When commands executed in a subshell fail the error message is lost.
Easy-RSA error log provides a permanent temp-file to write those
error messages to and be displayed on completion of the script.
This first use of the log-file by easyrsa_mktemp(), will log errors
caused by requiring more than three (3) subshell temp-files.
Temp-files created during a subshell command do not update the
temp-file counter, so their name relies on a second, built-in
extension to the temp-file name. If this second extension exceeds
three (3) then a non-fatal warning is logged to the error log-file.
Other functions, which are executed in subshells, will use the error
log-file in follow up patches, as required.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Replace use of die(), which is very noisy, with user_error(),
which simply outputs the error message and EasyRSA Version.
Use of user_error() is specific to input and file errors,
caused by invalid user input.
Internal errors continue to use die().
Other associated improvements to output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Remove fucntion-end 'retrun 0' because it masks unexpected errors.
'if; then; else; fi;' wrap SSL call.
Minor improvements.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Only show the "foreign request" warning when sign-req is called for
an imported request. Do not show the warning when the request has
been created by build-full-*.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
build-ca:
* Replace 'print foo' with function create_x509_types_ca()
* Replace 'ignore' with function create_x509_type_COMMON()
sign-req:
* Replace 'ignore' with function create_x509_type_COMMON()
Note: x509-types/COMMON only has comments, no code.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Initial commit of a quick attempt at making a build script for OpenSSL.
This assumes some things present on my build VM. Appears to work at
least on an Ubuntu VM as well as on a Mac as long as mingw is installed.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This option bypasses the Easy-RSA code to manage the CA password.
The result is that the User MUST enter the CA password THREE times.
These three inputs are made directly to the SSL binary.
Easy-RSA will remain unaware of the CA password.
This is the most reliable way for Easy-RSA to create a CA, with a
password, without writing that password to a temp-file.
Equivalent to global option: '--raw-ca'
Usage:
* Command option: 'easyrsa build-ca raw-ca'
* Global option: 'easyrsa --raw-ca build-ca'
When specified, in ANY form, 'raw' method ALWAYS takes pririoty.
This change COMPLETELY removes the '--ca-via-stdin' method (v3.1.4),
which did not offer any more secuity than the standard method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If this code s left in then the unit test always falls through to
testing a CA without a password.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Change the integration of the following:
* build-ca: Replace password temp-file method with file-descriptors
* commit 27870d695a324e278854146afdac5d6bdade9bba
Instead of 'replacing' the standard temp-file method, the new 'stdin'
method is offered as an alternative by using option '--ca-via-stdin'
Discussion:
Using EasyRSA temp-files means that these files can be written to
specific places. In the case of the CA password, it is recommended
to use a RAM-Disk to write CA password temp-files to.
Using heredocs to pass data via file-descriptors, in all probability,
will write the heredoc data to a temp-file managed by the shell in use.
Thus, there are temp-files written in both methods.
The difference being that, the EasyRSA managed temp-files can be written to
specific places, while the shell managed temp-files are out of EasyRSA scope.
In conclusion, both methods are offered, however, the default remains
as EasyRSA temp-files for the CA password method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
ERSA_UTEST_VERSION and EASYRSA_USE_PASS are only defined when the unit-tests are run.
When they are detected, force use of CA password via 'stdin'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When OpenSSL is built "for Windows", it does not support
password input/output via argument 'fd:N', file-descriptors.
However, OpenSSL built "for Windows" does allow use of 'stdin'.
eg: -pass:stdin (-passin/-passout)
There is one drawback; When using 'stdin' openssl cannot allow
further user input to customise the 'commonName', or any other
organisational fields used by '--dn-mode=org'. OpenSSL enforces
'-batch' when 'stdin' is used. Therefore, EasyRSA must set batch
mode, to correctly use 'stdin' to pass the CA password.
Creating CA key pair this way also requires that SSL option
'-keyout' be dropped from the create CA request command.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d3592f1b6ea69bb93559108ac78c869308a8e2f3
Merge: ec1d428 05d0213
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 23:06:20 2023 +0100
Merge branch 'verify-cert-direct-openssl-call' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-verify-cert-direct-openssl-call
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 05d0213d6dff4706d058442b6e9cddcad1124fbc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 13:35:12 2023 +0100
verify-cert: Call 'openssl' directly to capture error
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'upgrade' was configured to create a second secure_session,
this is not allowed, so remove.
Minor format changes for 'show-expire' and --verbose output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This allows a fallback to use temp-files for CA password, in the event
that file-descriptor method fails.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Until now, EasyRSA has used temp-files to store the CA password and
passed those temp-files to SSL to build a CA keypair, when building
a CA manually, with a password.
From now, EasyRSA will use an internal variable to contain the CA
password and pass the value of that variable via file-descriptors
to SSL, when building a CA keypair.
This file-descriptor method is only used when building a CA with a
password manually, when the user enters the password via keyboard.
All other build-ca methods remain unchanged.
Also, move keypair temp-files to output files or error out.
Also, minor improvements to comments and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
