nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve error detection in cert_dates()

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-05-05 13:37:28 +01:00
parent 0948e81304
commit 36543be760
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
easyrsa3/easyrsa
View File

@ -1596,11 +1596,18 @@ revoke_move() {
cert_dates() {
if [ "$1" ]; then
# Required for renewal
crt_not_before="$(easyrsa_openssl x509 -in "$1" -noout -startdate)"
# Call openssl directly, otherwise this is not debug compatible
crt_not_before="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -startdate 2>&1)" \
|| die "cert_dates - crt_not_before: $crt_not_before"
crt_not_before="${crt_not_before#*=}"
crt_not_after="$(easyrsa_openssl x509 -in "$1" -noout -enddate)"
crt_not_after="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -enddate 2>&1)" \
|| die "cert_dates - crt_not_after: $crt_not_after"
crt_not_after="${crt_not_after#*=}"
shift
else
# Required for --fix-offset
# This is a fake date to satisfy the 'if expire_date' command test
crt_not_after="Jun 12 02:02:02 1999 GMT"
fi
# Set fixed dates for new certificate
@ -1623,8 +1630,8 @@ Non-decimal value for EASYRSA_FIX_OFFSET: '$EASYRSA_FIX_OFFSET'"
fix_days="$(( (EASYRSA_CERT_EXPIRE / 365) * 365 + EASYRSA_FIX_OFFSET ))"
# Current Year and seconds
this_year="$(date +%Y)"
now_sec="$(date +%s)"
this_year="$(date +%Y)" || die "cert_dates - this_year"
now_sec="$(date +%s)" || die "cert_dates - now_sec"
esac
# OS dependencies
@ -1646,6 +1653,7 @@ Non-decimal value for EASYRSA_FIX_OFFSET: '$EASYRSA_FIX_OFFSET'"
# Linux and Windows (FTR: date.exe does not support format +%s as input)
if expire_date="$(date -d "$crt_not_after" +%s)"
then
# Note: date.exe is Year 2038 end 32bit
allow_renew_date="$(date -d "+${EASYRSA_CERT_RENEW}day" +%s)"
if [ "$EASYRSA_FIX_OFFSET" ]; then
@ -1686,12 +1694,13 @@ Non-decimal value for EASYRSA_FIX_OFFSET: '$EASYRSA_FIX_OFFSET'"
# Do not generate an expired, fixed date certificate
if [ "$EASYRSA_FIX_OFFSET" ]; then
[ "$now_sec" ] || die "Undefined: now_sec"
[ "$end_fix_sec" ] || die "Undefined end_fix_sec"
[ "$(( now_sec * end_fix_sec ))" -gt 0 ] \
|| die "Undefined: now_sec, end_fix_sec"
[ "$now_sec" -lt "$end_fix_sec" ] || die "\
The lifetime of the certificate will expire before the date today."
[ "$start_fixdate" ] || die "Undefined: start_fixdate"
[ "$end_fixdate" ] || die "Undefined: end_fixdate"
unset -v crt_not_after
fi
} # => cert_dates()