install/openvpn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

get_revoked_keys.sh: add sipport for new easyrsa layout.

Browse Source
This commit is contained in:
Christoph 2019-07-16 17:34:24 +02:00
parent ddfd6c01bd
commit a3f8307fac
1 changed files with 50 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
get_revoked_keys.sh
View File

@ -11,9 +11,16 @@ clean_up() {
# Perform program exit housekeeping
rm -f "$log_file"
blank_line
exit $1
}
blank_line() {
if $terminal ; then
echo ""
fi
}
trim() {
local var="$*"
var="${var#"${var%%[![:space:]]*}"}" # remove leading whitespace characters
@ -123,8 +130,6 @@ if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
fi
echo ""
declare -i i=0
if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
@ -166,6 +171,14 @@ else
warn "No configuration file 'conf_file' for OpenVON Service '$service_name' found.\n Loading defaults.."
fi
if [[ -z "$OPENVPN_BASE_DIR" ]]; then
fatal "OpenVPN base diretory not given!"
else
if [[ ! -d "$OPENVPN_BASE_DIR" ]]; then
fatal "OpenVPN base diretory '$OPENVPN_BASE_DIR' not found!"
fi
fi
if [[ -z "$OPENVPN_BASE_DIR" ]]; then
fatal "OpenVPN base diretory not given!"
else
@ -173,11 +186,36 @@ else
fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
fi
fi
[[ -n "$KEY_DIR" ]] || KEY_DIR="${OPENVPN_BASE_DIR}/keys"
[[ -n "$CRL_PEM" ]] || CRL_PEM="${KEY_DIR}/crl.pem"
if [[ ! -d "$KEY_DIR" ]] ; then
fatal "Key directory '$KEY_DIR' not found. (See var 'KEY_DIR')"
if [[ -d "${OPENVPN_BASE_DIR}/pki" ]] ; then
EASYRSA_LAYOUT_NEW=true
else
EASYRSA_LAYOUT_NEW=false
fi
if [[ -z "$OPENVPN_KEY_DIR" ]] ; then
if $EASYRSA_LAYOUT_NEW ; then
OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/pki"
else
OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/keys"
fi
fi
if $EASYRSA_LAYOUT_NEW ; then
OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}/revoked/certs_by_serial"
OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}/certs_by_serial"
RV_CERT_EXT="crt"
else
OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}"
OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}"
RV_CERT_EXT="pem"
fi
[[ -n "$CRL_PEM" ]] || CRL_PEM="${OPENVPN_KEY_DIR}/crl.pem"
if [[ ! -d "$OPENVPN_KEY_DIR" ]] ; then
fatal "Key directory '$OPENVPN_KEY_DIR' not found. (See var 'OPENVPN_KEY_DIR')"
fi
if [[ ! -f "$CRL_PEM" ]] ; then
fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
@ -195,7 +233,7 @@ fi
if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
for _serial in ${revoked_serial_arr[@]} ; do
_cn="$(openssl x509 -noout -text -in ${KEY_DIR}/${_serial}.pem 2> $log_file \
_cn="$(openssl x509 -noout -text -in ${OPENVPN_REVOKED_KEY_DIR}/${_serial}.${RV_CERT_EXT} 2> $log_file \
| grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
if [[ -s "$log_file" ]]; then
error "$(cat "$log_file")"
@ -204,18 +242,16 @@ if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
fi
done
else
info "No revoked keys in \033[1m${KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
info "No revoked keys in \033[1m${OPENVPN_REVOKED_KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
fi
echo
if [[ ${#revoked_cn_arr[@]} -gt 0 ]]; then
echo ""
if $terminal ; then
echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
else
echo "Revoked Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
echo "Revoked Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
fi
echo ""
blank_line
for _val in ${revoked_cn_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}"
if $terminal ; then
@ -226,6 +262,4 @@ if [[ ${#revoked_cn_arr[@]} -gt 0 ]]; then
done
fi
echo
exit
clean_up 0