From 6060015b39d7fa79443c97128096f95f595640f3 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 25 Jun 2022 15:25:56 +0100 Subject: [PATCH] Restore files when 'renew' fails during 'build_full()' phase Because easyrsa uses die() on errors, functions which call other functions may not receive a returned error code and, therefore, a test for an error will not occur in the calling function. If 'renew' fails in the build_full() phase then build_full(), gen_req() or sign_req() will error out to die() and not return an error to 'renew'. This leaves the files which are about to be renewed in the 'renewed' sub-folder without replacement files in the PKI folders. Set 'on_error_undo_renew_move=1' and call renew_restore_move() from cleanup() when an error occurs during the build_full() phase of 'renew'. Closes: #613 Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 81962b3..28daec3 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -626,6 +626,11 @@ cleanup() { rm -rf "$EASYRSA_EC_DIR" fi + # Restore files when renew is interrupted + if [ "$on_error_undo_renew_move" ]; then + renew_restore_move + fi + # shellcheck disable=SC3040 # In POSIX sh, set option [name] is undefined case "$easyrsa_host_os" in nix) [ -t 1 ] && stty echo ;; @@ -2047,10 +2052,11 @@ with the following subject: # move renewed files so we can reissue certificate with the same name renew_move + on_error_undo_renew_move=1 # renew certificate if build_full "$cert_type" "$file_name_base" "$opt_nopass"; then - : # ok + unset on_error_undo_renew_move else # If renew failed then restore cert, key and req. Otherwise, issue a warning # If *restore* fails then at least the file-names are not serial-numbers @@ -2070,7 +2076,7 @@ been deployed, use 'revoke-renewed $file_name_base reason' ('reason' is optional # Restore files on failure to renew renew_restore_move() { - unset -v rrm_err + unset -v rrm_err on_error_undo_renew_move # restore crt, key and req file to PKI folders if mv "$restore_crt_out" "$restore_crt_in"; then : # ok @@ -2103,7 +2109,7 @@ renew_restore_move() { if [ "$rrm_err" ]; then warn "Failed to restore renewed files." else - notice "Renewed files have been successfully restored." + notice "Renew FAILED but files have been successfully restored." fi return 0