routeros-scripts/check-certificates

115 lines
4.7 KiB
Text
Raw Normal View History

#!rsc
2018-07-05 13:29:26 +00:00
# RouterOS script: check-certificates
2020-01-01 16:00:39 +00:00
# Copyright (c) 2013-2020 Christian Hesse <mail@eworm.de>
2018-07-05 13:29:26 +00:00
#
# check for certificate validity
global: variable names are CamelCase ___ _ ___ __ / _ )(_)__ _ / _/__ _/ /_ / _ / / _ `/ / _/ _ `/ __/ /____/_/\_, / /_/ \_,_/\__/ _ __ /___/ _ __ | | / /___ __________ (_)___ ____ _/ / | | /| / / __ `/ ___/ __ \/ / __ \/ __ `/ / | |/ |/ / /_/ / / / / / / / / / / /_/ /_/ |__/|__/\__,_/_/ /_/ /_/_/_/ /_/\__, (_) /____/ RouterOS has some odd behavior when it comes to variable names. Let's have a look at the interfaces: [admin@MikroTik] > / interface print where name=en1 Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU 0 RS en1 ether 1500 1598 That looks ok. Now we use a script: { :local interface "en1"; / interface print where name=$interface; } And the result... [admin@MikroTik] > { :local interface "en1"; {... / interface print where name=$interface; } Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU 0 RS en1 ether 1500 1598 ... still looks ok. We make a little modification to the script: { :local name "en1"; / interface print where name=$name; } And the result: [admin@MikroTik] > { :local name "en1"; {... / interface print where name=$name; } Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU 0 RS en1 ether 1500 1598 1 S en2 ether 1500 1598 2 S en3 ether 1500 1598 3 S en4 ether 1500 1598 4 S en5 ether 1500 1598 5 R br-local bridge 1500 1598 Ups! The filter has no effect! That happens whenever the variable name ($name) matches the property name (name=). And another modification: { :local type "en1"; / interface print where name=$type; } And the result: [admin@MikroTik] > { :local type "en1"; {... / interface print where name=$type; } Flags: D - dynamic, X - disabled, R - running, S - slave # NAME TYPE ACTUAL-MTU L2MTU Ups! Nothing? Even if the variable name ($type) matches whatever property name (type=) things go wrong. The answer from MikroTik support (in Ticket#2019010222000454): > This is how scripting works in RouterOS and we will not fix it. To get around this we use variable names in CamelCase. Let's hope Mikrotik never ever introduces property names in CamelCase... *fingers crossed*
2019-01-03 16:45:43 +00:00
:global CertRenewPass;
2020-02-28 14:26:26 +00:00
:global CertRenewUrl;
:global Identity;
2018-07-05 13:29:26 +00:00
:global CertificateNameByCN;
2020-02-28 14:26:26 +00:00
:global LogPrintExit;
:global ParseKeyValueStore;
:global SendNotification;
:global TimeIsSync;
:global UrlEncode;
:global WaitForFile;
:local FormatExpire do={
:global CharacterReplace;
:return [ $CharacterReplace [ $CharacterReplace [ :tostr $1 ] "w" "w " ] "d" "d " ];
}
:if ($TimeIsSync = false) do={
$LogPrintExit warning "Time is not yet synchronized." true;
}
:foreach Cert in=[ / certificate find where !revoked !ca expires-after<3w ] do={
:local CertVal [ / certificate get $Cert ];
2018-07-05 13:29:26 +00:00
:do {
:if ([ :len $CertRenewUrl ] = 0) do={
$LogPrintExit warning "No CertRenewUrl given." true;
}
:foreach Type in={ ".pem"; ".p12" } do={
:local CertFileName ([ $UrlEncode ($CertVal->"common-name") ] . $Type);
:do {
/ tool fetch check-certificate=yes-without-crl \
($CertRenewUrl . $CertFileName) dst-path=$CertFileName;
$WaitForFile $CertFileName;
:foreach PassPhrase in=$CertRenewPass do={
/ certificate import file-name=$CertFileName passphrase=$PassPhrase;
}
/ file remove [ find where name=$CertFileName ];
:foreach CertInChain in=[ / certificate find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=($CertVal->"common-name") ] do={
$CertificateNameByCN [ / certificate get $CertInChain common-name ];
}
} on-error={
$LogPrintExit debug ("Could not download certificate file " . $CertFileName) false;
}
}
:local CertNew [ / certificate find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>3w ];
:local CertNewVal [ / certificate get $CertNew ];
:if ($Cert != $CertNew) do={
$LogPrintExit debug ("Certificate '" . $CertVal->"name" . "' was not updated, but replaced.") false;
/ ip service set certificate=($CertNewVal->"name") [ find where certificate=($CertVal->"name") ];
:do {
/ ip ipsec identity set certificate=($CertNewVal->"name") [ / ip ipsec identity find where certificate=($CertVal->"name") ];
/ ip ipsec identity set remote-certificate=($CertNewVal->"name") [ / ip ipsec identity find where remote-certificate=($CertVal->"name") ];
} on-error={
$LogPrintExit debug ("Setting IPSEC certificates failed. Package 'security' not installed?") false;
}
:do {
/ ip hotspot profile set ssl-certificate=($CertNewVal->"name") [ / ip hotspot profile find where ssl-certificate=($CertVal->"name") ];
} on-error={
$LogPrintExit debug ("Setting hotspot certificates failed. Package 'hotspot' not installed?") false;
}
/ certificate remove $Cert;
/ certificate set $CertNew name=($CertVal->"name");
}
$SendNotification ("Certificate renewed") \
("A certificate on " . $Identity . " has been renewed.\n\n" . \
"Name: " . ($CertVal->"name") . "\n" . \
"CommonName: " . ($CertNewVal->"common-name") . "\n" . \
"Fingerprint: " . ($CertNewVal->"fingerprint") . "\n" . \
"Issuer: " . ([ $ParseKeyValueStore ($CertNewVal->"issuer") ]->"CN") . "\n" . \
"Validity: " . ($CertNewVal->"invalid-before") . " to " . ($CertNewVal->"invalid-after") . "\n" . \
"Expires in: " . [ $FormatExpire ($CertNewVal->"expires-after") ]) "" "true";
$LogPrintExit info ("The certificate " . ($CertVal->"name") . " has been renewed.") false;
} on-error={
$LogPrintExit debug ("Could not renew certificate " . ($CertVal->"name") . ".") false;
}
}
:foreach Cert in=[ / certificate find where !revoked expires-after<2w fingerprint~"."] do={
:local CertVal [ / certificate get $Cert ];
:local ExpiresAfter [ $FormatExpire ($CertVal->"expires-after") ];
:local State "is about to expire";
:if (($CertVal->"expired") = true) do={
:set ExpiresAfter "expired";
:set State "expired";
2018-07-05 13:29:26 +00:00
}
$SendNotification ("Certificate warning!") \
("A certificate on " . $Identity . " " . $State . ".\n\n" . \
"Name: " . ($CertVal->"name") . "\n" . \
"CommonName: " . ($CertVal->"common-name") . "\n" . \
"Fingerprint: " . ($CertVal->"fingerprint") . "\n" . \
"Issuer: " . ($CertVal->"ca") . ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN") . "\n" . \
"Validity: " . ($CertVal->"invalid-before") . " to " . ($CertVal->"invalid-after") . "\n" . \
"Expires in: " . $ExpiresAfter);
$LogPrintExit warning ("The certificate " . ($CertVal->"name") . " " . $State . \
", it is invalid after " . ($CertVal->"invalid-after") . ".") false;
2018-07-05 13:29:26 +00:00
}