From 8f2df2215b864c298df2dd1816e9538d16e0d2de Mon Sep 17 00:00:00 2001
From: chris <ckubu@oopen.de>
Date: Wed, 30 May 2018 02:58:54 +0200
Subject: [PATCH] Add script 'get_all_keys.sh'.

---
 get_all_keys.sh | 290 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 290 insertions(+)
 create mode 100755 get_all_keys.sh

diff --git a/get_all_keys.sh b/get_all_keys.sh
new file mode 100755
index 0000000..5edfffb
--- /dev/null
+++ b/get_all_keys.sh
@@ -0,0 +1,290 @@
+#!/usr/bin/env bash
+
+working_dir="$(dirname $(realpath $0))"
+
+log_file=$(mktemp)
+
+# -------------
+# --- Some functions
+# -------------
+clean_up() {
+
+   # Perform program exit housekeeping
+   rm -f "$log_file"
+   exit $1
+}
+
+trim() {
+    local var="$*"
+    var="${var#"${var%%[![:space:]]*}"}"   # remove leading whitespace characters
+    var="${var%"${var##*[![:space:]]}"}"   # remove trailing whitespace characters
+    echo -n "$var"
+}
+
+    
+is_number() {
+
+   return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
+   
+   # - also possible
+   # -
+   #[[ ! -z "${1##*[!0-9]*}" ]] && return 0 || return 1
+   #return $([[ ! -z "${1##*[!0-9]*}" ]])
+}  
+   
+is_int() {
+   return $(test "$@" -eq "$@" > /dev/null 2>&1);
+}
+
+echononl(){ 
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+
+fatal(){
+   echo ""
+   if $terminal ; then
+      echo -e "[ \033[31m\033[1mError\033[m ]: $*"
+      echo ""
+      echo -e "   \033[31m\033[1mScript was interupted\033[m!"
+   else
+      echo "   [ Fatal ]: $*"
+      echo ""
+      echo "              Script was terminated...."
+   fi
+   echo ""
+   clean_up 1
+}
+
+error (){
+   echo ""
+   if $terminal ; then
+      echo -e "   [ \033[31m\033[1mError\033[m ]: $*"
+   else
+      echo "[ Error ]: $*"
+   fi
+   echo ""
+}
+
+warn (){
+   echo ""
+   if $terminal ; then
+      echo -e "   [ \033[33m\033[1mWarning\033[m ]: $*"
+   else
+      echo "[ Warning ]: $*"
+   fi
+   echo ""
+}
+
+info (){
+   if $terminal ; then
+      echo ""
+      echo -e "   [ \033[32m\033[1mInfo\033[m ]: $*"
+      echo ""
+   fi
+}
+
+## -
+containsElement () {
+   local e
+   for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
+   return 1
+}
+
+
+
+
+# -------------
+# --- Check some prerequisites
+# -------------
+
+# - Running in a terminal?
+# -
+if [[ -t 1 ]] ; then
+   terminal=true
+else
+   terminal=false
+fi
+
+
+# -------------
+# --- Read Configurations from $conf_file
+# -------------
+
+declare -a conf_file_arr=()
+declare -a conf_name_arr=()
+for _conf_file in `ls ${working_dir}/conf/server-*.conf 2>/dev/null` ; do
+   conf_file_arr+=("${_conf_file}")
+   _basename=$(basename $_conf_file)
+   _tmp_name=${_basename%%.*}
+   _tmp_name=${_tmp_name#*-}
+   conf_name_arr+=("$_tmp_name")
+done
+
+if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
+   fatal "NO Configuration found!"
+fi
+
+
+echo ""
+
+declare -i i=0
+
+if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
+   echo ""
+   echo "Which Configuration should be loaded?"
+   echo ""
+   for _conf_file in ${conf_file_arr[@]} ; do
+      echo " [${i}] ${conf_name_arr[${i}]}"
+      (( i++ ))
+   done
+   _OK=false
+   echo
+   echononl "Eingabe: "
+   while ! $_OK ; do
+      read _IN
+      if is_number "$_IN" && [[ -n ${conf_file_arr[$_IN]} ]]; then
+         conf_file=${conf_file_arr[$_IN]}
+         service_name="${conf_name_arr[$_IN]}"
+         _OK=true
+      else
+         echo ""  
+         echo -e "\tFalsche Eingabe !"
+         echo ""
+         echononl "Eingabe: "
+      fi
+   done
+
+else
+   conf_file=${conf_file_arr[0]}
+fi
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+if [[ -f "$conf_file" ]] ; then
+   source "$conf_file"
+else
+   warn "No configuration file 'conf_file' for OpenVON Service '$service_name' found.\n                Loading defaults.."
+fi
+
+if [[ -z "$OPENVPN_BASE_DIR" ]]; then
+   fatal "OpenVPN base diretory not given!"
+else
+   if [[ ! -d "$OPENVPN_BASE_DIR" ]]; then
+      fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
+   fi
+fi
+[[ -n "$KEY_DIR" ]] || KEY_DIR="${OPENVPN_BASE_DIR}/keys"
+[[ -n "$CRL_PEM" ]] || CRL_PEM="${KEY_DIR}/crl.pem"
+
+if [[ ! -d "$KEY_DIR" ]] ; then
+   fatal "Key directory '$KEY_DIR' not found. (See var 'KEY_DIR')"
+fi
+if [[ ! -f "$CRL_PEM" ]] ; then
+   fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
+fi
+
+declare -a revoked_serial_arr
+declare -a revoked_cn_arr
+
+while read -r _serial ; do
+   revoked_serial_arr+=("$_serial")
+done < <(openssl crl -inform PEM -text -noout -in $CRL_PEM 2>> $log_file | grep -E "^\s+Serial Number:" | awk '{print$3}')
+if [[ -s "$log_file" ]]; then
+   fatal "$(cat "$log_file")"
+fi
+
+if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
+   for _serial in ${revoked_serial_arr[@]} ; do
+      _cn="$(openssl x509  -noout -text -in ${KEY_DIR}/${_serial}.pem 2> $log_file \
+         | grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
+      if [[ -s "$log_file" ]]; then
+         error "$(cat "$log_file")"
+      else
+         revoked_arr+=("$_serial:$(trim $_cn)")
+         revoked_cn_arr+=("$(trim $_cn)")
+      fi
+   done
+else
+   info "No revoked keys in \033[1m${KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
+fi
+
+while IFS= read -r -d '' _cert ; do
+
+	_serial="$(basename "$_cert")"
+	_serial="${_serial%.*}"
+
+   _cn="$(openssl x509  -noout -text -in $_cert | grep Subject: | grep -oE "CN\s*=\s*[^,]+" | awk '{print$3}')"
+	all_arr+=("${_serial}:$(trim $_cn)")
+	if ! containsElement "$_cn" "${revoked_cn_arr[@]}" ; then
+		active_arr+=("${_serial}:$(trim $_cn)")
+	fi
+done < <(find ${KEY_DIR}  -name "??\.pem" -print0 | sort -z )
+
+echo
+if [[ ${#all_arr[@]} -gt 0 ]]; then
+   echo ""
+   if $terminal ; then
+      echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+   else
+      echo "All created Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+   fi
+   echo ""
+   for _val in ${all_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      if $terminal ; then
+         echo -e "   Serial: \033[1m${_val_arr[0]}\033[m   CN: \033[1m${_val_arr[1]}\033[m"
+      else
+         echo "   Serial: ${_val_arr[0]}   CN: ${_val_arr[1]}"
+      fi
+   done
+fi
+
+echo
+if [[ ${#revoked_arr[@]} -gt 0 ]]; then
+   echo ""
+   if $terminal ; then
+      echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+   else
+      echo "Revoked Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+   fi
+   echo ""
+   for _val in ${revoked_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      if $terminal ; then
+         echo -e "   Serial: \033[1m${_val_arr[0]}\033[m   CN: \033[1m${_val_arr[1]}\033[m"
+      else
+         echo "   Serial: ${_val_arr[0]}   CN: ${_val_arr[1]}"
+      fi
+   done
+fi
+
+echo
+if [[ ${#active_arr[@]} -gt 0 ]]; then
+   echo ""
+   if $terminal ; then
+      echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
+   else
+      echo "Active Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
+   fi
+   echo ""
+   for _val in ${active_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      if $terminal ; then
+         echo -e "   Serial: \033[1m${_val_arr[0]}\033[m   CN: \033[1m${_val_arr[1]}\033[m"
+      else
+         echo "   Serial: ${_val_arr[0]}   CN: ${_val_arr[1]}"
+      fi
+   done
+fi
+
+echo
+exit
+