Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix PKCS#12 mobileconfig installation errors when using openssl version > 3 (trailofbits#14558) #14622

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fix PKCS#12 mobileconfig installation errors when using openssl version > 3 (trailofbits#14558) #14622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4bb12c4
Fix PKCS#12 file creation (#14558)
omgagg Feb 5, 2023
8fb897d
Fix reference to config dir of installed server
omgagg Feb 5, 2023
5394f06
Fixed issue with getting openssl version from existing fact, get it w…
ExtremeModerate Jul 4, 2023
4321212
Consistent with other shell executions, fix to use {{openssl_bin}} an…
ExtremeModerate Jul 4, 2023
4ecec2d
Merged in trailofbits/master (trailofbits#14558)
ExtremeModerate Jul 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions roles/strongswan/tasks/openssl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,10 +155,27 @@
format: OpenSSH
with_items: "{{ users }}"

- name: Gather the package facts
ansible.builtin.package_facts:
manager: auto

- name: Get OpenSSL version
shell: |
set -o pipefail
Copy link

@rafaelsms rafaelsms Jan 1, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When running cloud-init (Ubuntu 22.04 LTS x64 on Vultr), I got an error because set -o pipefail fails on /bin/sh

Fixed by specifying which shell to run:

  # (...)
  shell: |
        set -o pipefail
        {{ openssl_bin }} version |
        cut -f 2 -d ' '
  args:
    executable: bash
  # (...)

With this change, everything is working for me :)
Thanks everyone (for fixing this issue and keeping this very nice project). Happy new year for all!

{{ openssl_bin }} version |
cut -f 2 -d ' '
register: ssl_version
run_once: true

- name: Set OpenSSL version fact
set_fact:
openssl_version: "{{ ssl_version.stdout }}"

- name: Build the client's p12
shell: >
umask 077;
{{ openssl_bin }} pkcs12
{{ (openssl_version is version('3', '>=')) | ternary('-legacy', '') }}
-in certs/{{ item }}.crt
-inkey private/{{ item }}.key
-export
Expand All @@ -175,6 +192,7 @@
shell: >
umask 077;
{{ openssl_bin }} pkcs12
{{ (openssl_version is version('3', '>=')) | ternary('-legacy', '') }}
-in certs/{{ item }}.crt
-inkey private/{{ item }}.key
-export
Expand Down
2 changes: 1 addition & 1 deletion users.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
server_list: >-
[{% for i in _configs_list.files %}
{% set config = lookup('file', i.path)|from_yaml %}
'{{ config.server }}'
'{{ config.IP_subject_alt_name }}'
{{ ',' if not loop.last else '' }}
{% endfor %}]

Expand Down