From ecd65065e3303da78811278a154ef7a969c2777b Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 16:30:43 +0100 Subject: [PATCH 01/14] Advanced.md: Correct auto-load order and Remove program location Correct auto-load order: The previous order was to search the default PKI before EASYRSA. Change: EASYRSA is moved to a higher priority than a default PKI. Remove 'program location' as a valid target for auto-loading vars. Keeping writable data files in the same folder as executable code is not necessary. If it is required then use of other options is preferred. eg: --vars= or $EASYRSA Add additional information regarding use of default PKI. Add section to advise the preferred use of --pki over --vars. Signed-off-by: Richard T Bonhomme --- doc/EasyRSA-Advanced.md | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/doc/EasyRSA-Advanced.md b/doc/EasyRSA-Advanced.md index 4517ce6..65c7295 100644 --- a/doc/EasyRSA-Advanced.md +++ b/doc/EasyRSA-Advanced.md @@ -33,14 +33,27 @@ Configuration Reference 1. The file referenced by the `--vars` CLI option 2. The file referenced by the env-var named `EASYRSA_VARS_FILE` - 3. The directory referenced by the `EASYRSA_PKI` env-var - 4. The default PKI directory at `$PWD/pki` - 4. The directory referenced by the `EASYRSA` env-var - 5. The directory containing the easyrsa program + 3. The directory referenced by the `--pki` CLI option (Recommended) + 4. The directory referenced by the `EASYRSA_PKI` env-var + 5. The directory referenced by the `EASYRSA` env-var + 6. The default PKI directory at `$PWD/pki` (See note below) + 7. The default working directory at `$PWD` Defining the env-var `EASYRSA_NO_VARS` will override the sourcing of the vars file in all cases, including defining it subsequently as a global option. + Note: If the vars file `$PWD/pki/vars` is sourced then it is forbidden from + setting/changing the current PKI, as defined by `EASYRSA_PKI` env-var. + +#### Use of `--pki` verses `--vars` + + It is recommended to use option `--pki=DIR` to define your PKI at runtime. + This method will always auto-load the `vars` file found in defined PKI. + + In a multi-PKI installation, use of `--vars` can potentially lead to + a vars file that is configured to set a PKI which cannot be verified + as the expected PKI. Use of `--vars` is not recommended. + #### OpenSSL Config Easy-RSA is tightly coupled to the OpenSSL config file (.cnf) for the From dd702802c108296a229dee31f85c82e69fd1b922 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 17:02:59 +0100 Subject: [PATCH 02/14] Replace vars_setup with select_vars, source_vars and default_vars vars_setup was trying to do more work than only setting up vars. These tasks have been broken down as follows: select_vars: * Choose only ONE vars file to source by priority specified in Advanced.md * Apply restrictions to default vars changing EASYRSA or EASYRSA_PKI. source_vars: * Verify and source a vars file. default_vars: * Set all default values as expected. Note: Also disable use of vars_setup. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 207 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 206 insertions(+), 1 deletion(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 6361f80..b38ac14 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5609,11 +5609,212 @@ Use of --silent and --verbose is unresolvable." verbose "mutual_exclusions: COMPLETED" } # => mutual_exclusions() +# Select vars in order preference: +# Here sourcing of 'vars' if present occurs. +# If not present, defaults are used to support +# running without a sourced config format. +select_vars() { + # No vars file will be used + if [ "$EASYRSA_NO_VARS" ]; then + verbose "select_vars: EASYRSA_NO_VARS" + return + fi + + # User specified vars file will be used ONLY + if [ "$EASYRSA_VARS_FILE" ]; then + verbose "select_vars: EASYRSA_VARS_FILE" + source_vars "$EASYRSA_VARS_FILE" + return + fi + + # User specified PKI; if vars exists, use it ONLY + if [ "$EASYRSA_PKI" ]; then + if [ -e "$EASYRSA_PKI/vars" ]; then + verbose "select_vars: source EASYRSA_PKI/vars" + source_vars "$EASYRSA_PKI/vars" + return + fi + fi + + # User specified EASYRSA; if vars exists, use it ONLY + if [ "$EASYRSA" ]; then + if [ -e "$EASYRSA/vars" ]; then + verbose "select_vars: EASYRSA/vars" + source_vars "$EASYRSA/vars" + return + fi + fi + + # Default PKI; if vars exists, use it ONLY + if [ -e "$PWD/pki/vars" ]; then + # Prevent vars from changing values + set_var EASYRSA "$PWD" + set_var EASYRSA_PKI "$EASYRSA/pki" + verbose "select_vars: PWD/pki/vars" + source_vars "$PWD/pki/vars" + return + fi + + # Default working dir; if vars exists, use it ONLY + if [ -e "$PWD/vars" ]; then + # Prevent vars from changing values + set_var EASYRSA "$PWD" + verbose "select_vars: PWD/vars" + source_vars "$PWD/vars" + return + fi + + information "\ +No Easy-RSA 'vars' configuration file exists!" +} # => setup_vars() + +# Source a vars file +source_vars() { + # Never use vars file + if [ "$EASYRSA_NO_VARS" ]; then + verbose "source_vars: EASYRSA_NO_VARS" + return + fi + + # File to be sourced + target_file="$1" + + # 'vars' MUST not be a directory + [ -d "$target_file" ] && user_error "\ +Missing vars file: +* $target_file" + + # 'vars' now MUST exist + [ -e "$target_file" ] || user_error "\ +Missing vars file: +* $target_file" + + # Installation information + [ "$require_pki" ] && information "\ +Using Easy-RSA 'vars' configuration: +* $target_file" + + # Sanitize vars + if grep -q \ + -e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT' \ + -e '[^(]`[^)]' \ + "$target_file" + then + user_error "\ +One or more of these problems has been found in your 'vars' file: +* $target_file + +* Use of 'EASYRSA_PASSIN' or 'EASYRSA_PASSOUT': +Storing password information in the 'vars' file is not permitted. + +* Use of unsupported characters: +These characters are not supported: \` backtick + +Please, correct these errors and try again." + fi + + # Sanitize vars + if grep -q \ + -e '[[:blank:]]export[[:blank:]]*' \ + -e '[[:blank:]]unset[[:blank:]]*' \ + "$target_file" + then + user_error "\ +One or more of these problems has been found in your 'vars' file: +* $target_file + +* Use of 'export': +Remove 'export' or replace it with 'set_var'. + +* Use of 'unset': +Remove 'unset' ('force_set_var' may also work)." + fi + + # Enable sourcing 'vars' + # shellcheck disable=SC2034 # appears unused + EASYRSA_CALLER=1 + easyrsa_path="$PATH" + # shellcheck disable=SC2123 # PATH is the shell .. + PATH=./ + + # Test sourcing 'vars' in a subshell + # shellcheck disable=1090 # can't follow .. vars + ( . "$target_file" ) || \ + die "Failed to dry-run the '$target_file' file." + + # Source 'vars' now + # shellcheck disable=1090 # can't follow .. vars + . "$target_file" || \ + die "Failed to source the '$target_file' file." + + PATH="$easyrsa_path" + verbose "source_vars: sourced OK '$target_file'" + unset -v EASYRSA_CALLER easyrsa_path target_file +} # => source_vars() + +# Set defaults +default_vars() { + # Set defaults, preferring existing env-vars if present + set_var EASYRSA "$PWD" + set_var EASYRSA_OPENSSL openssl + set_var EASYRSA_PKI "$EASYRSA/pki" + set_var EASYRSA_DN cn_only + set_var EASYRSA_REQ_COUNTRY "US" + set_var EASYRSA_REQ_PROVINCE "California" + set_var EASYRSA_REQ_CITY "San Francisco" + set_var EASYRSA_REQ_ORG "Copyleft Certificate Co" + set_var EASYRSA_REQ_EMAIL me@example.net + set_var EASYRSA_REQ_OU "My Organizational Unit" + set_var EASYRSA_REQ_SERIAL "" + set_var EASYRSA_ALGO rsa + set_var EASYRSA_KEY_SIZE 2048 + + case "$EASYRSA_ALGO" in + rsa) + : # ok + # default EASYRSA_KEY_SIZE must always be set + # it must NOT be set selectively because it is + # present in the SSL config file + ;; + ec) + set_var EASYRSA_CURVE secp384r1 + ;; + ed) + set_var EASYRSA_CURVE ed25519 + ;; + *) user_error "\ +Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'" + esac + + set_var EASYRSA_CA_EXPIRE 3650 + set_var EASYRSA_CERT_EXPIRE 825 + set_var \ + EASYRSA_PRE_EXPIRY_WINDOW 90 + set_var EASYRSA_CRL_DAYS 180 + set_var EASYRSA_NS_SUPPORT no + set_var EASYRSA_NS_COMMENT \ + "Easy-RSA (~VER~) Generated Certificate" + + set_var EASYRSA_TEMP_DIR "$EASYRSA_PKI" + set_var EASYRSA_REQ_CN ChangeMe + set_var EASYRSA_DIGEST sha256 + + set_var EASYRSA_SSL_CONF \ + "$EASYRSA_PKI/openssl-easyrsa.cnf" + set_var EASYRSA_SAFE_CONF \ + "$EASYRSA_PKI/safessl-easyrsa.cnf" + + set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM" + + set_var EASYRSA_MAX_TEMP 4 +} # => default_vars() + # vars setup # Here sourcing of 'vars' if present occurs. # If not present, defaults are used to support # running without a sourced config format vars_setup() { + die "vars_setup: DISABLED" # Try to locate a 'vars' file in order of preference. # If one is found then source it. # NOTE: EASYRSA_PKI is never set here, @@ -5758,6 +5959,7 @@ No Easy-RSA 'vars' configuration file exists!" # If a vars file was located then source it else + # 'vars' MUST not be a directory [ -d "$vars" ] && user_error "\ Missing vars file: @@ -7288,7 +7490,10 @@ case "$cmd" in esac # Intelligent env-var detection and auto-loading: -vars_setup +# Select and source vars file +select_vars +# then set defaults +default_vars # Check for conflicting input options mutual_exclusions From 1d0ecaf17bbb01f0a2d5f9b5cb8979afcb53ecb2 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 19:20:09 +0100 Subject: [PATCH 03/14] New function: validate_default_vars() Check that sourcing default pki/vars has NOT changed EASYRSA or EASYRSA_PKI. This will be resolved in v3.2.0 - See #comment for details. Refactor select_vars(): To: single if/elif/else/fi. From: separate if/fi statements. Always set EASYRSA_VARS_FILE to the used vars-file. (Required for 'help' status) Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 93 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 66 insertions(+), 27 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index b38ac14..1155962 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5617,55 +5617,58 @@ select_vars() { # No vars file will be used if [ "$EASYRSA_NO_VARS" ]; then verbose "select_vars: EASYRSA_NO_VARS" - return - fi + unset -v EASYRSA_VARS_FILE # User specified vars file will be used ONLY - if [ "$EASYRSA_VARS_FILE" ]; then + elif [ "$EASYRSA_VARS_FILE" ]; then verbose "select_vars: EASYRSA_VARS_FILE" source_vars "$EASYRSA_VARS_FILE" - return - fi # User specified PKI; if vars exists, use it ONLY - if [ "$EASYRSA_PKI" ]; then + elif [ "$EASYRSA_PKI" ]; then if [ -e "$EASYRSA_PKI/vars" ]; then verbose "select_vars: source EASYRSA_PKI/vars" - source_vars "$EASYRSA_PKI/vars" - return + EASYRSA_VARS_FILE="$EASYRSA_PKI/vars" + source_vars "$EASYRSA_VARS_FILE" fi - fi # User specified EASYRSA; if vars exists, use it ONLY - if [ "$EASYRSA" ]; then + elif [ "$EASYRSA" ]; then if [ -e "$EASYRSA/vars" ]; then verbose "select_vars: EASYRSA/vars" - source_vars "$EASYRSA/vars" - return + EASYRSA_VARS_FILE="$EASYRSA/vars" + source_vars "$EASYRSA_VARS_FILE" fi - fi # Default PKI; if vars exists, use it ONLY - if [ -e "$PWD/pki/vars" ]; then - # Prevent vars from changing values - set_var EASYRSA "$PWD" - set_var EASYRSA_PKI "$EASYRSA/pki" + elif [ -e "$PWD/pki/vars" ]; then + # Prevent vars from changing expected PKI. + # A vars in the PKI MUST always imply EASYRSA_PKI + # This is NOT backward compatible + # Use expected value comparison for v3.1.7 + expected_EASYRSA="$PWD" + expected_EASYRSA_PKI="$PWD/pki" + # + # Use this for v3.2.0 + # If the pki/vars sets a different PKI then + # there will be no PKI in the default /pki + #set_var EASYRSA "$PWD" + #set_var EASYRSA_PKI "$EASYRSA/pki" + verbose "select_vars: PWD/pki/vars" - source_vars "$PWD/pki/vars" - return - fi + EASYRSA_VARS_FILE="$PWD/pki/vars" + source_vars "$EASYRSA_VARS_FILE" # Default working dir; if vars exists, use it ONLY - if [ -e "$PWD/vars" ]; then - # Prevent vars from changing values - set_var EASYRSA "$PWD" + elif [ -e "$PWD/vars" ]; then verbose "select_vars: PWD/vars" - source_vars "$PWD/vars" - return - fi + EASYRSA_VARS_FILE="$PWD/vars" + source_vars "$EASYRSA_VARS_FILE" - information "\ + else + information "\ No Easy-RSA 'vars' configuration file exists!" + fi } # => setup_vars() # Source a vars file @@ -5809,6 +5812,37 @@ Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'" set_var EASYRSA_MAX_TEMP 4 } # => default_vars() +# Validate expected values for EASYRSA and EASYRSA_PKI +validate_default_vars() { + unset -v unexpected_error + + # Keep checks separate + # EASYRSA + if [ "$expected_EASYRSA" ]; then + [ "$expected_EASYRSA" = "$EASYRSA" ] || \ + unexpected_error="\ + EASYRSA: $EASYRSA -- expected: $expected_EASYRSA${NL}" + fi + + # EASYRSA_PKI + if [ "$expected_EASYRSA_PKI" ]; then + [ "$expected_EASYRSA_PKI" = "$EASYRSA_PKI" ] || \ + unexpected_error="${unexpected_error}\ + EASYRSA_PKI: $EASYRSA_PKI -- expected: $expected_EASYRSA_PKI" + fi + + # Return no error + [ -z "$unexpected_error" ] && return + + # This is an unacceptable error + user_error "\ +The values in the vars file have unexpectedly changed the values for +EASYRSA and/or EASYRSA_PKI. The default pki/vars file is forbidden to +change these values: + vars-file: $EASYRSA_VARS_FILE +${unexpected_error}" +} # => validate_default_vars() + # vars setup # Here sourcing of 'vars' if present occurs. # If not present, defaults are used to support @@ -7495,6 +7529,11 @@ select_vars # then set defaults default_vars +# Check for unexpected changes to EASYRSA or EASYRSA_PKI +# This will be resolved in v3.2.0 +# https://github.com/OpenVPN/easy-rsa/issues/1006 +validate_default_vars + # Check for conflicting input options mutual_exclusions From cc9a19cf2813f5c8d55b0111f1caf1a76438faf9 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 19:31:00 +0100 Subject: [PATCH 04/14] help, status: Use EASYRSA_VARS_FILE for 'vars-file:' detection Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 1155962..084c30e 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -65,13 +65,6 @@ A list of commands is shown below: work_dir="${EASYRSA:-undefined}" pki_dir="${EASYRSA_PKI:-undefined}" - # vars file details - case "$found_vars" in - 0) vars_status="Missing or undefined" ;; - 1) vars_status="$vars" ;; - *) vars_status="WARNING: Multiple conflicting vars files!" - esac - # CA Status if verify_ca_init test; then CA_cert="$EASYRSA_PKI/ca.crt" @@ -92,7 +85,7 @@ A list of commands is shown below: DIRECTORY STATUS (commands would take effect on these locations) EASYRSA: $work_dir PKI: $pki_dir - vars-file: $vars_status + vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined} x509-types: ${EASYRSA_EXT_DIR:-Missing or undefined} $CA_status" From 632b369cd6085ace645ccd3a7ee465185e1bd06c Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 21:11:42 +0100 Subject: [PATCH 05/14] Simplify select_vars(): Use EASYRSA_NO_VARS or EASYRSA_VARS_FILE Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 084c30e..3656494 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5615,14 +5615,14 @@ select_vars() { # User specified vars file will be used ONLY elif [ "$EASYRSA_VARS_FILE" ]; then verbose "select_vars: EASYRSA_VARS_FILE" - source_vars "$EASYRSA_VARS_FILE" # User specified PKI; if vars exists, use it ONLY elif [ "$EASYRSA_PKI" ]; then if [ -e "$EASYRSA_PKI/vars" ]; then verbose "select_vars: source EASYRSA_PKI/vars" EASYRSA_VARS_FILE="$EASYRSA_PKI/vars" - source_vars "$EASYRSA_VARS_FILE" + else + EASYRSA_NO_VARS=1 fi # User specified EASYRSA; if vars exists, use it ONLY @@ -5630,7 +5630,8 @@ select_vars() { if [ -e "$EASYRSA/vars" ]; then verbose "select_vars: EASYRSA/vars" EASYRSA_VARS_FILE="$EASYRSA/vars" - source_vars "$EASYRSA_VARS_FILE" + else + EASYRSA_NO_VARS=1 fi # Default PKI; if vars exists, use it ONLY @@ -5650,19 +5651,21 @@ select_vars() { verbose "select_vars: PWD/pki/vars" EASYRSA_VARS_FILE="$PWD/pki/vars" - source_vars "$EASYRSA_VARS_FILE" # Default working dir; if vars exists, use it ONLY elif [ -e "$PWD/vars" ]; then verbose "select_vars: PWD/vars" EASYRSA_VARS_FILE="$PWD/vars" - source_vars "$EASYRSA_VARS_FILE" else information "\ No Easy-RSA 'vars' configuration file exists!" + EASYRSA_NO_VARS=1 fi -} # => setup_vars() + + # source the vars file + source_vars "$EASYRSA_VARS_FILE" +} # => select_vars() # Source a vars file source_vars() { From f05adaf9d79f03f3230372be722532d299962733 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 21:37:35 +0100 Subject: [PATCH 06/14] select_vars: Establish correct hierarchy to assign EASYRSA_VARS_FILE All candidate vars-files are searched for and EASYRSA_VARS_FILE is set to the first valid vars-file found. According to Advanced.md Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 3656494..abd7b52 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5611,31 +5611,34 @@ select_vars() { if [ "$EASYRSA_NO_VARS" ]; then verbose "select_vars: EASYRSA_NO_VARS" unset -v EASYRSA_VARS_FILE + # skip the rest of this function + return + fi # User specified vars file will be used ONLY - elif [ "$EASYRSA_VARS_FILE" ]; then + if [ "$EASYRSA_VARS_FILE" ]; then + # Takes priority, nothing to do verbose "select_vars: EASYRSA_VARS_FILE" + fi # User specified PKI; if vars exists, use it ONLY - elif [ "$EASYRSA_PKI" ]; then + if [ "$EASYRSA_PKI" ]; then if [ -e "$EASYRSA_PKI/vars" ]; then verbose "select_vars: source EASYRSA_PKI/vars" - EASYRSA_VARS_FILE="$EASYRSA_PKI/vars" - else - EASYRSA_NO_VARS=1 + set_var EASYRSA_VARS_FILE "$EASYRSA_PKI/vars" fi + fi # User specified EASYRSA; if vars exists, use it ONLY - elif [ "$EASYRSA" ]; then + if [ "$EASYRSA" ]; then if [ -e "$EASYRSA/vars" ]; then verbose "select_vars: EASYRSA/vars" - EASYRSA_VARS_FILE="$EASYRSA/vars" - else - EASYRSA_NO_VARS=1 + set_var EASYRSA_VARS_FILE "$EASYRSA/vars" fi + fi # Default PKI; if vars exists, use it ONLY - elif [ -e "$PWD/pki/vars" ]; then + if [ -e "$PWD/pki/vars" ]; then # Prevent vars from changing expected PKI. # A vars in the PKI MUST always imply EASYRSA_PKI # This is NOT backward compatible @@ -5650,14 +5653,16 @@ select_vars() { #set_var EASYRSA_PKI "$EASYRSA/pki" verbose "select_vars: PWD/pki/vars" - EASYRSA_VARS_FILE="$PWD/pki/vars" + set_var EASYRSA_VARS_FILE "$PWD/pki/vars" + fi # Default working dir; if vars exists, use it ONLY - elif [ -e "$PWD/vars" ]; then + if [ -e "$PWD/vars" ]; then verbose "select_vars: PWD/vars" - EASYRSA_VARS_FILE="$PWD/vars" + set_var EASYRSA_VARS_FILE="$PWD/vars" + fi - else + if [ -z "$EASYRSA_VARS_FILE" ]; then information "\ No Easy-RSA 'vars' configuration file exists!" EASYRSA_NO_VARS=1 From 79571583e5c444104b0fbdfeb9e27e2a2d0cef52 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 22:15:45 +0100 Subject: [PATCH 07/14] Remove unused function vars_setup() Replaced by: select_vars(), source_vars() and default_vars(). Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 295 ----------------------------------------------- 1 file changed, 295 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index abd7b52..98a13d5 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5844,301 +5844,6 @@ change these values: ${unexpected_error}" } # => validate_default_vars() -# vars setup -# Here sourcing of 'vars' if present occurs. -# If not present, defaults are used to support -# running without a sourced config format -vars_setup() { - die "vars_setup: DISABLED" - # Try to locate a 'vars' file in order of preference. - # If one is found then source it. - # NOTE: EASYRSA_PKI is never set here, - # unless cmd-line --pki-dir= is set. - # NOTE: EASYRSA is never set here, - # unless done so outside of easyrsa. - vars= - - # Find vars - # User set vars '$user_vars_true' takes priority - # Deliberate NO vars - if [ "$EASYRSA_NO_VARS" ]; then - user_vars_true=1 - # Found exactly zero vars files - found_vars=0 - - # Priority: Explicit user defined vars file: - elif [ "$EASYRSA_VARS_FILE" ]; then - if [ -e "$EASYRSA_VARS_FILE" ]; then - vars="$EASYRSA_VARS_FILE" - # User set vars turns off pki/var warning - user_vars_true=1 - # Found exactly one vars file - found_vars=1 - else - # If the --vars option does not point to a file - user_error "\ -The 'vars' file was not found: -* $EASYRSA_VARS_FILE" - fi - - # Secondary: Setting EASYRSA forces vars to EASYRSA/vars - elif [ "$EASYRSA" ]; then - if [ -e "$EASYRSA/vars" ]; then - vars="${EASYRSA}/vars" - user_vars_true=1 - found_vars=1 - else - # Allow to run without EASYRSA/vars file - user_vars_true=1 - found_vars=0 - fi - - # Otherwise, find vars - else - - # If EASYRSA_PKI is set then it is user set, - # allow use of the default vars in the set PKI - if [ "$EASYRSA_PKI" ]; then - # EASYRSA_PKI will not be changed by vars - pki_vars="${EASYRSA_PKI}/vars" - else - # default pki/vars - # if this conflicts then bail - pki_vars="${PWD}/pki/vars" - - # Setup "catch EXPECTED PKI changed" - # auto-load 'pki/vars' is FORBIDDEN to change PKI - expected_pki="${PWD}/pki" - fi - - # vars of last resort; The Default - pwd_vars="$PWD/vars" - - # Clear flags - This is the preferred order to find: - unset -v \ - e_pki_vars e_pwd_vars \ - found_vars vars_in_pki - - # PKI location, if present: - [ -e "$pki_vars" ] && e_pki_vars=1 - - # vars of last resort - [ -e "$pwd_vars" ] && e_pwd_vars=1 - - # Allow only one vars to be found, No exceptions! - found_vars="$(( - e_pki_vars + e_pwd_vars - ))" - verbose "vars_setup: found_vars = '$found_vars'" - - # If found_vars greater than 1 - # then output user info and exit - case "$found_vars" in - 0) - : # ok - ;; - 1) - # If a SINGLE vars file is found - # then assign $vars - [ "$e_pwd_vars" ] && vars="$pwd_vars" - if [ "$e_pki_vars" ]; then - vars="$pki_vars" - vars_in_pki=1 - else - unset -v vars_in_pki - fi - ;; - *) - found_msg="" - [ "$e_pki_vars" ] && \ - found_msg="${found_msg}${NL} * Found pki_vars : $pki_vars" - [ "$e_pwd_vars" ] && \ - found_msg="${found_msg}${NL} * Found pwd_vars : $pwd_vars" - - # If command is not 'help' etc then Error out - [ "$ignore_vars" ] || user_error "\ -Conflicting 'vars' files found: -$found_msg - -Use option --vars= to define the vars file -or remove the conflicting vars files. - -Easy-RSA recommends moving your vars file to your PKI and using -option --pki=, which will auto-select the correct vars file." - - verbose "vars_setup: Conflicting vars IGNORED" - esac - verbose "vars_setup: vars = '$vars'" - - # Clean up - unset -v pwd_vars pki_vars - # END: Find vars - fi - - # If EASYRSA_NO_VARS is defined then do not use vars - # If PKI is not required then located vars files are - # not required - if [ "$EASYRSA_NO_VARS" ]; then - verbose "vars_setup: EASYRSA_NO_VARS enabled" - - # $vars remains undefined .. no vars found - # 'install_data_to_pki vars-setup' will NOT - # create a default PKI/vars, no_new_vars - elif [ -z "$vars" ]; then - # If PKI is required then warn - # For init-pki, version and help, skip this - if [ "$require_pki" ]; then - information "\ -No Easy-RSA 'vars' configuration file exists!" - fi - - # If a vars file was located then source it - else - - # 'vars' MUST not be a directory - [ -d "$vars" ] && user_error "\ -Missing vars file: -* $vars" - - # 'vars' now MUST exist - [ -e "$vars" ] || user_error "\ -Missing vars file: -* $vars" - - # Installation information - [ "$require_pki" ] && information "\ -Using Easy-RSA 'vars' configuration: -* $vars" - - # Sanitize vars - if grep -q \ - -e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT' \ - -e '[^(]`[^)]' \ - "$vars" - then - user_error "\ -One or more of these problems has been found in your 'vars' file: - -* Use of 'EASYRSA_PASSIN' or 'EASYRSA_PASSOUT': -Storing password information in the 'vars' file is not permitted. - -* Use of unsupported characters: -These characters are not supported: \` backtick - -Please, correct these errors and try again." - fi - - # Sanitize vars - if grep -q \ - -e '[[:blank:]]export[[:blank:]]*' \ - -e '[[:blank:]]unset[[:blank:]]*' \ - "$vars" - then - user_error "\ -One or more of these problems has been found in your 'vars' file: - -* Use of 'export': -Remove 'export' or replace it with 'set_var'. - -* Use of 'unset': -Remove 'unset' ('force_set_var' may also work)." - fi - - # Enable sourcing 'vars' - # shellcheck disable=SC2034 # appears unused - EASYRSA_CALLER=1 - easyrsa_path="$PATH" - # shellcheck disable=SC2123 # PATH is the shell .. - PATH=./ - - # Test sourcing 'vars' in a subshell - # shellcheck disable=1090 # can't follow .. vars - ( . "$vars" ) || \ - die "Failed to dry-run the vars file." - - # Source 'vars' now - # shellcheck disable=1090 # can't follow .. vars - . "$vars" || \ - die "Failed to source the vars file." - - PATH="$easyrsa_path" - unset -v EASYRSA_CALLER easyrsa_path - verbose "vars_setup: sourced 'vars' OK" - fi - - # Set defaults, preferring existing env-vars if present - set_var EASYRSA "$PWD" - set_var EASYRSA_OPENSSL openssl - set_var EASYRSA_PKI "$EASYRSA/pki" - set_var EASYRSA_DN cn_only - set_var EASYRSA_REQ_COUNTRY "US" - set_var EASYRSA_REQ_PROVINCE "California" - set_var EASYRSA_REQ_CITY "San Francisco" - set_var EASYRSA_REQ_ORG "Copyleft Certificate Co" - set_var EASYRSA_REQ_EMAIL me@example.net - set_var EASYRSA_REQ_OU "My Organizational Unit" - set_var EASYRSA_REQ_SERIAL "" - set_var EASYRSA_ALGO rsa - set_var EASYRSA_KEY_SIZE 2048 - - case "$EASYRSA_ALGO" in - rsa) - : # ok - # default EASYRSA_KEY_SIZE must always be set - # it must NOT be set selectively because it is - # present in the SSL config file - ;; - ec) - set_var EASYRSA_CURVE secp384r1 - ;; - ed) - set_var EASYRSA_CURVE ed25519 - ;; - *) user_error "\ -Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'" - esac - - set_var EASYRSA_CA_EXPIRE 3650 - set_var EASYRSA_CERT_EXPIRE 825 - set_var \ - EASYRSA_PRE_EXPIRY_WINDOW 90 - set_var EASYRSA_CRL_DAYS 180 - set_var EASYRSA_NS_SUPPORT no - set_var EASYRSA_NS_COMMENT \ - "Easy-RSA (~VER~) Generated Certificate" - - set_var EASYRSA_TEMP_DIR "$EASYRSA_PKI" - set_var EASYRSA_REQ_CN ChangeMe - set_var EASYRSA_DIGEST sha256 - - set_var EASYRSA_SSL_CONF \ - "$EASYRSA_PKI/openssl-easyrsa.cnf" - set_var EASYRSA_SAFE_CONF \ - "$EASYRSA_PKI/safessl-easyrsa.cnf" - - set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM" - - set_var EASYRSA_MAX_TEMP 4 - - # Catch unexpected PKI change - if [ "$expected_pki" ]; then - [ "$expected_pki" = "$EASYRSA_PKI" ] || \ - user_error "\ -The PKI was unexpectedly changed by the vars file. - - * vars : $vars - * Expected: $expected_pki - * Set : $EASYRSA_PKI" - fi - - # if the vars file in use is not in the PKI - # and not user defined then Show the messages - if [ "$require_pki" ]; then - prefer_vars_in_pki_msg - fi - verbose "vars_setup: COMPLETED" -} # => vars_setup() - # Verify working environment verify_working_env() { # Do not allow demented paths, eg: '/' or '\' From 11c510ef9c35aff208b46abe2307e69b1d8f4e02 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 22:21:30 +0100 Subject: [PATCH 08/14] Remove unused variable $found_vars Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 98a13d5..09fe4cb 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -1310,11 +1310,6 @@ and initialize a fresh PKI here." # # # shellcheck disable=SC2115 # Use "${var:?}" rm -rf "$EASYRSA_PKI" || \ die "init-pki hard reset failed." - - # If vars was in the old pki, it has been removed - # If vars was somewhere else, it is user defined - # Clear found_vars, we MUST not find pki/vars - [ "$vars_in_pki" ] && unset -v found_vars ;; soft) # There is no unit test for a soft reset @@ -1487,7 +1482,7 @@ install_data_to_pki: $context - COMPLETED" # Create PKI/vars from PKI/example unset -v new_vars_true - if [ "$found_vars" = 1 ] || [ "$user_vars_true" ] || \ + if [ "$user_vars_true" ] || \ [ "$no_new_vars" ] then : # ok - Do not make a PKI/vars if another vars exists @@ -5663,7 +5658,7 @@ select_vars() { fi if [ -z "$EASYRSA_VARS_FILE" ]; then - information "\ + [ "$ignore_vars" ] || information "\ No Easy-RSA 'vars' configuration file exists!" EASYRSA_NO_VARS=1 fi @@ -6978,7 +6973,7 @@ unset -v \ makesafeconf \ alias_days \ prohibit_no_pass \ - found_vars no_new_vars user_vars_true \ + no_new_vars user_vars_true \ expected_pki \ do_build_full error_build_full_cleanup \ internal_batch \ From 587510b52fa06babbdfafa0b1b6e493e859a5400 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 24 Sep 2023 23:49:27 +0100 Subject: [PATCH 09/14] Improve warnings for default pki/vars changing EASYRSA/EASYRSA_PKI Also, remove unused variable $expected_pki. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 09fe4cb..0a0b193 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -80,12 +80,20 @@ A list of commands is shown below: CA_status=" CA status: CA has not been built" fi + if [ "$invalid_vars" ]; then + ivmsg=" + *WARNING*: \ +Invalid vars setting for EASYRSA and/or EASYRSA_PKI${NL}" + else + unset -v ivmsg + fi + # Print details print " DIRECTORY STATUS (commands would take effect on these locations) EASYRSA: $work_dir PKI: $pki_dir - vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined} + vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined}${ivmsg} x509-types: ${EASYRSA_EXT_DIR:-Missing or undefined} $CA_status" @@ -5658,7 +5666,7 @@ select_vars() { fi if [ -z "$EASYRSA_VARS_FILE" ]; then - [ "$ignore_vars" ] || information "\ + [ "$require_pki" ] && information "\ No Easy-RSA 'vars' configuration file exists!" EASYRSA_NO_VARS=1 fi @@ -5817,25 +5825,37 @@ validate_default_vars() { if [ "$expected_EASYRSA" ]; then [ "$expected_EASYRSA" = "$EASYRSA" ] || \ unexpected_error="\ - EASYRSA: $EASYRSA -- expected: $expected_EASYRSA${NL}" + EASYRSA: $EASYRSA + Expected: $expected_EASYRSA" fi # EASYRSA_PKI if [ "$expected_EASYRSA_PKI" ]; then - [ "$expected_EASYRSA_PKI" = "$EASYRSA_PKI" ] || \ + if [ "$expected_EASYRSA_PKI" = "$EASYRSA_PKI" ]; then + : # ok + else + if [ "$unexpected_error" ]; then + # Add a new-line Extra separator, for clarity + unexpected_error="${unexpected_error}${NL}${NL}" + fi unexpected_error="${unexpected_error}\ - EASYRSA_PKI: $EASYRSA_PKI -- expected: $expected_EASYRSA_PKI" + EASYRSA_PKI: $EASYRSA_PKI + Expected: $expected_EASYRSA_PKI" + fi fi # Return no error [ -z "$unexpected_error" ] && return - # This is an unacceptable error - user_error "\ + # This is an almost unacceptable error + invalid_vars=1 + [ "$ignore_vars" ] || user_error "\ The values in the vars file have unexpectedly changed the values for EASYRSA and/or EASYRSA_PKI. The default pki/vars file is forbidden to -change these values: - vars-file: $EASYRSA_VARS_FILE +change these values. + + vars-file: $EASYRSA_VARS_FILE + ${unexpected_error}" } # => validate_default_vars() @@ -6973,8 +6993,8 @@ unset -v \ makesafeconf \ alias_days \ prohibit_no_pass \ + invalid_vars \ no_new_vars user_vars_true \ - expected_pki \ do_build_full error_build_full_cleanup \ internal_batch \ easyrsa_exit_with_error error_info From 302fa37a798e0a5b1911c665cd036a7ae1d9db31 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Mon, 25 Sep 2023 01:49:46 +0100 Subject: [PATCH 10/14] ChangeLog: Rewrite vars-auto-detect, adhere to EasyRSA-Advanced.md Additional: Caveat: The default '$PWD/pki/vars' file is forbidden to change either EASYRSA or EASYRSA_PKI, which are both implied by default. NOTICE: vars-auto-detect no longer searches easyrsa program directory. Signed-off-by: Richard T Bonhomme --- ChangeLog | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0e17081..0e83399 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,12 +3,18 @@ Easy-RSA 3 ChangeLog 3.2.0 (TBD) 3.1.7 (2023-10-13) + * Rewrite vars-auto-detect, adhere to EasyRSA-Advanced.md (#1029) + Under the hood, this is a considerable change but there are no user + noticable differences. With the exception of: + Caveat: The default '$PWD/pki/vars' file is forbidden to change either + EASYRSA or EASYRSA_PKI, which are both implied by default. + NOTICE: vars-auto-detect no longer searches 'easyrsa' program directory. + * EasyRSA-Advanced.md: Correct vars-auto-detect hierarchy (#1029) * gen-crl: preserve existing crl.pem ownership+mode (#1020) * New command: make-vars - Print vars.example (here-doc) to stdout (#1024) * show-expire: Calculate cert. expire seconds from DB date (#1023) * Forbid "default vars in the default PKI" for all commands (#1021) - There can be only one default vars file, that is now './vars' ONLY. - Use of other 'vars' files can be done by using option --vars= + REVERTED in #1029 above. * Update OpenSSL to 3.1.2 3.1.6 (2023-07-18) From 29bd64ceb0e0a9f4dc7a8a04a5b47f944e95b35f Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Fri, 29 Sep 2023 03:02:34 +0100 Subject: [PATCH 11/14] select_vars: Set "expected" values ONLY when "$PWD/pki/vars" is used Vars 'expected_EASYRSA' and 'expected_EASYRSA_PKI' must only be set when "$PWD/pki/vars" is used. This is the only file which can set the PKI to an "unexpected" location. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 87 +++++++++++++++++++++++++----------------------- 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 0a0b193..d883eb8 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5616,55 +5616,60 @@ select_vars() { unset -v EASYRSA_VARS_FILE # skip the rest of this function return - fi # User specified vars file will be used ONLY - if [ "$EASYRSA_VARS_FILE" ]; then + elif [ "$EASYRSA_VARS_FILE" ]; then # Takes priority, nothing to do verbose "select_vars: EASYRSA_VARS_FILE" - fi - # User specified PKI; if vars exists, use it ONLY - if [ "$EASYRSA_PKI" ]; then - if [ -e "$EASYRSA_PKI/vars" ]; then - verbose "select_vars: source EASYRSA_PKI/vars" - set_var EASYRSA_VARS_FILE "$EASYRSA_PKI/vars" + # This is where auto-load goes bananas + else + + # User specified PKI; if vars exists, use it ONLY + if [ "$EASYRSA_PKI" ]; then + if [ -e "$EASYRSA_PKI/vars" ]; then + verbose "select_vars: source EASYRSA_PKI/vars" + set_var EASYRSA_VARS_FILE "$EASYRSA_PKI/vars" + fi + fi + + # User specified EASYRSA; if vars exists, use it ONLY + if [ "$EASYRSA" ]; then + if [ -e "$EASYRSA/vars" ]; then + verbose "select_vars: EASYRSA/vars" + set_var EASYRSA_VARS_FILE "$EASYRSA/vars" + fi + fi + + # Default PKI; if vars exists, use it ONLY + if [ -e "$PWD/pki/vars" ]; then + # Prevent vars from changing expected PKI. + # A vars in the PKI MUST always imply EASYRSA_PKI + # This is NOT backward compatible + # Use expected value comparison for v3.1.7 + if [ -z "$EASYRSA_VARS_FILE" ]; then + expected_EASYRSA="$PWD" + expected_EASYRSA_PKI="$PWD/pki" + fi + + # Use this for v3.2.0 + # If the pki/vars sets a different PKI then + # there will be no PKI in the default /pki + #set_var EASYRSA "$PWD" + #set_var EASYRSA_PKI "$EASYRSA/pki" + + verbose "select_vars: PWD/pki/vars" + set_var EASYRSA_VARS_FILE "$PWD/pki/vars" + fi + + # Default working dir; if vars exists, use it ONLY + if [ -e "$PWD/vars" ]; then + verbose "select_vars: PWD/vars" + set_var EASYRSA_VARS_FILE="$PWD/vars" fi fi - # User specified EASYRSA; if vars exists, use it ONLY - if [ "$EASYRSA" ]; then - if [ -e "$EASYRSA/vars" ]; then - verbose "select_vars: EASYRSA/vars" - set_var EASYRSA_VARS_FILE "$EASYRSA/vars" - fi - fi - - # Default PKI; if vars exists, use it ONLY - if [ -e "$PWD/pki/vars" ]; then - # Prevent vars from changing expected PKI. - # A vars in the PKI MUST always imply EASYRSA_PKI - # This is NOT backward compatible - # Use expected value comparison for v3.1.7 - expected_EASYRSA="$PWD" - expected_EASYRSA_PKI="$PWD/pki" - # - # Use this for v3.2.0 - # If the pki/vars sets a different PKI then - # there will be no PKI in the default /pki - #set_var EASYRSA "$PWD" - #set_var EASYRSA_PKI "$EASYRSA/pki" - - verbose "select_vars: PWD/pki/vars" - set_var EASYRSA_VARS_FILE "$PWD/pki/vars" - fi - - # Default working dir; if vars exists, use it ONLY - if [ -e "$PWD/vars" ]; then - verbose "select_vars: PWD/vars" - set_var EASYRSA_VARS_FILE="$PWD/vars" - fi - + # User info if [ -z "$EASYRSA_VARS_FILE" ]; then [ "$require_pki" ] && information "\ No Easy-RSA 'vars' configuration file exists!" From 9db0671d70e39895fb4fc4aecd1ef947e1e33482 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Fri, 29 Sep 2023 18:15:48 +0100 Subject: [PATCH 12/14] select_vars: Correct use of set_var syntax Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index d883eb8..cc501fb 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5665,7 +5665,7 @@ select_vars() { # Default working dir; if vars exists, use it ONLY if [ -e "$PWD/vars" ]; then verbose "select_vars: PWD/vars" - set_var EASYRSA_VARS_FILE="$PWD/vars" + set_var EASYRSA_VARS_FILE "$PWD/vars" fi fi From edcc61c49b4cb107e4740f8a1d6ea98700200de7 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Fri, 29 Sep 2023 18:58:29 +0100 Subject: [PATCH 13/14] select_vars: Selective use of default "$PWD/pki/vars" If either EASYRSA or EASYRSA_PKI is already defined when searching for default "$PWD/pki/var" then ignore this default vars file. If EASYRSA_PKI is defined then do not load a vars file from a different PKI. If EASYRSA is defined then do not load a vars file from any PKI. Signed-off-by: Richard T Bonhomme --- easyrsa3/easyrsa | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index cc501fb..de0d23f 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -5642,7 +5642,10 @@ select_vars() { fi # Default PKI; if vars exists, use it ONLY - if [ -e "$PWD/pki/vars" ]; then + if [ -e "$PWD/pki/vars" ] && \ + [ -z "$EASYRSA_PKI" ] && \ + [ -z "$EASYRSA" ] + then # Prevent vars from changing expected PKI. # A vars in the PKI MUST always imply EASYRSA_PKI # This is NOT backward compatible From de708b411fbb95e507015ac10e1b6101fa3a11d0 Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Sun, 1 Oct 2023 20:50:33 +0100 Subject: [PATCH 14/14] ChangeLog: Add reference commit ID ecd65065 Signed-off-by: Richard T Bonhomme --- ChangeLog | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0e83399..d42f2bf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,13 +8,13 @@ Easy-RSA 3 ChangeLog noticable differences. With the exception of: Caveat: The default '$PWD/pki/vars' file is forbidden to change either EASYRSA or EASYRSA_PKI, which are both implied by default. - NOTICE: vars-auto-detect no longer searches 'easyrsa' program directory. * EasyRSA-Advanced.md: Correct vars-auto-detect hierarchy (#1029) + Commit: ecd65065e3303da78811278a154ef7a969c2777b + EASYRSA/vars is moved to a higher priority than a default PKI. + vars-auto-detect no longer searches 'easyrsa' program directory. * gen-crl: preserve existing crl.pem ownership+mode (#1020) * New command: make-vars - Print vars.example (here-doc) to stdout (#1024) * show-expire: Calculate cert. expire seconds from DB date (#1023) - * Forbid "default vars in the default PKI" for all commands (#1021) - REVERTED in #1029 above. * Update OpenSSL to 3.1.2 3.1.6 (2023-07-18)