke_date db_reason
|
||||
case "$db_status" in
|
||||
@ -4368,12 +4422,10 @@ expire_status: cert_date_to_timestamp_s: for comparison"
|
||||
# Prove this works
|
||||
if [ "$cert_expire_date_s" = "$old_cert_expire_date_s" ]
|
||||
then
|
||||
: # ok
|
||||
verbose "expire_status: ABSOLUTE seconds MATCH:"
|
||||
verbose " cert_expire_date_s= $cert_expire_date_s"
|
||||
verbose " old_cert_expire_date_s= $old_cert_expire_date_s"
|
||||
else
|
||||
|
||||
verbose "expire_status: ABSOLUTE seconds do not MATCH:"
|
||||
verbose " cert_expire_date_s= $cert_expire_date_s"
|
||||
verbose " old_cert_expire_date_s= $old_cert_expire_date_s"
|
||||
@ -4382,7 +4434,8 @@ $(( cert_expire_date_s - old_cert_expire_date_s ))"
|
||||
|
||||
# If there is an error then use --days-margin=10
|
||||
[ "$EASYRSA_iso_8601_MARGIN" ] || \
|
||||
die "expire_status: ABSOLUTE seconds mismatch"
|
||||
die "\
|
||||
expire_status - ABSOLUTE seconds mismatch: Use --allow-margin=N"
|
||||
|
||||
# Allows days for margin of error in seconds
|
||||
margin_s="$((
|
||||
@ -4713,8 +4766,9 @@ Failed to generate ecparam file (permissions?) at:
|
||||
;;
|
||||
ed)
|
||||
# Verify Edwards curve
|
||||
easyrsa_openssl genpkey -algorithm "$EASYRSA_CURVE" \
|
||||
> /dev/null || die "\
|
||||
"$EASYRSA_OPENSSL" genpkey \
|
||||
-algorithm "$EASYRSA_CURVE" \
|
||||
1>/dev/null || die "\
|
||||
Edwards Curve $EASYRSA_CURVE not found."
|
||||
;;
|
||||
*) die "\
|
||||
@ -4982,7 +5036,8 @@ Please, correct these errors and try again."
|
||||
|
||||
set_var EASYRSA_CA_EXPIRE 3650
|
||||
set_var EASYRSA_CERT_EXPIRE 825
|
||||
set_var EASYRSA_CERT_RENEW 90
|
||||
set_var \
|
||||
EASYRSA_PRE_EXPIRY_WINDOW 90
|
||||
set_var EASYRSA_CRL_DAYS 180
|
||||
set_var EASYRSA_NS_SUPPORT no
|
||||
set_var EASYRSA_NS_COMMENT \
|
||||
@ -4995,7 +5050,10 @@ Please, correct these errors and try again."
|
||||
set_var EASYRSA_SAFE_CONF "$EASYRSA_PKI/safessl-easyrsa.cnf"
|
||||
|
||||
set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM"
|
||||
} # => vars_setup()
|
||||
|
||||
# Verify working environment
|
||||
verify_working_env() {
|
||||
# Verify SSL Lib - One time ONLY
|
||||
verify_ssl_lib
|
||||
|
||||
@ -5046,7 +5104,7 @@ Temporary directory does not exist:
|
||||
* $EASYRSA_TEMP_DIR"
|
||||
fi
|
||||
fi
|
||||
} # vars_setup()
|
||||
} # => verify_working_env()
|
||||
|
||||
# variable assignment by indirection when undefined; merely exports
|
||||
# the variable when it is already defined (even if currently null)
|
||||
@ -5691,7 +5749,7 @@ NL='
|
||||
'
|
||||
|
||||
# Be secure with a restrictive umask
|
||||
[ "$EASYRSA_NO_UMASK" ] || umask "${EASYRSA_UMASK:-077}"
|
||||
[ "$EASYRSA_NO_UMASK" ] || umask "${EASYRSA_UMASK:=077}"
|
||||
|
||||
# Register cleanup on EXIT
|
||||
trap 'cleanup $?' EXIT
|
||||
@ -5842,6 +5900,7 @@ while :; do
|
||||
-S|--silent-ssl)
|
||||
empty_ok=1
|
||||
export EASYRSA_SILENT_SSL=1
|
||||
save_EASYRSA_SILENT_SSL=1
|
||||
;;
|
||||
--no-safe-ssl)
|
||||
empty_ok=1
|
||||
@ -5938,6 +5997,9 @@ vars_setup
|
||||
# Check for conflicting input options
|
||||
mutual_exclusions
|
||||
|
||||
# Final checks of working environment
|
||||
verify_working_env
|
||||
|
||||
# Hand off to the function responsible
|
||||
case "$cmd" in
|
||||
init-pki|clean-all)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user