Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable prefer_vars_in_pki_msg(), until further notice #1014

Closed
wants to merge 21 commits into from
Closed

Disable prefer_vars_in_pki_msg(), until further notice #1014

wants to merge 21 commits into from

Conversation

TinCanTech
Copy link
Collaborator

@TinCanTech TinCanTech commented Aug 29, 2023 •
edited
Loading

This patch set completes the following:

1
4cb05fe

  • Disable prefer_vars_in_pki_msg().
    No other changes.

2
2e5865a

  • install_data_to_pki: Disable creating new vars file.
    Stop 'init-pki' creating a new vars file inside the new PKI.
    Disable confirmation advising user to use 'init-pki soft'
    ('init-pki soft' is no longer useful and will be removed)

3
f18c9a0

  • Disable creating a vars file and only allow one vars file to exist
    Completely disable creating any vars file
    If more than one vars file exists is a fatal error
    (Changed from FATAL to WARNING in b19beb2 below)

4
d05a89e

  • Never create a pki/vars.example file

5
8d55b9f

  • Update ChangeLog: Disable code which requests vars be moved to the PKI

6
53f443c

  • vars_setup: Downgrade warning to info for "no vars file exists"

7
3b4ac2e

  • install_data_to_pki: Correct error message "text" only

8
b19beb2

  • vars_setup: Multiple vars files, downgrade FATAL error to WARNING
    Finding multiple vars files will result in a WARNING instead of a
    FATAL error, then a vars file is selected.

9
1c0228b

  • vars_setup: Prioritise pre-defined EASYRSA/vars over standard search
    EASYRSA can only be set by the user so prioritise "$EASYRSA/vars"

10
b75c8b0

  • vars_setup: Prohibit specifying vars as a directory. eg: ./

11
4a80b21

  • vars_setup: Split into setup_vars() and source_vars()

12
b9914c6

  • Repurpose prefer_vars_in_pki_msg() to "warn against vars in PKI"

13
92a6341

  • Add explicit confirmation for default 'pki/vars' setting a different PKI
    (Possible bug (Fix) caused by moving vars to the PKI)

14
a68edb3

  • Update ChangeLog: Retract "preference for vars in the PKI"

15
bb1adae

  • Change to FATAL error when default 'pki/vars' sets a different PKI
    (Changes 13 92a6341 above)

16
fab09e6

  • init-pki: Remove unnecessary user information concerning vars

17
0e53ae1

  • install_data_to_pki() init-pki: Remove code to create a 'pki/vars' file

18
6f88df3

  • Insert required errors and warning to control vars location

19
d2c25de

  • Forbid 'pki/vars' setting PKI for command 'init-pki'

20
dc15f35

  • 'init-pki', prioritise USER set EASYRSA_PKI and EASYRSA

21
0c8fd82

  • Move "Setup: catch vars file changing PKI unexpectedly"
    Prioritise command line options above 'vars' file assignments

@TinCanTech TinCanTech mentioned this pull request Aug 29, 2023
Closed
@TinCanTech TinCanTech self-assigned this Aug 29, 2023
@TinCanTech TinCanTech added this to the v3.1.7 milestone Aug 29, 2023
This was referenced Aug 29, 2023
Closed
Closed
Closed
@TinCanTech
Disable creating a vars file and only allow one vars file to exist
f18c9a0 
intall_data_to_pki init-pki: Never create a vars file.
Creating a vars file in the PKI is not recommended due to the possibility
of defining use of a different PKI via EASYRSA_PKI variable.

vars_setup: Never allow multiple vars files to exist for any commands.
If there are multiple vars file found then EasyRSA has no way to prioritise
one over another.

Remove unused variable: expected_pki_vars

Standardise some verbose messages.

Correct some comments related to 'vars in PKI', no longer suitable.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
install_data_to_pki: Never create a pki/vars.example file
d05a89e 
Having a pki/vars.example file exist, leads to the incorrect conclusion
that a pki/vars file is suitable. Therefore, never create an example file.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from fcb1011 to d05a89e Compare August 30, 2023 11:12
@TinCanTech TinCanTech mentioned this pull request Aug 30, 2023
Closed
@TinCanTech
vars_setup: Downgrade warning to info for "no vars file exists"
53f443c 
Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
install_data_to_pki: Correct error message "text" only
3b4ac2e 
Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
vars_setup: Multiple vars files, downgrade FATAL error to WARNING
b19beb2 
Finding multiple vars files will result in a WARNING instead of a
FATAL error, then a vars file is selected.

If --vars=<FILE> is used or EASYRSA_VARS_FILE is defined then only
the vars file defined is used, all other vars files are ignored
without warning.

If multiple vars files are found then select in the following order:
* EASYRSA/vars - User has preset EASYRSA, highest priority.
* PWD/vars - The expected default.
* Program directory - This is essentially the same as PWD/vars
  However, it is explicitly listed due to code history.
* pki/vars - This is least wanted. See note below.

Note:
The pki/vars was an attempt to change the default expected location
of the vars file. After extensive testing, this change has proven to
be fraught with misuse. Specifically, setting EASYRSA_PKI from with
in a different PKI, an obvious conflict of inerests.

If a single vars file is found then select it with the same priority
as multiple vars files.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from a364299 to b19beb2 Compare September 3, 2023 21:43
@TinCanTech
vars_setup: Prioritise pre-defined EASYRSA/vars over standard search
1c0228b 
There is no built-in way to set EASYRSA as a variable, it must be set
externally by the user.

Therefore, when EASYRSA is set allow ONLY "$EASYRSA/vars".
Allow "$EASYRSA/vars" to NOT exist.

Command option --vars=<FILE> has priority.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
vars_setup: Prohibit specifying vars as a directory. eg: ./
b75c8b0 
Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
vars_setup: Split into setup_vars() and source_vars()
4a80b21 
setup_vars: Determine which vars file to use.

source_vars: Validate and source accepted vars file.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
Repurpose prefer_vars_in_pki_msg() to "warn against vars in PKI"
b9914c6 
Use the same logic as "prefer vars in pki" but change the message
to "warn against vars in the pki".

Signed-off-by: Richard T Bonhomme <[email protected]>
TinCanTech
TinCanTech commented Sep 4, 2023
View reviewed changes
Copy link
Collaborator Author

@TinCanTech TinCanTech left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add explicit confirmation for default 'pki/vars' setting a different PKI - Fixes: #1015

@TinCanTech
Add explicit confirmation for default 'pki/vars' setting a different PKI
92a6341 
If the default 'pki/vars' exists and sets EASYRSA_PKI to a different PKI,
anything other than "$PWD/pki", then issue a warning with an explicit user
confirmation to proceed with this invalid configuration.

This is a left-over by-product of trying to move the vars file to the PKI.

Problem: 'pki/vars' sets EASYRSA_PKI to a different PKI.

Conclusion: Easy-RSA v3.1.7 does NOT support a vars file in the PKI.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from 4283ad2 to 92a6341 Compare September 4, 2023 23:47
@TinCanTech
Copy link
Collaborator Author

92a6341 - Concerns #1006

@TinCanTech
source_vars: FATAL error when default 'pki/vars' sets a different PKI
bb1adae 
Previously, this was a warning and confirmation to continue.
Changed to, NEVER allow this invalid configuration.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
init-pki: Remove unnecessary user information concerning vars
fab09e6 
Remove second warning on hard-reset which promotes soft-reset,
soft-reset will be removed.

Remove information concerning 'vars' file. 'init-pki' does not
create a 'vars' file in the PKI, therefore, the information is
no longer relevant.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
install_data_to_pki() init-pki: Remove code to create a 'pki/vars' file
0e53ae1 
Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
Insert required errors and warning to control vars location
6f88df3 
Error-1: For multiple vars files when 'pki/vars' is true.
Not thrown for multiple vars if 'pki/vars' is not true.
When multiple vars are found one is selected based on priority.
Priority is: "$PWD/vars" (default); Program folder; 'pki/vars'
Not thrown if user specifies 'vars' by either specifying
* EASYRSA, can only be set externally.
* --vars=<FILE>, user set vars is respected.

Error-2: When the default 'pki/vars' sets EASYRSA_PKI, causing
the PKI to be changed during setup proceedure.
This is a rare error but must be caught, otherwise it is very
easy to use 'init-pki' to remove the wrong PKI.

Warning: When 'pki/vars' is true.
After completing any command, this warning will be issued,
if the sourced 'vars' file is in the default 'pki' AND
if the user did not specifically select a vars file.

Allow commands 'version', 'upgrade' and 'show-host' to
complete without using any 'vars' file.

Upgrade warning to error for 'export' or 'unset' used in
the 'vars' file.

Downgrade die to user_error for simple 'vars' file problems.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from 5b215b0 to 6f88df3 Compare September 6, 2023 18:55
@TinCanTech
source_vars(): Forbid 'pki/vars' setting PKI for command 'init-pki'
d2c25de 
Forbid default 'pki/vars', if it exists, from setting EASYRSA_PKI
to any other value except "$PWD/pki", for command 'init-pki'.

When 'init-pki' is called with all default options then
it will load a dafault 'pki/vars' file, if it exists.
This EXPECTS the PKI to be 'pki' ONLY.

For 'init-pki';
This 'pki/vars' file MUST NOT be allowed to set EASYRSA_PKI.
This MUST include setting EASYRSA_PKI to 'pki'.

Otherwise, this allows default command 'init-pki' to delete
a non-default PKI.

This change also forbids using command line settings for
--vars and --pki-dir, to set the expected vars file or PKI,
when a default 'pki/vars' exists AND changes the expected
PKI, to anything other than "$PWD/pki".

Example of the problem:

  If 'easyrsa' is executed with all default settings then
  the expected value for EASYRSA_PKI is "$PWD/pki" and
  if 'pki/vars' file exists, it IS loaded.

  If 'pki/vars' sets EASYRSA_PKI to a different PKI, 'bad-pki',
  then this would allow 'init-pki' to delete 'bad-pki' not 'pki'.

For the record:
All of these changes have been extensively tested.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech
Copy link
Collaborator Author

Unit tests, doing a good job.

@TinCanTech
source_vars(): 'init-pki', prioritise USER set EASYRSA_PKI and EASYRSA
dc15f35 
When souring 'vars' file, allow user set EASYRSA_PKI and EASYRSA
to take priority over default settings.

This will still error out when default 'pki/vars' sets EASYRSA_PKI to
a non-default PKI.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from 924159c to dc15f35 Compare September 12, 2023 17:31
@TinCanTech
Move "Setup: catch vars file changing PKI unexpectedly"
0c8fd82 
This setup assigns values for '$expected_pki' to before
sourcing the vars file.  This prioritises command line
options above 'vars' file assignments.

Minor improvement to error message given when subshell
testing of sourcing 'vars' fails.

On user_error(), exit_with_error via cleanup().

Minor improvements to error and verbose messages.

Signed-off-by: Richard T Bonhomme <[email protected]>
@TinCanTech TinCanTech force-pushed the disable-vars-in-pki-msg branch from fe867ba to 0c8fd82 Compare September 13, 2023 20:01
@TinCanTech TinCanTech added development Possible changes and removed improvement labels Sep 13, 2023
@TinCanTech TinCanTech mentioned this pull request Sep 14, 2023
Merged
@TinCanTech
Copy link
Collaborator Author

Replaced-by: #1021

@TinCanTech TinCanTech closed this Sep 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@TinCanTech TinCanTech

Labels
ChangeLog Item development Possible changes MAJOR CHANGE Version 3.1.7
Projects
None yet
Milestone
v3.1.7
Development

Successfully merging this pull request may close these issues.
1 participant
@TinCanTech