nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vars: Forbid auto-loaded "$EASYRSA_PKI/vars" from changing the PKI

Browse Source 
If a vars file in the PKI tries to change the expected PKI then fail.

Allow vars file in the working directory to change the PKI.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-09-19 03:21:25 +01:00
parent f47b491346
commit 7b38d99b4c
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
easyrsa3/easyrsa
View File

@ -5665,15 +5665,16 @@ The 'vars' file was not found:
# If EASYRSA_PKI is set then it is user set, # If EASYRSA_PKI is set then it is user set,
# allow use of the default vars in the set PKI # allow use of the default vars in the set PKI
if [ "$EASYRSA_PKI" ]; then if [ "$EASYRSA_PKI" ]; then
# EASYRSA_PKI will not be changed by vars
pki_vars="${EASYRSA_PKI}/vars" pki_vars="${EASYRSA_PKI}/vars"
user_pki_true=1
unset -v default_pki_true
else else
# default pki/vars # default pki/vars
# if this conflicts then bail # if this conflicts then bail
pki_vars="${PWD}/pki/vars" pki_vars="${PWD}/pki/vars"
default_pki_true=1
unset -v user_pki_true # Setup "catch EXPECTED PKI changed"
# auto-load 'pki/vars' is FORBIDDEN to change PKI
expected_pki="${PWD}/pki"
fi fi
# vars of last resort; The Default # vars of last resort; The Default
@ -5878,6 +5879,16 @@ Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'"
set_var EASYRSA_MAX_TEMP 4 set_var EASYRSA_MAX_TEMP 4
# Catch unexpected PKI change
if [ "$expected_pki" ]; then
[ "$expected_pki" = "$EASYRSA_PKI" ] || \
user_error "\
The PKI was unexpectedly changed by the vars file.
vars : $vars
Expected: $expected_pki
Set : $EASYRSA_PKI"
fi
# if the vars file in use is not in the PKI # if the vars file in use is not in the PKI
# and not user defined then Show the messages # and not user defined then Show the messages
if [ "$require_pki" ]; then if [ "$require_pki" ]; then
@ -7040,6 +7051,7 @@ unset -v \
alias_days \ alias_days \
prohibit_no_pass \ prohibit_no_pass \
found_vars no_new_vars user_vars_true \ found_vars no_new_vars user_vars_true \
expected_pki \
do_build_full error_build_full_cleanup \ do_build_full error_build_full_cleanup \
internal_batch \ internal_batch \
easyrsa_exit_with_error error_info easyrsa_exit_with_error error_info