From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 1/3] ovpnmain.cgi: Define OpenSSL configuration globally
Date: Thu, 18 Apr 2024 21:36:52 +0000
Message-ID: <20240418213654.3321580-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1398197722811227371=="
List-Id: <development.lists.ipfire.org>

--===============1398197722811227371==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This makes commands shorter and therefore easier to read.

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 html/cgi-bin/ovpnmain.cgi | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index c92d0237d..9b8ff5aa5 100755
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -53,6 +53,9 @@ my %mainsettings =3D ();
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", =
\%color);
=20
+# Use a custom OpenSSL configuration file for all operations
+$ENV["OPENSSL_CONF"] =3D "${General::swroot}/ovpn/ca/cacert.pem";
+
 ###
 ### Initialize variables
 ###
@@ -1835,8 +1838,7 @@ END
 	    unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
 			'-days', '999999', '-newkey', 'rsa:4096', '-sha512',
 			'-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
-			'-out', "${General::swroot}/ovpn/ca/cacert.pem",
-			'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
+			'-out', "${General::swroot}/ovpn/ca/cacert.pem")) {
 		$errormessage =3D "$Lang::tr{'cant start openssl'}: $!";
 		goto ROOTCERT_ERROR;
 	    }
@@ -1867,8 +1869,7 @@ END
 			'-newkey', 'rsa:4096',
 			'-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
 			'-out', "${General::swroot}/ovpn/certs/serverreq.pem",
-			'-extensions', 'server',
-			'-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
+			'-extensions', 'server')) {
 		$errormessage =3D "$Lang::tr{'cant start openssl'}: $!";
 		unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
 		unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
@@ -1884,8 +1885,7 @@ END
 		'-batch', '-notext',
 		'-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
 		'-out', "${General::swroot}/ovpn/certs/servercert.pem",
-		'-extensions', 'server',
-		'-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
+		'-extensions', 'server');
 	if ($?) {
 	    $errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
 	    unlink ("${General::swroot}/ovpn/ca/cakey.pem");
@@ -1903,8 +1903,7 @@ END
 	# Create an empty CRL
 	# System call is safe, because all arguments are passed as array.
 	system('/usr/bin/openssl', 'ca', '-gencrl',
-		'-out', "${General::swroot}/ovpn/crls/cacrl.pem",
-		'-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
+		'-out', "${General::swroot}/ovpn/crls/cacrl.pem");
 	if ($?) {
 	    $errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
 	    unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
@@ -2426,8 +2425,8 @@ else
=20
 	if ($confighash{$cgiparams{'KEY'}}) {
 		# Revoke certificate if certificate was deleted and rewrite the CRL
-		&General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/=
ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General:=
:swroot}/ovpn/openssl/ovpn.cnf");
-		&General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::=
swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovp=
n.cnf");
+		&General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/=
ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+		&General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::=
swroot}/ovpn/crls/cacrl.pem");
=20
 ###
 # m.a.d net2net
@@ -2480,7 +2479,7 @@ else
 		&General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgip=
arams{'KEY'}}[1]");
=20
 		delete $confighash{$cgiparams{'KEY'}};
-		&General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::=
swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovp=
n.cnf");
+		&General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::=
swroot}/ovpn/crls/cacrl.pem");
 		&General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighas=
h);
=20
 	} else {
@@ -4052,8 +4051,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
 	    system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
 		'-batch', '-notext',
 		'-in', $filename,
-		'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
-		'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
+		'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
 	    if ($?) {
 		$errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
 		unlink ($filename);
@@ -4265,8 +4263,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
 		unless (exec ('/usr/bin/openssl', 'req', '-nodes',
 			'-newkey', 'rsa:4096',
 			'-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
-			'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
-			'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
+			'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem")) {
 		    $errormessage =3D "$Lang::tr{'cant start openssl'}: $!";
 		    unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
 		    unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
@@ -4279,8 +4276,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
 	    system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
 		'-batch', '-notext',
 		'-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
-		'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
-		'-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
+		'-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
 	    if ($?) {
 		$errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
 		unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
--=20
2.39.2


--===============1398197722811227371==--