openvpn/get_revoked_keys.sh

#!/usr/bin/env bash

working_dir="$(dirname $(realpath $0))"

log_file=$(mktemp)

# -------------
# --- Some functions
# -------------
clean_up() {

   # Perform program exit housekeeping
   rm -f "$log_file"
   blank_line
   exit $1
}

blank_line() {
   if $terminal ; then
      echo ""
   fi
}

trim() {
    local var="$*"
    var="${var#"${var%%[![:space:]]*}"}"   # remove leading whitespace characters
    var="${var%"${var##*[![:space:]]}"}"   # remove trailing whitespace characters
    echo -n "$var"
}

    
is_number() {

   return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
   
   # - also possible
   # -
   #[[ ! -z "${1##*[!0-9]*}" ]] && return 0 || return 1
   #return $([[ ! -z "${1##*[!0-9]*}" ]])
}  
   
is_int() {
   return $(test "$@" -eq "$@" > /dev/null 2>&1);
}

echononl(){ 
   echo X\\c > /tmp/shprompt$$
   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
      echo -e -n "$*\\c" 1>&2
   else
       echo -e -n "$*" 1>&2
   fi
   rm /tmp/shprompt$$
}

fatal(){
   echo ""
   if $terminal ; then
      echo -e "[ \033[31m\033[1mError\033[m ]: $*"
      echo ""
      echo -e "   \033[31m\033[1mScript was interupted\033[m!"
   else
      echo "   [ Fatal ]: $*"
      echo ""
      echo "              Script was terminated...."
   fi
   echo ""
   clean_up 1
}

error (){
   echo ""
   if $terminal ; then
      echo -e "   [ \033[31m\033[1mError\033[m ]: $*"
   else
      echo "[ Error ]: $*"
   fi
   echo ""
}

warn (){
   echo ""
   if $terminal ; then
      echo -e "   [ \033[33m\033[1mWarning\033[m ]: $*"
   else
      echo "[ Warning ]: $*"
   fi
   echo ""
}

info (){
   if $terminal ; then
      echo ""
      echo -e "   [ \033[32m\033[1mInfo\033[m ]: $*"
      echo ""
   fi
}



# -------------
# --- Check some prerequisites
# -------------

# - Running in a terminal?
# -
if [[ -t 1 ]] ; then
   terminal=true
else
   terminal=false
fi


# -------------
# --- Read Configurations from $conf_file
# -------------

declare -a conf_file_arr=()
declare -a conf_name_arr=()
for _conf_file in `ls ${working_dir}/conf/server-*.conf 2>/dev/null` ; do
   conf_file_arr+=("${_conf_file}")
   _basename=$(basename $_conf_file)
   _tmp_name=${_basename%%.*}
   _tmp_name=${_tmp_name#*-}
   conf_name_arr+=("$_tmp_name")
done

if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
   fatal "NO Configuration found!"
fi


declare -i i=0

if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
   echo ""
   echo "Which Configuration should be loaded?"
   echo ""
   for _conf_file in ${conf_file_arr[@]} ; do
      echo " [${i}] ${conf_name_arr[${i}]}"
      (( i++ ))
   done
   _OK=false
   echo
   echononl "Eingabe: "
   while ! $_OK ; do
      read _IN
      if is_number "$_IN" && [[ -n ${conf_file_arr[$_IN]} ]]; then
         conf_file=${conf_file_arr[$_IN]}
         service_name="${conf_name_arr[$_IN]}"
         _OK=true
      else
         echo ""  
         echo -e "\tFalsche Eingabe !"
         echo ""
         echononl "Eingabe: "
      fi
   done

else
   conf_file=${conf_file_arr[0]}
fi

echo ""
echo -e "\033[32m--\033[m"
echo ""

if [[ -f "$conf_file" ]] ; then
   source "$conf_file"
else
   warn "No configuration file 'conf_file' for OpenVON Service '$service_name' found.\n                Loading defaults.."
fi

if [[ -z "$OPENVPN_BASE_DIR" ]]; then
   fatal "OpenVPN base diretory not given!"
else
   if [[ ! -d "$OPENVPN_BASE_DIR" ]]; then
      fatal "OpenVPN base diretory '$OPENVPN_BASE_DIR' not found!"
   fi
fi

if [[ -z "$OPENVPN_BASE_DIR" ]]; then
   fatal "OpenVPN base diretory not given!"
else
   if [[ ! -d "$OPENVPN_BASE_DIR" ]]; then
      fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
   fi
fi

if [[ -d "${OPENVPN_BASE_DIR}/pki" ]] ; then
   EASYRSA_LAYOUT_NEW=true
else
   EASYRSA_LAYOUT_NEW=false
fi


if [[ -z "$OPENVPN_KEY_DIR" ]] ; then
   if $EASYRSA_LAYOUT_NEW ; then
      OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/pki"
   else
      OPENVPN_KEY_DIR="${OPENVPN_BASE_DIR}/keys"
   fi
fi

if $EASYRSA_LAYOUT_NEW ; then
   OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}/revoked/certs_by_serial"
   OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}/certs_by_serial"
   RV_CERT_EXT="crt"
else
   OPENVPN_REVOKED_KEY_DIR="${OPENVPN_KEY_DIR}"
   OPENVPN_CERT_DIR_SERIAL="${OPENVPN_KEY_DIR}"
   RV_CERT_EXT="pem"
fi

[[ -n "$CRL_PEM" ]] || CRL_PEM="${OPENVPN_KEY_DIR}/crl.pem"

if [[ ! -d "$OPENVPN_KEY_DIR" ]] ; then
   fatal "Key directory '$OPENVPN_KEY_DIR' not found. (See var 'OPENVPN_KEY_DIR')"
fi
if [[ ! -f "$CRL_PEM" ]] ; then
   fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
fi

declare -a revoked_serial_arr
declare -a revoked_cn_arr

while read -r _serial ; do
   revoked_serial_arr+=("$_serial")
done < <(openssl crl -inform PEM -text -noout -in $CRL_PEM 2>> $log_file | grep -E "^\s+Serial Number:" | awk '{print$3}')
if [[ -s "$log_file" ]]; then
   fatal "$(cat "$log_file")"
fi

if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
   for _serial in ${revoked_serial_arr[@]} ; do
      _cn="$(openssl x509  -noout -text -in ${OPENVPN_REVOKED_KEY_DIR}/${_serial}.${RV_CERT_EXT} 2> $log_file \
         | grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
      if [[ -s "$log_file" ]]; then
         error "$(cat "$log_file")"
      else
         revoked_cn_arr+=("$_serial:$(trim $_cn)")
      fi
   done
else
   info "No revoked keys in \033[1m${OPENVPN_REVOKED_KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
fi

if [[ ${#revoked_cn_arr[@]} -gt 0 ]]; then
   if $terminal ; then
      echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${OPENVPN_KEY_DIR}\033[m:"
   else
      echo "Revoked Keys for OpenVPN service '$service_name' in '${OPENVPN_KEY_DIR}':"
   fi
   blank_line
   for _val in ${revoked_cn_arr[@]} ; do
      IFS=':' read -a _val_arr <<< "${_val}"
      if $terminal ; then
         echo -e "   Serial: \033[1m${_val_arr[0]}\033[m   CN: \033[1m${_val_arr[1]}\033[m"
      else
         echo "   Serial: ${_val_arr[0]}   CN: ${_val_arr[1]}"
      fi
   done
fi

clean_up 0