Quantcast
Channel: Active questions tagged config - Stack Overflow
Viewing all articles
Browse latest Browse all 5049

What does the .pragma directive do in openssl.cnf?

$
0
0

Background: I've spent over a year working exclusively in OpenSSL configuration files and .pragma is the only thing I still can't figure out.

From the openssl documentation (man config):

For compatibility with older versions of OpenSSL, an equal sign after the directive will be ignored. Older versions will treat it as an assignment, so care should be taken if the difference in semantics is important.
...
In these files, the dollar sign, $, is used to reference a variable, as described below. On some platforms, however, it is common to treat $ as a regular character in symbol names. Supporting this behavior can be done with the following directive:
.pragma [=] dollarid:value
Where value is one of the following:
off or false
This is the default behavior. For example, foo$bar is interpreted as foo followed by the expansion of the variable bar.
on or true
This specifies that dollar signs are part of the symbol name and variable expansions must be specified using braces or parentheses. For example, foo$bar is treated as a single seven-character name.

I created openssl-pragma.cnf to test this:

#OPENSSL_CONF=openssl-pragma.cnf#.pragma dollarid:true    # Doesn't parse ( = is necessary)#.pragma = dollarid:false # Default ($bar/${bar}/$(bar) should expand)#.pragma = dollarid:off   # Same as above#.pragma = dollarid:true  # Strict mode (only ${bar}/$(bar) should expand).pragma = dollarid:on    # Same as abovebar = 123 # Use the doc variable name[req]  distinguished_name  = dn[dn]  # Used DN for accessibility- the same results occur with anything \  #  from .include to sections to OID to ASN1 entries  description         = foo$bar # Should only expand using dollarid:false or off  #description         = foo${bar} # Should always expand  #description         = foo$(bar) # Should always expand  description_default = ${description} # Match description

I then build and inspect the key pair using openssl-pragma.cnf:

#!/bin/bash#generate a self-signed key pair using openssl-pragma.cnfOPENSSL_CONF=openssl-pragma.cnf openssl req -x509 -nodes -newkey ec \ -pkeyopt ec_paramgen_curve:secp384r1 -keyout private.pem -out public.pem -batch#show only the subjectopenssl x509 -in public.pem -noout -subject -nameopt nofname

The output is always subject=foo123, but in the example case the subject should be foo$bar. Changing .pragma = dollarid: to (true|on|false|off) doesn't affect anything (that I can tell). I am aware I can escape the dollar sign with \$ but that's not the point.

openssl version; OpenSSL 1.1.1i 8 Dec 2020
lsb_release -d; Description: Ubuntu 20.04.1 LTS

Request(s):

  • provide me with a simple working example!
  • determine exceptions (like $section::bar, $ENV::bar, .(include|pragma) = $bar, etc).
  • determine if .pragma only works in the default/first section. .include works everywhere.
  • determine whether multiple .pragma directives changes variable behavior after each use. (turning it on and off with declarations in between)

Viewing all articles
Browse latest Browse all 5049

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>