Skip to content

Commit 8210e3d

Browse files
ValantinValantin
committed
Drop easyrsa2 support
1 parent 437b590 commit 8210e3d

File tree

6 files changed

+11
-183
lines changed

6 files changed

+11
-183
lines changed

‎lib/facter/easyrsa.rb

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,31 @@
33
Facter.add(:easyrsa) do
44
confine kernel: 'Linux'
55
setcode do
6-
binaryv2 = ''
76
binaryv3 = ''
87
operatingsystem = Facter.value(:operatingsystem)
98
operatingsystemrelease = Facter.value(:operatingsystemrelease)
109

1110
case operatingsystem
12-
when %r{RedHat|CentOS|Amazon}
13-
binaryv2 = '/usr/share/easy-rsa/2.0/pkitool'
11+
when %r{RedHat|CentOS|Amazon|Rocky|AlmaLinux|OracleLinux}
1412
binaryv3 = '/usr/share/easy-rsa/3/easyrsa'
1513
when %r{Ubuntu|Debian}
1614
case operatingsystemrelease
1715
when %r{|11|12|18.04|20.04|22.04|24.04}
18-
binaryv2 = '/usr/share/easy-rsa/pkitool'
1916
binaryv3 = '/usr/share/easy-rsa/easyrsa'
2017
else
21-
binaryv2 = '/usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool'
2218
binaryv3 = '/usr/share/doc/openvpn/examples/easy-rsa/3.0/easyrsa'
2319
end
2420
when %r{FreeBSD}
25-
binaryv2 = '/usr/local/share/easy-rsa/pkitool'
2621
binaryv3 = '/usr/local/share/easy-rsa/easyrsa'
2722
when %r{Solaris}
2823
binaryv3 = '/opt/local/bin/easyrsa'
2924
end
3025

3126
if File.exist? binaryv3
32-
data = Facter::Core::Execution.execute("#{binaryv3} --help")
27+
data = Facter::Core::Execution.execute("#{binaryv3} help")
3328
version = '3.0' if data.gsub!(%r{Easy-RSA 3 usage}, '')
34-
elsif File.exist? binaryv2
35-
data = Facter::Core::Execution.execute("#{binaryv2} --help")
36-
version = '2.0' if data.gsub!(%r{pkitool 2.0}, '')
37-
elsif Facter::Util::Resolution.which('pkitool')
38-
data = Facter::Core::Execution.execute('pkitool --help')
39-
version = '2.0' if data.gsub!(%r{pkitool 2.0}, '')
4029
elsif Facter::Util::Resolution.which('easyrsa')
41-
data = Facter::Core::Execution.execute('easyrsa --help')
30+
data = Facter::Core::Execution.execute('easyrsa help')
4231
version = '3.0' if data.gsub!(%r{Easy-RSA 3 usage}, '')
4332
end
4433
version = nil if version.nil?

‎manifests/ca.pp

Lines changed: 2 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -87,59 +87,6 @@
8787
}
8888

8989
case $openvpn::easyrsa_version {
90-
'2.0': {
91-
if $ssl_key_algo != 'rsa' {
92-
fail('easy-rsa 2.0 supports only rsa keys.')
93-
}
94-
95-
file { "${server_directory}/${name}/easy-rsa/vars":
96-
ensure => file,
97-
mode => '0550',
98-
content => template('openvpn/vars.erb'),
99-
require => File["${server_directory}/${name}/easy-rsa"],
100-
}
101-
102-
if $openvpn::link_openssl_cnf {
103-
File["${server_directory}/${name}/easy-rsa/openssl.cnf"] {
104-
ensure => link,
105-
target => "${server_directory}/${name}/easy-rsa/openssl-1.0.0.cnf",
106-
before => Exec["initca ${name}"],
107-
}
108-
}
109-
110-
exec { "generate dh param ${name}":
111-
command => '. ./vars && ./clean-all && ./build-dh',
112-
timeout => 20000,
113-
cwd => "${server_directory}/${name}/easy-rsa",
114-
creates => "${server_directory}/${name}/easy-rsa/keys/dh${ssl_key_size}.pem",
115-
provider => 'shell',
116-
require => File["${server_directory}/${name}/easy-rsa/vars"],
117-
}
118-
119-
exec { "initca ${name}":
120-
command => '. ./vars && ./pkitool --initca',
121-
cwd => "${server_directory}/${name}/easy-rsa",
122-
creates => "${server_directory}/${name}/easy-rsa/keys/ca.key",
123-
provider => 'shell',
124-
require => Exec["generate dh param ${name}"],
125-
}
126-
127-
exec { "generate server cert ${name}":
128-
command => ". ./vars && ./pkitool --server ${common_name}",
129-
cwd => "${server_directory}/${name}/easy-rsa",
130-
creates => "${server_directory}/${name}/easy-rsa/keys/${common_name}.key",
131-
provider => 'shell',
132-
require => Exec["initca ${name}"],
133-
}
134-
135-
exec { "create crl.pem on ${name}":
136-
command => ". ./vars && KEY_CN='' KEY_OU='' KEY_NAME='' KEY_ALTNAMES='' openssl ca -gencrl -out ${server_directory}/${name}/crl.pem -config ${server_directory}/${name}/easy-rsa/openssl.cnf",
137-
cwd => "${server_directory}/${name}/easy-rsa",
138-
creates => "${server_directory}/${name}/crl.pem",
139-
provider => 'shell',
140-
require => Exec["generate server cert ${name}"],
141-
}
142-
}
14390
'3.0': {
14491
file { "${server_directory}/${name}/easy-rsa/vars":
14592
ensure => file,
@@ -171,7 +118,7 @@
171118
if $openvpn::link_openssl_cnf {
172119
File["${server_directory}/${name}/easy-rsa/openssl.cnf"] {
173120
ensure => link,
174-
target => "${server_directory}/${name}/easy-rsa/openssl-1.0.cnf",
121+
target => "${server_directory}/${name}/easy-rsa/openssl-easyrsa.cnf",
175122
before => Exec["initca ${name}"],
176123
}
177124
}
@@ -228,7 +175,7 @@
228175
}
229176
}
230177
default: {
231-
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0.")
178+
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0.")
232179
}
233180
}
234181

‎manifests/client.pp

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,11 @@
9999
if $expire {
100100
if is_integer($expire) {
101101
case $openvpn::easyrsa_version {
102-
'2.0': {
103-
$env_expire = "KEY_EXPIRE=${expire}"
104-
}
105102
'3.0': {
106103
$env_expire = "EASYRSA_CERT_EXPIRE=${expire} EASYRSA_NO_VARS=1"
107104
}
108105
default: {
109-
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0.")
106+
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0.")
110107
}
111108
}
112109
} else {
@@ -117,26 +114,6 @@
117114
}
118115

119116
case $openvpn::easyrsa_version {
120-
'2.0': {
121-
exec { "generate certificate for ${name} in context of ${ca_name}":
122-
command => ". ./vars && ${env_expire} ./pkitool ${name}",
123-
cwd => "${server_directory}/${ca_name}/easy-rsa",
124-
creates => "${server_directory}/${ca_name}/easy-rsa/keys/${name}.crt",
125-
provider => 'shell';
126-
}
127-
128-
file { "${server_directory}/${server}/download-configs/${name}/keys/${name}/${name}.crt":
129-
ensure => link,
130-
target => "${server_directory}/${ca_name}/easy-rsa/keys/${name}.crt",
131-
require => Exec["generate certificate for ${name} in context of ${ca_name}"],
132-
}
133-
134-
file { "${server_directory}/${server}/download-configs/${name}/keys/${name}/${name}.key":
135-
ensure => link,
136-
target => "${server_directory}/${ca_name}/easy-rsa/keys/${name}.key",
137-
require => Exec["generate certificate for ${name} in context of ${ca_name}"],
138-
}
139-
}
140117
'3.0': {
141118
exec { "generate certificate for ${name} in context of ${ca_name}":
142119
command => ". ./vars && ${env_expire} ./easyrsa --batch build-client-full ${name} nopass",
@@ -158,7 +135,7 @@
158135
}
159136
}
160137
default: {
161-
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0.")
138+
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0.")
162139
}
163140
}
164141

‎manifests/revoke.pp

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,13 @@
2525
$server_directory = $openvpn::server_directory
2626

2727
$revocation_command = $openvpn::easyrsa_version ? {
28-
'2.0' => ". ./vars && ./revoke-full ${name}; echo \"exit $?\" | grep -qE '(error 23|exit (0|2))'",
2928
'3.0' => ". ./vars && ./easyrsa --batch revoke ${name}; echo \"exit $?\" | grep -qE '(error 23|exit (0|2))'",
29+
default => fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0."),
3030
}
3131

3232
$renew_command = $openvpn::easyrsa_version ? {
33-
'2.0' => ". ./vars && KEY_CN='' KEY_OU='' KEY_NAME='' KEY_ALTNAMES='' openssl ca -gencrl -out ${server_directory}/${server}/crl.pem -config ${server_directory}/${server}/easy-rsa/openssl.cnf",
3433
'3.0' => './easyrsa gen-crl',
35-
default => fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0."),
34+
default => fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0."),
3635
}
3736

3837
file { "${server_directory}/${server}/easy-rsa/revoked/${name}":

‎templates/server.erb

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,19 +30,12 @@ dh <%= @extca_dh_file %>
3030
crl-verify <%= @extca_ca_crl_file %>
3131
<% end -%>
3232
<% else -%>
33-
<%- if @_easyrsa_version == '2.0' -%>
34-
ca <%= @server_directory %>/<%= @ca_name %>/keys/ca.crt
35-
cert <%= @server_directory %>/<%= @ca_name %>/keys/<%= @ca_common_name %>.crt
36-
key <%= @server_directory %>/<%= @ca_name %>/keys/<%= @ca_common_name %>.key
37-
<%- else -%>
33+
3834
ca <%= @server_directory %>/<%= @ca_name %>/keys/ca.crt
3935
cert <%= @server_directory %>/<%= @ca_name %>/keys/issued/<%= @ca_common_name %>.crt
4036
key <%= @server_directory %>/<%= @ca_name %>/keys/private/<%= @ca_common_name %>.key
41-
<%- end -%>
4237
<% unless @remote -%>
43-
<%- if @_easyrsa_version == '2.0' -%>
44-
dh <%= @server_directory %>/<%= @ca_name %>/keys/dh<%= @ssl_key_size %>.pem
45-
<%- elsif @ssl_key_algo == 'rsa' -%>
38+
<%- if @ssl_key_algo == 'rsa' -%>
4639
dh <%= @server_directory %>/<%= @ca_name %>/keys/dh.pem
4740
<%- else -%>
4841
dh none

‎templates/vars.erb

Lines changed: 0 additions & 77 deletions
This file was deleted.

0 commit comments

Comments
 (0)