install/openvpn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

get_all_keys.sh: add support for new easyrsa layout.

Browse Source
This commit is contained in:
Christoph 2019-07-16 16:49:54 +02:00
parent c8663d51f9
commit 08016ed7b2
2 changed files with 64 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
.get_all_keys.sh.swo Normal file
View File

Binary file not shown.

77
get_all_keys.sh
View File

@ -11,9 +11,16 @@ clean_up() {
# Perform program exit housekeeping
rm -f "$log_file"
blank_line
exit $1
}
blank_line() {
if $terminal ; then
echo ""
fi
}
trim() {
local var="$*"
var="${var#"${var%%[![:space:]]*}"}" # remove leading whitespace characters
@ -98,7 +105,6 @@ containsElement () {
# -------------
# --- Check some prerequisites
# -------------
@ -131,8 +137,6 @@ if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
fi
echo ""
declare -i i=0
if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
@ -162,6 +166,7 @@ if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
else
conf_file=${conf_file_arr[0]}
service_name="${conf_name_arr[0]}"
fi
echo ""
@ -181,18 +186,47 @@ else
fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
fi
fi
[[ -n "$KEY_DIR" ]] || KEY_DIR="${OPENVPN_BASE_DIR}/keys"
[[ -n "$CRL_PEM" ]] || CRL_PEM="${KEY_DIR}/crl.pem"
if [[ ! -d "$KEY_DIR" ]] ; then
fatal "Key directory '$KEY_DIR' not found. (See var 'KEY_DIR')"
if [[ -d "${OPENVPN_BASE_DIR}/pki" ]] ; then
EASYRSA_LAYOUT_NEW=true
else
EASYRSA_LAYOUT_NEW=false
fi
if [[ -z "$OPENVPN_KEY_DIR" ]] ; then
if $EASYRSA_LAYOUT_NEW ; then
OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/pki"
else
OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/keys"
fi
fi
if $EASYRSA_LAYOUT_NEW ; then
OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}/revoked/certs_by_serial"
OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}/certs_by_serial"
RV_CERT_EXT="crt"
else
OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}"
OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}"
RV_CERT_EXT="pem"
fi
[[ -n "$CRL_PEM" ]] || CRL_PEM="${OPENVPN_KEY_DIR}/crl.pem"
if [[ ! -d "$OPENVPN_KEY_DIR" ]] ; then
fatal "Key directory '$OPENVPN_KEY_DIR' not found. (See var 'OPENVPN_KEY_DIR')"
fi
if [[ ! -f "$CRL_PEM" ]] ; then
fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
fi
declare -a revoked_arr
declare -a revoked_serial_arr
declare -a revoked_cn_arr
declare -a all_arr
declare -a all_cn_arr
declare -a active_arr
while read -r _serial ; do
revoked_serial_arr+=("$_serial")
@ -203,17 +237,20 @@ fi
if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
for _serial in ${revoked_serial_arr[@]} ; do
_cn="$(openssl x509 -noout -text -in ${KEY_DIR}/${_serial}.pem 2> $log_file \
_cn="$(openssl x509 -noout -text -in ${OPENVPN_REVOKED_KEY_DIR}/${_serial}.${RV_CERT_EXT} 2> $log_file \
| grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
if [[ -s "$log_file" ]]; then
error "$(cat "$log_file")"
else
revoked_arr+=("$_serial:$(trim $_cn)")
revoked_cn_arr+=("$(trim $_cn)")
if $EASYRSA_LAYOUT_NEW ; then
all_arr+=("$_serial:$(trim $_cn)")
fi
fi
done
else
info "No revoked keys in \033[1m${KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
info "No revoked keys in \033[1m${OPENVPN_REVOKED_KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
fi
while IFS= read -r -d '' _cert ; do
@ -222,19 +259,22 @@ while IFS= read -r -d '' _cert ; do
_serial="${_serial%.*}"
_cn="$(openssl x509 -noout -text -in $_cert | grep Subject: | grep -oE "CN\s*=\s*[^,]+" | awk '{print$3}')"
if ! containsElement "$_cn" "${all_cn_arr[@]}" ; then
all_arr+=("${_serial}:$(trim $_cn)")
all_cn_arr+=("$(trim $_cn)")
fi
if ! containsElement "$_cn" "${revoked_cn_arr[@]}" ; then
active_arr+=("${_serial}:$(trim $_cn)")
fi
done < <(find ${KEY_DIR} -name "??\.pem" -print0 | sort -z )
echo
done < <(find ${OPENVPN_CERT_DIR_SERIAL} -name "*\.pem" -print0 | sort -z )
if [[ ${#all_arr[@]} -gt 0 ]]; then
echo ""
if $terminal ; then
echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
else
echo "All created Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
echo "All created Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
fi
echo ""
for _val in ${all_arr[@]} ; do
@ -251,9 +291,9 @@ echo
if [[ ${#revoked_arr[@]} -gt 0 ]]; then
echo ""
if $terminal ; then
echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
else
echo "Revoked Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
echo "Revoked Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
fi
echo ""
for _val in ${revoked_arr[@]} ; do
@ -270,9 +310,9 @@ echo
if [[ ${#active_arr[@]} -gt 0 ]]; then
echo ""
if $terminal ; then
echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
else
echo "Active Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
echo "Active Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
fi
echo ""
for _val in ${active_arr[@]} ; do
@ -285,6 +325,5 @@ if [[ ${#active_arr[@]} -gt 0 ]]; then
done
fi
echo
exit
clean_up 0