nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Minor improvement to secure_session() and easyrsa_mktemp()

Browse Source 
Also, remove obsolete comment.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-05-16 21:30:48 +01:00
parent 26b7247f70
commit 55f5745786
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 19 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
easyrsa3/easyrsa
View File

@ -415,14 +415,17 @@ secure_session() {
[ "$EASYRSA_TEMP_DIR_session" ] && die "session overload" [ "$EASYRSA_TEMP_DIR_session" ] && die "session overload"
# temporary directory must exist # temporary directory must exist
[ -n "$EASYRSA_TEMP_DIR" ] || return if [ "$EASYRSA_TEMP_DIR" ] && [ -d "$EASYRSA_TEMP_DIR" ]; then
[ -d "$EASYRSA_TEMP_DIR" ] || die "\ : # ok
Non-existant temporary directory: $EASYRSA_TEMP_DIR" else
die "Non-existant temporary directory: $EASYRSA_TEMP_DIR"
fi
for i in 1 2 3; do for i in 1 2 3; do
# Always use openssl directly for rand # Always use openssl directly for rand
rand="$("$EASYRSA_OPENSSL" rand -hex 4)" \ rand="$(
|| die "secure_session - rand '$rand'" "$EASYRSA_OPENSSL" rand -hex 4
)" || die "secure_session - rand '$rand'"
mkdir "${EASYRSA_TEMP_DIR}/${rand}" || continue mkdir "${EASYRSA_TEMP_DIR}/${rand}" || continue
EASYRSA_TEMP_DIR_session="${EASYRSA_TEMP_DIR}/${rand}" EASYRSA_TEMP_DIR_session="${EASYRSA_TEMP_DIR}/${rand}"
@ -434,13 +437,17 @@ Non-existant temporary directory: $EASYRSA_TEMP_DIR"
# Create tempfile atomically or fail # Create tempfile atomically or fail
easyrsa_mktemp() { easyrsa_mktemp() {
# session directory must exist # session directory must exist
[ -n "$EASYRSA_TEMP_DIR_session" ] || return if [ "$EASYRSA_TEMP_DIR_session" ] && [ -d "$EASYRSA_TEMP_DIR_session" ]; then
[ -d "$EASYRSA_TEMP_DIR_session" ] || return : # ok
else
die "Non-existant temporary session: $EASYRSA_TEMP_DIR_session"
fi
for i in 1 2 3; do for i in 1 2 3; do
# Always use openssl directly for rand # Always use openssl directly for rand
rand="$("$EASYRSA_OPENSSL" rand -hex 4)" \ rand="$(
|| die "easyrsa_mktemp - rand '$rand'" "$EASYRSA_OPENSSL" rand -hex 4
)" || die "easyrsa_mktemp - rand '$rand'"
shotfile="${EASYRSA_TEMP_DIR_session}/shot.$rand" shotfile="${EASYRSA_TEMP_DIR_session}/shot.$rand"
if [ -e "$shotfile" ]; then if [ -e "$shotfile" ]; then
@ -560,10 +567,6 @@ easyrsa_openssl() {
mv -f "$easyrsa_openssl_conf" "$EASYRSA_SAFE_CONF" || \ mv -f "$easyrsa_openssl_conf" "$EASYRSA_SAFE_CONF" || \
die "easyrsa_openssl - makesafeconf failed" die "easyrsa_openssl - makesafeconf failed"
else else
# !!!
# this debug CANNOT be used in automated testing
# to function correctly easyrsa_openssl()
# must ONLY output SSL layer output
# debug log on # debug log on
if [ "$EASYRSA_DEBUG" ]; then set -x; fi if [ "$EASYRSA_DEBUG" ]; then set -x; fi
@ -575,10 +578,6 @@ easyrsa_openssl() {
if [ "$EASYRSA_DEBUG" ]; then set +x; fi if [ "$EASYRSA_DEBUG" ]; then set +x; fi
fi fi
else else
# !!!
# this debug CANNOT be used in automated testing
# to function correctly easyrsa_openssl()
# must ONLY output SSL layer output
# debug log on # debug log on
if [ "$EASYRSA_DEBUG" ]; then set -x; fi if [ "$EASYRSA_DEBUG" ]; then set -x; fi
@ -981,6 +980,7 @@ build_ca() {
Unable to create a CA as you already seem to have one set up. Unable to create a CA as you already seem to have one set up.
If you intended to start a new CA, run init-pki first." If you intended to start a new CA, run init-pki first."
fi fi
# If a private key exists here, a intermediate ca was created but not signed. # If a private key exists here, a intermediate ca was created but not signed.
# Notify the user and require a signed ca.crt or a init-pki: # Notify the user and require a signed ca.crt or a init-pki:
[ -f "$out_key" ] && \ [ -f "$out_key" ] && \
@ -1114,7 +1114,8 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
NOTE: Your intermediate CA request is at $out_file NOTE: Your intermediate CA request is at $out_file
and now must be sent to your parent CA for signing. Place your resulting cert and now must be sent to your parent CA for signing. Place your resulting cert
at $EASYRSA_PKI/ca.crt prior to signing operations." at $EASYRSA_PKI/ca.crt prior to signing operations."
else notice "\ else
notice "\
CA creation complete and you may now import and sign cert requests. CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at: Your new CA certificate file for publishing is at: