nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden sourcing vars and warn for potential problems

Browse Source 
In 'org' mode, fields such as EASYRSA_REQ_ORG can be abused.

If the field contains single quote ('), ampersand (&), back-tick (`),
dollar sign ($) or hash (#) then the result is undefined.

Due to EasyRSA running on Linux and Windows and supporting multiple
SSL Libraries, it is not feasible to support these characters.

Add a check to determine if any unsupported characters are found in
the vars file and issue a warning if they are found.

Add a sub-shell test to source vars.  If the test fails then exit
gracefully, with a specific error message.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-04-28 18:52:21 +01:00
parent ecbc6103bc
commit 5e57887c39
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
2 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
easyrsa3/easyrsa
View File

@ -2499,18 +2499,23 @@ recommended - please remove it from there before continuing."
# Sanitize vars further but ONLY if it is in PKI folder
if [ "$pki_vars" ]; then
# Warning: Single quote
if grep -q "'" "$vars"; then
if grep '^[[:blank:]]*set_var[[:blank:]]\+.*' "$vars" | \
grep -q -e '&' -e "'" -e '`' -e '\$' -e '#' ; then
warn "\
Single quote (') has been found in the configuration file.
This character is not supported in the configuration file.
Sourcing the vars file will probably fail .."
Unsupported characters are present in the vars file.
These characters are not supported: (') (&) (\`) (\$) (#)
Sourcing the vars file and building certificates will probably fail .."
fi
fi
# shellcheck disable=SC2034 # EASYRSA_CALLER appears unused.
EASYRSA_CALLER=1
# shellcheck disable=1090 # can't follow non-constant source. vars
. "$vars"
( . "$vars" 2>/dev/null ) || die "\
Failed to source the vars file, remove any unsupported characters."
# shellcheck disable=1090 # can't follow non-constant source. vars
. "$vars" 2>/dev/null
notice "Using Easy-RSA configuration from: $vars"
[ "$pki_vars" ] || \
warn "Move your vars file to your PKI folder, where it is safe!"

9
easyrsa3/vars.example
View File

@ -92,6 +92,15 @@ fi
# you may omit any specific field by typing the "." symbol (not valid for
# email.)
# NOTE: The following characters are not supported
# in these "Organizational fields" by Easy-RSA:
# single quote (')
# back-tick (`)
# hash (#)
# ampersand (&)
# dollar sign ($)
# Use them at your own risk!
#set_var EASYRSA_REQ_COUNTRY "US"
#set_var EASYRSA_REQ_PROVINCE "California"
#set_var EASYRSA_REQ_CITY "San Francisco"