If this code s left in then the unit test always falls through to
testing a CA without a password.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Change the integration of the following:
* build-ca: Replace password temp-file method with file-descriptors
* commit 27870d695a324e278854146afdac5d6bdade9bba
Instead of 'replacing' the standard temp-file method, the new 'stdin'
method is offered as an alternative by using option '--ca-via-stdin'
Discussion:
Using EasyRSA temp-files means that these files can be written to
specific places. In the case of the CA password, it is recommended
to use a RAM-Disk to write CA password temp-files to.
Using heredocs to pass data via file-descriptors, in all probability,
will write the heredoc data to a temp-file managed by the shell in use.
Thus, there are temp-files written in both methods.
The difference being that, the EasyRSA managed temp-files can be written to
specific places, while the shell managed temp-files are out of EasyRSA scope.
In conclusion, both methods are offered, however, the default remains
as EasyRSA temp-files for the CA password method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
ERSA_UTEST_VERSION and EASYRSA_USE_PASS are only defined when the unit-tests are run.
When they are detected, force use of CA password via 'stdin'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When OpenSSL is built "for Windows", it does not support
password input/output via argument 'fd:N', file-descriptors.
However, OpenSSL built "for Windows" does allow use of 'stdin'.
eg: -pass:stdin (-passin/-passout)
There is one drawback; When using 'stdin' openssl cannot allow
further user input to customise the 'commonName', or any other
organisational fields used by '--dn-mode=org'. OpenSSL enforces
'-batch' when 'stdin' is used. Therefore, EasyRSA must set batch
mode, to correctly use 'stdin' to pass the CA password.
Creating CA key pair this way also requires that SSL option
'-keyout' be dropped from the create CA request command.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d3592f1b6ea69bb93559108ac78c869308a8e2f3
Merge: ec1d428 05d0213
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 23:06:20 2023 +0100
Merge branch 'verify-cert-direct-openssl-call' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-verify-cert-direct-openssl-call
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 05d0213d6dff4706d058442b6e9cddcad1124fbc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 13:35:12 2023 +0100
verify-cert: Call 'openssl' directly to capture error
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'upgrade' was configured to create a second secure_session,
this is not allowed, so remove.
Minor format changes for 'show-expire' and --verbose output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This allows a fallback to use temp-files for CA password, in the event
that file-descriptor method fails.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Until now, EasyRSA has used temp-files to store the CA password and
passed those temp-files to SSL to build a CA keypair, when building
a CA manually, with a password.
From now, EasyRSA will use an internal variable to contain the CA
password and pass the value of that variable via file-descriptors
to SSL, when building a CA keypair.
This file-descriptor method is only used when building a CA with a
password manually, when the user enters the password via keyboard.
All other build-ca methods remain unchanged.
Also, move keypair temp-files to output files or error out.
Also, minor improvements to comments and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Saving the name of the fully expanded Safe SSL config means that this
config file only has to be built once.
The assignment of working_safe_ssl_conf, which signifies that a Safe
SSL config has already been created, was set too late, which caused
it to be set even if the Safe SSL config had not been created.
Also, include a final check in verify_working_env() to ensure that
working_safe_ssl_conf has not been set prior to executing the issued
command, eg. build-ca.
Also, improve verbose messages and comments.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
verify_algo_params() expects errors when settings are not corrrect.
Therefore, is must not use easyrsa_openssl() meta-wrapper, which would
error out with a misleading error message.
Fixing this also ensures that the SAFE SSL config is not built prior
to EASYRSA_REQ_CN being set.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
EASYRSA_KEY_SIZE is present in the SSL config file, therefore,
it MUST always be set, regardless of EASYRSA_ALGO in use.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'easyrsa_openssl makesafecnf' is used internally to create a safe
SSL config file. (By status reports, read_db())
Once the safe SSL config file has been named as a temp-file and created,
the script continues to use that temp-file as the master copy, it does not
recreate a safe SSL config file for subsequent calls to easyrsa_openssl().
Therefore, the temp-file MUST be copied to the standard safe SSL file not
moved. Otherwise, the named temp-file is removed.
Also, move the assignment of the safe SSL temp-file to the correct place.
This means that a new temp-file wiill only be assigned once.
Also, verify that the safe SSL temp-file exists when it is expected to.
Also, change use of '--no--safe-ssl' with LibreSSL to a FATAL error.
Other changes are for error and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
X509-types insert markers are used by 'awk' to insert data at specific
points in the easyrsa-openssl.cnf file in use.
The checks are moved to below more important imput checks
For build-ca, the check is ONLY done if EASYRSA_EXTRA_EXTS is defined.
This is exceedingly unlikely, because EASYRSA_EXTRA_EXTS is not documented.
For sign-req, the check is only done if --copy-ext isused.
Also, remove an over-indent in "Confirm use of NS extestions"
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
* gen-req: Use verify_pki_init().
* sign-req: Use verify_ca_init().
* build-full: Defer requirements to functions above.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
