Skip to content

Commit df2d8fe

Browse files
TinCanTechTinCanTech
committed
Merge branch 'TinCanTech-init-try-user-home'
Signed-off-by: Richard T Bonhomme <[email protected]>
2 parents 8ac7c3c + d5a762d commit df2d8fe

File tree

4 files changed

+310
-130
lines changed

4 files changed

+310
-130
lines changed

‎ChangeLog‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,15 @@ Easy-RSA 3 ChangeLog
22

33
3.2.4 (TBD)
44

5+
* help: Correct build-ca 'rawca' command option (0447f42) (#1374)
6+
* Windows easyrsa-shell-init.sh: Modernize prompt (5bf2e99) (#1374)
7+
* Windows UT: Update 'wop-test.sh' to latest 'easyrsa-shell-init.sh' (ea5b168) (#1374)
8+
* verify_openvpn(): Convert Windows path '\' to *nix path '/' (75a8fdd) (#1374)
9+
* verify_openvpn(): Windows, add check for 'openvpn.exe' (10c6267) (#1374)
10+
* gen-crl: Replace file-move with file-copy-preserve-attribs (4cc1d48) (#1374)
11+
* Windows easyrsa-shell-init.sh: Add non-fatal check for 'openvpn.exe' (bb78615) (#1374)
12+
* Windows easyrsa-shell-init.sh: Require confirmation for User-Home mode (bfa6cfd) (#1374)
13+
* Windows easyrsa-shell-init.sh: Allow Easy-RSA to use '\User\$HOME' (f194da5) (#1374)
514
* mutual_exclusions(): Include basic checks for --startdate/--enddate (e1478c3) (#1372)
615
* Windows easyrsa-shell-init.sh: Replace 'read -p' (49b2181) (#1371)
716
* inline: Include missing OpenVPN TLS key to cause INCOMPLETE warning (d98eee6) (#1368)

‎distro/windows/bin/easyrsa-shell-init.sh‎

Lines changed: 131 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,115 +1,90 @@
11
#!/bin/sh
2-
# shellcheck disable=SC2161,SC1091,SC2028
32

43
# This script is a frontend designed to create & launch a POSIX shell
54
# environment suitable for use with Easy-RSA. mksh/Win32 is used with this
65
# project; use with other POSIX shells for Windows may require modification to
76
# this wrapper script.
87

9-
echo "Easy-RSA starting.."
10-
11-
setup_path="${EASYRSA:-$PWD}"
12-
export PATH="$setup_path;$setup_path/bin;$PATH"
13-
export HOME="$setup_path"
14-
15-
# This prevents reading from a user's .mkshrc if they have one.
16-
# A user who runs mksh for other purposes might have it
17-
export ENV="/disable-env"
8+
# SC2162 - read without -r will mangle backslashes
9+
# SC1091 - Not following source file
10+
# SC1003 - (info): Want to escape a single quote?
11+
# shellcheck disable=SC2162,SC1091,SC1003
12+
13+
# intent confirmation helper func
14+
# modified from easyrsa
15+
confirm() {
16+
prompt="$1"
17+
value="$2"
18+
msg="$3"
19+
input=""
20+
print "\
21+
$msg
22+
23+
Type the word '$value' to continue, or any other input to abort."
24+
printf %s " $prompt"
25+
# shellcheck disable=SC2162 # read without -r - confirm()
26+
read input
27+
printf '\n'
28+
[ "$input" = "$value" ] && return
29+
unset -v EASYRSA_SILENT
30+
notice "Aborting without confirmation."
31+
exit 1
32+
} # => confirm()
1833

19-
# Verify required externals are present
20-
extern_list="which awk cat cp mkdir printf rm"
21-
for f in $extern_list; do
22-
if ! which "${f}.exe" >/dev/null 2>&1; then
23-
echo ""
24-
echo "FATAL: EasyRSA Shell init is missing a required external file:"
25-
echo " ${f}.exe"
26-
echo " Your installation is incomplete and cannot function without the required"
27-
echo " files."
28-
echo ""
29-
#shellcheck disable=SC2162
30-
echo "Press Enter to exit."
34+
# Access denied error
35+
access_denied() {
36+
echo "Cannot locate or use a User-Home directory."
37+
echo "Press [Enter] to exit."
3138
read
3239
exit 1
40+
} # => access_denied()
41+
42+
# Administrator access Required tests
43+
admin_access() {
44+
mkdir "$1" 2>/dev/null || return 1
45+
[ -d "$1" ] || return 1
46+
echo 1 >"$1"/1 2>/dev/null || return 1
47+
[ -f "$1"/1 ] || return 1
48+
rm -rf "$1" 2>/dev/null || return 1
49+
[ ! -d "$1" ] || return 1
50+
} # => admin_access()
51+
52+
# Setup "$HOMEDRIVE\$HOMEPATH\OpenVPN\easy-rsa" directory
53+
use_home_dir() {
54+
if [ "$USERPROFILE" ]; then
55+
# Use $USERPROFILE
56+
user_home="$USERPROFILE"
57+
elif [ "$HOMEDRIVE" ]; then
58+
if [ "$HOMEPATH" ]; then
59+
# Use $HOMEDRIVE and $HOMEPATH
60+
user_home="${HOMEDRIVE}${HOMEPATH}"
61+
else
62+
user_home=
63+
fi
64+
else
65+
user_home=
3366
fi
34-
done
3567

36-
# Allow options
37-
non_admin=""
38-
while [ "$1" ]; do
39-
case "$1" in
40-
/[Nn][Aa]|/no-adm*|--no-adm*)
41-
non_admin=1
42-
echo "Using no-admin mode"
43-
;;
44-
*)
45-
echo "Ignoring unknown option: '$1'"
46-
esac
47-
shift
48-
done
49-
50-
# Access denied
51-
access_denied() {
52-
echo "Access error: $1"
53-
echo "\
54-
To use Easy-RSA in a protected system directory, you must have
55-
full administrator privileges via Windows User Access Control."
56-
echo ""
57-
58-
#shellcheck disable=SC2162
59-
echo "Press Enter to exit."
60-
read
61-
exit 1
62-
}
68+
# If no $user_home was identified
69+
[ "$user_home" ] || access_denied
6370

64-
# Use home directory/easy-rsa
65-
if [ "$non_admin" ]; then
66-
[ "${HOMEDRIVE}" ] || \
67-
access_denied "Undefined: HOMEDRIVE"
68-
user_home_drv="${HOMEDRIVE}"
69-
70-
[ "${HOMEPATH}" ] || \
71-
access_denied "Undefined: HOMEPATH"
72-
eval "user_home_dir='\\${HOMEPATH}'"
73-
74-
# shellcheck disable=SC2154 # user_home_dir is not assigned
75-
user_home="${user_home_drv}${user_home_dir}"
76-
77-
[ -d "$user_home" ] || \
78-
access_denied "Missing: $user_home"
79-
80-
cd "$user_home" 2>/dev/null || \
81-
access_denied "Access: $user_home"
71+
# Use $user_home/openvpn directory
72+
cd "$user_home"/openvpn || access_denied
8273

74+
# Create $user_home/openvpn/easy-rsa directory
8375
if [ ! -d easy-rsa ]; then
84-
mkdir easy-rsa 2>/dev/null || \
85-
access_denied "mkdir: easy-rsa"
76+
mkdir easy-rsa 2>/dev/null || access_denied
8677
# Required test
87-
[ -d easy-rsa ] || \
88-
access_denied "Missing: easy-rsa"
78+
[ -d easy-rsa ] || access_denied
8979
fi
9080

91-
cd easy-rsa 2>/dev/null || \
92-
access_denied "Access: easy-rsa"
81+
# Use $user_home/openvpn/easy-rsa directory
82+
cd easy-rsa 2>/dev/null || access_denied
9383

9484
export HOME="$PWD"
9585
export PATH="$HOME;$PATH"
96-
unset -v user_home_drv user_home_dir user_home
97-
fi
98-
99-
# Check for broken administrator access
100-
# https://github.com/OpenVPN/easy-rsa/issues/1072
101-
[ -d "$HOME" ] || access_denied "-d HOME"
102-
win_tst_d="$HOME"/easyrsa-write-test
103-
104-
# Required tests
105-
mkdir "$win_tst_d" 2>/dev/null || access_denied "mkdir"
106-
[ -d "$win_tst_d" ] || access_denied "-d"
107-
echo 1 >"$win_tst_d"/1 2>/dev/null || access_denied "write"
108-
[ -f "$win_tst_d"/1 ] || access_denied "-f"
109-
rm -rf "$win_tst_d" 2>/dev/null || access_denied "rm"
110-
[ ! -d "$win_tst_d" ] || access_denied "! -d"
111-
unset -v win_tst_d
112-
unset -f access_denied
86+
unset -v user_home
87+
} # => use_home_dir()
11388

11489
# set_var is defined as any vars file needs it.
11590
# This is the same as in easyrsa, but we _don't_ export
@@ -120,6 +95,54 @@ set_var() {
12095
eval "$var=\"\${$var-$value}\""
12196
} #=> set_var()
12297

98+
########################################
99+
# Invocation entry point:
100+
101+
echo "Starting Easy-RSA shell.."
102+
103+
setup_path="${EASYRSA:-$PWD}"
104+
export PATH="$setup_path;$setup_path/bin;$PATH"
105+
export HOME="$setup_path"
106+
107+
# This prevents reading from a user's .mkshrc if they have one.
108+
# A user who runs mksh for other purposes might have it
109+
export ENV="/disable-env"
110+
111+
# Check for broken administrator access
112+
# https://github.com/OpenVPN/easy-rsa/issues/1072
113+
if admin_access "$HOME"/easyrsa-write-test; then
114+
sec_lev='#'
115+
else
116+
echo "
117+
To use Easy-RSA in a protected system directory, you must have
118+
full administrator privileges via Windows User Access Control."
119+
120+
confirm "Continue without administrator access ? " yes "
121+
Easy-RSA will now try to use your User-Home directory."
122+
123+
use_home_dir
124+
sec_lev='$'
125+
echo "
126+
NOTICE:
127+
Easy-RSA has been auto-configured to run in your User-Home directory."
128+
fi
129+
130+
# Verify required externals are present
131+
extern_list="which awk cat cp mkdir printf rm grep sed"
132+
for f in $extern_list; do
133+
if ! which "${f}.exe" >/dev/null 2>&1; then
134+
echo ""
135+
echo "FATAL: EasyRSA Shell init is missing a required external file:"
136+
echo " ${f}.exe"
137+
echo " Your installation is incomplete and cannot function without"
138+
echo " the required files."
139+
echo ""
140+
echo "Press Enter to exit."
141+
read
142+
exit 1
143+
fi
144+
done
145+
123146
# Check for a usable openssl bin, referencing vars if present
124147
[ -r "vars" ] && EASYRSA_CALLER=1 . "vars" 2>/dev/null
125148
if [ -z "$EASYRSA_OPENSSL" ] && ! which openssl.exe >/dev/null 2>&1; then
@@ -135,18 +158,30 @@ fi
135158
exit 1
136159
}
137160

161+
# Check for openvpn executable
162+
if which openvpn.exe >/dev/null 2>&1; then
163+
EASYRSA_OPENVPN="$(which openvpn.exe | sed s/'\\'/'\/'/g)" || {
164+
echo "verify_openvpn - Failed to convert openvpn path."
165+
echo "Press Enter to exit."
166+
read
167+
exit 1
168+
}
169+
export EASYRSA_OPENVPN="$EASYRSA_OPENVPN"
170+
else
171+
echo "WARNING: openvpn.exe is not in your system PATH."
172+
echo "EasyRSA will not be able to generate OpenVPN TLS keys."
173+
fi
174+
138175
# Set prompt and welcome message
139-
export PS1='
140-
EasyRSA Shell
141-
# '
176+
export PS1="$USERNAME@$COMPUTERNAME $HOME
177+
EasyRSA-Shell: $sec_lev "
178+
142179
echo ""
143180
echo "Welcome to the EasyRSA 3 Shell for Windows."
144181
echo "Easy-RSA 3 is available under a GNU GPLv2 license."
145182
echo ""
146183
echo "Invoke 'easyrsa' to call the program. Without commands, help is displayed."
147184
echo ""
148-
echo "Using directory: $HOME"
149-
echo ""
150185

151186
# Drop to a shell and await input
152187
sh.exe

‎easyrsa3/easyrsa‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,8 @@ Command list:
149149
serial|check-serial <SERIAL>
150150
display-dn <form> <DIR/FILE_NAME>
151151
show-eku <file_name_base>|<DIR/FILE_NAME>
152-
rand <decimal_number>"
152+
rand <decimal_number>
153+
"
153154
} # => usage()
154155

155156
# Detailed command help
@@ -187,8 +188,8 @@ Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
187188
Creates a new CA"
188189

189190
opts="
190-
* raw-ca - ONLY use SSL binary to input CA password
191-
raw (Equivalent to global option '--raw-ca')
191+
* rawca - ONLY use SSL binary to input CA password
192+
(Equivalent to global option '--rawca|--raw-ca')
192193

193194
* nopass - Do not encrypt the private key (Default: encrypted)
194195
(Equivalent to global option '--nopass|--no-pass')
@@ -1567,7 +1568,7 @@ build_ca() {
15671568
nopass)
15681569
[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
15691570
;;
1570-
rawca|raw-ca)
1571+
rawca)
15711572
# option --raw-ca demands user interaction
15721573
# which forbids --batch
15731574
[ "$EASYRSA_BATCH" ] && user_error \
@@ -3546,11 +3547,7 @@ gen_crl() {
35463547
die "CRL Generation failed."
35473548

35483549
# Move temp-files to target-files
3549-
mv "$out_file_tmp" "$out_file" || mv_temp_error=1
3550-
if [ "$mv_temp_error" ]; then
3551-
#rm -f "$out_file"
3552-
die "Failed to move temp CRL file."
3553-
fi
3550+
cp -p "$out_file_tmp" "$out_file" || die "Failed to move temp CRL file."
35543551

35553552
# Copy to DER - As published by OpenSSL
35563553
if "$EASYRSA_OPENSSL" crl -in "$out_file" -out "$out_der" \
@@ -3972,14 +3969,32 @@ ${cipher:+You will then enter a new password for this key.$NL}"
39723969

39733970
# Verify OpenVPN binary
39743971
verify_openvpn() {
3975-
# Try to find openvpn
3976-
set_var EASYRSA_OPENVPN "$(which openvpn)"
39773972
if [ -f "$EASYRSA_OPENVPN" ]; then
3978-
verbose \
3979-
"verify_openvpn - EASYRSA_OPENVPN='$EASYRSA_OPENVPN'"
3973+
verbose "verify_openvpn; Preset EASYRSA_OPENVPN='$EASYRSA_OPENVPN'"
3974+
return
3975+
fi
3976+
3977+
# Try to find openvpn *nix
3978+
if which openvpn >/dev/null 2>&1; then
3979+
set_var EASYRSA_OPENVPN "$(which openvpn)"
39803980
else
3981-
user_error "Cannot find an OpenVPN binary."
3981+
# Try to find openvpn.exe, specifically for Windows
3982+
# Assign temp-file for Windows path name
3983+
ovpn_path_tmp=""
3984+
easyrsa_mktemp ovpn_path_tmp
3985+
3986+
if which openvpn.exe > "$ovpn_path_tmp"; then
3987+
# shellcheck disable=SC1003 # (info): Want to escape a single quote?
3988+
ovpn_path="$(sed s/'\\'/'\/'/ "$ovpn_path_tmp")" || \
3989+
die "verify_openvpn - Failed to convert openvpn path."
3990+
set_var EASYRSA_OPENVPN "$ovpn_path"
3991+
else
3992+
user_error "\
3993+
An 'openvpn' binary is not in your system PATH.
3994+
EasyRSA can not generate OpenVPN TLS keys."
3995+
fi
39823996
fi
3997+
verbose "verify_openvpn; Set EASYRSA_OPENVPN='$EASYRSA_OPENVPN'"
39833998
} # => verify_openvpn()
39843999

39854000
# OpenVPN TLS Auth/Crypt Key

0 commit comments

Comments
 (0)