mktemp was used to create temp-files but it is not POSIX and
the version shipped for Windows has known bugs.
Replace mktemp with atomic directory and file creation using mkdir
and mv, both of which are atomic.
The temporary directory "session" directory is created using mkdir
with a 32bit random number for the name.
eg: /tmp/easyrsa-temp/b01dface
The temporary file is created by moving another file into the place
of the temp-file, with a 32bit random number for the name.
eg: /tmp/easyrsa-temp/b01dface/c01dface
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The problem:
* crypto_opts="$crypto_opts -pass file:$out_key_pass_tmp"
This cannot be reliably expanded and passed as an unquoted option.
This is due to the unquoted file name $out_key_pass_tmp.
The solution:
* Do not polute $crypto_opts with password related options.
* Specifiy the correct '-pass/-passin/-passout file:xx' for each command.
This allows "$out_key_pass_tmp" to be corrrectly quoted.
Also, apply the same quoting technique to $crypto_opts.
Minor alterations to OpenSSL command line layout, readability.
Comment out the replaced code, not removed. For comparison.
(Follow-up patch will remove the comments)
Full unit-tests completed throughout development.
Manually tested multiple password protected PKIs.
OpenSSL 1.1.1 and 3.0.2
Not tested:
* OpenSSL options: -pass/-passin-/passout file:"$out_key_pass_tmp"
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The config file is unambiguously and previously created by
install_data_to_pki().
The config file location is exported in the previous command.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This code injection 'attempted' to insert a temp-file created with
EASYRSA_EXTRA_EXTS data. The insertion would take place at the awk
script marker "^#%EXTRA_EXTS%". However, this marker has already
been replaced by gen_req(), thus the condition to insert the code
was never met and the code injection has never taken place.
Testing this, I created a new marker for this injection to key from
and, due to the file-name variable not having been quoted, the test
fails when the file name has a space in it.
General tidy-up of easyrsa_openssl()
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Make detecting all vars files more simple and robust.
Improve warning and error messages.
Favour PKI/vars, wiith bias.
* Minor changes to output format for warn() and notice()
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Using single quotes in the vars file does not work:
* Either the vars file syntax is corrupted by an unescaped single quote.
* Or the SSL library will drop the single quote from the signed certificate.
Changes:
* Sanitize vars.example - Remove all single quotes.
* Search vars for single quote before sourcing it.
Closes: #34
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
