get_all_keys.sh: add support for new easyrsa layout.

get_all_keys.sh

@@ -11,9 +11,16 @@ clean_up() {
 
    # Perform program exit housekeeping
    rm -f "$log_file"
+   blank_line
    exit $1
 }
 
+blank_line() {
+   if $terminal ; then
+      echo ""
+   fi
+}
+
 trim() {
     local var="$*"
     var="${var#"${var%%[![:space:]]*}"}"   # remove leading whitespace characters
@@ -98,7 +105,6 @@ containsElement () {
 
 
 
-
 # -------------
 # --- Check some prerequisites
 # -------------
@@ -131,8 +137,6 @@ if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
 fi
 
 
-echo ""
-
 declare -i i=0
 
 if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
@@ -162,6 +166,7 @@ if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
 
 else
    conf_file=${conf_file_arr[0]}
+   service_name="${conf_name_arr[0]}"
 fi
 
 echo ""
@@ -181,18 +186,47 @@ else
       fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
    fi
 fi
-[[ -n "$KEY_DIR" ]] || KEY_DIR="${OPENVPN_BASE_DIR}/keys"
-[[ -n "$CRL_PEM" ]] || CRL_PEM="${KEY_DIR}/crl.pem"
 
-if [[ ! -d "$KEY_DIR" ]] ; then
+if [[ -d "${OPENVPN_BASE_DIR}/pki" ]] ; then
-   fatal "Key directory '$KEY_DIR' not found. (See var 'KEY_DIR')"
+   EASYRSA_LAYOUT_NEW=true
+else
+   EASYRSA_LAYOUT_NEW=false
+fi
+
+
+if [[ -z "$OPENVPN_KEY_DIR" ]] ; then
+   if $EASYRSA_LAYOUT_NEW ; then
+      OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/pki"
+   else
+      OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/keys"
+   fi
+fi
+
+if $EASYRSA_LAYOUT_NEW ; then
+   OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}/revoked/certs_by_serial"
+   OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}/certs_by_serial"
+   RV_CERT_EXT="crt"
+else
+   OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}"
+   OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}"
+   RV_CERT_EXT="pem"
+fi
+
+[[ -n "$CRL_PEM" ]] || CRL_PEM="${OPENVPN_KEY_DIR}/crl.pem"
+
+if [[ ! -d "$OPENVPN_KEY_DIR" ]] ; then
+   fatal "Key directory '$OPENVPN_KEY_DIR' not found. (See var 'OPENVPN_KEY_DIR')"
 fi
 if [[ ! -f "$CRL_PEM" ]] ; then
    fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
 fi
 
+declare -a revoked_arr
 declare -a revoked_serial_arr
 declare -a revoked_cn_arr
+declare -a all_arr
+declare -a all_cn_arr
+declare -a active_arr
 
 while read -r _serial ; do
    revoked_serial_arr+=("$_serial")
@@ -203,38 +237,44 @@ fi
 
 if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
    for _serial in ${revoked_serial_arr[@]} ; do
-      _cn="$(openssl x509  -noout -text -in ${KEY_DIR}/${_serial}.pem 2> $log_file \
+      _cn="$(openssl x509  -noout -text -in ${OPENVPN_REVOKED_KEY_DIR}/${_serial}.${RV_CERT_EXT} 2> $log_file \
          | grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
       if [[ -s "$log_file" ]]; then
          error "$(cat "$log_file")"
       else
          revoked_arr+=("$_serial:$(trim $_cn)")
          revoked_cn_arr+=("$(trim $_cn)")
+         if $EASYRSA_LAYOUT_NEW ; then
+            all_arr+=("$_serial:$(trim $_cn)")
+         fi
       fi
    done
 else
-   info "No revoked keys in \033[1m${KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
+   info "No revoked keys in \033[1m${OPENVPN_REVOKED_KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
 fi
 
 while IFS= read -r -d '' _cert ; do
 
-	_serial="$(basename "$_cert")"
+   _serial="$(basename "$_cert")"
-	_serial="${_serial%.*}"
+   _serial="${_serial%.*}"
 
    _cn="$(openssl x509  -noout -text -in $_cert | grep Subject: | grep -oE "CN\s*=\s*[^,]+" | awk '{print$3}')"
-	all_arr+=("${_serial}:$(trim $_cn)")
+   if ! containsElement "$_cn" "${all_cn_arr[@]}" ; then
-	if ! containsElement "$_cn" "${revoked_cn_arr[@]}" ; then
+      all_arr+=("${_serial}:$(trim $_cn)")
-		active_arr+=("${_serial}:$(trim $_cn)")
+      all_cn_arr+=("$(trim $_cn)")
-	fi
+   fi
-done < <(find ${KEY_DIR}  -name "??\.pem" -print0 | sort -z )
+   if ! containsElement "$_cn" "${revoked_cn_arr[@]}" ; then
+      active_arr+=("${_serial}:$(trim $_cn)")
+   fi
+   
+done < <(find ${OPENVPN_CERT_DIR_SERIAL}  -name "*\.pem" -print0 | sort -z )
 
-echo
 if [[ ${#all_arr[@]} -gt 0 ]]; then
    echo ""
    if $terminal ; then
-      echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+      echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
    else
-      echo "All created Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+      echo "All created Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
    fi
    echo ""
    for _val in ${all_arr[@]} ; do
@@ -251,9 +291,9 @@ echo
 if [[ ${#revoked_arr[@]} -gt 0 ]]; then
    echo ""
    if $terminal ; then
-      echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+      echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
    else
-      echo "Revoked Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+      echo "Revoked Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
    fi
    echo ""
    for _val in ${revoked_arr[@]} ; do
@@ -270,9 +310,9 @@ echo
 if [[ ${#active_arr[@]} -gt 0 ]]; then
    echo ""
    if $terminal ; then
-      echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+      echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
    else
-      echo "Active Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+      echo "Active Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
    fi
    echo ""
    for _val in ${active_arr[@]} ; do
@@ -285,6 +325,5 @@ if [[ ${#active_arr[@]} -gt 0 ]]; then
    done
 fi
 
-echo
+clean_up 0
-exit