Introduce write_legacy_file_v2()

write_legacy_file_v2() takes explicit control of output redirection.
This means that all required checks are completed before redirecting
output to a file.

Input syntax:
* write_legacy_file_v2 "$type" [ "$file_name" ] [ 'overwite' ]

"$type" is required.

"$file_name" is optional.
When "$file_name" is not specified then output is sent to stdout.

'overwite' is optional.
When 'overwite' is not specified then an existing file is preserved.
When "$file_name" is a temp-file, in the session directory, then
'overwite' is enabled by default.

Signed-off-by: Richard T Bonhomme <[email protected]>

easyrsa3/easyrsa

@@ -1427,8 +1427,8 @@ and initialize a fresh PKI here."
 		easyrsa_mkdir "${EASYRSA_PKI}/$i"
 	done
 
-	# pki/vars.example
-	write_legacy_file vars "$EASYRSA_PKI" || \
+	# write pki/vars.example - no temp-file because no session
+	write_legacy_file_v2 vars "$EASYRSA_PKI"/vars.example || \
 		die "init-pki - write vars"
 
 	# User notice
@@ -1650,6 +1650,7 @@ Unable to create necessary PKI files (permissions?)"
 
 	# Check for insert-marker in ssl config file
 	if [ "$EASYRSA_EXTRA_EXTS" ]; then
+		#[ -f "$EASYRSA_SSL_CONF" ] || die "Missing SSL config"
 		if ! grep -q '^#%CA_X509_TYPES_EXTRA_EXTS%' \
 			"$EASYRSA_SSL_CONF"
 		then
@@ -4064,7 +4065,7 @@ Edwards Curve '$EASYRSA_CURVE' not found."
 Unknown algorithm '$EASYRSA_ALGO': Must be 'rsa', 'ec' or 'ed'"
 	esac
 	verbose "\
-verify_algo_params: Params verified for algo '$EASYRSA_ALGO'"
+verify_algo_params: Params verified for algo '$EASYRSA_ALGO' OK"
 } # => verify_algo_params()
 
 # Check for conflicting input options
@@ -4467,7 +4468,7 @@ write_global_safe_ssl_cnf_tmp() {
 	easyrsa_mktemp global_safe_ssl_cnf_tmp || die "\
 verify_working_env - easyrsa_mktemp global_safe_ssl_cnf_tmp"
 
-	write_legacy_file safe-cnf > "$global_safe_ssl_cnf_tmp" || \
+	write_legacy_file_v2 safe-cnf "$global_safe_ssl_cnf_tmp" || \
 		die "verify_working_env - write safe-cnf"
 
 	export OPENSSL_CONF="$global_safe_ssl_cnf_tmp"
@@ -4574,7 +4575,7 @@ f97425686fa1976d436fa31f550641aa"
 write_easyrsa_ssl_cnf_tmp - easyrsa_mktemp"
 
 	# Write SSL cnf to temp-file
-	write_legacy_file "$ssl_cnf_type" > "$ssl_cnf_tmp" || die "\
+	write_legacy_file_v2 "$ssl_cnf_type" "$ssl_cnf_tmp" || die "\
 write_easyrsa_ssl_cnf_tmp - write $ssl_cnf_type: $ssl_cnf_tmp"
 
 	# export SSL cnf tmp
@@ -4603,7 +4604,7 @@ write_x509_type_tmp() {
 	easyrsa_mktemp write_x509_file_tmp || \
 		die "write_x509_type_tmp - easyrsa_mktemp"
 
-	write_legacy_file "$1" > "$write_x509_file_tmp" || \
+	write_legacy_file_v2 "$1" "$write_x509_file_tmp" || \
 		die "write_x509_type_tmp - write $1"
 
 	verbose ": write_x509_type_tmp: $1 COMPLETE"
@@ -4616,9 +4617,61 @@ write_x509_type_tmp() {
 # Directories are user configurable, File names are fixed
 
 # Write ALL legacy files to $1 or default
-legacy_files() {
-	require_pki=1
-	verify_working_env
+all_legacy_files_v2() {
+	# Confirm over write
+	if [ "$legacy_file_over_write" ]; then
+		confirm "${NL}  Confirm OVER-WRITE files ? " yes "
+Warning:
+'legacy-hard' will OVER-WRITE all legacy files to default settings.
+
+Legacy files:
+* File: ${EASYRSA_PKI}/openssl-easyrsa.cnf
+* File: ${EASYRSA_PKI}/vars.example
+* Dir:  ${EASYRSA_PKI}/x509-types/*"
+
+		verbose "all_legacy_files_v2 - over-write ENABLED"
+	fi
+
+	# Output directories
+	legacy_out_d="$EASYRSA_PKI"
+		easyrsa_mkdir "$EASYRSA_PKI"
+	x509_types_d="${legacy_out_d}"/x509-types
+		easyrsa_mkdir "$x509_types_d"
+
+	# Create x509-types
+	for legacy_type in COMMON ca server serverClient client \
+		email codeSigning kdc
+	do
+		legacy_target="${x509_types_d}/${legacy_type}"
+		write_legacy_file_v2 "$legacy_type" "$legacy_target" \
+			"$legacy_file_over_write"
+	done
+
+	# vars.example
+	legacy_type=vars
+	legacy_target="${legacy_out_d}"/vars.example
+	write_legacy_file_v2 "$legacy_type" "$legacy_target" \
+		"$legacy_file_over_write"
+
+	# openssl-easyrsa.cnf
+	legacy_type=ssl-cnf
+	legacy_target="${legacy_out_d}"/openssl-easyrsa.cnf
+	write_legacy_file_v2 "$legacy_type" "$legacy_target" \
+		"$legacy_file_over_write"
+
+	# User notice
+	if [ "$legacy_file_over_write" ]; then
+		notice "legacy-hard has updated all files."
+	else
+		notice "legacy has updated missing files."
+	fi
+} # => legacy_files_v2()
+
+# Write ALL legacy files to $1 or default
+all_legacy_files() {
+
+	die "Disbaled: all_legacy_files (v1)"
+
 
 	if [ "$legacy_file_over_write" ]; then
 		confirm "${NL}  Confirm OVER-WRITE files ? " yes "
@@ -4652,8 +4705,84 @@ Legacy files: openssl-easyrsa.cnf and x509-types/ directory."
 	unset -v legacy_out_d x509_d
 } # => legacy_files()
 
+# write legacy files to stdout or to $folder
+write_legacy_file_v2() {
+	# recursion check
+	write_recursion="$(( write_recursion + 1 ))"
+	if [ "$write_recursion" -gt 1 ]; then
+		print "write recursion" > "$easyrsa_err_log"
+		die "write recursion"
+	fi
+
+	write_type="$1"
+	write_file="$2"
+	write_over=
+	[ "$3" = overwrite ] && write_over="$3"
+
+	# Select by type
+	case "$write_type" in
+	ssl-cnf|safe-cnf)
+		# Set expansion style
+		case "$write_type" in
+			ssl-cnf) set_openssl_easyrsa_cnf_vars unexpanded ;;
+			safe-cnf) set_openssl_easyrsa_cnf_vars expanded ;;
+		esac
+		;;
+	vars)
+		;;
+	# This correctly renames 'code-signing' to 'codeSigning'
+	COMMON|ca|server|serverClient|client|codeSigning|email|kdc)
+		;;
+	selfsign)
+		;;
+	*)
+		user_error "write - unknown type '$write_type'"
+	esac
+
+	# If given then $write_file is required to exist
+	# and be a temp-file ONLY
+	if [ "$write_file" ]; then
+		# Verify write_file is a temp-file
+		if [ -f "$write_file" ]; then
+			# is this a temp file ?
+			path="${write_file%%/temp.*}"
+			if [ "${secured_session}" = "$path" ]; then
+				verbose ": write_legacy_file_v2 - temp-file ACCEPTED"
+				write_over=overwrite
+				verbose ": write_legacy_file_v2 - over-write ENABLED"
+			else
+				verbose ": Target is not a temp-file: $write_file"
+			fi
+		else
+			# enable overwrite, "there is no file" to over write
+			verbose ": Missing input file: $write_file"
+			write_over=overwrite
+			verbose ": write_legacy_file_v2 - over-write ENABLED"
+		fi
+	fi
+
+	# write legacy data stream to stdout or temp-file
+	if [ "$write_file" ]; then
+		if [ "$write_over" ]; then
+			create_legacy_stream "$write_type" >"$write_file" || \
+				die "write failed"
+		else
+			verbose ": Over-write refused for existing file!"
+		fi
+	else
+		# write stream to stdout ONLY
+		create_legacy_stream "$write_type"
+	fi
+
+	write_recursion="$(( write_recursion - 1 ))"
+} # => write_legacy_file_v2()
+
 # write legacy files to stdout or to $folder
 write_legacy_file() {
+
+	die "Disabled: write_legacy_file (v1)"
+
+
 	# recursion check
 	write_recursion="$(( write_recursion + 1 ))"
 	if [ "$write_recursion" -gt 2 ]; then
@@ -5484,8 +5613,8 @@ case "$cmd" in
 		;;
 	write)
 		# write is not compatible with diagnostics
-		unset -v EASYRSA_VERBOSE
-		EASYRSA_SILENT=1
+		#unset -v EASYRSA_VERBOSE
+		#EASYRSA_SILENT=1
 		;;
 	init-pki|clean-all)
 		: # ok
@@ -5503,6 +5632,9 @@ case "$cmd" in
 			self-sign-*)
 				: # ok
 				;;
+			write-v2)
+				: # ok
+				;;
 			*)
 				require_ca=1
 		esac
@@ -5740,7 +5872,32 @@ EasyRSA Tools version is out of date:
 		verify_cert "$@" || \
 			easyrsa_exit_with_error=1
 		;;
+	write-v2)
+		verify_working_env
+
+		# Write legacy files to write_dir
+		# or EASYRSA_PKI or EASYRSA
+		case "$1" in
+		legacy)
+			# over-write NO
+			shift
+			all_legacy_files_v2 "$@"
+			;;
+		legacy-hard)
+			# over-write YES
+			shift
+			legacy_file_over_write=overwrite
+			all_legacy_files_v2 "$@"
+			;;
+		*)
+			write_legacy_file_v2 "$@"
+		esac
+		;;
 	write)
+
+		die "Disabled: Command write (v1)"
+
+
 		verify_working_env
 		# Write legacy files to write_dir
 		# or EASYRSA_PKI or EASYRSA