+
+
+
openvpn-admin
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
- | Name |
- Flag |
- Expiration date |
- Revocation date |
-
-
-
-
- | {{ row.Identity }} |
- {{ row.Flag }} |
- {{ row.ExpirationDate }} |
- {{ row.RevocationDate }} |
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
{{ u.openvpnConfig }}
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+ This will show up when there are no rows
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
{{ u.openvpnConfig }}
+
+
+
+
+
+
+
+
+
+
+
+
-
diff --git a/frontend/webpack.config.js b/frontend/webpack.config.js
index 07a8bee..813cb9d 100644
--- a/frontend/webpack.config.js
+++ b/frontend/webpack.config.js
@@ -1,5 +1,6 @@
var path = require('path')
var webpack = require('webpack')
+const TerserPlugin = require('terser-webpack-plugin');
module.exports = {
entry: './src/main.js',
@@ -95,11 +96,8 @@ if (process.env.NODE_ENV === 'production') {
NODE_ENV: '"production"'
}
}),
- new webpack.optimize.UglifyJsPlugin({
- sourceMap: true,
- compress: {
- warnings: false
- }
+ new TerserPlugin({
+ sourceMap: true
}),
new webpack.LoaderOptionsPlugin({
minimize: true
diff --git a/main.go b/main.go
index a76b357..f0c30f5 100644
--- a/main.go
+++ b/main.go
@@ -8,34 +8,33 @@ import (
"os"
"os/exec"
"regexp"
+ "time"
"strings"
"text/template"
- // "reflect"
"bufio"
"net"
- // "io"
- // "encoding/binary"
"encoding/json"
"net/http"
"gopkg.in/alecthomas/kingpin.v2"
)
var (
- listenHost = kingpin.Flag("listen.host","host for openvpn-admin").Default("127.0.0.1").String()
- listenPort = kingpin.Flag("listen.port","port for openvpn-admin").Default("8080").String()
- easyrsaPath = kingpin.Flag("easyrsa.path", "path to easyrsa dir").Default("/etc/openvpn/easyrsa").String()
- indexTxtPath = kingpin.Flag("easyrsa.index-path", "path to easyrsa index file.").Default("/etc/openvpn/easyrsa/pki/index.txt").String()
- ccdCustom = kingpin.Flag("ccd.custom", "enable or disable custom routes").Default("false").Bool()
- ccdDir = kingpin.Flag("ccd.path", "path to client-config-dir").Default("/etc/openvpn/ccd").String()
- staticPath = kingpin.Flag("static.path", "path to static dir").Default("./static").String()
+ listenHost = kingpin.Flag("listen.host","host for openvpn-admin").Default("0.0.0.0").String()
+ listenPort = kingpin.Flag("listen.port","port for openvpn-admin").Default("8080").String()
+ openvpnServerHost = kingpin.Flag("ovpn.host","host for openvpn server").Default("127.0.0.1").String()
+ openvpnServerPort = kingpin.Flag("ovpn.port","port for openvpn server").Default("7777").String()
+ openvpnNetwork = kingpin.Flag("ovpn.network","network for openvpn server").Default("172.16.100.0/24").String()
+ mgmtListenHost = kingpin.Flag("mgmt.host","host for mgmt").Default("127.0.0.1").String()
+ mgmtListenPort = kingpin.Flag("mgmt.port","port for mgmt").Default("8989").String()
+ easyrsaDirPath = kingpin.Flag("easyrsa.path", "path to easyrsa dir").Default("/mnt/easyrsa").String()
+ indexTxtPath = kingpin.Flag("easyrsa.index-path", "path to easyrsa index file.").Default("/mnt/easyrsa/pki/index.txt").String()
+ ccdDir = kingpin.Flag("ccd.path", "path to client-config-dir").Default("/mnt/ccd").String()
+ staticPath = kingpin.Flag("static.path", "path to static dir").Default("./static").String()
+ debug = kingpin.Flag("debug", "Enable debug mode.").Default("false").Bool()
)
const (
usernameRegexp = `^([a-zA-Z0-9_.-])+$`
- openvpnServerHost = "127.0.0.1"
- openvpnServerPort = "7777"
- mgmtListenHost = "127.0.0.1"
- mgmtListenPort = "7788"
)
type openvpnClientConfig struct {
@@ -47,14 +46,24 @@ type openvpnClientConfig struct {
TLS string
}
-type ccdLine struct {
- addr string `json:"addr"`
- mask string `json:"mask"`
- desc string `json:"desc"`
+type openvpnClient struct {
+ Identity string `json:"Identity"`
+ AccountStatus string `json:"AccountStatus"`
+ ExpirationDate string `json:"ExpirationDate"`
+ RevocationDate string `json:"RevocationDate"`
+ ConnectionStatus string `json:"ConnectionStatus"`
}
-type ccdFile struct {
- lines []ccdLine
+type ccdRoute struct {
+ Address string `json:"Address"`
+ Mask string `json:"Mask"`
+ Description string `json:"Description"`
+}
+
+type Ccd struct {
+ User string `json:"User"`
+ ClientAddress string `json:"ClientAddress"`
+ CustomRoutes []ccdRoute `json:"CustomRoutes"`
}
type indexTxtLine struct {
@@ -80,13 +89,21 @@ type clientStatus struct {
}
func userListHandler(w http.ResponseWriter, r *http.Request) {
- userList, _ := json.Marshal(indexTxtParser(fRead(*indexTxtPath)))
- fmt.Fprintf(w, "%s", userList)
+ usersList, _ := json.Marshal(usersList())
+ fmt.Fprintf(w, "%s", usersList)
}
func userCreateHandler(w http.ResponseWriter, r *http.Request) {
r.ParseForm()
- fmt.Fprintf(w, "%s", userCreate(r.FormValue("username")))
+ userCreated, userCreateStatus := userCreate(r.FormValue("username"))
+
+ if userCreated {
+ w.WriteHeader(http.StatusOK)
+ fmt.Fprintf(w, userCreateStatus)
+ return
+ } else {
+ http.Error(w, userCreateStatus, http.StatusUnprocessableEntity)
+ }
}
func userRevokeHandler(w http.ResponseWriter, r *http.Request) {
@@ -101,20 +118,42 @@ func userUnrevokeHandler(w http.ResponseWriter, r *http.Request) {
func userShowConfigHandler(w http.ResponseWriter, r *http.Request) {
r.ParseForm()
- fmt.Printf("username: %v\n%s\n", r.PostForm, r.FormValue("username"))
fmt.Fprintf(w, "%s", renderClientConfig(r.FormValue("username")))
}
+func userDisconnectHandler(w http.ResponseWriter, r *http.Request) {
+ r.ParseForm()
+// fmt.Fprintf(w, "%s", userDisconnect(r.FormValue("username")))
+ fmt.Fprintf(w, "%s", r.FormValue("username"))
+}
+
func userShowCcdHandler(w http.ResponseWriter, r *http.Request) {
r.ParseForm()
- fmt.Printf("username: %v\n%s\n", r.PostForm, r.FormValue("username"))
- fmt.Fprintf(w, "%s", renderCcdConfig(r.FormValue("username")))
+ ccd, _ := json.Marshal(getCcd(r.FormValue("username")))
+ fmt.Fprintf(w, "%s", ccd)
}
func userApplyCcdHandler(w http.ResponseWriter, r *http.Request) {
- r.ParseForm()
- fmt.Printf("username: %v\n%s\n", r.PostForm, r.FormValue("username"))
- fmt.Fprintf(w, "%s", ccdFileModify(r.FormValue("username"),ccdFileParser(r.FormValue("ccd"))))
+ var ccd Ccd
+ if r.Body == nil {
+ http.Error(w, "Please send a request body", 400)
+ return
+ }
+
+ err := json.NewDecoder(r.Body).Decode(&ccd)
+ if err != nil {
+ log.Println(err)
+ }
+
+ ccdApplied, applyStatus := modifyCcd(ccd)
+
+ if ccdApplied {
+ w.WriteHeader(http.StatusOK)
+ fmt.Fprintf(w, applyStatus)
+ return
+ } else {
+ http.Error(w, applyStatus, http.StatusUnprocessableEntity)
+ }
}
func main() {
@@ -122,34 +161,26 @@ func main() {
fmt.Println("Bind: http://" + *listenHost + ":" + *listenPort)
- fs := http.FileServer(http.Dir(*staticPath))
+ fs := CacheControlWrapper(http.FileServer(http.Dir(*staticPath)))
http.Handle("/", fs)
http.HandleFunc("/api/users/list", userListHandler)
http.HandleFunc("/api/user/create", userCreateHandler)
http.HandleFunc("/api/user/revoke", userRevokeHandler)
http.HandleFunc("/api/user/unrevoke", userUnrevokeHandler)
- http.HandleFunc("/api/user/showconfig", userShowConfigHandler)
- http.HandleFunc("/api/user/ccd/list", userShowCcdHandler)
+ http.HandleFunc("/api/user/config/show", userShowConfigHandler)
+ http.HandleFunc("/api/user/disconnect", userDisconnectHandler)
+ http.HandleFunc("/api/user/ccd", userShowCcdHandler)
http.HandleFunc("/api/user/ccd/apply", userApplyCcdHandler)
log.Fatal(http.ListenAndServe(*listenHost + ":" + *listenPort, nil))
}
-func fRead(path string) string {
- content, err := ioutil.ReadFile(path)
- if err != nil {
- log.Fatal(err)
- }
-
- return string(content)
-}
-
-func fWrite(path, content string) {
- err := ioutil.WriteFile(path, []byte(content), 0644)
- if err != nil {
- log.Fatal(err)
- }
+func CacheControlWrapper(h http.Handler) http.Handler {
+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ w.Header().Set("Cache-Control", "max-age=2592000") // 30 days
+ h.ServeHTTP(w, r)
+ })
}
func indexTxtParser(txt string) []indexTxtLine {
@@ -163,13 +194,12 @@ func indexTxtParser(txt string) []indexTxtLine {
switch {
// case strings.HasPrefix(str[0], "E"):
case strings.HasPrefix(str[0], "V"):
- indexTxt = append(indexTxt, indexTxtLine{Flag: str[0], ExpirationDate: str[1], SerialNumber: str[2], Filename: str[3], DistinguishedName: str[4], Identity: str[4][strings.Index(str[4], "=")+1:]})
+ indexTxt = append(indexTxt, indexTxtLine{Flag: str[0], ExpirationDate: str[1], SerialNumber: str[2], Filename: str[3], DistinguishedName: str[4], Identity: str[4][strings.Index(str[4], "=")+1:]})
case strings.HasPrefix(str[0], "R"):
- indexTxt = append(indexTxt, indexTxtLine{Flag: str[0], ExpirationDate: str[1], RevocationDate: str[2], SerialNumber: str[3], Filename: str[4], DistinguishedName: str[5], Identity: str[5][strings.Index(str[5], "=")+1:]})
+ indexTxt = append(indexTxt, indexTxtLine{Flag: str[0], ExpirationDate: str[1], RevocationDate: str[2], SerialNumber: str[3], Filename: str[4], DistinguishedName: str[5], Identity: str[5][strings.Index(str[5], "=")+1:]})
}
}
}
-
return indexTxt
}
@@ -178,159 +208,211 @@ func renderIndexTxt(data []indexTxtLine) string {
for _, line := range data {
switch {
case line.Flag == "V":
- // if line.distinguishedName != "/CN=server" {
- // fmt.Printf("%s\t%s\t\t%s\t%s\t%s\n", line.flag, line.expirationDate, line.serialNumber, line.filename, line.distinguishedName)
- indexTxt += fmt.Sprintf("%s\t%s\t\t%s\t%s\t%s\n", line.Flag, line.ExpirationDate, line.SerialNumber, line.Filename, line.DistinguishedName)
- // }
+ indexTxt += fmt.Sprintf("%s\t%s\t\t%s\t%s\t%s\n", line.Flag, line.ExpirationDate, line.SerialNumber, line.Filename, line.DistinguishedName)
case line.Flag == "R":
- // if line.distinguishedName != "/CN=server" {
- // fmt.Printf("%s\t%s\t%s\t%s\t%s\t%s\n", line.flag, line.expirationDate, line.revocationDate, line.serialNumber, line.filename, line.distinguishedName)
- indexTxt += fmt.Sprintf("%s\t%s\t%s\t%s\t%s\t%s\n", line.Flag, line.ExpirationDate, line.RevocationDate, line.SerialNumber, line.Filename, line.DistinguishedName)
- // }
- // case line.flag == "E":
+ indexTxt += fmt.Sprintf("%s\t%s\t%s\t%s\t%s\t%s\n", line.Flag, line.ExpirationDate, line.RevocationDate, line.SerialNumber, line.Filename, line.DistinguishedName)
+ // case line.flag == "E":
}
}
- return (indexTxt)
+ return indexTxt
}
func renderClientConfig(username string) string {
if checkUserExist(username) {
conf := openvpnClientConfig{}
- conf.Host = openvpnServerHost
- conf.Port = openvpnServerPort
- conf.CA = fRead(*easyrsaPath + "/pki/ca.crt")
- conf.Cert = fRead(*easyrsaPath + "/pki/issued/" + username + ".crt")
- conf.Key = fRead(*easyrsaPath + "/pki/private/" + username + ".key")
- conf.TLS = fRead(*easyrsaPath + "/pki/ta.key")
+ conf.Host = *openvpnServerHost
+ conf.Port = *openvpnServerPort
+ conf.CA = fRead(*easyrsaDirPath + "/pki/ca.crt")
+ conf.Cert = fRead(*easyrsaDirPath + "/pki/issued/" + username + ".crt")
+ conf.Key = fRead(*easyrsaDirPath + "/pki/private/" + username + ".key")
+ conf.TLS = fRead(*easyrsaDirPath + "/pki/ta.key")
+
t, _ := template.ParseFiles("client.conf.tpl")
var tmp bytes.Buffer
t.Execute(&tmp, conf)
- // fmt.Printf("%+v\n", err)
+
fmt.Printf("%+v\n", tmp.String())
return (fmt.Sprintf("%+v\n", tmp.String()))
}
fmt.Printf("User \"%s\" not found", username)
- return (fmt.Sprintf("User \"%s\" not found", username))
+ return fmt.Sprintf("User \"%s\" not found", username)
}
-func ccdFileParser(txt string) ccdFile {
- ccdFile := ccdFile{}
+func parseCcd(username string) Ccd {
+ ccd := Ccd{}
+ ccd.User = username
+ ccd.ClientAddress = "dynamic"
+ ccd.CustomRoutes = []ccdRoute{}
- txtLinesArray := strings.Split(txt, "\n")
+ txtLinesArray := strings.Split(fRead(*ccdDir + "/" + username), "\n")
for _, v := range txtLinesArray {
str := strings.Fields(v)
if len(str) > 0 {
switch {
case strings.HasPrefix(str[0], "ifconfig-push"):
- ccdFile.lines = append(ccdFile.lines, ccdLine{addr: str[2], mask: str[3], desc: "Client Address"})
+ ccd.ClientAddress = str[1]
case strings.HasPrefix(str[0], "push"):
- ccdFile.lines = append(ccdFile.lines, ccdLine{addr: str[2], mask: str[3], desc: strings.Join(str[4:], "")})
+ ccd.CustomRoutes = append(ccd.CustomRoutes, ccdRoute{Address: strings.Trim(str[2], "\""), Mask: strings.Trim(str[3], "\""), Description: strings.Trim(strings.Join(str[4:], ""), "#")})
}
}
}
- return ccdFile
+ return ccd
}
+func modifyCcd(ccd Ccd) (bool, string) {
-func renderCcdConfig(username string) string {
- if checkCcdExist(username) {
- ccdFileParser(fRead(*ccdDir + "/" + username))
+ if fCreate(*ccdDir + "/" + ccd.User) {
+ ccdValid, ccdErr := validateCcd(ccd)
+ if ccdErr != "" {
+ return false, ccdErr
+ }
+
+ if ccdValid {
+ t, _ := template.ParseFiles("ccd.tpl")
+ var tmp bytes.Buffer
+ t.Execute(&tmp, ccd)
+ fWrite(*ccdDir + "/" + ccd.User, tmp.String())
+ return true, "ccd updated successfully"
+ }
}
- fmt.Printf("ccd for user \"%s\" not found", username)
- return (fmt.Sprintf("ccd for user \"%s\" not found", username))
+ return false, "something goes wrong"
}
+func validateCcd(ccd Ccd) (bool, string) {
+ ccdErr := ""
-func ccdFileModify(username string, ccdFile ccdFile) bool {
- if checkCcdExist(username) {
+ if ccd.ClientAddress != "dynamic" {
+ _, ovpnNet, err := net.ParseCIDR(*openvpnNetwork)
+ if err != nil {
+ log.Println(err)
+ }
+
+ if ! checkStaticAddressIsFree(ccd.ClientAddress, ccd.User) {
+ ccdErr = fmt.Sprintf("ClientAddress \"%s\" already assigned to another user", ccd.ClientAddress)
+ if *debug {
+ log.Printf("ERROR: Modify ccd for user %s: %s", ccd.User, ccdErr)
+ }
+ return false, ccdErr
+ }
+
+ if net.ParseIP(ccd.ClientAddress) == nil {
+ ccdErr = fmt.Sprintf("ClientAddress \"%s\" not a valid IP address", ccd.ClientAddress)
+ if *debug {
+ log.Printf("ERROR: Modify ccd for user %s: %s", ccd.User, ccdErr)
+ }
+ return false, ccdErr
+ }
+
+ if ! ovpnNet.Contains(net.ParseIP(ccd.ClientAddress)) {
+ ccdErr = fmt.Sprintf("ClientAddress \"%s\" not belongs to openvpn server network", ccd.ClientAddress)
+ if *debug {
+ log.Printf("ERROR: Modify ccd for user %s: %s", ccdErr)
+ }
+ return false, ccdErr
+ }
}
- return true
+
+ for _, route := range ccd.CustomRoutes {
+ if net.ParseIP(route.Address) == nil {
+ ccdErr = fmt.Sprintf("CustomRoute.Address \"%s\" must be a valid IP address", route.Address)
+ if *debug {
+ log.Printf("ERROR: Modify ccd for user %s: %s", ccdErr)
+ }
+ return false, ccdErr
+ }
+
+ if net.ParseIP(route.Mask) == nil {
+ ccdErr = fmt.Sprintf("CustomRoute.Mask \"%s\" must be a valid IP address", route.Mask)
+ if *debug {
+ log.Printf("ERROR: Modify ccd for user %s: %s", ccd.User, ccdErr)
+ }
+ return false, ccdErr
+ }
+ }
+
+ return true, ccdErr
}
-// https://community.openvpn.net/openvpn/ticket/623
-func crlFix() {
- os.Chmod(*easyrsaPath + "/pki", 0755)
- err := os.Chmod(*easyrsaPath + "/pki/crl.pem", 0640)
- if err != nil {
- log.Println(err)
- }
+func getCcd(username string) Ccd {
+ ccd := Ccd{}
+ ccd.User = username
+ ccd.ClientAddress = "dynamic"
+ ccd.CustomRoutes = []ccdRoute{}
+
+ if fCreate(*ccdDir + "/" + username) {
+ ccd = parseCcd(username)
+ }
+ return ccd
}
-func runBash(script string) string {
- fmt.Println(script)
- cmd := exec.Command("bash", "-c", script)
- stdout, err := cmd.CombinedOutput()
- if err != nil {
- return (fmt.Sprint(err) + " : " + string(stdout))
- }
- return (string(stdout))
+func checkStaticAddressIsFree(staticAddress string, username string) bool {
+ o := runBash(fmt.Sprintf("grep -rl %s %s | grep -vx %s/%s | wc -l", staticAddress, *ccdDir, *ccdDir, username))
+
+ if strings.TrimSpace(o) == "0" {
+ return true
+ }
+ return false
}
func validateUsername(username string) bool {
var validUsername = regexp.MustCompile(usernameRegexp)
- return (validUsername.MatchString(username))
+ return validUsername.MatchString(username)
}
func checkUserExist(username string) bool {
for _, u := range indexTxtParser(fRead(*indexTxtPath)) {
if u.DistinguishedName == ("/CN=" + username) {
- return (true)
+ return true
}
}
- return (false)
+ return false
}
-func checkCcdExist(username string) bool {
- if *ccdCustom {
- if _, err := os.Stat(*ccdDir + "/" + username); err == nil {
- return (true)
- } else if os.IsNotExist(err) {
- fmt.Printf("ccd for user \"%s\" not found", username)
- return (false)
- } else {
- fmt.Printf("Something goes wrong during checking ccd for user \"%s\"", username)
- fmt.Printf("err: %s", err)
- return (false)
- }
- }
-
- return (false)
-}
-
-func usersList() []string {
- users := []string{}
+func usersList() []openvpnClient {
+ users := []openvpnClient{}
for _, line := range indexTxtParser(fRead(*indexTxtPath)) {
- users = append(users, line.Identity)
+ if line.Identity != "server" {
+ switch {
+ case line.Flag == "V":
+ users = append(users, openvpnClient{Identity: line.Identity, ExpirationDate: indexTxtDateToHumanReadable(line.ExpirationDate), AccountStatus: "Active"})
+ case line.Flag == "R":
+ users = append(users, openvpnClient{Identity: line.Identity, RevocationDate: indexTxtDateToHumanReadable(line.RevocationDate), ExpirationDate: indexTxtDateToHumanReadable(line.ExpirationDate), AccountStatus: "Revoked"})
+ case line.Flag == "E":
+ users = append(users, openvpnClient{Identity: line.Identity, RevocationDate: indexTxtDateToHumanReadable(line.RevocationDate), ExpirationDate: indexTxtDateToHumanReadable(line.ExpirationDate), AccountStatus: "Expired"})
+
+ }
+ }
}
- return (users)
+ return users
}
-func userCreate(username string) string {
+func userCreate(username string) (bool, string) {
+ // TODO: add password for user cert . priority=low
if validateUsername(username) == false {
fmt.Printf("Username \"%s\" incorrect, you can use only %s\n", username, usernameRegexp)
- return (fmt.Sprintf("Username \"%s\" incorrect, you can use only %s\n", username, usernameRegexp))
+ return false, fmt.Sprintf("Username \"%s\" incorrect, you can use only %s", username, usernameRegexp)
}
if checkUserExist(username) {
fmt.Printf("User \"%s\" already exists\n", username)
- return (fmt.Sprintf("User \"%s\" already exists\n", username))
+ return false, fmt.Sprintf("User \"%s\" already exists", username)
}
- o := runBash(fmt.Sprintf("date +%%Y-%%m-%%d\\ %%H:%%M:%%S && cd %s && ./easyrsa build-client-full %s nopass", *easyrsaPath, username))
+ o := runBash(fmt.Sprintf("date +%%Y-%%m-%%d\\ %%H:%%M:%%S && cd %s && easyrsa build-client-full %s nopass", *easyrsaDirPath, username))
fmt.Println(o)
- return ("")
+ return true, fmt.Sprintf("User \"%s\" created", username)
}
func userRevoke(username string) string {
if checkUserExist(username) {
// check certificate valid flag 'V'
- o := runBash(fmt.Sprintf("date +%%Y-%%m-%%d\\ %%H:%%M:%%S && cd %s && echo yes | ./easyrsa revoke %s && ./easyrsa gen-crl", *easyrsaPath, username))
+ o := runBash(fmt.Sprintf("date +%%Y-%%m-%%d\\ %%H:%%M:%%S && cd %s && echo yes | easyrsa revoke %s && easyrsa gen-crl", *easyrsaDirPath, username))
crlFix()
- return (fmt.Sprintln(o))
+ return fmt.Sprintln(o)
}
fmt.Printf("User \"%s\" not found", username)
- return (fmt.Sprintf("User \"%s\" not found", username))
+ return fmt.Sprintf("User \"%s\" not found", username)
}
func userUnrevoke(username string) string {
@@ -339,24 +421,45 @@ func userUnrevoke(username string) string {
usersFromIndexTxt := indexTxtParser(fRead(*indexTxtPath))
for i := range usersFromIndexTxt {
if usersFromIndexTxt[i].DistinguishedName == ("/CN=" + username) {
- usersFromIndexTxt[i].Flag = "V"
- usersFromIndexTxt[i].RevocationDate = ""
- break
+ if usersFromIndexTxt[i].Flag == "R" {
+ usersFromIndexTxt[i].Flag = "V"
+ usersFromIndexTxt[i].RevocationDate = ""
+ o := runBash(fmt.Sprintf("cd %s && cp pki/revoked/certs_by_serial/%s.crt pki/issued/%s.crt", *easyrsaDirPath, usersFromIndexTxt[i].SerialNumber, username))
+ fmt.Println(o)
+ o = runBash(fmt.Sprintf("cd %s && cp pki/revoked/certs_by_serial/%s.crt pki/certs_by_serial/%s.pem", *easyrsaDirPath, usersFromIndexTxt[i].SerialNumber, usersFromIndexTxt[i].SerialNumber))
+ fmt.Println(o)
+ o = runBash(fmt.Sprintf("cd %s && cp pki/revoked/private_by_serial/%s.key pki/private/%s.key", *easyrsaDirPath, usersFromIndexTxt[i].SerialNumber, username))
+ fmt.Println(o)
+ o = runBash(fmt.Sprintf("cd %s && cp pki/revoked/reqs_by_serial/%s.req pki/reqs/%s.req", *easyrsaDirPath, usersFromIndexTxt[i].SerialNumber, username))
+ fmt.Println(o)
+ fWrite(*indexTxtPath, renderIndexTxt(usersFromIndexTxt))
+ fmt.Print(renderIndexTxt(usersFromIndexTxt))
+ o = runBash(fmt.Sprintf("cd %s && easyrsa gen-crl", *easyrsaDirPath))
+ fmt.Println(o)
+ crlFix()
+ break
+ }
}
}
fWrite(*indexTxtPath, renderIndexTxt(usersFromIndexTxt))
fmt.Print(renderIndexTxt(usersFromIndexTxt))
crlFix()
- return (fmt.Sprintf("{\"msg\":\"User %s successfully unrevoked\"}", username))
+ return fmt.Sprintf("{\"msg\":\"User %s successfully unrevoked\"}", username)
}
- return (fmt.Sprintf("{\"msg\":\"User \"%s\" not found\"}", username))
+ return fmt.Sprintf("{\"msg\":\"User \"%s\" not found\"}", username)
}
+// TODO: add ability to change password for user cert . priority=low
+// func userChangePassword(username string, newPassword string) bool {
+//
+// return false
+// }
+
func ovpnMgmtRead(conn net.Conn) string {
buf := make([]byte, 32768)
len, _ := conn.Read(buf)
s := string(buf[:len])
- return (s)
+ return s
}
func mgmtConnectedUsersParser(text string) []clientStatus {
@@ -397,11 +500,11 @@ func mgmtConnectedUsersParser(text string) []clientStatus {
}
}
}
- return (u)
+ return u
}
func mgmtKillUserConnection(username string) {
- conn, _ := net.Dial("tcp", mgmtListenHost+":"+mgmtListenPort)
+ conn, _ := net.Dial("tcp", *mgmtListenHost+":"+*mgmtListenPort)
ovpnMgmtRead(conn) // read welcome message
conn.Write([]byte(fmt.Sprintf("kill %s\n", username)))
fmt.Printf("%v", ovpnMgmtRead(conn))
@@ -409,10 +512,66 @@ func mgmtKillUserConnection(username string) {
}
func mgmtGetActiveClients() []clientStatus {
- conn, _ := net.Dial("tcp", mgmtListenHost+":"+mgmtListenPort)
+ conn, _ := net.Dial("tcp", *mgmtListenHost+":"+*mgmtListenPort)
ovpnMgmtRead(conn) // read welcome message
conn.Write([]byte("status\n"))
activeClients := mgmtConnectedUsersParser(ovpnMgmtRead(conn))
conn.Close()
- return (activeClients)
+ return activeClients
+}
+
+func indexTxtDateToHumanReadable(datetime string) string {
+ layout := "060102150405Z"
+ t, err := time.Parse(layout, datetime)
+ if err != nil {
+ fmt.Println(err)
+ }
+ return t.Format("2006-01-02 15:04:05")
+}
+
+func runBash(script string) string {
+ fmt.Println(script)
+ cmd := exec.Command("bash", "-c", script)
+ stdout, err := cmd.CombinedOutput()
+ if err != nil {
+ return (fmt.Sprint(err) + " : " + string(stdout))
+ }
+ return string(stdout)
+}
+
+// https://community.openvpn.net/openvpn/ticket/623
+func crlFix() {
+ os.Chmod(*easyrsaDirPath + "/pki", 0755)
+ err := os.Chmod(*easyrsaDirPath + "/pki/crl.pem", 0640)
+ if err != nil {
+ log.Println(err)
+ }
+}
+
+func fRead(path string) string {
+ content, err := ioutil.ReadFile(path)
+ if err != nil {
+ log.Fatal(err)
+ }
+ return string(content)
+}
+
+func fCreate(path string) bool {
+ var _, err = os.Stat(path)
+ if os.IsNotExist(err) {
+ var file, err = os.Create(path)
+ if err != nil {
+ log.Println(err)
+ return false
+ }
+ defer file.Close()
+ }
+ return true
+}
+
+func fWrite(path, content string) {
+ err := ioutil.WriteFile(path, []byte(content), 0644)
+ if err != nil {
+ log.Fatal(err)
+ }
}
diff --git a/werf.yaml b/werf.yaml
index 73e594b..b893e49 100644
--- a/werf.yaml
+++ b/werf.yaml
@@ -27,7 +27,7 @@ ansible:
- build-base
- gcc
- name: Build backend
- command: go build -ldflags='-extldflags "-static" -s -w' -o openvpn-ui
+ command: go build -ldflags='-extldflags "-static" -s -w' -o openvpn-admin
environment:
CGO_ENABLED: 0
GOOS: linux
@@ -64,13 +64,24 @@ image: openvpn-admin
from: alpine:3.11
import:
- artifact: backend-builder
- add: /app/openvpn-ui
- to: /usr/bin/openvpn-ui
+ add: /app/openvpn-admin
+ to: /usr/bin/openvpn-admin
before: setup
- artifact: frontend-builder
add: /app/static
to: /app/static
before: setup
+git:
+ - add: /client.conf.tpl
+ to: /app/client.conf.tpl
+ stageDependencies:
+ setup:
+ - "*"
+ - add: /ccd.tpl
+ to: /app/ccd.tpl
+ stageDependencies:
+ setup:
+ - "*"
ansible:
install:
- name: Install packages
@@ -88,8 +99,8 @@ ansible:
image: openvpn
from: alpine:3.11
git:
- - add: /.werffiles/configure.sh
- to: /etc/openvpn/setup/configure.sh
+ - add: /.werffiles/
+ to: /etc/openvpn/setup/
stageDependencies:
install:
- "*"