tools/install_openvpn.sh

#!/bin/bash
# install_openvpn.sh - Install OpenVPN and generate required certificates
#
# install_openvpn.sh --client name
# install_openvpn.sh --server [name]
#
# name is used on the CN of the generated cert, and the filename of
# the configuration, certificate and key files.
#
# --server mode configures the host with a running OpenVPN server instance
# --client mode creates a tarball of a client configuration for this server

# Get config file
if [ -e localrc ]; then
    . localrc
fi
if [ -e vpnrc ]; then
    . vpnrc
fi

# Do some IP manipulation
function cidr2netmask() {
    set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
    if [[ $1 -gt 1 ]]; then
        shift $1
    else
        shift
    fi
    echo ${1-0}.${2-0}.${3-0}.${4-0}
}

FIXED_NET=`echo $FIXED_RANGE | cut -d'/' -f1`
FIXED_CIDR=`echo $FIXED_RANGE | cut -d'/' -f2`
FIXED_MASK=`cidr2netmask $FIXED_CIDR`

# VPN Config
VPN_SERVER=${VPN_SERVER:-`ifconfig eth0 | awk "/inet addr:/ { print \$2 }" | cut -d: -f2`}  # 50.56.12.212
VPN_PROTO=${VPN_PROTO:-tcp}
VPN_PORT=${VPN_PORT:-6081}
VPN_DEV=${VPN_DEV:-tap0}
VPN_BRIDGE=${VPN_BRIDGE:-br100}
VPN_BRIDGE_IF=${VPN_BRIDGE_IF:-$FLAT_INTERFACE}
VPN_CLIENT_NET=${VPN_CLIENT_NET:-$FIXED_NET}
VPN_CLIENT_MASK=${VPN_CLIENT_MASK:-$FIXED_MASK}
VPN_CLIENT_DHCP="${VPN_CLIENT_DHCP:-net.1 net.254}"

VPN_DIR=/etc/openvpn
CA_DIR=$VPN_DIR/easy-rsa

usage() {
    echo "$0 - OpenVPN install and certificate generation"
    echo ""
    echo "$0 --client name"
    echo "$0 --server [name]"
    echo ""
    echo " --server mode configures the host with a running OpenVPN server instance"
    echo " --client mode creates a tarball of a client configuration for this server"
    exit 1
}

if [ -z $1 ]; then
    usage
fi

# Install OpenVPN
VPN_EXEC=`which openvpn`
if [ -z "$VPN_EXEC" -o ! -x "$VPN_EXEC" ]; then
    apt-get install -y openvpn bridge-utils
fi
if [ ! -d $CA_DIR ]; then
    cp -pR /usr/share/doc/openvpn/examples/easy-rsa/2.0/ $CA_DIR
fi

# Keep track of the current directory
TOOLS_DIR=$(cd $(dirname "$0") && pwd)
TOP_DIR=$(cd $TOOLS_DIR/.. && pwd)

WEB_DIR=$TOP_DIR/../vpn
if [[ ! -d $WEB_DIR ]]; then
    mkdir -p $WEB_DIR
fi
WEB_DIR=$(cd $TOP_DIR/../vpn && pwd)

cd $CA_DIR
source ./vars

# Override the defaults
export KEY_COUNTRY="US"
export KEY_PROVINCE="TX"
export KEY_CITY="SanAntonio"
export KEY_ORG="Cloudbuilders"
export KEY_EMAIL="rcb@lists.rackspace.com"

if [ ! -r $CA_DIR/keys/dh1024.pem ]; then
    # Initialize a new CA
    $CA_DIR/clean-all
    $CA_DIR/build-dh
    $CA_DIR/pkitool --initca
    openvpn --genkey --secret $CA_DIR/keys/ta.key  ## Build a TLS key
fi

do_server() {
    NAME=$1
    # Generate server certificate
    $CA_DIR/pkitool --server $NAME

    (cd $CA_DIR/keys;
        cp $NAME.crt $NAME.key ca.crt dh1024.pem ta.key $VPN_DIR
    )
    cat >$VPN_DIR/br-up <<EOF
#!/bin/bash

BR="$VPN_BRIDGE"
TAP="\$1"

if [[ ! -d /sys/class/net/\$BR ]]; then
    brctl addbr \$BR
fi

for t in \$TAP; do
    openvpn --mktun --dev \$t
    brctl addif \$BR \$t
    ifconfig \$t 0.0.0.0 promisc up
done
EOF
    chmod +x $VPN_DIR/br-up
    cat >$VPN_DIR/br-down <<EOF
#!/bin/bash

BR="$VPN_BRIDGE"
TAP="\$1"

for i in \$TAP; do
    brctl delif \$BR $t
    openvpn --rmtun --dev \$i
done
EOF
    chmod +x $VPN_DIR/br-down
    cat >$VPN_DIR/$NAME.conf <<EOF
proto $VPN_PROTO
port $VPN_PORT
dev $VPN_DEV
up $VPN_DIR/br-up
down $VPN_DIR/br-down
cert $NAME.crt
key $NAME.key  # This file should be kept secret
ca ca.crt
dh dh1024.pem
duplicate-cn
server-bridge $VPN_CLIENT_NET $VPN_CLIENT_MASK $VPN_CLIENT_DHCP
ifconfig-pool-persist ipp.txt
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
EOF
    /etc/init.d/openvpn restart
}

do_client() {
    NAME=$1
    # Generate a client certificate
    $CA_DIR/pkitool $NAME

    TMP_DIR=`mktemp -d`
    (cd $CA_DIR/keys;
        cp -p ca.crt ta.key $NAME.key $NAME.crt $TMP_DIR
    )
    if [ -r $VPN_DIR/hostname ]; then
        HOST=`cat $VPN_DIR/hostname`
    else
        HOST=`hostname`
    fi
    cat >$TMP_DIR/$HOST.conf <<EOF
proto $VPN_PROTO
port $VPN_PORT
dev $VPN_DEV
cert $NAME.crt
key $NAME.key  # This file should be kept secret
ca ca.crt
client
remote $VPN_SERVER $VPN_PORT
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
comp-lzo
verb 3
EOF
    (cd $TMP_DIR; tar cf $WEB_DIR/$NAME.tar *)
    rm -rf $TMP_DIR
    echo "Client certificate and configuration is in $WEB_DIR/$NAME.tar"
}

# Process command line args
case $1 in
    --client)   if [ -z $2 ]; then
                    usage
                fi
                do_client $2
                ;;
    --server)   if [ -z $2 ]; then
                    NAME=`hostname`
                else
                    NAME=$2
                    # Save for --client use
                    echo $NAME >$VPN_DIR/hostname
                fi
                do_server $NAME
                ;;
    --clean)    $CA_DIR/clean-all
                ;;
    *)          usage
esac