From e68a41c50f3a483fb1977a595f91761c0fd1831d Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 6 May 2023 15:39:45 +0100 Subject: [PATCH 1/4] vars_setup(): Always assign EASYRSA_KEY_SIZE EASYRSA_KEY_SIZE is present in the SSL config file, therefore, it MUST always be set, regardless of EASYRSA_ALGO in use. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 6335339..ff8f055 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5195,10 +5195,14 @@ One or more of these problems has been found in your 'vars' file: set_var EASYRSA_REQ_OU "My Organizational Unit" set_var EASYRSA_REQ_SERIAL "" set_var EASYRSA_ALGO rsa + set_var EASYRSA_KEY_SIZE 2048 case "$EASYRSA_ALGO" in rsa) - set_var EASYRSA_KEY_SIZE 2048 + : # ok + # default EASYRSA_KEY_SIZE must always be set + # it must NOT be set selectively because it is + # present in the SSL config file ;; ec) set_var EASYRSA_CURVE secp384r1 From 601766bdafdea56ea5519f7d2829d8ef38e4cb53 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 6 May 2023 15:44:38 +0100 Subject: [PATCH 2/4] verify_algo_params(): Call SSL lib via EASYRSA_OPENSSL verify_algo_params() expects errors when settings are not corrrect. Therefore, is must not use easyrsa_openssl() meta-wrapper, which would error out with a misleading error message. Fixing this also ensures that the SAFE SSL config is not built prior to EASYRSA_REQ_CN being set. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index ff8f055..d8a03e8 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -4901,7 +4901,7 @@ verify_algo_params() { "verify_algo_params - easyrsa_mktemp EASYRSA_ALGO_PARAMS" # Create the required ecparams file - easyrsa_openssl ecparam -name "$EASYRSA_CURVE" \ + "$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" \ -out "$EASYRSA_ALGO_PARAMS" \ 1>/dev/null || die "\ Failed to generate ecparam file (permissions?) at: From 7d6810ebb90d522e1fe699ae2fa9335f832181de Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 6 May 2023 15:50:26 +0100 Subject: [PATCH 3/4] easyrsa_openssl(): Move saving SAFE SSL config name to correct place Saving the name of the fully expanded Safe SSL config means that this config file only has to be built once. The assignment of working_safe_ssl_conf, which signifies that a Safe SSL config has already been created, was set too late, which caused it to be set even if the Safe SSL config had not been created. Also, include a final check in verify_working_env() to ensure that working_safe_ssl_conf has not been set prior to executing the issued command, eg. build-ca. Also, improve verbose messages and comments. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index d8a03e8..5d8355d 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -689,8 +689,6 @@ easyrsa_mktemp - Temporary session undefined" t="${secured_session}/temp.${mktemp_counter}" # Create shotfile - verbose "\ -easyrsa_mktemp: Create temp-file for: $1" for h in x y x; do shotfile="${t}.${h}" if [ -e "$shotfile" ]; then @@ -700,8 +698,6 @@ easyrsa_mktemp: shot-file EXISTS: $shotfile" else printf "" > "$shotfile" || die "\ easyrsa_mktemp: create shotfile failed (1) $1" - verbose "\ -easyrsa_mktemp: shot-file created: $shotfile" # Create temp-file or die # subshells do not update mktemp_counter, @@ -715,17 +711,19 @@ easyrsa_mktemp: temp-file EXISTS: $want_tmp_file" continue else # atomic: - [ "$easyrsa_host_os" = win ] && \ + [ "$easyrsa_host_os" = win ] && { set -o noclobber + } if mv "$shotfile" "$want_tmp_file"; then - verbose "\ -easyrsa_mktemp: atomic: Create temp-file OK: $want_tmp_file" # Assign external temp-file name if force_set_var "$1" "$want_tmp_file" then - [ "$easyrsa_host_os" = win ] && \ + verbose "\ +easyrsa_mktemp: $1 temp-file OK: $want_tmp_file" + [ "$easyrsa_host_os" = win ] && { set +o noclobber + } unset -v want_tmp_file shotfile return 0 else @@ -954,6 +952,8 @@ easyrsa_openssl: escape_hazard SKIPPED" else escape_hazard || \ die "easyrsa_openssl - escape_hazard failed" + verbose "\ +easyrsa_openssl: escape_hazard COMPLETED" fi # Make LibreSSL safe config file from OpenSSL config file @@ -983,20 +983,20 @@ easyrsa_openssl - easyrsa_mktemp easyrsa_safe_ssl_conf" if easyrsa_rewrite_ssl_config; then verbose "\ easyrsa_openssl: easyrsa_rewrite_ssl_config COMPLETED" + # Save the the safe conf file-name + working_safe_ssl_conf="$easyrsa_safe_ssl_conf" + verbose "\ +easyrsa_openssl: NEW SAFE SSL config: $easyrsa_safe_ssl_conf" else die "\ easyrsa_openssl - easyrsa_rewrite_ssl_config" fi - - # Save the the safe conf file-name - working_safe_ssl_conf="$easyrsa_safe_ssl_conf" - verbose "\ -easyrsa_openssl: NEW SSL cnf file: $easyrsa_safe_ssl_conf" fi else # Assign safe temp file as Original openssl-easyrsa.conf easyrsa_safe_ssl_conf="$EASYRSA_SSL_CONF" + verbose "easyrsa_openssl: No SAFE SSL config" fi # VERIFY safe temp-file exists @@ -4901,6 +4901,7 @@ verify_algo_params() { "verify_algo_params - easyrsa_mktemp EASYRSA_ALGO_PARAMS" # Create the required ecparams file + # call openssl directly because error is expected "$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" \ -out "$EASYRSA_ALGO_PARAMS" \ 1>/dev/null || die "\ @@ -4909,6 +4910,7 @@ Failed to generate ecparam file (permissions?) at: ;; ed) # Verify Edwards curve + # call openssl directly because error is expected "$EASYRSA_OPENSSL" genpkey \ -algorithm "$EASYRSA_CURVE" \ 1>/dev/null || die "\ @@ -4917,6 +4919,8 @@ Edwards Curve $EASYRSA_CURVE not found." *) die "\ Alg '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'" esac + verbose "\ +verify_algo_params: Params verified for algo '$EASYRSA_ALGO'" } # => verify_algo_params() # Check for conflicting input options @@ -5273,6 +5277,13 @@ verify_working_env - install_data_to_pki vars-setup failed" # Verify selected algorithm and parameters verify_algo_params + # Check $working_safe_ssl_conf, to build + # a fully configured safe ssl conf, on the + # next invocation of easyrsa_openssl() + [ -z "$working_safe_ssl_conf" ] || { + die "working_safe_ssl_conf must not be set!" + } + # Last setup msg information "\ Using SSL: $EASYRSA_OPENSSL $ssl_version @@ -5949,6 +5960,7 @@ unset -v \ easyrsa_error_exit \ prohibit_no_pass \ secured_session \ + working_safe_ssl_conf \ user_vars_true \ user_san_true \ alias_days From 9316a37417e54b30aa797b2d22bc5485850f45a9 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 6 May 2023 20:04:53 +0100 Subject: [PATCH 4/4] easyrsa_openssl(): Move escape_hazaard() usage call Move escape_hazard() to use the same control as easyrsa_rewrite_ssl_config(). Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 32 +++++++++++++------------------- 1 file changed, 13 insertions(+), 19 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 5d8355d..33edc28 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -937,25 +937,6 @@ easyrsa_openssl() { has_config=1 fi - # Auto-escape hazardous characters: - # '&' - Workaround 'sed' behavior - # '$' - Workaround 'easyrsa' based limitation - # This is required for all SSL libs, otherwise, - # there are unacceptable differences in behavior - # EASYRSA_FORCE_SAFE_SSL will always over-ride - if [ -z "$EASYRSA_FORCE_SAFE_SSL" ] && \ - [ "$working_safe_ssl_conf" ] - then - : # ok - This has been done before - verbose "\ -easyrsa_openssl: escape_hazard SKIPPED" - else - escape_hazard || \ - die "easyrsa_openssl - escape_hazard failed" - verbose "\ -easyrsa_openssl: escape_hazard COMPLETED" - fi - # Make LibreSSL safe config file from OpenSSL config file # $require_safe_ssl_conf is ALWAYS set by verify_ssl_lib() # Can be over-ruled for OpenSSL by option --no-safe-ssl @@ -970,10 +951,23 @@ easyrsa_openssl: escape_hazard COMPLETED" [ "$working_safe_ssl_conf" ] then # ok - This has been done before + # Set SAFE SSL conf to working SAFE SSL conf easyrsa_safe_ssl_conf="$working_safe_ssl_conf" verbose "\ +easyrsa_openssl: escape_hazard SKIPPED" + verbose "\ easyrsa_openssl: easyrsa_rewrite_ssl_config SKIPPED" else + # Auto-escape hazardous characters: + # '&' - Workaround 'sed' behavior + # '$' - Workaround 'easyrsa' based limitation + # This is required for all SSL libs, otherwise, + # there are unacceptable differences in behavior + escape_hazard || \ + die "easyrsa_openssl - escape_hazard failed" + verbose "\ +easyrsa_openssl: escape_hazard COMPLETED" + # Assign easyrsa_safe_ssl_conf temp-file easyrsa_safe_ssl_conf="" easyrsa_mktemp easyrsa_safe_ssl_conf || die "\