Merge pull request #95 from redfast00/cleanup

Sanitization 'n input validation

scripts/listOVPN.sh

@@ -3,9 +3,8 @@
 
 INDEX="/etc/openvpn/easy-rsa/keys/index.txt"
 printf "\n"
-if [ ! -f $INDEX ]; then
+if [ ! -f "$INDEX" ]; then
-        printf "The file: $INDEX \n"
+        echo "The file: $INDEX was not found!"
-        printf "Was not Found!\n"
         exit 1
 fi
 
@@ -14,18 +13,15 @@ printf "\n"
 printf "\e[1m::: Certificate Status List :::\e[0m\n"
 printf " ::\e[4m  Status  \e[0m||\e[4m   Name   \e[0m:: \n"
 
-while read -r line || [[ -n "$line" ]]; do
+while read -r line || [ -n "$line" ]; do
-    status=$(echo $line | awk '{print $1}')
+    STATUS=$(echo "$line" | awk '{print $1}')
-    var=$(echo $line | sed -e 's/^.*CN=\([^/]*\)\/.*/\1/')
+    NAME=$(echo "$line" | sed -e 's/^.*CN=\([^/]*\)\/.*/\1/')
-    if [[ $status = "V" ]]; then
+    if [ "$STATUS" = "V" ]; then
-        printf "     Valid   :: "
+        printf "     Valid   ::   %s\n" "$NAME"
-        printf "  $var\n"
+    elif [ "$STATUS" = "R" ]; then
-    elif [[ $status = "R" ]]; then
+        printf "     Revoked ::   %s\n" "$NAME"
-        printf "     Revoked :: "
-        printf "  $var\n"
     else
-        printf "     Unknown :: \n"
+        printf "     Unknown ::   %s\n" "$NAME"
-        printf "  $var\n"
     fi
 done <$INDEX
 printf "\n"

scripts/makeOVPN.sh

@@ -8,6 +8,7 @@ OKEY=".key"
 KEY=".3des.key"
 CA="ca.crt"
 TA="ta.key"
+INDEX="/etc/openvpn/easy-rsa/keys/index.txt"
 INSTALL_USER=$(cat /etc/pivpn/INSTALL_USER)
 
 # Functions def
@@ -19,7 +20,7 @@ function keynoPASS() {
 
     #Build the client key
     expect << EOF
-    spawn ./build-key $NAME
+    spawn ./build-key "$NAME"
     expect "Country Name" { send "\r" }
     expect "State or Province Name" { send "\r" }
     expect "Locality Name" { send "\r" }
@@ -35,7 +36,7 @@ function keynoPASS() {
     expect eof
 EOF
 
-    cd keys
+    cd keys || exit
 
 }
 
@@ -44,21 +45,32 @@ function keyPASS() {
     stty -echo
     while true
     do
-        printf "Enter the password for the Client:  "
+        printf "Enter the password for the client:  "
-        read PASSWD
+        read -r PASSWD
         printf "\n"
         printf "Enter the password again to verify:  "
-        read PASSWD2
+        read -r PASSWD2
         printf "\n"
         [ "$PASSWD" = "$PASSWD2" ] && break
         printf "Passwords do not match! Please try again.\n"
     done
     stty echo
+    if [[ -z "$PASSWD" ]]; then
+        echo "You left the password blank"
+        echo "If you don't want a password, please run:"
+        echo "pivpn add nopass"
+        exit 1
+    fi
+    if [ ${#PASSWD} -lt 4 ] || [ ${#PASSWD} -gt 1024 ]
+    then
+        echo "Password must be between from 4 to 1024 characters"
+        exit 1
+    fi
 
     #Build the client key and then encrypt the key
 
     expect << EOF
-    spawn ./build-key-pass $NAME
+    spawn ./build-key-pass "$NAME"
     expect "Enter PEM pass phrase" { send "$PASSWD\r" }
     expect "Verifying - Enter PEM pass phrase" { send "$PASSWD\r" }
     expect "Country Name" { send "\r" }
@@ -76,10 +88,10 @@ function keyPASS() {
     expect eof
 EOF
 
-    cd keys
+    cd keys || exit
 
     expect << EOF
-    spawn openssl rsa -in $NAME$OKEY -des3 -out $NAME$KEY
+    spawn openssl rsa -in "$NAME$OKEY" -des3 -out "$NAME$KEY"
     expect "Enter pass phrase for" { send "$PASSWD\r" }
     expect "Enter PEM pass phrase" { send "$PASSWD\r" }
     expect "Verifying - Enter PEM pass" { send "$PASSWD\r" }
@@ -88,14 +100,33 @@ EOF
 }
 
 printf "Enter a Name for the Client:  "
-read NAME
+read -r NAME
 
-if [[ -z "$NAME" ]]; then
+if [[ "$NAME" =~ [^a-zA-Z0-9] ]]; then
-    printf '%s\n' "::: You can not leave this blank!"
+    echo "Name can only contain alphanumeric characters"
     exit 1
 fi
 
-cd /etc/openvpn/easy-rsa
+if [[ -z "$NAME" ]]; then
+    echo "You cannot leave the name blank"
+    exit 1
+fi
+
+# Check if name is already in use
+while read -r line || [ -n "$line" ]; do
+    if [ "$(echo "$line" | sed -e 's/^.*CN=\([^/]*\)\/.*/\1/')" = "$NAME" ]; then
+        echo "Name is already in use"
+        exit 1
+    fi
+done <$INDEX
+
+# Check if name is reserved
+if [ "$NAME" = "ta" ] || [ "$NAME" = "server" ] || [ "$NAME" = "ca" ]; then
+    echo "Sorry, this name is unavailable, please choose another one"
+    exit 1
+fi
+
+cd /etc/openvpn/easy-rsa || exit
 source /etc/openvpn/easy-rsa/vars
 
 if [[ "$@" =~ "nopass" ]]; then
@@ -105,64 +136,66 @@ else
 fi
 
 #1st Verify that clients Public Key Exists
-if [ ! -f $NAME$CRT ]; then 
+if [ ! -f "$NAME$CRT" ]; then
     echo "[ERROR]: Client Public Key Certificate not found: $NAME$CRT"
     exit
 fi
 echo "Client's cert found: $NAME$CRT"
 
 #Then, verify that there is a private key for that client
-if [ ! -f $NAME$KEY ]; then 
+if [ ! -f "$NAME$KEY" ]; then
     echo "[ERROR]: Client 3des Private Key not found: $NAME$KEY"
     exit
 fi
 echo "Client's Private Key found: $NAME$KEY"
 
 #Confirm the CA public key exists
-if [ ! -f $CA ]; then 
+if [ ! -f "$CA" ]; then
     echo "[ERROR]: CA Public Key not found: $CA"
     exit
 fi
 echo "CA public Key found: $CA"
 
 #Confirm the tls-auth ta key file exists
-if [ ! -f $TA ]; then 
+if [ ! -f "$TA" ]; then
     echo "[ERROR]: tls-auth Key not found: $TA"
     exit
 fi
 echo "tls-auth Private Key found: $TA"
 
-#Ready to make a new .ovpn file - Start by populating with the 
+#Ready to make a new .ovpn file
-#default file 
+{
-cat $DEFAULT > $NAME$FILEEXT 
+    # Start by populating with the default file
+    cat "$DEFAULT"
 
     #Now, append the CA Public Cert
-echo "<ca>" >> $NAME$FILEEXT 
+    echo "<ca>"
-cat $CA >> $NAME$FILEEXT 
+    cat "$CA"
-echo "</ca>" >> $NAME$FILEEXT
+    echo "</ca>"
 
     #Next append the client Public Cert
-echo "<cert>" >> $NAME$FILEEXT 
+    echo "<cert>"
-cat $NAME$CRT | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >> $NAME$FILEEXT 
+    sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' < "$NAME$CRT"
-echo "</cert>" >> $NAME$FILEEXT 
+    echo "</cert>"
 
     #Then, append the client Private Key
-echo "<key>" >> $NAME$FILEEXT 
+    echo "<key>"
-cat $NAME$KEY >> $NAME$FILEEXT 
+    cat "$NAME$KEY"
-echo "</key>" >> $NAME$FILEEXT 
+    echo "</key>"
 
     #Finally, append the TA Private Key
-echo "<tls-auth>" >> $NAME$FILEEXT 
+    echo "<tls-auth>"
-cat $TA >> $NAME$FILEEXT 
+    cat "$TA"
-echo "</tls-auth>" >> $NAME$FILEEXT 
+    echo "</tls-auth>"
+} > "$NAME$FILEEXT"
 
 # Copy the .ovpn profile to the home directory for convenient remote access
-cp /etc/openvpn/easy-rsa/keys/$NAME$FILEEXT /home/$INSTALL_USER/ovpns/$NAME$FILEEXT
+cp "/etc/openvpn/easy-rsa/keys/$NAME$FILEEXT" "/home/$INSTALL_USER/ovpns/$NAME$FILEEXT"
-chown $INSTALL_USER /home/$INSTALL_USER/ovpns/$NAME$FILEEXT
+chown "$INSTALL_USER" "/home/$INSTALL_USER/ovpns/$NAME$FILEEXT"
 printf "\n\n"
 printf "========================================================\n"
-printf "\e[1mDone! $NAME$FILEEXT successfully created!\e[0m \n"
+printf "\e[1mDone! %s successfully created!\e[0m \n" "$NAME$FILEEXT"
-printf "$NAME$FILEEXT was copied to:\n"
+printf "%s was copied to:\n" "$NAME$FILEEXT"
-printf "  /home/$INSTALL_USER/ovpns\n"
+printf "  /home/%s/ovpns\n" "$INSTALL_USER"
 printf "for easy transfer.\n"
 printf "========================================================\n\n"

scripts/removeOVPN.sh

@@ -6,9 +6,8 @@ REVOKE_STATUS=$(cat /etc/pivpn/REVOKE_STATUS)
 PLAT=$(cat /etc/pivpn/DET_PLATFORM)
 INDEX="/etc/openvpn/easy-rsa/keys/index.txt"
 
-if [ ! -f $INDEX ]; then
+if [ ! -f "$INDEX" ]; then
-        printf "The file: $INDEX \n"
+        printf "The file: %s was not found\n" "$INDEX"
-        printf "Was not Found!\n"
         exit 1
 fi
 
@@ -16,49 +15,49 @@ printf "\n"
 printf " ::\e[4m  Certificate List  \e[0m:: \n"
 
 i=0
-while read -r line || [[ -n "$line" ]]; do
+while read -r line || [ -n "$line" ]; do
-    status=$(echo $line | awk '{print $1}')
+    STATUS=$(echo "$line" | awk '{print $1}')
-    if [[ $status = "V" ]]; then
+    if [[ "$STATUS" = "V" ]]; then
-        var=$(echo $line | sed -e 's/^.*CN=\([^/]*\)\/.*/\1/')
+        NAME=$(echo "$line" | sed -e 's/^.*CN=\([^/]*\)\/.*/\1/')
-        certs[$i]=$var
+        CERTS[$i]=$NAME
         if [ "$i" != 0 ]; then
-            printf "  $var\n"
+            # Prevent printing "server" certificate
+            printf "  %s\n" "$NAME"
         fi
         let i=i+1
-        y=$i
     fi
 done <$INDEX
 printf "\n"
 
 echo "::: Please enter the Name of the client to be revoked from the list above:"
-read NAME
+read -r NAME
 
 if [[ -z "$NAME" ]]; then
-    printf '%s\n' "::: You can not leave this blank!"
+    echo "::: You can not leave this blank!"
     exit 1
 fi
 
-for((x=1;x<=$y;++x)); do
+for((x=1;x<=i;++x)); do
-    if [[ ${certs[$x]} = ${NAME} ]]; then
+    if [ "${CERTS[$x]}" = "${NAME}" ]; then
-        Valid=1
+        VALID=1
     fi
 done
 
-if [[ -z "$Valid" ]]; then
+if [ -z "$VALID" ]; then
     printf "::: You didn't enter a valid cert name!\n"
     exit 1
 fi
 
-cd /etc/openvpn/easy-rsa
+cd /etc/openvpn/easy-rsa || exit
 source /etc/openvpn/easy-rsa/vars
 
-./revoke-full $NAME
+./revoke-full "$NAME"
 echo "::: Certificate revoked, removing ovpns from /home/$INSTALL_USER/ovpns"
-rm /home/$INSTALL_USER/ovpns/$NAME.ovpn
+rm "/home/$INSTALL_USER/ovpns/$NAME.ovpn"
 cp /etc/openvpn/easy-rsa/keys/crl.pem /etc/openvpn/crl.pem
 echo "::: Completed!"
 
-if [ $REVOKE_STATUS == 0 ]; then
+if [ "$REVOKE_STATUS" == 0 ]; then
         echo 1 > /etc/pivpn/REVOKE_STATUS
         printf "\nThis seems to be the first time you have revoked a cert.\n"
         printf "We are adding the CRL to the server.conf and restarting openvpn.\n"