From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH v2] CRL updater: Update script for OpenVPNs CRL Date: Tue, 06 Feb 2018 21:45:45 +0000 Message-ID: <1517953545.21272.134.camel@ipfire.org> In-Reply-To: <1517947776-23744-1-git-send-email-erik.kapfer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0793769237546124130==" List-Id: --===============0793769237546124130== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, On Tue, 2018-02-06 at 21:09 +0100, Erik Kapfer wrote: > Update script for OpenVPNs CRL cause OpenVPN refactors the CRL handling sin= ce > v.2.4.0 . > Script checks the next update field from the CRL and executes an update > before it expires. > Script is placed under fcron.daily for daily checks. >=20 > Signed-off-by: Erik Kapfer > --- > config/ovpn/openvpn-crl-updater | 88 > +++++++++++++++++++++++++++++++++++++++++ > config/rootfiles/common/openvpn | 1 + > lfs/openvpn | 6 +++ > 3 files changed, 95 insertions(+) > create mode 100644 config/ovpn/openvpn-crl-updater >=20 > diff --git a/config/ovpn/openvpn-crl-updater b/config/ovpn/openvpn-crl-upda= ter > new file mode 100644 > index 0000000..9063b04 > --- /dev/null > +++ b/config/ovpn/openvpn-crl-updater > @@ -0,0 +1,88 @@ > +#!/bin/bash > + > +##########################################################################= ### > ############ There is an extra empty line before the header and an extra hash in the first line of the header. > +# =09 > # > +# This file is part of the IPFire Firewall. =09 > # > +# =09 > # > +# IPFire is free software: you can redistribute it and/or modify =09 > # > +# it under the terms of the GNU General Public License as published by=09 > # > +# the Free Software Foundation, either version 3 of the License, or =09 > # > +# (at your option) any later version. =09 > # > +# =09 > # > +# IPFire is distributed in the hope that it will be useful, =09 > # > +# but WITHOUT ANY WARRANTY; without even the implied warranty of =09 > # > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the =09 > # > +# GNU General Public License for more details. =09 > # > +# =09 > # > +# You should have received a copy of the GNU General Public License =09 > # > +# along with IPFire. If not, see . =09 > # > +# =09 > # > +# Copyright (C) 2007 IPFire-Team . =09 > # > +# =09 > # > +##########################################################################= ### > ############ > +# =09 > # > +# Script Name: openvpn-crl-updater =09 > # > +# Description: This script checks the "Next Update:" field of the CRL =09 > # > +# and renews it if needed, which prevents the expiration of OpenVPNs CRL= .=09 > # > +# With OpenVPN 2.4.x the CRL handling has been refactored, =09 > # > +# whereby the verification logic has been removed from > ssl_verify_.c . # > +# For more infos: =09 > # > +# https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c03234529= 29e > 07016a336 # > +# =09 > # > +# Run Information: If OpenVPNs CRL is presant, =09 *present* > # > +# this script provides a cronjob which checks daily if an update of the > CRL # > +# is needed. If the expiring date reaches the value =09 > # > +# (defined in the 'UPDATE' variable in days) before the CRL expiration, = an > openssl #=20 > +# command will be executed to renew the CRL. =09 > # > +# Script execution will be logged into /var/log/messages. =09 > # > +# =09 > # > +# Author: Erik Kapfer =09 > # > +# =09 > # > +# Date: 06.02.2018 =09 Dates are not required. Git does this for us. > # > +# =09 > # > +##########################################################################= ### > ############ > + > +# Check if OpenVPN is active or if the CRL is presant > +if [ ! -e "/var/ipfire/ovpn/crls/cacrl.pem" ]; then > + exit 0; > +fi You got a hardcoded path here. Variables are set after this. It probably makes sense to move the check after the initialisation block and then check things and/or exit. > +## Paths > +OVPN=3D"/var/ipfire/ovpn" > +CRL=3D"${OVPN}/crls/cacrl.pem" > +CAKEY=3D"${OVPN}/ca/cakey.pem" > +CACERT=3D"${OVPN}/ca/cacert.pem" > +OPENSSLCONF=3D"${OVPN}/openssl/ovpn.cnf" > + > +## Values > +# CRL check for the 'Next Update:' in seconds > +EXPIRINGDATEINSEC=3D"$(( > +$(/bin/date -d "$(/usr/bin/openssl crl -in "${CRL}" -text | \ > + /bin/grep -oP 'Next Update: *\K.*')" +%s) - \ > + $(/bin/date +%s) \ > +))" You never need to use "/bin" or so before a command. The shell will find it. Just use date, grep, and (further down) openssl. And I didn't mean just breaking the lines. I meant splitting this into smaller chunks that are easy to understand and modify if we need to. Like: NOW=3D"$(date "+%s")" EXPIRES_AT=3D"$(openssl ... | grep ...)" # Convert into seconds from epoch EXPIRES_AT=3D"$(date "${EXPIRES_AT}" "+%s")" EXPIRINGDATEINSEC=3D$(( EXPIRES_AT - NOW )) I find this way easier to read and audit and it will execute in the same amou= nt of time. > +# Day in seconds to calculate > +DAYINSEC=3D"86400" > + > +# Convert seconds to days > +NEXTUPDATE=3D"$((EXPIRINGDATEINSEC / DAYINSEC))" Here this is super easy to read and understand. Way better. > +# Update of the CRL in days before CRL expiring date > +UPDATE=3D"14" > + > + > +# Check if OpenVPNs CRL needs to be renewed > +if [ ${NEXTUPDATE} -le ${UPDATE} ]; then > + if /usr/bin/openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -= out > "${CRL}" -config "${OPENSSLCONF}"; then > + logger -t openvpn "CRL has been updated" > + else > + logger -t openvpn "error: Could not update CRL" > + fi > +fi > + > +exit 0 > + > + > +# EOF > + > diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/open= vpn > index 2b63424..131d798 100644 > --- a/config/rootfiles/common/openvpn > +++ b/config/rootfiles/common/openvpn > @@ -1,3 +1,4 @@ > +etc/fcron.daily/openvpn-crl-updater > #usr/include/openvpn-msg.h > #usr/include/openvpn-plugin.h > #usr/lib/openvpn > diff --git a/lfs/openvpn b/lfs/openvpn > index 3913f02..1ecc18c 100644 > --- a/lfs/openvpn > +++ b/lfs/openvpn > @@ -96,5 +96,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify > chown root:root /usr/lib/openvpn/verify > chmod 755 /usr/lib/openvpn/verify > + # Add crl updater > + mv -v /var/ipfire/ovpn/openvpn-crl-updater /etc/fcron.daily > + chown root:root /etc/fcron.daily/openvpn-crl-updater > + chmod 750 /etc/fcron.daily/openvpn-crl-updater > + > @rm -rf $(DIR_APP) > @$(POSTBUILD) > + There is an extra empty line at the end of the LFS file. Best, -Michael --===============0793769237546124130== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUU1L3JXNWwzR0dl Mnlwa3R4Z0hudy8yK1FDUWNGQWxwNklna0FDZ2tRZ0hudy8yK1EKQ1FmdllCQUFqTjFRTVhSQktl bEJBVnp2NTZsOUNyRUZaU2lnaGd4NGU5a3d3aEJMc09PajF0eHVxRUZ5R1gzbwpVbnRFeUkxWDZO akxiVW8yMnU2OXNRRFhQMU00NnBRVGptcFZoRVcyZ0ZGbGFHWjFRR2dmMzlRTlNVc0MyNUhaCnNT Yk1HVC9xZjYwcnhWZ1VpeGdiL1IrcFNZYmtxb3pMTVB5N2UrREJESE8rcm1VMmRLM1FQV05ud0tF UkR0REIKa1pERDhkK1VEWC96dVNQdytranFFYzh4czh3cmNVbkdVdVJSVlBTNmtTTDRDeEM4RTVR eVlKVGFvRElYaFpITwpNelc3V0ZuK3d0Z3BpWURGYmFTamIrYmlQdjF0VUtvZW41T0tWT1FBTFA3 UFVoZEN2YzVrWk9LNkN3Y2VoN09qCmcvNE1jUmNPK0RISERGL0Y0VzB6Sy9iSzJxWmxKSTVoUWZv U3VXT1BDcThzYUJFNEZRenZ3bWtyVWxIQ3NFSUUKWDdpZ2FnSWsyUjZoMUpURjkxOG0zbUY0Rkpa alVUa1R5WEs1YUU5YU1sRFBCcjc2VmV5M0NRVXZKWHNDZFB4WQo3RFI2aDZKSXg3bzZidUl2TitJ b2NYSzhmZnFQOHppTHhGTXJBZ0tnL0ZEOWU1cmhlbDFhRFRIdzFQK25LMms1CnFvTEJqd05XMXUx V3pEcFdxaG56K1ZSUzdQVmNDaGU4OExoemJWbjJUTlM0L3Z6akdycjF4eDJwOFFOT01laUkKV2d3 WEtNTmM4VnJaVDhPaFJYS1hMMGFHcFB4UDlCZmxQVitPeHVSUEFvMnZqN0cwVHRTQTlEWWdNVkVZ dWpJaApqZkoxb2FrUndSanVld2ZkSTE3d3B2R0wxVU9zZWpUQ1lSYjBoVHlwaW4wT0wxR0h6clk9 Cj1DV3dnCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============0793769237546124130==--