nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,548 Commits 1 Branch 0 Tags 43 MiB
Commit Graph

1548 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Richard T Bonhomme
e57fef63f1
Merge branch 'TinCanTech-status-CN-missing-from-index' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-10 20:24:25 +00:00
Richard T Bonhomme
c9acb53229
Merge branch 'status-CN-missing-from-index' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-status-CN-missing-from-index 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-10 20:23:46 +00:00
Richard T Bonhomme
598b8f8617
Exit with error on untrapped error detected 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-09 20:36:27 +00:00
Richard T Bonhomme
e71a2088d3
Merge branch 'TinCanTech-general-improvements' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-08 22:46:58 +00:00
Richard T Bonhomme
2b0d8f775c
Merge branch 'general-improvements' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-general-improvements 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-08 22:46:21 +00:00
Richard T Bonhomme
d455e84b7e
Status reports: Refactor conditionals that can cause untrapped errors 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-08 22:20:57 +00:00
Richard T Bonhomme
93cefa2e05
Status reports: Warn if given commonName is not found in database 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-08 22:15:38 +00:00
Richard T Bonhomme
6a4798ea5e
Merge branch 'TinCanTech-up23-fix-secure_session' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-07 22:56:47 +00:00
Richard T Bonhomme
c509507541
Merge branch 'up23-fix-secure_session' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-up23-fix-secure_session 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-07 22:56:13 +00:00
Richard T Bonhomme
9149aa8f74
ChangeLog: Always verify SSL lib, for all commands (#877) 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-07 22:37:36 +00:00
Richard T Bonhomme
69424ecedb
Standardise use of '$# = N' and associated error messages 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-07 22:03:23 +00:00
Richard T Bonhomme
2343503f94
Prefer parameter expansion '${x:-y}' to test for "null or unset" 
EasyRSA allows variables to be set to "" [null], therefore, as a
standard, the script now always tests for null or unset.

IE. Include the colon ':'.

The obvious exception to this is set_var(), which remains as test
for unset ONLY.

set_var() ONLY assigns a value if the variable is currently unset,
otherwise, it would over-write a deliberately empty value.

Also, where it helps readability, separate the expansion operator
from the expandable value, with a space.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-07 20:44:59 +00:00
Richard T Bonhomme
e7c371e44a
Upgrade-23: Remove unnecessary internal call to secure_session() 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-06 01:46:51 +00:00
Richard T Bonhomme
8c6948c4cc
Upgrade_23: Prioritise new PKI creation to allow temp file creation 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-03-06 01:13:52 +00:00
Richard T Bonhomme
940a94dee9
Merge branch 'TinCanTech-gen-crl-minor-improvement' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-25 17:58:40 +00:00
Richard T Bonhomme
ebd5f66db0
Merge branch 'gen-crl-minor-improvement' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-gen-crl-minor-improvement 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-25 17:58:04 +00:00
Richard T Bonhomme
95f4b67703
gen-crl: Minor improvements 
Add EASYRSA_CRL_DAYS to command to generate a new CRL.
Although this is taken care of in the SSL config file,
it is easier to understand by having the code incuded
in the script.

Honor batch mode and over write an existing CRL, with
out confirmation.  An out dated CRL is of little value
and the user has specified batch mode, so honor it.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-25 14:56:09 +00:00
Richard T Bonhomme
1dd740f9a5
Merge branch 'TinCanTech-bugfix-req-serial-no-safe-ssl' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-23 13:23:46 +00:00
Richard T Bonhomme
c55b410f52
Merge branch 'bugfix-req-serial-no-safe-ssl' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-bugfix-req-serial-no-safe-ssl 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-23 13:23:01 +00:00
Richard T Bonhomme
8944eae7ac
Use set_var to correctly assign EASYRSA_REQ_SERIAL 
This configures EASYRSA_REQ_SERIAL for use in the SSL config file.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-23 13:09:07 +00:00
Richard T Bonhomme
5fa424b913
Merge branch 'TinCanTech-fix-offset-use-enddate' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-21 22:16:21 +00:00
Richard T Bonhomme
04ee3b0977
Merge branch 'fix-offset-use-enddate' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-fix-offset-use-enddate 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-21 22:15:40 +00:00
Richard T Bonhomme
d35e288700
Merge branch 'TinCanTech-move-rand-serial-file' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-21 22:04:02 +00:00
Richard T Bonhomme
32dc387723
Merge branch 'move-rand-serial-file' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-move-rand-serial-file 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-21 22:03:07 +00:00
Richard T Bonhomme
436f77e888
ChangeLog; Only create a random serial number file when expected (#896) 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-21 22:01:16 +00:00
Richard T Bonhomme
06fed95730
sign-req: Use either SSL option -days OR -startdate/-enddate 
Using --fix-offset will not use -days, only -statdate/-enddate.

Options -startdate/-enddate are absolute dates, not counted from
today by OpenSSL, for any reason.

Fixes some unrelated warnings about incomplete SSL config file,
when using --fix-offset.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-19 22:10:26 +00:00
Richard T Bonhomme
2eda52061b
sign-req: Only create a random serial number file when expected 
When EASYRSA_RAND_SN="no", the file pki/serial file is not meant to
be updated by easyrsa. OpenSSL manages the file itself.

Move the code to write the file pki/serial with a random number,
inside the if condition for EASYRSA_RAND_SN, so the file is only
written to by easyrsa, when a random serial number is expected.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-19 21:37:30 +00:00
Richard T Bonhomme
2abc237594
Merge branch 'TinCanTech-ca-password-temp-file-removal' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-14 21:04:37 +00:00
Richard T Bonhomme
58638bcfc2
Merge branch 'ca-password-temp-file-removal' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-ca-password-temp-file-removal 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-14 21:03:42 +00:00
Richard T Bonhomme
88557aae8c
build_ca: Initialise get_passphrase() correctly 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-12 02:37:34 +00:00
Richard T Bonhomme
2dd2767922
build-ca: Deliberately remove manual password in temp-file 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 23:11:43 +00:00
Richard T Bonhomme
41f23444c6
Merge branch 'TinCanTech-set_var-v2' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:54:57 +00:00
Richard T Bonhomme
9d21db8629
Merge branch 'set_var-v2' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-set_var-v2 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:54:04 +00:00
Richard T Bonhomme
3d1f2135bb
Merge branch 'TinCanTech-cleanup-stty-echo' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:43:25 +00:00
Richard T Bonhomme
8510681747
Merge branch 'cleanup-stty-echo' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-cleanup-stty-echo 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:42:07 +00:00
Richard T Bonhomme
a23232144c
Merge branch 'TinCanTech-easyrsa_mktemp-v2' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:28:13 +00:00
Richard T Bonhomme
1dc5c265ac
Merge branch 'easyrsa_mktemp-v2' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-easyrsa_mktemp-v2 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 21:27:32 +00:00
Richard T Bonhomme
35dd0d919c
Remove unused variable EASYRSA_EC_DIR 
This was used to define a temp-dir for a temp-file for EC params.

This was replaced by standard temp-file EASYRSA_ALGO_PARAMS.

The replacement was due to EasyRSA support for OpenSSL version 3,
where SSL command 'genpkey' replaced the previous commands.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-11 02:51:24 +00:00
Richard T Bonhomme
66d282e1c1
set-var(): Check input, die on errors 
Previously, set_var() had no input checking, combined with
the point that, via vars, set_var() is user facing, this
can lead to easy user errors.

Now, input is checked:
- Parameter 1 is required.
- Parameter 1 cannot contain a space.
- Less-than 3 input parameters are expected.
- Quote the expansion of the first occurence of parameter 1
  in the evaluated expression.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-09 20:47:15 +00:00
Richard T Bonhomme
d4a1caa394
Rename variable EASYRSA_TEMP_DIR_session to secured_session 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-09 01:21:55 +00:00
Richard T Bonhomme
9a4b98246b
secure_session(): Wrap long lines 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-09 00:41:45 +00:00
Richard T Bonhomme
f762627e2d
easyrsa_mktemp(): Drop redundant test of temp-session existence 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-09 00:21:35 +00:00
Richard T Bonhomme
043448503f
easyrsa_mktemp(): Correct logic for file creation 
Each try is now aimed at creating a unique target file.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-09 00:20:28 +00:00
Richard T Bonhomme
fd8dcfdafe
Merge branch 'TinCanTech-verify-ssl-before-temp-session' 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-08 23:11:26 +00:00
Richard T Bonhomme
393a094aa4
Merge branch 'verify-ssl-before-temp-session' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-verify-ssl-before-temp-session 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-08 23:10:28 +00:00
Richard T Bonhomme
8de04a1439
Move verify_ssl_lib() - Always verify SSL lib, for all commands 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-08 23:05:33 +00:00
Richard T Bonhomme
e70c6363e6
cleanup(): Only enable terminal echo when it has been disabled 
Only build-ca with a manually entered password disables terminal echo.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-08 18:04:14 +00:00
Richard T Bonhomme
b52f6cbd8b
easyrsa_mktemp(): Pre-assign empty value to temp-file name 
Satisfy shellcheck SC2154, var is referenced but not assigned.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-07 23:32:48 +00:00
Richard T Bonhomme
fba0cf1986
easyrsa_mktemp(): Use sequentially numbered temp-files 
This drops use of SSL to generate randomly numbered files.
The temp-session is still randomly named.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-07 19:49:24 +00:00
Richard T Bonhomme
ab264130c1
ChangeLog: Option --fix-offset: Adjust off-by-one day 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
 2023-02-04 21:14:01 +00:00