Merge branch 'TinCanTech-bugfix-inline_file-add-dh-params'

Signed-off-by: Richard T Bonhomme <[email protected]>

Author: TinCanTech

ChangeLog

@@ -2,6 +2,7 @@ Easy-RSA 3 ChangeLog
 
 3.2.3 (TBD)
 
+   * inline_file(): Include DH file or placeholder, for RSA Servers (8a7b1fa) (#1310)
    * add_critical_attrib(): Do not add 'critical' if it exists (cdfaf61) (#1308)
      Original bug report: Dmitry Kononov (#1306)
    * select_vars(): Minor improvements (12ecc1a) (#1300)

easyrsa3/easyrsa

@@ -3017,13 +3017,21 @@ inline_file() {
 	ca_source="$EASYRSA_PKI"/ca.crt
 	tls_source="$EASYRSA_PKI"/private/easyrsa-tls.key
 	old_tls_key_file="$EASYRSA_PKI"/easyrsa-keepsafe-tls.key
+	dh_params_source="$EASYRSA_PKI"/dh.pem
 
 	# output
 	inline_out="${EASYRSA_PKI}/inline/${1}.inline"
-	print "\
-# Inline files in the 'private' directory contain security keys which
-# MUST only be transmitted over a secure connection, such as 'scp'." \
-		> "$EASYRSA_PKI"/inline/private/README.inline.private
+	readme="$EASYRSA_PKI"/inline/private/README.inline.private
+	if [ ! -f "$readme" ]; then
+		print "\
+# Inline files in the 'private' directory contain security keys
+# which MUST ONLY be transmitted over a SECURE connection.
+# eg. 'https' or 'scp'." > "$readme" || \
+			warn "inline_file - Failed to create README"
+	fi
+	unset -v readme
+
+	# flags
 	inline_incomplete=
 	inline_private=
 
@@ -3122,6 +3130,33 @@ $(cat "$ca_source")
 # </ca>"
 	fi
 
+	# dh params file, for RSA servers only
+	if [ "$EASYRSA_ALGO" = rsa ]; then
+		case "$crt_type" in
+		server|serverClient)
+			# Collect DH data
+			if [ -f "$dh_params_source" ]; then
+				dh_params_data="${NL}
+<dh>
+$(cat "$dh_params_source")
+</dh>"
+			else
+				inline_incomplete=1
+				dh_params_data="${NL}
+# <dh>
+# * Paste your Diffie-Hellman parameters file here *
+# </dh>"
+			fi
+
+			# Append DH data to CA data
+			ca_data="${ca_data}${dh_params_data}"
+		;;
+		*) : # ok, not server
+		esac
+	else
+		: # ok, not RSA
+	fi
+
 	# TLS KEY - Set TLS auth|crypt key inline label
 	if [ -f "$tls_source" ]; then
 		tls_key_data="$(cat "$tls_source")"