nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always configure OPENSSL_CONF=/dev/null when there is no SSL config

Browse Source 
This applies to all direct calls using EASYRSA_OPENSSL (Default: 'openssl'),
which bypass using easyrsa_openssl() wrapper function.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-07-19 21:51:45 +01:00
parent e207f855eb
commit 82a52d1a9f
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 41 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
easyrsa3/easyrsa
View File

@ -72,9 +72,14 @@ A list of commands is shown below:
# CA Status # CA Status
if verify_ca_init test; then if verify_ca_init test; then
CA_cert="$EASYRSA_PKI/ca.crt" CA_cert="$EASYRSA_PKI/ca.crt"
CA_status=" CA status: OK CA_status=" CA status: OK"
CA subject: \ CA_subject="$(
$("$EASYRSA_OPENSSL" x509 -in "$CA_cert" -noout -subject)" OPENSSL_CONF=/dev/null \
"$EASYRSA_OPENSSL" x509 -in "$CA_cert" \
-noout -subject -nameopt multiline
)"
CA_subject=" CA subject: ${CA_subject#subject=}"
CA_status="${CA_status}${NL}${CA_subject}"
else else
CA_status=" CA status: CA has not been built." CA_status=" CA status: CA has not been built."
fi fi
@ -661,7 +666,8 @@ easyrsa_random() {
(*[!1234567890]*|0*|"") : ;; # invalid input (*[!1234567890]*|0*|"") : ;; # invalid input
(*) (*)
# Only return on success # Only return on success
if "$EASYRSA_OPENSSL" rand -hex "$1" 2>/dev/null if OPENSSL_CONF=/dev/null \
"$EASYRSA_OPENSSL" rand -hex "$1"
then then
return return
fi fi
@ -1127,12 +1133,13 @@ verify_ssl_lib() {
verify_ssl_lib_ok=1 verify_ssl_lib_ok=1
# redirect std-err, ignore missing ssl/openssl.cnf # redirect std-err, ignore missing ssl/openssl.cnf
val="$("$EASYRSA_OPENSSL" version 2>/dev/null)" val="$(
OPENSSL_CONF=/dev/null "$EASYRSA_OPENSSL" version
)"
ssl_version="$val" ssl_version="$val"
# SSL lib name # SSL lib name
case "${val%% *}" in case "${val%% *}" in
# OpenSSL does require a safe config-file for ampersand
OpenSSL) OpenSSL)
ssl_lib=openssl ssl_lib=openssl
;; ;;
@ -1959,14 +1966,16 @@ at: $out_file"
die "gen_dh - easyrsa_mktemp tmp_dh_file" die "gen_dh - easyrsa_mktemp tmp_dh_file"
# Generate dh.pem # Generate dh.pem
"$EASYRSA_OPENSSL" dhparam -out "$tmp_dh_file" \ OPENSSL_CONF=/dev/null \
"$EASYRSA_KEY_SIZE" || \ "$EASYRSA_OPENSSL" dhparam -out "$tmp_dh_file" \
die "Failed to generate DH params" "$EASYRSA_KEY_SIZE" || \
die "Failed to generate DH params"
# Validate dh.pem # Validate dh.pem
"$EASYRSA_OPENSSL" dhparam -in "$tmp_dh_file" \ OPENSSL_CONF=/dev/null \
-check -noout || \ "$EASYRSA_OPENSSL" dhparam -in "$tmp_dh_file" \
die "Failed to validate DH params" -check -noout || \
die "Failed to validate DH params"
mv -f "$tmp_dh_file" "$out_file" || \ mv -f "$tmp_dh_file" "$out_file" || \
die "Failed to move temp DH file" die "Failed to move temp DH file"
@ -4091,16 +4100,17 @@ Input is not a valid certificate: $crt_in"
if [ "$EASYRSA_SILENT_SSL" ]; then if [ "$EASYRSA_SILENT_SSL" ]; then
# Test SSL out # Test SSL out
# openssl direct call because error is expected # openssl direct call because error is expected
if "$EASYRSA_OPENSSL" verify \ if OPENSSL_CONF=/dev/null "$EASYRSA_OPENSSL" verify \
-CAfile "$ca_crt" "$crt_in" 1>/dev/null 2>&1 -CAfile "$ca_crt" "$crt_in" 1>/dev/null
then then
verify_cert_ok=1 verify_cert_ok=1
else else
unset -v verify_cert_ok unset -v verify_cert_ok
fi fi
else else
if "$EASYRSA_OPENSSL" verify \ if OPENSSL_CONF=/dev/null \
-CAfile "$ca_crt" "$crt_in" "$EASYRSA_OPENSSL" verify \
-CAfile "$ca_crt" "$crt_in"
then then
verify_cert_ok=1 verify_cert_ok=1
else else
@ -4895,9 +4905,10 @@ expire_status: FALL-BACK completed"
# Check cert expiry against window # Check cert expiry against window
# openssl direct call because error is expected # openssl direct call because error is expected
if "$EASYRSA_OPENSSL" x509 -in "$cert_issued" \ if OPENSSL_CONF=/dev/null \
-noout -checkend "$pre_expire_window_s" \ "$EASYRSA_OPENSSL" x509 -in "$cert_issued" \
1>/dev/null -noout -checkend "$pre_expire_window_s" \
1>/dev/null
then then
expire_msg="will NOT expire" expire_msg="will NOT expire"
will_not_expire=1 will_not_expire=1
@ -5275,18 +5286,21 @@ verify_algo_params - easyrsa_mktemp EASYRSA_ALGO_PARAMS"
# Create the required ecparams file # Create the required ecparams file
# call openssl directly because error is expected # call openssl directly because error is expected
"$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" \ OPENSSL_CONF=/dev/null \
-out "$EASYRSA_ALGO_PARAMS" \ "$EASYRSA_OPENSSL" ecparam \
1>/dev/null || die "\ -name "$EASYRSA_CURVE" \
-out "$EASYRSA_ALGO_PARAMS" \
1>/dev/null || die "\
Failed to generate ecparam file (permissions?) at: Failed to generate ecparam file (permissions?) at:
* $EASYRSA_ALGO_PARAMS" * $EASYRSA_ALGO_PARAMS"
;; ;;
ed) ed)
# Verify Edwards curve # Verify Edwards curve
# call openssl directly because error is expected # call openssl directly because error is expected
"$EASYRSA_OPENSSL" genpkey \ OPENSSL_CONF=/dev/null \
-algorithm "$EASYRSA_CURVE" \ "$EASYRSA_OPENSSL" genpkey \
1>/dev/null || die "\ -algorithm "$EASYRSA_CURVE" \
1>/dev/null || die "\
Edwards Curve $EASYRSA_CURVE not found." Edwards Curve $EASYRSA_CURVE not found."
;; ;;
*) user_error "\ *) user_error "\
@ -6701,7 +6715,8 @@ return 0
print_version() print_version()
{ {
ssl_version="$( ssl_version="$(
"${EASYRSA_OPENSSL:-openssl}" version 2>/dev/null OPENSSL_CONF=/dev/null \
"${EASYRSA_OPENSSL:-openssl}" version
)" )"
cat << VERSION_TEXT cat << VERSION_TEXT
EasyRSA Version Information EasyRSA Version Information