Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

date function for Darwin is incorrect #559

Closed
TinCanTech opened this issue May 7, 2022 · 19 comments
Closed

date function for Darwin is incorrect #559

TinCanTech opened this issue May 7, 2022 · 19 comments
Assignees
@ecrist
Labels
BUG
Milestone
v3.1.0

Comments

@TinCanTech
Copy link
Collaborator

https://github.com/OpenVPN/easy-rsa/runs/6336081225?check_suite_focus=true

Let's see the queue of Mac users breaking down the door to help .. yawn
@TinCanTech TinCanTech added the BUG label May 7, 2022
@ecrist
Copy link
Member

ecrist commented May 7, 2022 via email

@TinCanTech
Copy link
Collaborator Author

TinCanTech commented May 7, 2022 •
edited
Loading

The log doesn't have anything useful.

This is the code in question:

easy-rsa/easyrsa3/easyrsa

Lines 1647 to 1661 in af4120c

# OS dependencies
case "$easyrsa_uname" in
"Darwin"|*"BSD")
now_sec="$(date -j +%s)"
expire_date="$(date -j -f '%b %d %T %Y %Z' "$crt_not_after" +%s)"
allow_renew_date="$(( now_sec + EASYRSA_CERT_RENEW * 86400 ))"
if [ "$EASYRSA_FIX_OFFSET" ]; then
start_fix_sec="$(date -j "${this_year}01010000.00" +%s)"
end_fix_sec="$(( start_fix_sec + fix_days * 86400 ))"
# Convert to date-stamps for SSL input
start_fixdate="$(date -j -r "$start_fix_sec" +%Y%m%d%H%M%SZ)"
end_fixdate="$(date -j -r "$end_fix_sec" +%Y%m%d%H%M%SZ)"
fi
;;

I tested on FreeBSD and got no error.

@TinCanTech
Copy link
Collaborator Author

TinCanTech commented May 7, 2022 •
edited
Loading

Following a minor unit-test change, it is apparent that the failed command is the first one: expire_date="$(date -j -f '%b %d %T %Y %Z' "$crt_not_after" +%s)"

@TinCanTech
Copy link
Collaborator Author

I can fix date on Darwin tomorrow.

Breath held ...

@mandree
Copy link

mandree commented May 7, 2022

It's very simple. POSIX date only supports the -u option and +"FORMAT"

@ecrist
Copy link
Member

ecrist commented May 8, 2022 via email

@ecrist ecrist self-assigned this May 8, 2022
@ecrist ecrist mentioned this issue May 8, 2022
Closed
@ecrist ecrist added the invalid label May 8, 2022
@TinCanTech
Copy link
Collaborator Author

Run the unit test like so:

LIBRESSL_LIMIT=1 sh op-test.sh -vv

@TinCanTech TinCanTech removed the invalid label May 8, 2022
@TinCanTech
Copy link
Collaborator Author

I do not agree to "dropping POSIX claim".

@ecrist
Copy link
Member

ecrist commented May 8, 2022 via email

@TinCanTech
Copy link
Collaborator Author

I guess this is a Darwin issue. github runner macos-latest maybe too up to date.

Manual test succeeds, with:
Darwin wiscii-MacBook-Pro.local 19.6.0 Darwin Kernel Version 19.6.0: Thu Oct 29 22:56:45 PDT 2020; root:xnu-6153.141.2.2~1/RELEASE_X86_64 x86_64

wiscii@wiscii-MacBook-Pro easyrsa3 % openssl version
LibreSSL 2.8.3

@TinCanTech
Copy link
Collaborator Author 

wiscii@wiscii-MacBook-Pro easyrsa3 % ./easyrsa init-pki                                        

WARNING!!!

You are about to remove the EASYRSA_PKI at:
* /Users/wiscii/git/easy-rsa/easyrsa3/pki

and initialize a fresh PKI here.

Type the word 'yes' to continue, or any other input to abort.
  Confirm removal: yes

* Notice:

  init-pki complete; you may now create a CA or requests.

  Your newly created PKI dir is:
  * /Users/wiscii/git/easy-rsa/easyrsa3/pki

  IMPORTANT: Easy-RSA 'vars' file has now been moved to your PKI above.


wiscii@wiscii-MacBook-Pro easyrsa3 % ./easyrsa build-ca nopass                                 
* Notice:
Using Easy-RSA configuration from: /Users/wiscii/git/easy-rsa/easyrsa3/pki/vars

* Notice:
Using SSL: openssl LibreSSL 2.8.3

...............+++
.......................................................................................+++
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

* Notice:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/Users/wiscii/git/easy-rsa/easyrsa3/pki/ca.crt


wiscii@wiscii-MacBook-Pro easyrsa3 % ./easyrsa build-server-full s1 nopass
* Notice:
Using Easy-RSA configuration from: /Users/wiscii/git/easy-rsa/easyrsa3/pki/vars

* Notice:
Using SSL: openssl LibreSSL 2.8.3

Generating a 2048 bit RSA private key
..................................................................+++
...........+++
writing new private key to '/Users/wiscii/git/easy-rsa/easyrsa3/pki/153692f4/temp.37f39c00'
-----
* Notice:

Keypair and certificate request completed. Your files are:
req: /Users/wiscii/git/easy-rsa/easyrsa3/pki/reqs/s1.req
key: /Users/wiscii/git/easy-rsa/easyrsa3/pki/private/s1.key

Using configuration from /Users/wiscii/git/easy-rsa/easyrsa3/pki/153692f4/temp.7237aeb6
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'s1'
Certificate is to be certified until Aug 11 00:53:33 2024 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

* Notice:
Certificate created at: /Users/wiscii/git/easy-rsa/easyrsa3/pki/issued/s1.crt

@ecrist
Copy link
Member

ecrist commented May 9, 2022 via email

@TinCanTech
Copy link
Collaborator Author

Further investigation indicates that start_fix_sec is probably the problem:

easy-rsa/easyrsa3/easyrsa

Lines 1654 to 1660 in 85b35cc

if [ "$EASYRSA_FIX_OFFSET" ]; then
start_fix_sec="$(date -j "${this_year}01010000.00" +%s)"
end_fix_sec="$(( start_fix_sec + fix_days * 86400 ))"
# Convert to date-stamps for SSL input
start_fixdate="$(date -j -r "$start_fix_sec" +%Y%m%d%H%M%SZ)"
end_fixdate="$(date -j -r "$end_fix_sec" +%Y%m%d%H%M%SZ)"
fi

@ecrist
Copy link
Member

ecrist commented May 9, 2022 via email

@mandree
Copy link

mandree commented May 9, 2022

I guess this is a Darwin issue. github runner macos-latest maybe too up to date.

Manual test succeeds, with: Darwin wiscii-MacBook-Pro.local 19.6.0 Darwin Kernel Version 19.6.0: Thu Oct 29 22:56:45 PDT 2020; root:xnu-6153.141.2.2~1/RELEASE_X86_64 x86_64

wiscii@wiscii-MacBook-Pro easyrsa3 % openssl version
LibreSSL 2.8.3

I do not buy "too up to date" unless there is some irony I were missing. That version of LibreSSL is pretty stale and has diverted from OpenSSL pretty early. About the date, see https://www.libressl.org/releases.html - Dec 2018 - so why waste time with it?

Require a supported version of OpenSSL (meaning in the 1.1.1 or 3.0 tracks) and let the LibreSSL zealots deal with it. I understand why LibreSSL was forked, but essentially is has fallen so far behind it's not worth the efforts. And even OpenBSD offers ports of OpenSSL...

@ecrist
Copy link
Member

ecrist commented May 9, 2022

I do get this error when running the command manually:

ecrist@marvin:~-> date -j "202201010000.00" +%s
date: illegal time format
usage: date [-jnRu] [-r seconds|file] [-v[+|-]val[ymwdHMS]]
            [-I[date | hours | minutes | seconds]]
            [-f fmt date | [[[mm]dd]HH]MM[[cc]yy][.ss]] [+format]

But, in my testing I'm not making it that far in op-test.sh.

@mandree there are going to be people that may want to run this on their Mac and I think it's worth a little bit of effort.

@TinCanTech op-test.sh still fails after your commit.

@ecrist ecrist reopened this May 9, 2022
@mandree
Copy link

mandree commented May 9, 2022

No objection against running on Macs, but developing new code against an outdated LibreSSL version seems pretty far off.

@TinCanTech
Copy link
Collaborator Author

TinCanTech commented May 9, 2022 •
edited
Loading

@ecrist (edit) can you please try running:

LIBRESSL_LIMIT=1 sh op-test.sh -vv

@TinCanTech TinCanTech mentioned this issue May 9, 2022
Closed
ecrist added a commit that referenced this issue May 10, 2022
@ecrist
Backport patch for #559 to 3.0
8670ee4 
Backport the patch from a4e37cf to 3.0
that fixes the data arguments on Darwin and BSD.  Patch originally
authored by @TinCanTech.

Update .gitignore to ignore macOS .DS_Store files.

Update ChangeLog for v3.0.9 release

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
ecrist added a commit that referenced this issue May 10, 2022
@ecrist
Merge pull request #563 from OpenVPN/release/3.0
2f1e6ea 
Backport patch for #559 to 3.0
@TinCanTech TinCanTech added this to the v3.1.0 milestone May 10, 2022
@TinCanTech
Copy link
Collaborator Author

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ecrist ecrist

Labels
BUG
Projects
None yet
Milestone
v3.1.0
Development

No branches or pull requests
3 participants
@ecrist @mandree @TinCanTech