From b578efcb507ef1863f0746bdb8038340e63228ca Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 10 Dec 2022 13:17:39 +0000 Subject: [PATCH 1/4] New function safe_set_var(): Safe wrapper for set_var() When using set_var() with a variable as in input for name of the variable, use this wrapper to verify the input is suitable as a variable name. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 0b9d632..6e54685 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -3714,6 +3714,18 @@ db_date_to_ff_date() { ff_date="${yy}-${mm}-${dd} ${HH}:${MM}:${SS}${TZ}" } # => build_ff_date_string() +# sanatize and set var +safe_set_var() { + [ "$#" -eq 2 ] || return 1 + # check for simple errors + case "$1" in + [1234567890]*|*-*|"* *") return 1 + esac + eval "$1"=1 || return 1 + unset -v "$1" || return 1 + set_var "$1" "$2" || return 1 +} # => safe_set_var() + # get the serial number of the certificate -> serial=XXXX ssl_cert_serial() { [ "$#" = 2 ] || die "ssl_cert_serial - invalid input" @@ -3723,15 +3735,14 @@ ssl_cert_serial() { fn_ssl_out="$( unset -v EASYRSA_DEBUG easyrsa_openssl x509 -in "$1" -noout -serial - )" || die "ssl_cert_serial - failed to get serial" - shift - + )" || die "ssl_cert_serial - failed: -serial" # remove the serial= part -> we only need the XXXX part fn_ssl_out="${fn_ssl_out##*=}" - unset -v "$@" - set_var "$@" "$fn_ssl_out" || \ + shift + safe_set_var "$*" "$fn_ssl_out" || \ die "ssl_cert_serial - failed to set variable '$*'" + unset -v fn_ssl_out } # => ssl_cert_serial() From 8f71f71d8e1bb94e5b9cef84a658446df72a1a9d Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 10 Dec 2022 13:29:56 +0000 Subject: [PATCH 2/4] build-ca: Use safe_set_var() Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 6e54685..b6ff87b 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -1256,8 +1256,7 @@ get_passphrase() { if [ "${#r}" -lt 4 ]; then printf '\n%s\n' "Passphrase must be at least 4 characters!" else - unset -v "$@" - set_var "$@" "$r" || die "Passphrase error!" + safe_set_var "$*" "$r" || die "Passphrase error!" unset -v r print return 0 From ec184ca49e40aba48ae230dea5334ccb6bafdcaf Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 10 Dec 2022 14:14:19 +0000 Subject: [PATCH 3/4] ssl_cert_not_before_date(): Use safe_set_var() Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index b6ff87b..c9edd94 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -3729,7 +3729,6 @@ safe_set_var() { ssl_cert_serial() { [ "$#" = 2 ] || die "ssl_cert_serial - invalid input" [ -f "$1" ] || die "ssl_cert_serial - missing cert" - verify_file x509 "$1" || die "ssl_cert_serial - invalid cert" fn_ssl_out="$( unset -v EASYRSA_DEBUG @@ -3747,14 +3746,20 @@ ssl_cert_serial() { # Get certificate start date ssl_cert_not_before_date() { - [ "$1" ] || die "ssl_cert_not_before_date - Invalid input" + [ "$#" = 2 ] || die "ssl_cert_not_before_date - invalid input" + [ -f "$1" ] || die "ssl_cert_not_before_date - missing cert" + fn_ssl_out="$( unset -v EASYRSA_DEBUG easyrsa_openssl x509 -in "$1" -noout -startdate )" || die "ssl_cert_not_before_date - failed: -startdate" + # 'cert_not_before_date' is *not* used, at this time.. # disable #shellcheck disable=SC2034 # Prefer to keep warning - cert_not_before_date="${fn_ssl_out#*=}" + fn_ssl_out="${fn_ssl_out#*=}" + + shift + safe_set_var "$*" "$fn_ssl_out" unset -v fn_ssl_out } # => ssl_cert_not_before_date() From d3f4cb4d02a53930eaf725712adb5983e1c2807b Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sat, 10 Dec 2022 14:26:46 +0000 Subject: [PATCH 4/4] ssl_cert_not_after_date(): Use safe_set_var() Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index c9edd94..e0a584e 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -3739,7 +3739,7 @@ ssl_cert_serial() { shift safe_set_var "$*" "$fn_ssl_out" || \ - die "ssl_cert_serial - failed to set variable '$*'" + die "ssl_cert_serial - failed to set var '$*'" unset -v fn_ssl_out } # => ssl_cert_serial() @@ -3754,23 +3754,31 @@ ssl_cert_not_before_date() { easyrsa_openssl x509 -in "$1" -noout -startdate )" || die "ssl_cert_not_before_date - failed: -startdate" - # 'cert_not_before_date' is *not* used, at this time.. - # disable #shellcheck disable=SC2034 # Prefer to keep warning fn_ssl_out="${fn_ssl_out#*=}" shift - safe_set_var "$*" "$fn_ssl_out" + safe_set_var "$*" "$fn_ssl_out" || \ + die "ssl_cert_not_before_date - failed to set var '$*'" + unset -v fn_ssl_out } # => ssl_cert_not_before_date() # Get certificate end date ssl_cert_not_after_date() { - [ "$1" ] || die "ssl_cert_not_after_date - Invalid input" + [ "$#" = 2 ] || die "ssl_cert_not_after_date - invalid input" + [ -f "$1" ] || die "ssl_cert_not_after_date - missing cert" + fn_ssl_out="$( unset -v EASYRSA_DEBUG easyrsa_openssl x509 -in "$1" -noout -enddate )" || die "ssl_cert_not_after_date - failed: -enddate" - cert_not_after_date="${fn_ssl_out#*=}" + + fn_ssl_out="${fn_ssl_out#*=}" + + shift + safe_set_var "$*" "$fn_ssl_out" || \ + die "ssl_cert_not_after_date - failed to set var '$*'" + unset -v fn_ssl_out } # => ssl_cert_not_after_date() @@ -3877,7 +3885,7 @@ serial mismatch: fi #cert_source=issued - ssl_cert_not_after_date "$cert_issued" # Assigns cert_not_after_date + ssl_cert_not_after_date "$cert_issued" cert_not_after_date else # Translate db date to usable date @@ -3976,7 +3984,7 @@ serial mismatch: # Use cert date # Assigns cert_not_after_date - ssl_cert_not_after_date "$cert_file_in" + ssl_cert_not_after_date "$cert_file_in" cert_not_after_date # Highlight renewed/cert_by_serial if [ "$renew_is_old" ]; then