nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'TinCanTech-externally-set-vars'

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-04-04 20:51:58 +01:00
commit a39de53f94
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 92 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

164
easyrsa3/easyrsa
View File

@ -4671,57 +4671,61 @@ EasyRSA '$cmd' does not support --startdate or --enddate"
} # => mutual_exclusions() } # => mutual_exclusions()
# vars setup # vars setup
# Here sourcing of 'vars' if present occurs. If not present, defaults are used # Here sourcing of 'vars' if present occurs.
# to support running without a sourced config format # If not present, defaults are used to support
# running without a sourced config format
vars_setup() { vars_setup() {
# Try to locate a 'vars' file in order of location preference. # Try to locate a 'vars' file in order of preference.
# If one is found, source it # If one is found then source it.
# NOTE: EASYRSA_PKI is never set here, unless cmd-line --pki-dir=<DIR> is set. # NOTE: EASYRSA_PKI is never set here,
# NOTE: EASYRSA is never set here, unless done so outside of easyrsa. # unless cmd-line --pki-dir=<DIR> is set.
# NOTE: EASYRSA is never set here,
# unless done so outside of easyrsa.
vars= vars=
# set up program path
prog_file="$0"
# Removed for basic sanity - To re-enable provide a REASON
#prog_file2="$(which -- "$prog_file" 2>/dev/null)" && prog_file="$prog_file2"
#prog_file2="$(readlink -f "$prog_file" 2>/dev/null)" && prog_file="$prog_file2"
prog_dir="${prog_file%/*}"
if [ "$prog_dir" = . ] || [ "$prog_dir" = "$PWD" ]; then
prog_in_pwd=1
else
unset -v prog_in_pwd
fi
# Program dir vars - This location is least wanted.
prog_vars="${prog_dir}/vars"
# set up PKI path vars - Top preference
pki_vars="${EASYRSA_PKI:-$PWD/pki}/vars"
expected_pki_vars="$pki_vars"
# Some other place vars, out of scope.
if [ "$EASYRSA" ]; then
easy_vars="${EASYRSA}/vars"
else
unset -v easy_vars
fi
# vars of last resort - Eventually this file must be removed from EasyRSA
pwd_vars="$PWD/vars"
# Find vars # Find vars
# Explicit command-line path: # Explicit user defined vars file:
if [ "$user_vars_true" ]; then if [ "$EASYRSA_VARS_FILE" ]; then
if [ -e "$EASYRSA_VARS_FILE" ]; then if [ -e "$EASYRSA_VARS_FILE" ]; then
vars="$EASYRSA_VARS_FILE" vars="$EASYRSA_VARS_FILE"
user_vars_true=1
else else
# If the --vars option does not point to a file, show helpful error. # If the --vars option does not point to a file
die "The file '$EASYRSA_VARS_FILE' was not found." die "\
The 'vars' file was not found:
* $EASYRSA_VARS_FILE"
fi fi
unset -v prog_vars pwd_vars easy_vars pki_vars expected_pki_vars
# Otherwise, find vars 'the new way' # Otherwise, find vars
else else
# set up program path
prog_file="$0"
prog_dir="${prog_file%/*}"
if [ "$prog_dir" = . ] || [ "$prog_dir" = "$PWD" ]
then
prog_in_pwd=1
else
unset -v prog_in_pwd
fi
# Program dir vars - This location is least wanted.
prog_vars="${prog_dir}/vars"
# set up PKI path vars - Top preference
pki_vars="${EASYRSA_PKI:-$PWD/pki}/vars"
expected_pki_vars="$pki_vars"
# Some other place vars, out of scope.
if [ "$EASYRSA" ]; then
easy_vars="${EASYRSA}/vars"
else
unset -v easy_vars
fi
# vars of last resort
pwd_vars="$PWD/vars"
# Clear flags - This is the preferred order to find: # Clear flags - This is the preferred order to find:
unset -v e_pki_vars e_easy_vars e_pwd_vars e_prog_vars \ unset -v e_pki_vars e_easy_vars e_pwd_vars e_prog_vars \
found_vars vars_in_pki found_vars vars_in_pki
@ -4739,23 +4743,29 @@ vars_setup() {
[ -e "$prog_vars" ] && e_prog_vars=1 [ -e "$prog_vars" ] && e_prog_vars=1
# Filter duplicates # Filter duplicates
if [ "$e_prog_vars" ] && [ "$e_pwd_vars" ] && [ "$prog_in_pwd" ] if [ "$e_prog_vars" ] && [ "$e_pwd_vars" ] && \
[ "$prog_in_pwd" ]
then then
unset -v prog_vars e_prog_vars unset -v prog_vars e_prog_vars
fi fi
# Allow only one vars to be found, No exceptions! # Allow only one vars to be found, No exceptions!
found_vars="$((e_pki_vars + e_easy_vars + e_pwd_vars + e_prog_vars))" found_vars="$((
e_pki_vars + e_easy_vars + e_pwd_vars + e_prog_vars
))"
# If found_vars greater than 1 then output user info and exit # If found_vars greater than 1
# then output user info and exit
case "$found_vars" in case "$found_vars" in
0) unset -v found_vars ;; 0) unset -v found_vars ;;
1) 1)
# If a SINGLE vars file is found then assign $vars # If a SINGLE vars file is found
# then assign $vars
[ "$e_prog_vars" ] && vars="$prog_vars" [ "$e_prog_vars" ] && vars="$prog_vars"
[ "$e_pwd_vars" ] && vars="$pwd_vars" [ "$e_pwd_vars" ] && vars="$pwd_vars"
[ "$e_easy_vars" ] && vars="$easy_vars" [ "$e_easy_vars" ] && vars="$easy_vars"
[ "$e_pki_vars" ] && vars="$pki_vars" && vars_in_pki=1 [ "$e_pki_vars" ] && \
vars="$pki_vars" && vars_in_pki=1
: # Wipe error status : # Wipe error status
;; ;;
*) *)
@ -4773,32 +4783,38 @@ Priority should be given to your PKI vars file:
fi fi
# For init-pki, pki/vars will be deleted # For init-pki, pki/vars will be deleted
# Another vars file exists, so don't create pki/vars # Another vars file exists
# so don't create pki/vars
no_new_vars=1 no_new_vars=1
esac esac
# Clean up # Clean up
unset -v prog_vars pwd_vars easy_vars pki_vars unset -v prog_vars pwd_vars easy_vars pki_vars \
expected_pki_vars
# END: Find vars # END: Find vars
fi fi
# Find vars 'the old way' # If EASYRSA_NO_VARS is defined then do not use vars
# If $EASYRSA_NO_VARS is defined (not blank) then do not use vars. # If no_pki_required then located vars files are not
# If $no_pki_required then located vars files are not required. # required
if [ "$EASYRSA_NO_VARS" ] || [ "$no_pki_required" ]; then if [ "$EASYRSA_NO_VARS" ] || [ "$no_pki_required" ]; then
: # ok : # ok
# If a vars file was located then source it # If a vars file was located then source it
else else
# $vars remains undefined .. no vars found # $vars remains undefined .. no vars found
# 'install_data_to_pki vars-setup' will NOT create a default PKI/vars # 'install_data_to_pki vars-setup' will NOT
# create a default PKI/vars
if [ -z "$vars" ]; then if [ -z "$vars" ]; then
information "No Easy-RSA 'vars' configuration file exists!" information \
"No Easy-RSA 'vars' configuration file exists!"
no_new_vars=1 no_new_vars=1
else else
# 'vars' now MUST exist # 'vars' now MUST exist
[ -e "$vars" ] || die "Missing vars file, expected: $vars" [ -e "$vars" ] || die "\
Missing vars file:
* $vars"
# Installation information # Installation information
information "\ information "\
@ -4827,15 +4843,16 @@ Please, correct these errors and try again."
fi fi
# Enable sourcing 'vars' # Enable sourcing 'vars'
# shellcheck disable=SC2034 # EASYRSA_CALLER appears unused. # shellcheck disable=SC2034 # appears unused
EASYRSA_CALLER=1 EASYRSA_CALLER=1
# Test souring 'vars' in a subshell # Test souring 'vars' in a subshell
# shellcheck disable=1090 # can't follow non-constant source. vars # shellcheck disable=1090 # can't follow .. vars
( . "$vars" ) || die "Failed to source the vars file." ( . "$vars" ) || \
die "Failed to source the vars file."
# Source 'vars' now # Source 'vars' now
# shellcheck disable=1090 # can't follow non-constant source. vars # shellcheck disable=1090 # can't follow .. vars
. "$vars" 2>/dev/null . "$vars" 2>/dev/null
unset -v EASYRSA_CALLER unset -v EASYRSA_CALLER
fi fi
@ -4869,11 +4886,12 @@ Please, correct these errors and try again."
esac esac
set_var EASYRSA_CA_EXPIRE 3650 set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 825 # new default of 36 months set_var EASYRSA_CERT_EXPIRE 825
set_var EASYRSA_PRE_EXPIRY_WINDOW 90 set_var EASYRSA_CERT_RENEW 90
set_var EASYRSA_CRL_DAYS 180 set_var EASYRSA_CRL_DAYS 180
set_var EASYRSA_NS_SUPPORT no set_var EASYRSA_NS_SUPPORT no
set_var EASYRSA_NS_COMMENT "Easy-RSA (~VER~) Generated Certificate" set_var EASYRSA_NS_COMMENT \
"Easy-RSA (~VER~) Generated Certificate"
set_var EASYRSA_TEMP_DIR "$EASYRSA_PKI" set_var EASYRSA_TEMP_DIR "$EASYRSA_PKI"
set_var EASYRSA_REQ_CN ChangeMe set_var EASYRSA_REQ_CN ChangeMe
set_var EASYRSA_DIGEST sha256 set_var EASYRSA_DIGEST sha256
@ -4886,29 +4904,28 @@ Please, correct these errors and try again."
# Verify SSL Lib - One time ONLY # Verify SSL Lib - One time ONLY
verify_ssl_lib verify_ssl_lib
# Find x509-types but do not fail - Not fatal here, used by 'help' # Find x509-types but do not fail
# Not fatal here, used by 'help'
install_data_to_pki x509-types-only install_data_to_pki x509-types-only
# For commands which 'require a PKI' and the PKI exists # For commands which 'require a PKI' and the PKI exists
if [ "$pki_is_required" ] && [ -d "$EASYRSA_PKI" ]; then if [ "$pki_is_required" ] && [ -d "$EASYRSA_PKI" ]; then
# mkdir Temp dir session # mkdir Temp dir session
secure_session || die "Temporary directory secure-session failed." secure_session || \
die "Temporary directory secure-session failed."
if [ -d "$EASYRSA_TEMP_DIR" ]; then if [ -d "$EASYRSA_TEMP_DIR" ]; then
#TODO: This should be removed. Not really suitable for packaging.
#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
# Hard break from 'old' Easy-RSA, see obsolete comment above.
# Install data-files into ALL PKIs # Install data-files into ALL PKIs
# This will find x509-types and export EASYRSA_EXT_DIR or die. # This will find x509-types
# and export EASYRSA_EXT_DIR or die.
# Other errors only require warning. # Other errors only require warning.
install_data_to_pki vars-setup || \ install_data_to_pki vars-setup || \
warn "install_data_to_pki vars-setup Failed" warn "install_data_to_pki vars-setup Failed"
# if the vars file in use is not in the PKI and not user defined # if the vars file in use is not in the PKI
# Show messages # and not user defined then Show the messages
if [ "$vars_in_pki" ] || [ "$user_vars_true" ] || \ if [ "$vars_in_pki" ] || [ "$user_vars_true" ] || \
[ "$no_new_vars" ] [ "$no_new_vars" ]
then then
@ -4926,9 +4943,12 @@ Using SSL: $EASYRSA_OPENSSL $ssl_version
" "
else else
# If the directory does not exist then we have not run init-pki # If the directory does not exist
# then we have not run init-pki
# The temp-dir is ALWAYS verified by secure_session() # The temp-dir is ALWAYS verified by secure_session()
die "Temporary directory does not exist: $EASYRSA_TEMP_DIR" die "\
Temporary directory does not exist:
* $EASYRSA_TEMP_DIR"
fi fi
fi fi
} # vars_setup() } # vars_setup()