Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minor corrections and improvements #1140

Merged
merged 7 commits into from
May 15, 2024
Merged

Minor corrections and improvements #1140

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
cc1b877
help: Simplify CA status output
TinCanTech May 14, 2024
38324bd
SSL config heredoc expansion: Remove duplicate $EASYRSA_DIGEST assign…
TinCanTech May 14, 2024
807bcec
verbose: Replace '>' label with '#'
TinCanTech May 14, 2024
fd5fe8e
Correct comment, Correct verbose message for temp-file usage
TinCanTech May 14, 2024
342c41c
easyrsa_openssl(): Expand short-circuit to full 'if/then'
TinCanTech May 14, 2024
168a0a0
locate_support_files(): Remove old comments and expand verbose output
TinCanTech May 14, 2024
474f849
sign-req with SAN: Add POSIX related comment for 'grep -A' use
TinCanTech May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 38 additions & 62 deletions easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# Help/usage output to stdout
usage() {
# command help:
print "
information "
Easy-RSA 3 usage and overview

$easyrsa_help_title
Expand Down Expand Up @@ -63,21 +63,6 @@ A list of commands is shown below:
work_dir="${EASYRSA:-undefined}"
pki_dir="${EASYRSA_PKI:-undefined}"

# CA Status
if verify_ca_init test; then
CA_cert="$EASYRSA_PKI/ca.crt"
CA_status=" CA status: OK"
CA_subject="$(
"$EASYRSA_OPENSSL" x509 -in "$CA_cert" \
-noout -subject -nameopt multiline \
2>/dev/null
)"
CA_subject=" CA subject: ${CA_subject#subject=}"
CA_status="${CA_status}${NL}${CA_subject}"
else
CA_status=" CA status: CA has not been built"
fi

# check for vars changing PKI unexpectedly!
if [ "$invalid_vars" ]; then
ivmsg="
Expand All @@ -88,22 +73,32 @@ Invalid vars setting for EASYRSA and/or EASYRSA_PKI${NL}"
fi

# Print details
print "
information "
DIRECTORY STATUS (commands would take effect on these locations)
EASYRSA: $work_dir
PKI: $pki_dir
vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined}${ivmsg}
$CA_status${NL}"
vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined}${ivmsg}"

# CA Status
if verify_ca_init test; then
if [ -z "$EASYRSA_SILENT" ]; then
# Show SSL output directly, with easyrsa header
printf '%s' " CA status: OK${NL}${NL} "
"$EASYRSA_OPENSSL" x509 -in "$EASYRSA_PKI/ca.crt" \
-noout -subject -nameopt utf8,multiline
print "" # for a clean line
fi
else
information " CA status: CA has not been built${NL}"
fi

# verbose info
verbose "ssl-cnf: ${EASYRSA_SSL_CONF:-built-in}"
verbose "x509-types: ${EASYRSA_EXT_DIR:-built-in}"
if [ -d "$EASYRSA_TEMP_DIR" ]; then
verbose "temp-dir: Found: $EASYRSA_TEMP_DIR"
elif [ "$EASYRSA_TEMP_DIR" ]; then
verbose "temp-dir: Missing: $EASYRSA_TEMP_DIR"
else
verbose "temp-dir: undefined"
verbose "temp-dir: Missing: ${EASYRSA_TEMP_DIR:-undefined}"
fi
} # => usage()

Expand Down Expand Up @@ -565,7 +560,7 @@ ${opts:-
# Options usage
opt_usage() {
text_only=1
print "
information "
Easy-RSA Global Option Flags

The following global-options may be provided before the command.
Expand Down Expand Up @@ -701,7 +696,7 @@ $1${NL}"
# verbose information
verbose() {
[ "$EASYRSA_VERBOSE" ] || return 0
printf '%s\n' " > $*"
printf '%s\n' " # $*"
} # => verbose()

# non-fatal warning output
Expand Down Expand Up @@ -1226,12 +1221,16 @@ easyrsa_openssl() {
# Exec SSL
if [ "$EASYRSA_SILENT_SSL" ] && [ "$EASYRSA_BATCH" ]
then
"$EASYRSA_OPENSSL" "$openssl_command" "$@" \
2>/dev/null && \
return
if "$EASYRSA_OPENSSL" "$openssl_command" "$@" \
2>/dev/null
then
return
fi
else
"$EASYRSA_OPENSSL" "$openssl_command" "$@" && \
return
if "$EASYRSA_OPENSSL" "$openssl_command" "$@"
then
return
fi
fi
esac

Expand Down Expand Up @@ -1469,21 +1468,6 @@ locate_support_files() {
x509_types_dir='x509-types'
easyrsa_tools='easyrsa-tools.lib'

# "$EASYRSA_PKI" - Preferred
# "$EASYRSA" - Old default and Windows
# "$PWD" - Usually the same as above, avoid
# "${0%/*}" - Usually the same as above, avoid
# '/usr/local/share/easy-rsa' - Default user installed
# '/usr/share/easy-rsa' - Default system installed
# Room for more..
# '/etc/easy-rsa' - Last resort

# Not currently used:
# Set EASYRSA_PKI only flag
#is_in_pki=1
#x509_dir_in_pki=""
#ssl_cnf_in_pki=""

# Find data-files
for area in \
"$EASYRSA_PKI" \
Expand All @@ -1498,29 +1482,22 @@ locate_support_files() {
# Find x509-types
if [ -e "${area}/${x509_types_dir}" ]; then
set_var EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
#[ "$is_in_pki" ] && x509_dir_in_pki=1
verbose "> Found x509 dir: ${area}/${x509_types_dir}"
fi

# Find openssl-easyrsa.cnf
if [ -e "${area}/${ssl_cnf_file}" ]; then
set_var EASYRSA_SSL_CONF "${area}/${ssl_cnf_file}"
#[ "$is_in_pki" ] && ssl_cnf_in_pki=1
verbose "> Found SSL cnf: ${area}/${ssl_cnf_file}"
fi

# Find easyrsa-tools.lib
if [ -e "${area}/${easyrsa_tools}" ]; then
set_var EASYRSA_TOOLS_LIB "${area}/${easyrsa_tools}"
verbose "> Found tools.lib: ${area}/${easyrsa_tools}"
fi

# Clear EASYRSA_PKI only flag
#unset -v is_in_pki
done

verbose "> EASYRSA_EXT_DIR: $EASYRSA_EXT_DIR"
verbose "> EASYRSA_SSL_CONF: $EASYRSA_SSL_CONF"
verbose "> EASYRSA_EXT_DIR: ${EASYRSA_EXT_DIR:-built-in}"
verbose "> EASYRSA_SSL_CONF: ${EASYRSA_SSL_CONF:-built-in}"
verbose "> EASYRSA_TOOLS_LIB: ${EASYRSA_TOOLS_LIB:-undefined}"
verbose "locate_support_files: COMPLETED"
} # => locate_support_files()

Expand Down Expand Up @@ -2562,10 +2539,11 @@ Forced subject=
grep -s 'X509v3 Subject Alternative Name'
then
# extract requested SAN
# 'grep -A' may not be strictly POSIX, die on error
req_x509_san="$(
echo "$req_text" | \
grep -A 1 'X509v3 Subject Alternative Name'
)" || die "sign-req: req_x509_san: grep -A 1 "
)" || die "sign-req: req_x509_san: grep -A 1 (POSIX)"
else
# No requested SAN
req_x509_san=
Expand Down Expand Up @@ -4450,9 +4428,9 @@ force_set_var() {
die "force_set_var - set_var '$*'"
} # => force_set_var()

# Verify: $EASYRSA_SSL_CONF pki/openssl-easyrsa.cnf
# If the existing file is default then delete it
# and create temp-file. Otherwise, leave in place.
# Create as needed: $EASYRSA_SSL_CONF pki/openssl-easyrsa.cnf
# If the existing file has a known hash then use temp-file.
# Otherwise, use the file in place.
write_easyrsa_ssl_cnf_tmp() {
if [ -f "$EASYRSA_SSL_CONF" ]; then
verbose "write_easyrsa_ssl_cnf_tmp: SSL config EXISTS"
Expand Down Expand Up @@ -4549,7 +4527,6 @@ write_easyrsa_ssl_cnf_tmp: SSL config using temp-file"

# Write x509 type file to a temp file
write_x509_type_tmp() {
# Use a temp file
type="$1"
shift

Expand Down Expand Up @@ -4708,7 +4685,6 @@ set_openssl_easyrsa_cnf_vars(){
conf_EASYRSA_PKI="$EASYRSA_PKI"
conf_EASYRSA_DIGEST="$EASYRSA_DIGEST"
conf_EASYRSA_KEY_SIZE="$EASYRSA_KEY_SIZE"
conf_EASYRSA_DIGEST="$EASYRSA_DIGEST"
conf_EASYRSA_DN="$EASYRSA_DN"
conf_EASYRSA_REQ_CN="$EASYRSA_REQ_CN"
conf_EASYRSA_REQ_COUNTRY="$EASYRSA_REQ_COUNTRY"
Expand All @@ -4725,7 +4701,6 @@ set_openssl_easyrsa_cnf_vars(){
conf_EASYRSA_PKI='$ENV::EASYRSA_PKI'
conf_EASYRSA_DIGEST='$ENV::EASYRSA_DIGEST'
conf_EASYRSA_KEY_SIZE='$ENV::EASYRSA_KEY_SIZE'
conf_EASYRSA_DIGEST='$ENV::EASYRSA_DIGEST'
conf_EASYRSA_DN='$ENV::EASYRSA_DN'
conf_EASYRSA_REQ_CN='$ENV::EASYRSA_REQ_CN'
conf_EASYRSA_REQ_COUNTRY='$ENV::EASYRSA_REQ_COUNTRY'
Expand Down Expand Up @@ -5751,11 +5726,12 @@ Place a copy of easyrsa-tools.lib in a standard system location."
Unknown command '$cmd'. Run without commands for usage help."
esac

verbose "mktemp_counter: $mktemp_counter uses"

# Check for untrapped errors
# shellcheck disable=SC2181 # Quote expand - pre-cleanup $?
if [ $? = 0 ]; then
# Do 'cleanup ok' on successful completion
#print "mktemp_counter: $mktemp_counter uses"
cleanup ok
fi

Expand Down