When commands executed in a subshell fail the error message is lost.
Easy-RSA error log provides a permanent temp-file to write those
error messages to and be displayed on completion of the script.
This first use of the log-file by easyrsa_mktemp(), will log errors
caused by requiring more than three (3) subshell temp-files.
Temp-files created during a subshell command do not update the
temp-file counter, so their name relies on a second, built-in
extension to the temp-file name. If this second extension exceeds
three (3) then a non-fatal warning is logged to the error log-file.
Other functions, which are executed in subshells, will use the error
log-file in follow up patches, as required.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Replace use of die(), which is very noisy, with user_error(),
which simply outputs the error message and EasyRSA Version.
Use of user_error() is specific to input and file errors,
caused by invalid user input.
Internal errors continue to use die().
Other associated improvements to output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Remove fucntion-end 'retrun 0' because it masks unexpected errors.
'if; then; else; fi;' wrap SSL call.
Minor improvements.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Only show the "foreign request" warning when sign-req is called for
an imported request. Do not show the warning when the request has
been created by build-full-*.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
build-ca:
* Replace 'print foo' with function create_x509_types_ca()
* Replace 'ignore' with function create_x509_type_COMMON()
sign-req:
* Replace 'ignore' with function create_x509_type_COMMON()
Note: x509-types/COMMON only has comments, no code.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This option bypasses the Easy-RSA code to manage the CA password.
The result is that the User MUST enter the CA password THREE times.
These three inputs are made directly to the SSL binary.
Easy-RSA will remain unaware of the CA password.
This is the most reliable way for Easy-RSA to create a CA, with a
password, without writing that password to a temp-file.
Equivalent to global option: '--raw-ca'
Usage:
* Command option: 'easyrsa build-ca raw-ca'
* Global option: 'easyrsa --raw-ca build-ca'
When specified, in ANY form, 'raw' method ALWAYS takes pririoty.
This change COMPLETELY removes the '--ca-via-stdin' method (v3.1.4),
which did not offer any more secuity than the standard method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If this code s left in then the unit test always falls through to
testing a CA without a password.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Change the integration of the following:
* build-ca: Replace password temp-file method with file-descriptors
* commit 27870d695a324e278854146afdac5d6bdade9bba
Instead of 'replacing' the standard temp-file method, the new 'stdin'
method is offered as an alternative by using option '--ca-via-stdin'
Discussion:
Using EasyRSA temp-files means that these files can be written to
specific places. In the case of the CA password, it is recommended
to use a RAM-Disk to write CA password temp-files to.
Using heredocs to pass data via file-descriptors, in all probability,
will write the heredoc data to a temp-file managed by the shell in use.
Thus, there are temp-files written in both methods.
The difference being that, the EasyRSA managed temp-files can be written to
specific places, while the shell managed temp-files are out of EasyRSA scope.
In conclusion, both methods are offered, however, the default remains
as EasyRSA temp-files for the CA password method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
ERSA_UTEST_VERSION and EASYRSA_USE_PASS are only defined when the unit-tests are run.
When they are detected, force use of CA password via 'stdin'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When OpenSSL is built "for Windows", it does not support
password input/output via argument 'fd:N', file-descriptors.
However, OpenSSL built "for Windows" does allow use of 'stdin'.
eg: -pass:stdin (-passin/-passout)
There is one drawback; When using 'stdin' openssl cannot allow
further user input to customise the 'commonName', or any other
organisational fields used by '--dn-mode=org'. OpenSSL enforces
'-batch' when 'stdin' is used. Therefore, EasyRSA must set batch
mode, to correctly use 'stdin' to pass the CA password.
Creating CA key pair this way also requires that SSL option
'-keyout' be dropped from the create CA request command.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d3592f1b6ea69bb93559108ac78c869308a8e2f3
Merge: ec1d428 05d0213
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 23:06:20 2023 +0100
Merge branch 'verify-cert-direct-openssl-call' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-verify-cert-direct-openssl-call
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 05d0213d6dff4706d058442b6e9cddcad1124fbc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 13:35:12 2023 +0100
verify-cert: Call 'openssl' directly to capture error
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'upgrade' was configured to create a second secure_session,
this is not allowed, so remove.
Minor format changes for 'show-expire' and --verbose output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This allows a fallback to use temp-files for CA password, in the event
that file-descriptor method fails.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Until now, EasyRSA has used temp-files to store the CA password and
passed those temp-files to SSL to build a CA keypair, when building
a CA manually, with a password.
From now, EasyRSA will use an internal variable to contain the CA
password and pass the value of that variable via file-descriptors
to SSL, when building a CA keypair.
This file-descriptor method is only used when building a CA with a
password manually, when the user enters the password via keyboard.
All other build-ca methods remain unchanged.
Also, move keypair temp-files to output files or error out.
Also, minor improvements to comments and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Saving the name of the fully expanded Safe SSL config means that this
config file only has to be built once.
The assignment of working_safe_ssl_conf, which signifies that a Safe
SSL config has already been created, was set too late, which caused
it to be set even if the Safe SSL config had not been created.
Also, include a final check in verify_working_env() to ensure that
working_safe_ssl_conf has not been set prior to executing the issued
command, eg. build-ca.
Also, improve verbose messages and comments.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
verify_algo_params() expects errors when settings are not corrrect.
Therefore, is must not use easyrsa_openssl() meta-wrapper, which would
error out with a misleading error message.
Fixing this also ensures that the SAFE SSL config is not built prior
to EASYRSA_REQ_CN being set.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
EASYRSA_KEY_SIZE is present in the SSL config file, therefore,
it MUST always be set, regardless of EASYRSA_ALGO in use.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'easyrsa_openssl makesafecnf' is used internally to create a safe
SSL config file. (By status reports, read_db())
Once the safe SSL config file has been named as a temp-file and created,
the script continues to use that temp-file as the master copy, it does not
recreate a safe SSL config file for subsequent calls to easyrsa_openssl().
Therefore, the temp-file MUST be copied to the standard safe SSL file not
moved. Otherwise, the named temp-file is removed.
Also, move the assignment of the safe SSL temp-file to the correct place.
This means that a new temp-file wiill only be assigned once.
Also, verify that the safe SSL temp-file exists when it is expected to.
Also, change use of '--no--safe-ssl' with LibreSSL to a FATAL error.
Other changes are for error and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
X509-types insert markers are used by 'awk' to insert data at specific
points in the easyrsa-openssl.cnf file in use.
The checks are moved to below more important imput checks
For build-ca, the check is ONLY done if EASYRSA_EXTRA_EXTS is defined.
This is exceedingly unlikely, because EASYRSA_EXTRA_EXTS is not documented.
For sign-req, the check is only done if --copy-ext isused.
Also, remove an over-indent in "Confirm use of NS extestions"
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
* gen-req: Use verify_pki_init().
* sign-req: Use verify_ca_init().
* build-full: Defer requirements to functions above.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
