nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

easyrsa_openssl(): Create a safe SSL config once per instance ONLY

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-04-08 23:01:33 +01:00
parent 1f18f19555
commit 867333d67e
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
easyrsa3/easyrsa
View File

@ -917,15 +917,31 @@ easyrsa_openssl() {
# '$' - Workaround 'easyrsa' based limitation # '$' - Workaround 'easyrsa' based limitation
# This is required for all SSL libs, otherwise, # This is required for all SSL libs, otherwise,
# there are unacceptable differences in behavior # there are unacceptable differences in behavior
escape_hazard || die "easyrsa_openssl - escape_hazard failed" if [ "$working_safe_ssl_conf" ]; then
: # ok - This has been done before
else
escape_hazard || \
die "easyrsa_openssl - escape_hazard failed"
fi
# Make LibreSSL safe config file from OpenSSL config file # Make LibreSSL safe config file from OpenSSL config file
# $require_safe_ssl_conf is ALWAYS set by verify_ssl_lib() # $require_safe_ssl_conf is ALWAYS set by verify_ssl_lib()
# Can be over-ruled for OpenSSL by option --no-safe-ssl # Can be over-ruled for OpenSSL by option --no-safe-ssl
if [ "$require_safe_ssl_conf" ]; then if [ "$require_safe_ssl_conf" ]; then
# Write a safe SSL config temp-file
easyrsa_rewrite_ssl_config || die \ # Only create a new safe config,
"easyrsa_openssl - easyrsa_rewrite_ssl_config" # if it has not been done before.
if [ "$working_safe_ssl_conf" ]; then
# ok - This has been done before
easyrsa_safe_ssl_conf="$working_safe_ssl_conf"
else
# Write a safe SSL config temp-file
easyrsa_rewrite_ssl_config || die \
"easyrsa_openssl - easyrsa_rewrite_ssl_config"
# Save the the safe conf file-name
working_safe_ssl_conf="$easyrsa_safe_ssl_conf"
fi
else else
# Assign safe temp file as Original openssl-easyrsa.conf # Assign safe temp file as Original openssl-easyrsa.conf
easyrsa_safe_ssl_conf="$EASYRSA_SSL_CONF" easyrsa_safe_ssl_conf="$EASYRSA_SSL_CONF"
@ -5766,6 +5782,7 @@ detect_host
# Initialisation requirements # Initialisation requirements
unset -v \ unset -v \
working_safe_ssl_conf \
easyrsa_error_exit \ easyrsa_error_exit \
prohibit_no_pass \ prohibit_no_pass \
secured_session \ secured_session \