Background: I've spent over a year working exclusively in OpenSSL configuration files and .pragma
is the only thing I still can't figure out.
From the openssl documentation (man config
):
For compatibility with older versions of OpenSSL, an equal sign after the directive will be ignored. Older versions will treat it as an assignment, so care should be taken if the difference in semantics is important.
...
In these files, the dollar sign,$
, is used to reference a variable, as described below. On some platforms, however, it is common to treat $ as a regular character in symbol names. Supporting this behavior can be done with the following directive:.pragma [=] dollarid:value
Where value is one of the following:off
orfalse
This is the default behavior. For example,foo$bar
is interpreted as foo followed by the expansion of the variable bar.on
ortrue
This specifies that dollar signs are part of the symbol name and variable expansions must be specified using braces or parentheses. For example,foo$bar
is treated as a single seven-character name.
I created openssl-pragma.cnf
to test this:
#OPENSSL_CONF=openssl-pragma.cnf#.pragma dollarid:true # Doesn't parse ( = is necessary)#.pragma = dollarid:false # Default ($bar/${bar}/$(bar) should expand)#.pragma = dollarid:off # Same as above#.pragma = dollarid:true # Strict mode (only ${bar}/$(bar) should expand).pragma = dollarid:on # Same as abovebar = 123 # Use the doc variable name[req] distinguished_name = dn[dn] # Used DN for accessibility- the same results occur with anything \ # from .include to sections to OID to ASN1 entries description = foo$bar # Should only expand using dollarid:false or off #description = foo${bar} # Should always expand #description = foo$(bar) # Should always expand description_default = ${description} # Match description
I then build and inspect the key pair using openssl-pragma.cnf
:
#!/bin/bash#generate a self-signed key pair using openssl-pragma.cnfOPENSSL_CONF=openssl-pragma.cnf openssl req -x509 -nodes -newkey ec \ -pkeyopt ec_paramgen_curve:secp384r1 -keyout private.pem -out public.pem -batch#show only the subjectopenssl x509 -in public.pem -noout -subject -nameopt nofname
The output is always subject=foo123
, but in the example case the subject should be foo$bar
. Changing .pragma = dollarid:
to (true|on|false|off) doesn't affect anything (that I can tell). I am aware I can escape the dollar sign with \$
but that's not the point.
openssl version
; OpenSSL 1.1.1i 8 Dec 2020
lsb_release -d
; Description: Ubuntu 20.04.1 LTS
Request(s):
- provide me with a simple working example!
- determine exceptions (like
$section::bar
,$ENV::bar
,.(include|pragma) = $bar
, etc). - determine if
.pragma
only works in the default/first section..include
works everywhere. - determine whether multiple
.pragma
directives changes variable behavior after each use. (turning it on and off with declarations in between)