nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Integrate '$has_config' into expand_ssl_config() and escape_hazard()

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-07-17 03:02:26 +01:00
parent f352b6f40f
commit d80040ba09
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
easyrsa3/easyrsa
View File

@ -918,15 +918,22 @@ escape_hazard() {
then then
# Always run # Always run
verbose "escape_hazard: FORCED" verbose "escape_hazard: FORCED"
elif [ "$EASYRSA_NO_SAFE_SSL" ]; then # Do not respect --no-safe-ssl, escape the fields
# Never run # before they are expanded by OpenSSL or easyrsa.
verbose "escape_hazard: DENIED" #elif [ "$EASYRSA_NO_SAFE_SSL" ]; then
return # # Never run
# verbose "escape_hazard: DENIED"
# return
elif [ "$working_safe_org_conf" ]; then elif [ "$working_safe_org_conf" ]; then
# Has run once # Has run once
verbose "escape_hazard: BYPASSED"
return
elif [ -z "$has_config" ]; then
# SSL Config not required
verbose "escape_hazard: IGNORED" verbose "escape_hazard: IGNORED"
return return
else else
# Run once
verbose "escape_hazard: RUN-ONCE" verbose "escape_hazard: RUN-ONCE"
fi fi
@ -976,9 +983,14 @@ expand_ssl_config() {
return return
elif [ "$working_safe_ssl_conf" ]; then elif [ "$working_safe_ssl_conf" ]; then
# Has run once # Has run once
verbose "expand_ssl_config: BYPASSED"
return
elif [ -z "$has_config" ]; then
# SSL Config not required
verbose "expand_ssl_config: IGNORED" verbose "expand_ssl_config: IGNORED"
return return
else else
# Run once
verbose "expand_ssl_config: RUN-ONCE" verbose "expand_ssl_config: RUN-ONCE"
fi fi
@ -1051,6 +1063,11 @@ easyrsa_mktemp safe_ssl_cnf_tmp"
# Easy-RSA meta-wrapper for SSL # Easy-RSA meta-wrapper for SSL
# WARNING: Running easyrsa_openssl in a subshell # WARNING: Running easyrsa_openssl in a subshell
# will hide error message and verbose messages # will hide error message and verbose messages
#
# The expansion here takes place on EASYRSA_SSL_CONF,
# which may have already been replaced by a temp-file
# with the extensions having been inserted by build-ca,
# sign-req or gen-req.
easyrsa_openssl() { easyrsa_openssl() {
openssl_command="$1"; shift openssl_command="$1"; shift
@ -1059,7 +1076,7 @@ easyrsa_openssl() {
rand) rand)
die "easyrsa_openssl: Illegal SSL command: rand" die "easyrsa_openssl: Illegal SSL command: rand"
;; ;;
makesafeconf) makesafeconf=1 ;; makesafeconf) makesafeconf=1; has_config=1 ;;
ca|req|srp|ts) has_config=1 ;; ca|req|srp|ts) has_config=1 ;;
*) unset -v has_config *) unset -v has_config
esac esac
@ -1093,7 +1110,7 @@ easyrsa_openssl() {
verbose "\ verbose "\
easyrsa_openssl: Safe SSL conf OK: $safe_ssl_cnf_tmp" easyrsa_openssl: Safe SSL conf OK: $safe_ssl_cnf_tmp"
else else
die "\ [ "$has_config" ] && die "\
easyrsa_openssl - Safe SSL conf MISSING: $safe_ssl_cnf_tmp" easyrsa_openssl - Safe SSL conf MISSING: $safe_ssl_cnf_tmp"
fi fi
@ -4247,7 +4264,7 @@ $in_file"
This file is not a valid $type file: This file is not a valid $type file:
$in_file" $in_file"
notice " notice "\
Showing details for CA certificate, at: Showing details for CA certificate, at:
* $in_file${NL}" * $in_file${NL}"