Skip to content

Commit a3bb655

Browse files
TinCanTechTinCanTech
committed
Merge branch 'TinCanTech-source_vars-add-grep-for-assign-by-equal'
Signed-off-by: Richard T Bonhomme <[email protected]>
2 parents 8eba707 + c9f3869 commit a3bb655

File tree

3 files changed

+100
-69
lines changed

3 files changed

+100
-69
lines changed

‎ChangeLog‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ Easy-RSA 3 ChangeLog
22

33
3.2.5 (TBD)
44

5+
* Introduce global option --force-vars (5560d3c) (#1405)
6+
* source_vars(): Add 'set -e' to dry-run, sub-shell sourcing vars (6598711) (#1405)
7+
* source_vars(): Add grep check for assignment by '=' (fc36545) (#1405)
58
* Update EasyRSA-Advanced.md (276eaa5) (#1403)
69
* Introduce global option --no-inline (75e52f7) (#1403)
710
* Replace $ignore_vars with $EASYRSA_NO_VARS (Revert 3c0ca17) (5879488) (#1403)

‎doc/EasyRSA-Advanced.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,8 @@ short description is shown below:
180180
* `EASYRSA_TEXT_ON` (CLI: `--text`) - include human readable text in SSL output
181181
* `EASYRSA_TEXT_OFF` (CLI: `--notext`) - exclude human readable text from SSL
182182
output
183-
183+
* `EASYRSA_FORCE_SAFE_SSL` (CLI: `--force-safe-ssl`) - expand environment
184+
variables in SSL config
185+
* `EASYRSA_FORCE_VARS` (CLI: `--force-vars`) - ignore known errors in 'vars' file
184186

185187
**NOTE:** the global options must be provided before the commands.

‎easyrsa3/easyrsa‎

Lines changed: 94 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Global options:
4545
(Default config file is in the EasyRSA PKI directory)
4646
--force-safe-ssl: Always generate a safe SSL config file
4747
(Default: Generate Safe SSL config once per instance)
48-
48+
--force-vars : Ignore known errors in 'vars' file
4949
--no-lockfile : Disable lock-file (Useful for read-only PKI)
5050
--no-inline : Disable inline file creation
5151
--tmp-dir=DIR : Declare the temporary directory
@@ -2882,7 +2882,7 @@ inline_file() {
28822882
# Allow complete disable
28832883
if [ "$EASYRSA_NO_INLINE" ] || [ "$EASYRSA_DISABLE_INLINE" ]; then
28842884
[ -z "$EASYRSA_DISABLE_INLINE" ] || \
2885-
warn 'Use $EASYRSA_NO_INLINE not $EASYRSA_DISABLE_INLINE'
2885+
warn "Use \$EASYRSA_NO_INLINE not \$EASYRSA_DISABLE_INLINE"
28862886
verbose "inline_file; DISABLED"
28872887
return
28882888
fi
@@ -5433,7 +5433,7 @@ Option --passout cannot be used with --nopass|nopass."
54335433
fi
54345434

54355435
# Restrict --days=0 to 'show-expire'
5436-
if [ "$alias_days" = 0 ]; then
5436+
if [ "$EASYRSA_ALIAS_DAYS" = 0 ]; then
54375437
case "$cmd" in
54385438
show-expire) : ;; # ok
54395439
*) user_error "Cannot use --days=0 for command $cmd"
@@ -5470,12 +5470,12 @@ Format of --startdate/--enddate must be [YY]YYMMDDhhmmssZ"
54705470
if [ "$EASYRSA_END_DATE" ]; then
54715471
case "$cmd" in
54725472
sign-req|build-*-full|renew)
5473-
# User specified alias_days IS over-ruled
5474-
if [ "$alias_days" ]; then
5473+
# User specified EASYRSA_ALIAS_DAYS IS over-ruled
5474+
if [ "$EASYRSA_ALIAS_DAYS" ]; then
54755475
warn "\
54765476
Option --days is over-ruled by option --enddate."
54775477
fi
5478-
unset -v EASYRSA_CERT_EXPIRE alias_days
5478+
unset -v EASYRSA_CERT_EXPIRE EASYRSA_ALIAS_DAYS
54795479
;;
54805480
*)
54815481
warn "\
@@ -5568,61 +5568,74 @@ Missing vars file:
55685568
* $target_file"
55695569

55705570
# Sanitize target_file
5571-
if grep -q \
5571+
if grep -v '^[[:blank:]]*#' "$target_file" | grep -q \
55725572
-e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT' \
5573-
-e '[^(]`[^)]' \
5574-
-e 'export ' \
5575-
-e 'unset ' \
5576-
"$target_file"
5573+
-e '`' \
5574+
-e 'EASYRSA_[_[:upper:]]*=.*' \
5575+
-e 'export[[:blank:]]' \
5576+
-e 'unset[[:blank:]]' \
5577+
# EOL
55775578
then
55785579
# here we go ..
55795580
err_msg="\
5580-
These problems have been found in your 'vars' settings:${NL}"
5581+
These problems have been found in your 'vars' settings:
5582+
* $target_file"
55815583

55825584
# No passwords!
5583-
if grep -q \
5584-
-e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT' \
5585-
"$target_file"
5585+
if grep -v '^[[:blank:]]*#' "$target_file" | \
5586+
grep -q -e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT'
55865587
then
5587-
err_msg="${err_msg}
5588+
err_msg="${err_msg}${NL}
55885589
Use of 'EASYRSA_PASSIN' or 'EASYRSA_PASSOUT':
55895590
Storing password information in the 'vars' file is not permitted."
5591+
# enforce this rule
5592+
unset -v EASYRSA_FORCE_VARS
55905593
fi
55915594

55925595
# No backticks
5593-
if grep -q \
5594-
-e '[^(]`[^)]' \
5595-
"$target_file"
5596+
if grep -v '^[[:blank:]]*#' "$target_file" | \
5597+
grep -q -e '`'
55965598
then
5597-
err_msg="${err_msg}
5599+
err_msg="${err_msg}${NL}
55985600
Use of unsupported characters:
55995601
These characters are not supported: \` backtick"
56005602
fi
56015603

5604+
# No standard assignment by '='
5605+
if grep -v '^[[:blank:]]*#' "$target_file" | \
5606+
grep -q -e 'EASYRSA_[_[:upper:]]*='
5607+
then
5608+
err_msg="${err_msg}${NL}
5609+
Assignment by '=':
5610+
Remove '=' and replace it with 'set_var'."
5611+
fi
5612+
56025613
# No export
5603-
if grep -q \
5604-
-e 'export ' \
5605-
"$target_file"
5614+
if grep -v '^[[:blank:]]*#' "$target_file" | \
5615+
grep -q -e 'export[[:blank:]]'
56065616
then
5607-
err_msg="${err_msg}
5617+
err_msg="${err_msg}${NL}
56085618
Use of 'export':
56095619
Remove 'export' or replace it with 'set_var'."
56105620
fi
56115621

56125622
# No unset
5613-
if grep -q \
5614-
-e 'unset ' \
5615-
"$target_file"
5623+
if grep -v '^[[:blank:]]*#' "$target_file" | \
5624+
grep -q -e 'unset[[:blank:]]'
56165625
then
5617-
err_msg="${err_msg}
5626+
err_msg="${err_msg}${NL}
56185627
Use of 'unset':
56195628
Remove 'unset' ('force_set_var' may also work)."
56205629
fi
56215630

56225631
# Fatal error
5623-
user_error "${err_msg}${NL}
5632+
if [ "$EASYRSA_FORCE_VARS" ]; then
5633+
warn "${err_msg}"
5634+
verbose "source_vars; ignore 'vars' errors"
5635+
else
5636+
user_error "${err_msg}${NL}
56245637
Please, correct these errors and try again."
5625-
5638+
fi
56265639
fi
56275640

56285641
# Enable sourcing target_file
@@ -5631,7 +5644,7 @@ Please, correct these errors and try again."
56315644

56325645
# Test sourcing target_file in a subshell
56335646
# shellcheck disable=1090 # can't follow - source_vars()
5634-
if ( . "$target_file" ); then
5647+
if ( set -e; . "$target_file" 2>/dev/null ); then
56355648
# Source target_file now
56365649
# shellcheck disable=1090 # can't follow - source_vars()
56375650
. "$target_file" || \
@@ -5640,8 +5653,11 @@ Please, correct these errors and try again."
56405653
die "Failed to dry-run the '$target_file' file."
56415654
fi
56425655

5656+
# Protect $EASYRSA_ALIAS_DAYS from vars abuse
5657+
[ "$EASYRSA_ALIAS_DAYS" = undefined ] && unset -v EASYRSA_ALIAS_DAYS
5658+
56435659
verbose "source_vars; sourced $target_file"
5644-
unset -v EASYRSA_CALLER target_file
5660+
unset -v EASYRSA_CALLER target_file err_msg
56455661
} # => source_vars()
56465662

56475663
# Set defaults
@@ -5807,6 +5823,20 @@ Using Easy-RSA 'vars' configuration:
58075823
* $EASYRSA_VARS_FILE"
58085824
fi
58095825

5826+
# Initialisation requirements
5827+
unset -v \
5828+
OPENSSL_CONF \
5829+
verify_ssl_lib_ok ssl_batch \
5830+
secured_session write_recursion \
5831+
text prohibit_no_pass \
5832+
quiet_vars invalid_vars \
5833+
local_request error_build_full_cleanup \
5834+
selfsign_eku \
5835+
internal_batch mv_temp_error \
5836+
easyrsa_exit_with_error error_info \
5837+
require_pki require_ca \
5838+
prompt_restore mktemp_counter
5839+
58105840
# then set defaults
58115841
default_vars
58125842

@@ -6626,19 +6656,10 @@ trap "exit 15" 15
66266656
# Get host details - No configurable input allowed
66276657
detect_host
66286658

6629-
# Initialisation requirements
6630-
unset -v \
6631-
OPENSSL_CONF \
6632-
verify_ssl_lib_ok ssl_batch \
6633-
secured_session write_recursion \
6634-
alias_days text prohibit_no_pass \
6635-
quiet_vars invalid_vars \
6636-
local_request error_build_full_cleanup \
6637-
selfsign_eku \
6638-
internal_batch mv_temp_error \
6639-
easyrsa_exit_with_error error_info \
6640-
require_pki require_ca \
6641-
prompt_restore mktemp_counter
6659+
# Protect variables from alteration by sourcing vars file
6660+
# undocumented, not designed for use
6661+
export EASYRSA_ALIAS_DAYS=undefined # protect from sourcing vars
6662+
unset -v EASYRSA_FORCE_VARS # has no effect after sourcing vars
66426663

66436664
# Parse options
66446665
while :; do
@@ -6662,7 +6683,7 @@ while :; do
66626683
zero_allowed=1
66636684
# Set the appropriate date variable
66646685
# when called by command later
6665-
alias_days="$val"
6686+
export EASYRSA_ALIAS_DAYS="$val"
66666687
;;
66676688
--startdate)
66686689
export EASYRSA_START_DATE="$val"
@@ -6773,6 +6794,7 @@ while :; do
67736794
-v|--verbose)
67746795
empty_ok=1
67756796
export EASYRSA_VERBOSE=1
6797+
fn_name="Easy-RSA version" verbose "$EASYRSA_version"
67766798
;;
67776799
-S|--silent-ssl)
67786800
empty_ok=1
@@ -6782,6 +6804,10 @@ while :; do
67826804
empty_ok=1
67836805
export EASYRSA_FORCE_SAFE_SSL=1
67846806
;;
6807+
--force-vars)
6808+
empty_ok=1
6809+
export EASYRSA_FORCE_VARS=1
6810+
;;
67856811
--nopass|--no-pass)
67866812
empty_ok=1
67876813
export EASYRSA_NO_PASS=1
@@ -6916,20 +6942,20 @@ case "$cmd" in
69166942
;;
69176943
build-ca)
69186944
require_pki=1; require_ca=""; verify_working_env
6919-
[ -z "$alias_days" ] || \
6920-
export EASYRSA_CA_EXPIRE="$alias_days"
6945+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6946+
export EASYRSA_CA_EXPIRE="$EASYRSA_ALIAS_DAYS"
69216947
build_ca "$@"
69226948
;;
69236949
self-sign-server)
69246950
require_pki=1; require_ca=""; verify_working_env
6925-
[ -z "$alias_days" ] || \
6926-
export EASYRSA_CERT_EXPIRE="$alias_days"
6951+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6952+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69276953
self_sign server "$@"
69286954
;;
69296955
self-sign-client)
69306956
require_pki=1; require_ca=""; verify_working_env
6931-
[ -z "$alias_days" ] || \
6932-
export EASYRSA_CERT_EXPIRE="$alias_days"
6957+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6958+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69336959
self_sign client "$@"
69346960
;;
69356961
self*)
@@ -6945,32 +6971,32 @@ case "$cmd" in
69456971
;;
69466972
sign|sign-req)
69476973
require_pki=1; require_ca=1; verify_working_env
6948-
[ -z "$alias_days" ] || \
6949-
export EASYRSA_CERT_EXPIRE="$alias_days"
6974+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6975+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69506976
sign_req "$@"
69516977
;;
69526978
build-client-full)
69536979
require_pki=1; require_ca=1; verify_working_env
6954-
[ -z "$alias_days" ] || \
6955-
export EASYRSA_CERT_EXPIRE="$alias_days"
6980+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6981+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69566982
build_full client "$@"
69576983
;;
69586984
build-server-full)
69596985
require_pki=1; require_ca=1; verify_working_env
6960-
[ -z "$alias_days" ] || \
6961-
export EASYRSA_CERT_EXPIRE="$alias_days"
6986+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6987+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69626988
build_full server "$@"
69636989
;;
69646990
build-serverClient-full)
69656991
require_pki=1; require_ca=1; verify_working_env
6966-
[ -z "$alias_days" ] || \
6967-
export EASYRSA_CERT_EXPIRE="$alias_days"
6992+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6993+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
69686994
build_full serverClient "$@"
69696995
;;
69706996
gen-crl)
69716997
require_pki=1; require_ca=1; verify_working_env
6972-
[ -z "$alias_days" ] || \
6973-
export EASYRSA_CRL_DAYS="$alias_days"
6998+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
6999+
export EASYRSA_CRL_DAYS="$EASYRSA_ALIAS_DAYS"
69747000
gen_crl
69757001
;;
69767002
revoke|revoke-issued)
@@ -7049,20 +7075,20 @@ case "$cmd" in
70497075
;;
70507076
renew-ca)
70517077
require_pki=1; require_ca=1; verify_working_env
7052-
[ -z "$alias_days" ] || \
7053-
export EASYRSA_CA_EXPIRE="$alias_days"
7078+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
7079+
export EASYRSA_CA_EXPIRE="$EASYRSA_ALIAS_DAYS"
70547080
renew_ca_cert "$@"
70557081
;;
70567082
renew)
70577083
require_pki=1; require_ca=1; verify_working_env
7058-
[ -z "$alias_days" ] || \
7059-
export EASYRSA_CERT_EXPIRE="$alias_days"
7084+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
7085+
export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
70607086
renew "$@"
70617087
;;
70627088
show-expire)
70637089
require_pki=1; require_ca=1; verify_working_env
7064-
[ -z "$alias_days" ] || \
7065-
export EASYRSA_PRE_EXPIRY_WINDOW="$alias_days"
7090+
[ -z "$EASYRSA_ALIAS_DAYS" ] || \
7091+
export EASYRSA_PRE_EXPIRY_WINDOW="$EASYRSA_ALIAS_DAYS"
70667092
status expire "$@"
70677093
;;
70687094
show-revoke)

0 commit comments

Comments
 (0)