pfSense

<?php

/*

 *	Copyright (c)  2004-2015  Electric Sheep Fencing, LLC. All rights reserved.

 *	Redistribution and use in source and binary forms, with or without modification,

 *	are permitted provided that the following conditions are met:

 *

 *	1. Redistributions of source code must retain the above copyright notice,

 *		this list of conditions and the following disclaimer.

 *

 *	2. Redistributions in binary form must reproduce the above copyright

 *		notice, this list of conditions and the following disclaimer in

 *		the documentation and/or other materials provided with the

 *		distribution.

 *

 *	3. All advertising materials mentioning features or use of this software

 *		must display the following acknowledgment:

 *		"This product includes software developed by the pfSense Project

 *		 for use in the pfSense software distribution. (http://www.pfsense.org/).

 *

 *	4. The names "pfSense" and "pfSense Project" must not be used to

 *		 endorse or promote products derived from this software without

 *		 prior written permission. For written permission, please contact

 *		 coreteam@pfsense.org.

 *

 *	5. Products derived from this software may not be called "pfSense"

 *		nor may "pfSense" appear in their names without prior written

 *		permission of the Electric Sheep Fencing, LLC.

 *

 *	6. Redistributions of any form whatsoever must retain the following

 *		acknowledgment:

 *

 *	"This product includes software developed by the pfSense Project

 *	for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 *	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 *	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 *	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 *	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 *	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 *	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 *	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 *	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 *	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 *	OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 *	====================================================================

 *

 */

##|+PRIV

##|*IDENT=page-system-camanager

##|*NAME=System: CA Manager

##|*DESCR=Allow access to the 'System: CA Manager' page.

##|*MATCH=system_camanager.php*

##|-PRIV

require("guiconfig.inc");

$ca_methods = array(

	"intermediate" => gettext("Create an intermediate Certificate Authority"));

if (isset($_POST['id']) && is_numericint($_POST['id'])) {

$a_crl =& $config['crl'];

if ($act == "del") {

		exit;

	}

	$index = count($a_cert) - 1;

		if ($a_cert[$index]['caref'] == $a_ca[$id]['refid']) {

	}

		if ($a_crl[$index]['caref'] == $a_ca[$id]['refid']) {

	}

	write_config();

	exit;

	if (!$a_ca[$id]) {

		pfSenseHeader("system_camanager.php");

		exit;

	}

	$pconfig['descr']  = $a_ca[$id]['descr'];

	$pconfig['refid']  = $a_ca[$id]['refid'];

	$pconfig['cert']   = base64_decode($a_ca[$id]['crt']);

	$pconfig['serial'] = $a_ca[$id]['serial'];

	$pconfig['method'] = $_GET['method'];

	$pconfig['keylen'] = "2048";

}

	if (!$a_ca[$id]) {

		pfSenseHeader("system_camanager.php");

		exit;

	}

	$exp_size = strlen($exp_data);

	header("Content-Type: application/octet-stream");

	header("Content-Disposition: attachment; filename={$exp_name}");

	header("Content-Length: $exp_size");

	echo $exp_data;

	exit;

}

	if (!$a_ca[$id]) {

		pfSenseHeader("system_camanager.php");

		exit;

	}

	$exp_size = strlen($exp_data);

	header("Content-Type: application/octet-stream");

	header("Content-Disposition: attachment; filename={$exp_name}");

	header("Content-Length: $exp_size");

	echo $exp_data;

	exit;

}

	/* input validation */

	if ($pconfig['method'] == "existing") {

			gettext("Certificate data"));

		if ($_POST['cert'] && (!strstr($_POST['cert'], "BEGIN CERTIFICATE") || !strstr($_POST['cert'], "END CERTIFICATE"))) {

		if ($_POST['key'] && strstr($_POST['key'], "ENCRYPTED")) {

	if ($pconfig['method'] == "internal") {

		$reqdfields = explode(" ",

			"dn_organization dn_email dn_commonname");

			gettext("Key length"),

			gettext("Lifetime"),

			gettext("Distinguished name Country Code"),

			gettext("Distinguished name State or Province"),

			gettext("Distinguished name City"),

			gettext("Distinguished name Organization"),

			gettext("Distinguished name Email Address"),

			gettext("Distinguished name Common Name"));

		$reqdfields = explode(" ",

			"dn_organization dn_email dn_commonname");

			gettext("Signing Certificate Authority"),

			gettext("Key length"),

			gettext("Lifetime"),

			gettext("Distinguished name Country Code"),

			gettext("Distinguished name State or Province"),

			gettext("Distinguished name City"),

			gettext("Distinguished name Organization"),

			gettext("Distinguished name Email Address"),

			gettext("Distinguished name Common Name"));

			array_push($input_errors, "The field 'Descriptive Name' contains invalid characters.");

		}

				if (preg_match("/[\!\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST["dn_email"])) {

			} else if ($reqdfields[$i] == 'dn_commonname') {

				if (preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\"\']/", $_POST["dn_commonname"])) {

			} else if (($reqdfields[$i] != "descr") && preg_match("/[\!\@\#\$\%\^\(\)\~\?\>\<\&\/\\\,\.\"\']/", $_POST["$reqdfields[$i]"])) {

		if (!in_array($_POST["digest_alg"], $openssl_digest_algs)) {

	if (isAjax() && is_array($input_errors)) {

		input_errors2Ajax($input_errors);

		exit;

	}

	/* save modifications */

	if (!$input_errors) {

		$ca = array();

			$ca['refid']  = $pconfig['refid'];

			$ca['serial'] = $pconfig['serial'];

					'countryName' => $pconfig['dn_country'],

					'stateOrProvinceName' => $pconfig['dn_state'],

					'localityName' => $pconfig['dn_city'],

					'organizationName' => $pconfig['dn_organization'],

					'emailAddress' => $pconfig['dn_email'],

					'commonName' => $pconfig['dn_commonname']);

					while ($ssl_err = openssl_error_string()) {

						array_push($input_errors, "openssl library returns: " . $ssl_err);

					}

				}

				$dn = array(

					'countryName' => $pconfig['dn_country'],

					'stateOrProvinceName' => $pconfig['dn_state'],

					'localityName' => $pconfig['dn_city'],

					'organizationName' => $pconfig['dn_organization'],

					'emailAddress' => $pconfig['dn_email'],

					'commonName' => $pconfig['dn_commonname']);

					while ($ssl_err = openssl_error_string()) {

						array_push($input_errors, "openssl library returns: " . $ssl_err);

					}

				}

			}

}

include("head.inc");

	print_input_errors($input_errors);

// Load valid country codes

$dn_cc = array();

if (file_exists("/etc/ca_countries")){

	$dn_cc_file=file("/etc/ca_countries");

		if (preg_match('/^(\S*)\s(.*)$/', $line, $matches)) {

	}

$tab_array[] = array(gettext("CAs"), true, "system_camanager.php");

$tab_array[] = array(gettext("Certificates"), false, "system_certmanager.php");

$tab_array[] = array(gettext("Certificate Revocation"), false, "system_crlmanager.php");

display_top_tabs($tab_array);

if (!($act == "new" || $act == "edit" || $act == gettext("Save") || $input_errors))

{

?>

<div class="table-responsive">

<table class="table table-striped table-hover">

	<thead>

		<tr>

			<th><?=gettext("Name")?></th>

			<th><?=gettext("Internal")?></th>

			<th><?=gettext("Issuer")?></th>

			<th><?=gettext("Certificates")?></th>

			<th><?=gettext("Distinguished Name")?></th>

	</thead>

	<tbody>

	$name = htmlspecialchars($ca['descr']);

	$subj = cert_get_subject($ca['crt']);

	$issuer = cert_get_issuer($ca['crt']);

	list($startdate, $enddate) = cert_get_dates($ca['crt']);

		$issuer_name = gettext("self-signed");

	$issuer = htmlspecialchars($issuer);

	$certcount = 0;

	$issuer_ca = lookup_ca($ca['caref']);

	if ($issuer_ca)

		$issuer_name = $issuer_ca['descr'];

	// TODO : Need gray certificate icon

	$internal = (!!$ca['prv']);

	foreach ($a_cert as $cert)

		if ($cert['caref'] == $ca['refid'])

			$certcount++;

	foreach ($a_ca as $cert)

		if ($cert['caref'] == $ca['refid'])

			$certcount++;

			<td><?=$name?></td>

			<td><?=$internal?></td>

				<?=$subj?>

				<br />

				<small>

			<td>

				<a class="fa fa-sign-in"	title="<?=gettext("Export")?>"	href="system_camanager.php?act=exp&amp;id=<?=$i?>"></a>

			<?php if ($ca['prv']): ?>

				<a class="fa fa-key"	title="<?=gettext("Export key")?>"	href="system_camanager.php?act=expkey&amp;id=<?=$i?>"></a>

			<?php endif?>

				<a class="fa fa-trash" 	title="<?=gettext("Delete")?>"	href="system_camanager.php?act=del&amp;id=<?=$i?>"></a>

		</tr>

<?php endforeach; ?>

	</tbody>

</table>

	</a>

<?

	include("foot.inc");

	exit;

}

{

	$form->addGlobal(new Form_Input(

		'id',

		null,

		'hidden',

		$id

	));

}

{

	$form->addGlobal(new Form_Input(

		'refid',

		null,

		'hidden',

		$pconfig['refid']

	));

}

$section = new Form_Section('Create / edit CA');

$section->addInput(new Form_Input(

	'descr',

	'Descriptive name',

	'text',

	$pconfig['descr']

));

if (!isset($id) || $act == "edit")

{

	$section->addInput(new Form_Select(

		'method',

		'Method',

		$pconfig['method'],

		$ca_methods

$section = new Form_Section('Existing Certificate Authority');

$section->addClass('toggle-existing collapse');

$section->addInput(new Form_Textarea(

	'cert',

	'Certificate data',

	$pconfig['cert']

))->setHelp('Paste a certificate in X.509 PEM format here.');

$section->addInput(new Form_Textarea(

	'key',

	'Certificate Private Key (optional)',

	$pconfig['key']

))->setHelp('Paste the private key for the above certificate here. This is '.

	'optional in most cases, but required if you need to generate a '.

	'Certificate Revocation List (CRL).');

$section->addInput(new Form_Input(

	'serial',

	'Serial for next certificate',

	'number',

	$pconfig['serial']

))->setHelp('Enter a decimal number to be used as the serial number for the next '.

	'certificate to be created using this CA.');

$form->add($section);

$section = new Form_Section('Internal Certificate Authority');

$section->addClass('toggle-internal', 'toggle-intermediate', 'collapse');

$allCas = array();

foreach ($a_ca as $ca)

{

	if (!$ca['prv'])

			continue;

	$allCas[ $ca['refid'] ] = $ca['descr'];

}

	'caref',

	null,

	$pconfig['caref'],

	$allCas

));

$section->add($group);

$section->addInput(new Form_Select(

	'keylen',

	'Key length (bits)',

	$pconfig['keylen'],

$section->addInput(new Form_Select(

	'digest_alg',

	'Digest Algorithm',

	$pconfig['digest_alg'],

	'when possible.');

$section->addInput(new Form_Input(

	'lifetime',

	'Lifetime (days)',

	'number',

	$pconfig['lifetime']

));

$section->addInput(new Form_Select(

	'dn_country',

	'Country Code',

	$pconfig['dn_country'],

	$dn_cc

));

$section->addInput(new Form_Input(

	'dn_state',

	'State or Province',

	'text',

	$pconfig['dn_state'],

	['placeholder' => 'e.g. Texas']

));

$section->addInput(new Form_Input(

	'dn_city',

	'City',

	'text',

	$pconfig['dn_city'],

	['placeholder' => 'e.g. Austin']

));

$section->addInput(new Form_Input(

	'dn_organization',

	'Organization',

	'text',

	$pconfig['dn_organization'],

	['placeholder' => 'e.g. My Company Inc.']

));

$section->addInput(new Form_Input(

	'dn_email',

	'Email Address',

	'email',

	$pconfig['dn_email'],

	['placeholder' => 'e.g. admin@mycompany.com']

));

$section->addInput(new Form_Input(

	'dn_commonname',

	'Common Name',

	'text',

	$pconfig['dn_commonname'],

	['placeholder' => 'e.g. internal-ca']

));

$form->add($section);

print $form;

foreach ($a_ca as $ca) {

	if ($ca['prv']) {

		$internal_ca_count++;

	}

}