diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 18a096d..3575d15 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -69,8 +69,8 @@ Here is the list of commands available with a short syntax reminder. Use the DIRECTORY STATUS (commands would take effect on these locations) EASYRSA: $work_dir PKI: $pki_dir - x509-types: ${EASYRSA_EXT_DIR:-Missing or undefined} -" + x509-types: ${EASYRSA_EXT_DIR:-Missing or undefined}" + } # => usage() # Detailed command help @@ -576,7 +576,7 @@ confirm() { value="$2" msg="$3" input="" - print " + print "\ $msg Type the word '$value' to continue, or any other input to abort." @@ -720,12 +720,7 @@ Temporary session not preserved." *) warn "Host OS undefined." esac - if [ "$EASYRSA_BATCH" ] || [ "$EASYRSA_SILENT" ] - then - : # ok - else - print # To get a clean line - fi + [ "$EASYRSA_SILENT" ] || print # Get a clean line # Clear traps trap - 0 1 2 3 6 15 @@ -891,6 +886,7 @@ easyrsa_openssl() { verify_ssl_lib() { # Run once only [ "$EASYRSA_SSL_OK" ] && die "verify_ssl_lib - Overloaded" + EASYRSA_SSL_OK=1 # redirect std-err to ignore missing etc/ssl/openssl.cnf file val="$("$EASYRSA_OPENSSL" version 2>/dev/null)" @@ -929,13 +925,7 @@ $error_msg" ;; *) die "Unsupported SSL library: $osslv_major" esac - information "Using SSL: $EASYRSA_OPENSSL ${val}" - EASYRSA_SSL_OK=1 - - # Verify EASYRSA_SSL_CONF file exists - [ -f "$EASYRSA_SSL_CONF" ] || die "\ -The OpenSSL config file cannot be found. -Expected location: $EASYRSA_SSL_CONF" + ssl_version="$val" } # => verify_ssl_lib() # Basic sanity-check of PKI init and complain if missing @@ -1049,7 +1039,7 @@ and initialize a fresh PKI here." ecparams certs_by_serial do # # # shellcheck disable=SC2115 # Use "${var:?}" - rm -rf "$EASYRSA_PKI/${i}" || \ + rm -rf "$EASYRSA_PKI/$i" || \ die "init-pki soft reset failed." done ;; @@ -1213,6 +1203,9 @@ install_data_to_pki() { "${EASYRSA_PKI}/${vars_file}" && \ new_vars_true=1 fi + + # Use set_var to set vars, do not clobber $vars + set_var vars "${EASYRSA_PKI}/${vars_file}" ;; vars-setup) : ;; # No change to current 'vars' required @@ -1571,7 +1564,7 @@ at: $out_file" # gen-req and key backend: gen_req() { - # pull filename base and use as default interactive CommonName: + # pull filename base and use as default interactive CommonName [ "$1" ] || die "\ Error: gen-req must have a file base as the first argument. Run easyrsa without commands for usage and commands." @@ -1582,9 +1575,13 @@ Run easyrsa without commands for usage and commands." # Set ssl batch mode and Default commonName, as required if [ "$EASYRSA_BATCH" ]; then ssl_batch=1 - [ "$EASYRSA_REQ_CN" = ChangeMe ] && export EASYRSA_REQ_CN="$1" + # If EASYRSA_REQ_CN is set to something other than + # ChangeMe then keep user defined value + [ "$EASYRSA_REQ_CN" = ChangeMe ] && \ + export EASYRSA_REQ_CN="$1" else - # --req-cn must be used with --batch, otherwise use default + # --req-cn must be used with --batch + # otherwise use file-name export EASYRSA_REQ_CN="$1" fi @@ -1604,7 +1601,7 @@ Run easyrsa without commands for usage and commands." nopass) [ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1 ;; - # batch flag supports internal callers needing silent operation + # batch flag supports internal caller build_full() batch) ssl_batch=1 ;; *) warn "Ignoring unknown command option: '$1'" esac @@ -1619,14 +1616,18 @@ WARNING!!! An existing private key was found at $key_out Continuing with key generation will replace this key." - # When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section: + # When EASYRSA_EXTRA_EXTS is defined, + # append it to openssl's [req] section: if [ "$EASYRSA_EXTRA_EXTS" ]; then # Check for insert-marker in ssl config file - if ! grep -q '^#%EXTRA_EXTS%' "$EASYRSA_SSL_CONF"; then + if ! grep -q '^#%EXTRA_EXTS%' "$EASYRSA_SSL_CONF" + then die "\ -The copy of openssl-easyrsa.cnf in use does not support request extensions. +The copy of openssl-easyrsa.cnf in use \ +does not support request extensions. * $EASYRSA_SSL_CONF -Please update openssl-easyrsa.cnf to the latest official release." +Please update openssl-easyrsa.cnf \ +to the latest official release." fi # Setup & insert the extra ext data keyed by a magic line @@ -1634,24 +1635,28 @@ Please update openssl-easyrsa.cnf to the latest official release." req_extensions = req_extra [ req_extra ] $EASYRSA_EXTRA_EXTS" - # shellcheck disable=SC2016 # vars don't expand in single quote + # vars don't expand in single quote + # shellcheck disable=SC2016 awkscript=' {if ( match($0, "^#%EXTRA_EXTS%") ) { while ( getline<"/dev/stdin" ) {print} next } {print} }' - conf_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file" + conf_tmp="$(easyrsa_mktemp)" || die "\ +gen_req - easyrsa_mktemp - conf_tmp" print "$extra_exts" | \ awk "$awkscript" "$EASYRSA_SSL_CONF" \ > "$conf_tmp" \ - || die "Copying SSL config to temp file failed" - # Use this new SSL config for the rest of this function + || die "Writing SSL config to temp file failed" + # Use this SSL config for the rest of this function EASYRSA_SSL_CONF="$conf_tmp" fi # Name temp files - key_out_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file" - req_out_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file" + key_out_tmp="$(easyrsa_mktemp)" || die "\ +gen_req - easyrsa_mktemp - key_out_tmp" + req_out_tmp="$(easyrsa_mktemp)" || die "\ +gen_req - easyrsa_mktemp - req_out_tmp" # Set Edwards curve name or elliptic curve parameters file algo_opts="" @@ -1677,8 +1682,8 @@ $EASYRSA_EXTRA_EXTS" # Success messages notice "\ Keypair and certificate request completed. Your files are: -req: $req_out -key: $key_out" +* req: $req_out +* key: $key_out${build_full+ $NL}" return 0 } # => gen_req() @@ -1917,7 +1922,6 @@ Run easyrsa without commands for usage and commands." nopass) [ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1 ;; - inline) EASYRSA_INLINE=1 ;; *) warn "Ignoring unknown command option: '$1'" esac shift @@ -1954,6 +1958,7 @@ Option conflict: EASYRSA_REQ_CN="$name" # create request + build_full=1 gen_req "$name" batch # Sign it @@ -4650,6 +4655,11 @@ Sourcing the vars file and building certificates will probably fail ..' # Verify selected algorithm and parameters verify_algo_params + # Last setup msg + information "\ +Using SSL: $EASYRSA_OPENSSL $ssl_version +" + else # If the directory does not exist then we have not run init-pki # The temp-dir is ALWAYS verified by secure_session()