pfSense

<?php

/*

 *

 * part of pfSense (https://www.pfsense.org)

 * All rights reserved.

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

$openssl_crl_status = array(

	OCSP_REVOKED_STATUS_NOSTATUS              => "No Status (default)",

	OCSP_REVOKED_STATUS_UNSPECIFIED           => "Unspecified",

	OCSP_REVOKED_STATUS_KEYCOMPROMISE         => "Key Compromise",

	OCSP_REVOKED_STATUS_CACOMPROMISE          => "CA Compromise",

	OCSP_REVOKED_STATUS_AFFILIATIONCHANGED    => "Affiliation Changed",

	OCSP_REVOKED_STATUS_SUPERSEDED            => "Superseded",

	OCSP_REVOKED_STATUS_CESSATIONOFOPERATION  => "Cessation of Operation",

	OCSP_REVOKED_STATUS_CERTIFICATEHOLD       => "Certificate Hold"

);

	global $config;

		foreach ($config['ca'] as & $ca) {

			if ($ca['refid'] == $refid) {

		}

	}

	return false;

}

function & lookup_ca_by_subject($subject) {

	global $config;

		foreach ($config['ca'] as & $ca) {

	return false;

}

function & lookup_cert($refid) {

	global $config;

		foreach ($config['cert'] as & $cert) {

			if ($cert['refid'] == $refid) {

		}

	}

	return false;

}

	global $config;

		foreach ($config['cert'] as & $cert) {

			if ($cert['descr'] == $name) {

		}

	}

function & lookup_crl($refid) {

	global $config;

		foreach ($config['crl'] as & $crl) {

			if ($crl['refid'] == $refid) {

		}

	}

	return false;

}

		while ($crt) {

			$caref = $crt['caref'];

			if ($crt) {

		return $chain;

	}

	return false;

}

function ca_chain(& $cert) {

		$cas = ca_chain_array($cert);

			foreach ($cas as & $ca_cert) {

				$ca .= "\n";

			}

	}

	return "";

}

	$ca['crt'] = base64_encode($str);

		$ca['serial'] = 0;

	} else {

	$issuer = cert_get_issuer($str, false);

	/* Correct if child certificate was loaded first */

		foreach ($config['ca'] as & $oca) {

	if (is_array($config['cert'])) {

		foreach ($config['cert'] as & $cert) {

}

	$args = array(

		"encrypt_key" => false);

	// generate a new key pair

		return false;

	}

	// generate a certificate signing request

	$res_csr = openssl_csr_new($dn, $res_key, $args);

		return false;

	}

	// self sign the certificate

	$res_crt = openssl_csr_sign($res_csr, null, $res_key, $lifetime, $args);

		return false;

	}

	// export our certificate data

	// return our ca information

	$ca['crt'] = base64_encode($str_crt);

	$ca['prv'] = base64_encode($str_key);

	$ca['serial'] = 0;

	return true;

}

	$signing_ca =& lookup_ca($caref);

	$signing_ca_res_crt = openssl_x509_read(base64_decode($signing_ca['crt']));

	$signing_ca_res_key = openssl_pkey_get_private(array(0 => base64_decode($signing_ca['prv']) , 1 => ""));

		return false;

	}

	$args = array(

		"private_key_type" => OPENSSL_KEYTYPE_RSA,

		"encrypt_key" => false);

	// generate a new key pair

	$res_key = openssl_pkey_new($args);

		return false;

	}

	// generate a certificate signing request

	$res_csr = openssl_csr_new($dn, $res_key, $args);

		return false;

	}

	// Sign the certificate

	$res_crt = openssl_csr_sign($res_csr, $signing_ca_res_crt, $signing_ca_res_key, $lifetime, $args, $signing_ca_serial);

		return false;

	}

	// export our certificate data

	if (!openssl_pkey_export($res_key, $str_key) ||

	// return our ca information

	$ca['crt'] = base64_encode($str_crt);

	$ca['prv'] = base64_encode($str_key);

	$ca['serial'] = 0;

	return true;

}

	$cert['crt'] = base64_encode($crt_str);

	$cert['prv'] = base64_encode($key_str);

	$subject = cert_get_subject($crt_str, false);

	$issuer = cert_get_issuer($crt_str, false);

	return true;

}

		$cert['caref'] = $caref;

		$ca =& lookup_ca($caref);

		$ca_str_crt = base64_decode($ca['crt']);

		$ca_str_key = base64_decode($ca['prv']);

		$ca_res_crt = openssl_x509_read($ca_str_crt);

		$ca_res_key = openssl_pkey_get_private(array(0 => $ca_str_key, 1 => ""));

			return false;

		}

			$ca['serial'] = 0;

		}

	}

		case "ca":

			$cert_type = "v3_ca";

			break;

		case "server":

			break;

		default:

			$cert_type = "usr_cert";

			break;

	}

	// pass subjectAltName over environment variable 'SAN'

	if ($dn['subjectAltName']) {

		putenv("SAN={$dn['subjectAltName']}"); // subjectAltName can be set _only_ via configuration file

		$cert_type .= '_san';

		unset($dn['subjectAltName']);

	}

		"encrypt_key" => false);

	// generate a new key pair

		return false;

	}

	if ($type == "self-signed") {

		$ca           = null;

		$ca_res_crt   = null;

		$ca_res_key   = $res_key;

		$ca_serial    = 0;

		$cert['type'] = "server";

	}

	$res_csr = openssl_csr_new($dn, $res_key, $args);

		return false;

	}

				 $args, $ca_serial);

		return false;

	}

	// export our certificate data

	// return our certificate information

	$cert['crt'] = base64_encode($str_crt);

	$cert['prv'] = base64_encode($str_key);

	return true;

}

	$args = array(

		"encrypt_key" => false);

	// generate a new key pair

		return false;

	}

	// generate a certificate signing request

	$res_csr = openssl_csr_new($dn, $res_key, $args);

		return false;

	}

	// export our request data

	// return our request information

	$cert['csr'] = base64_encode($str_csr);

	$cert['prv'] = base64_encode($str_key);

	return true;

}

function csr_complete(& $cert, $str_crt) {

	cert_import($cert, $str_crt, $str_key);

	return true;

}

function csr_get_subject($str_crt, $decode = true) {

	$components = openssl_csr_get_subject($str_crt);

	return $subject;

}

function cert_get_subject($str_crt, $decode = true) {

	$inf_crt = openssl_x509_parse($str_crt);

	$components = $inf_crt['subject'];

			ksort($v);

				$asubject = "{$a}={$w}";

				$subject = (strlen($subject)) ? "{$asubject}, {$subject}" : $asubject;

			}

			$subject = (strlen($subject)) ? "{$asubject}, {$subject}" : $asubject;

		}

	return $subject;

}

function cert_get_subject_array($crt) {

	$str_crt = base64_decode($crt);

	$inf_crt = openssl_x509_parse($str_crt);

	$components = $inf_crt['subject'];

	return $subject_array;

}

	$str_crt = base64_decode($crt);

	$inf_crt = openssl_x509_parse($str_crt);

	return $inf_crt['subject'];

}

	if ($decode) {

		$str_crt = base64_decode($str_crt);

	}

	$sans = array();

	$crt_details = openssl_x509_parse($str_crt);

	if (!empty($crt_details['extensions']['subjectAltName'])) {

		$sans = explode(',', $crt_details['extensions']['subjectAltName']);

	}

	return $sans;

}

	$inf_crt = openssl_x509_parse($str_crt);

	$components = $inf_crt['issuer'];

	if (empty($components) || !is_array($components)) {

	ksort($components);

			ksort($v);

			foreach ($v as $w) {

				$aissuer = "{$a}={$w}";

				$issuer = (strlen($issuer)) ? "{$aissuer}, {$issuer}" : $aissuer;

			}

		} else {

			$aissuer = "{$a}={$v}";

			$issuer = (strlen($issuer)) ? "{$aissuer}, {$issuer}" : $aissuer;

		}

	return $issuer;

}

function cert_get_publickey($str_crt, $decode = true, $type = "crt") {

		case 'prv':

			exec("echo \"{$str_crt}\" | openssl pkey -pubout", $out);

			break;

		case 'crt':

			exec("echo \"{$str_crt}\" | openssl x509 -inform pem -noout -pubkey", $out);

			break;

		case 'csr':

			exec("echo \"{$str_crt}\" | openssl req -inform pem -noout -pubkey", $out);

			break;

		default:

			$out = array();

			break;

function cert_get_purpose($str_crt, $decode = true) {

		"1.3.6.1.5.5.8.2.2" => "IP Security IKE Intermediate",

	);

	$purpose = array();

		$purpose['ku'] = explode(',', $crt_details['extensions']['keyUsage']);

		foreach ($purpose['ku'] as & $ku) {

			$ku = trim($ku);

			if (array_key_exists($ku, $extended_oids)) {

				$ku = $extended_oids[$ku];

			}

		}

	} else {

		$purpose['ku'] = array();

	}

	if (!empty($crt_details['extensions']['extendedKeyUsage'])) {

		$purpose['eku'] = explode(',', $crt_details['extensions']['extendedKeyUsage']);

		foreach ($purpose['eku'] as & $eku) {

			$eku = trim($eku);

			if (array_key_exists($eku, $extended_oids)) {

				$eku = $extended_oids[$eku];

			}

		}

	} else {

		$purpose['eku'] = array();

	}

}

	if ($crt_details['validTo_time_t'] > 0) {

}

	global $config;

	if (!is_array($config['openvpn']['openvpn-server'])) {

		return;

	}

	foreach ($config['openvpn']['openvpn-server'] as $ovpns) {

		if ($ovpns['caref'] == $caref) {

			return true;

		}

	}

	return false;

}

function is_openvpn_client_ca($caref) {

	global $config;

	if (!is_array($config['openvpn']['openvpn-client'])) {

		return;

	}

	foreach ($config['openvpn']['openvpn-client'] as $ovpnc) {

		if ($ovpnc['caref'] == $caref) {

			return true;

		}

	}

	return false;