On Fri, May 19, 2017 at 09:56:14AM +0100, Stuart Henderson wrote:
> On 2017/05/19 00:32, Matthew Martin wrote:
> > ikectl errors in a number of situations where shell special characters
> > are used. For example:
> >
> > % doas ikectl ca test create password \'
> > [...]
> > subject=/C=DE/ST=Lower Saxony/L=Hanover/O=OpenBSD/OU=iked/CN=VPN
> > CA/[email protected]
> > Getting Private key
> > sh: no closing quote
> >
> > This is because it uses system(3) in various places to run openssl, tar,
> > and zip. Take the hint from the system(3) man page, and write a small
> > function that does the fork and exec bypassing sh.
>
> This seems like a good idea anyway, but this diff from Andrei-Marius Radu
> to stop passing the password on the command line is still pending :
>
> https://marc.info/?l=openbsd-bugs&m=149064755410645&w=2
Trying to test this gets me
ikectl -q ca test2 certificate 10.0.0.6 revoke
Using configuration from /etc/ssl/test2/ca-revoke-ssl.cnf
error on line 27 of config file '/etc/ssl/test2/ca-revoke-ssl.cnf'
30728805483616:error:0EFFF068:configuration file
routines:CRYPTO_internal:variable has no
value:/usr/src/lib/libcrypto/conf/conf_def.c:563:line 27
Using configuration from /etc/ssl/test2/ca-revoke-ssl.cnf
error on line 27 of config file '/etc/ssl/test2/ca-revoke-ssl.cnf'
19976781949600:error:0EFFF068:configuration file
routines:CRYPTO_internal:variable has no
value:/usr/src/lib/libcrypto/conf/conf_def.c:563:line 27
21 [ req ]
22 #default_bits = 2048
23 #default_md = sha256
24 #default_keyfile = privkey.pem
25 distinguished_name = req_distinguished_name
26 #attributes = req_attributes
27 req_extensions = $ENV::REQ_EXT
I'm ok with the Andrei-Marius Radu diff going in. Though below diff
should go in as well. Then we can start looking at the other two diffs.
Index: ikeca.c
===================================================================
RCS file: /cvs/src/usr.sbin/ikectl/ikeca.c,v
retrieving revision 1.43
diff -u -p -r1.43 ikeca.c
--- ikeca.c 21 May 2017 02:37:52 -0000 1.43
+++ ikeca.c 22 May 2017 10:17:08 -0000
@@ -900,6 +900,7 @@ ca_revoke(struct ca *ca, char *keyname)
ca_setenv("$ENV::CADB", ca->index);
ca_setenv("$ENV::CASERIAL", ca->serial);
+ ca_setenv("$ENV::REQ_EXT", "req");
ca_setcnf(ca, "ca-revoke");
if (keyname) {
