#!/bin/sh
# vpncheckCN-cert -- an OpenVPN tls-verify script
# """""""""""""""""""""""""""""""""""""""""""
#
# This script checks if the peer is in the allowed
# user list by checking the CN (common name) of the
# X509 certificate against a provided text file.
#
# For example in OpenVPN, you could use the directive
# (as one line):
#
# tls-verify "/etc/openvpn/vpncheckCN-cert.sh
# /etc/openvpn/userlist.txt"
#
# This would cause the connection to be dropped unless
# the client common name is within the userlist.txt.
#
# Special care has been taken to ensure that this script
# also works on openwrt systems where only busybox is
# available
#
# Written by Robert Penz <robert[at]penz.name> under the GPL 2
# Parts are copied from the verify-cn sample OpenVPN
# tls-verify script.
#
# Modifications made by Rafal Cichosz (rpc[at]rpc.one.pl)
[ $# -eq 3 ] || { echo usage: ovpnCNcheck.sh userfile certificate_depth X509_NAME_oneline ; exit 255 ; }
# $2 -> certificate_depth
if [ $2 -eq 0 ] ; then
# $3 -> X509_NAME_oneline
# $1 -> cn we are looking for
# echo "grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0" >> /etc/openvpn/client/1
# echo "grep -q "^$common_name $username" $PWD/userlist.txt && exit 0" >> /etc/openvpn/client/1
#script debian
# grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 0
#or other script by openwrt
# grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0
# echo "grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0" >> /etc/openvpn/client/2
# echo "grep -q `echo $3` && exit 1" >> /etc/openvpn/client/2
# echo "grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 2" >> /etc/openvpn/client/2
# echo "grep -q `echo Jan_Nowak` $1 && exit 3" >> /etc/openvpn/client/2
# grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0
# grep -q `echo Jan_Nowak` $1 && exit 0
# grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 0
# Uniwersalne Debian+Openwrt
# echo "grep -w "`echo "$3" | sed -r 's/.*CN=([^,]*),.*/\1/'`" $1 && exit 0" >> /etc/openvpn/client/2
grep -w "`echo "$3" | sed -r 's/.*CN=([^,]*),.*/\1/'`" $1 && exit 0
exit 1
fi
exit 0