pfSense

<?php

/*

	system_crlmanager.php

*/

 *	Copyright (c)  2004-2015  Electric Sheep Fencing, LLC. All rights reserved.

 *

 *	Redistribution and use in source and binary forms, with or without modification,

 *	are permitted provided that the following conditions are met:

 *

 *	1. Redistributions of source code must retain the above copyright notice,

 *		this list of conditions and the following disclaimer.

 *

 *	2. Redistributions in binary form must reproduce the above copyright

 *		notice, this list of conditions and the following disclaimer in

 *		the documentation and/or other materials provided with the

 *		distribution.

 *

 *	3. All advertising materials mentioning features or use of this software

 *		must display the following acknowledgment:

 *		"This product includes software developed by the pfSense Project

 *		 for use in the pfSense software distribution. (http://www.pfsense.org/).

 *

 *	4. The names "pfSense" and "pfSense Project" must not be used to

 *		 endorse or promote products derived from this software without

 *		 prior written permission. For written permission, please contact

 *		 coreteam@pfsense.org.

 *

 *	5. Products derived from this software may not be called "pfSense"

 *		nor may "pfSense" appear in their names without prior written

 *		permission of the Electric Sheep Fencing, LLC.

 *

 *	6. Redistributions of any form whatsoever must retain the following

 *		acknowledgment:

 *

 *	"This product includes software developed by the pfSense Project

 *	for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 *	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 *	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 *	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 *	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 *	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 *	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 *	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 *	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 *	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 *	OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 *	====================================================================

 *

 */

##|+PRIV

##|*IDENT=page-system-crlmanager

##|*NAME=System: CRL Manager

##|*DESCR=Allow access to the 'System: CRL Manager' page.

##|*MATCH=system_crlmanager.php*

##|-PRIV

require("guiconfig.inc");

require_once("certs.inc");

require_once("vpn.inc");

$crl_methods = array(

	"internal" => gettext("Create an internal Certificate Revocation List"),

	"existing" => gettext("Import an existing Certificate Revocation List"));

if (isset($_POST['id']) && ctype_alnum($_POST['id'])) {

$a_ca =& $config['ca'];

$a_cert =& $config['cert'];

$a_crl =& $config['crl'];

	if (!isset($acrl['refid'])) {

}

if (!$thiscrl && (($act != "") && ($act != "new"))) {

	pfSenseHeader("system_crlmanager.php");

	$act="";

	$savemsg = gettext("Invalid CRL reference.");

if ($act == "del") {

			if ($acrl['refid'] == $thiscrl['refid']) {

		}

if ($act == "new") {

	$pconfig['method'] = $_GET['method'];

	$pconfig['caref'] = $_GET['caref'];

	$pconfig['lifetime'] = "9999";

	$pconfig['serial'] = "0";

}

if ($act == "exp") {

	$exp_data = base64_decode($thiscrl['text']);

	header("Content-Type: application/octet-stream");

	header("Content-Disposition: attachment; filename={$exp_name}");

	header("Content-Length: $exp_size");

	echo $exp_data;

	exit;

}

	if ($_POST) {

		unset($input_errors);

		$pconfig = $_POST;

		if (!$pconfig['crlref'] || !$pconfig['certref']) {

			pfSenseHeader("system_crlmanager.php");

			exit;

		}

		// certref, crlref

		$crl =& lookup_crl($pconfig['crlref']);

		$cert = lookup_cert($pconfig['certref']);

		if (!$crl['caref'] || !$cert['caref']) {

			$input_errors[] = gettext("Both the Certificate and CRL must be specified.");

		}

		if ($crl['caref'] != $cert['caref']) {

			$input_errors[] = gettext("CA mismatch between the Certificate and CRL. Unable to Revoke.");

		}

		if (!is_crl_internal($crl)) {

			$input_errors[] = gettext("Cannot revoke certificates for an imported/external CRL.");

		}

		if (!$input_errors) {

			cert_revoke($cert, $crl, $reason);

	}

}

if ($act == "delcert") {

		exit;

	}

	foreach ($thiscrl['cert'] as $acert) {

		if ($acert['refid'] == $_GET['certref']) {

			$found = true;

			$thiscert = $acert;

		}

	}

	if (!$found) {

		pfSenseHeader("system_crlmanager.php");

		exit;

	}

	$crlname = htmlspecialchars($thiscrl['descr']);

	$act="edit";

	/* input validation */

			gettext("Certificate Revocation List data"));

	if ($pconfig['method'] == "internal") {

			gettext("Certificate Authority"));

		array_push($input_errors, "The field 'Descriptive Name' contains invalid characters.");

	}

	if (isAjax() && is_array($input_errors)) {

		input_errors2Ajax($input_errors);

		exit;

	}

	/* save modifications */

	if (!$input_errors) {

		$result = false;

			$crl = array();

			$crl['refid'] = uniqid();

		}

			$crl['caref'] = $pconfig['caref'];

			$crl['method'] = $pconfig['method'];

		}

		if ($pconfig['method'] == "internal") {

			$crl['serial'] = empty($pconfig['serial']) ? 9999 : $pconfig['serial'];

			$crl['lifetime'] = empty($pconfig['lifetime']) ? 9999 : $pconfig['lifetime'];

			$crl['cert'] = array();

		}

	}

}

include("head.inc");

?>

<script type="text/javascript">

function method_change() {

	switch (method) {

			document.getElementById("internal").style.display="";

			break;

			document.getElementById("internal").style.display="none";

			break;

	}

}

function build_method_list() {

	global $_GET, $crl_methods;

		if (($_GET['importonly'] == "yes") && ($method != "existing"))

			continue;

	return($list);

function build_ca_list() {

	global $a_ca;

		$list[$ca['refid']] = $ca['descr'];

	return($list);

}

function build_cacert_list() {

	global $ca_certs;

	foreach($ca_certs as $cert)

	return($list);

if ($input_errors)

	print_input_errors($input_errors);

$tab_array[] = array(gettext("CAs"), false, "system_camanager.php");

$tab_array[] = array(gettext("Certificates"), false, "system_certmanager.php");

$tab_array[] = array(gettext("Certificate Revocation"), true, "system_crlmanager.php");

display_top_tabs($tab_array);

if ($act == "new" || $act == gettext("Save") || $input_errors) {

	if (!isset($id)) {

		$form = new Form();

			'method',

			'Method',

			$pconfig['method'],

			build_method_list()

		));

		'descr',

		'Descriptive name',

		'text',

		$pconfig['descr']

	));

	$section->addInput(new Form_Select(

		'caref',

		'Certificate Authority',

		$pconfig['caref'],

		build_ca_list()

	));

	$section->addClass('existing');

		'crltext',

		'CRL data',

		$pconfig['crltext']

		))->setHelp('Paste a Certificate Revocation List in X.509 CRL format here.');

	$section->addClass('internal');

		'lifetime',

		'Lifetime (Days)',

		'number',

		$pconfig['lifetime'],

		[max => '9999']

	));

		'serial',

		'Serial',

		'number',

		$pconfig['serial'],

	$form->add($section);

		$section->addInput(new Form_Input(

			'id',

			null,

			'hidden',

			$id

} elseif ($act == "editimported") {

	$section = new Form_Section('Edit Imported Certificate Revocation List');

		'descr',

		'Descriptive name',

		'text',

		$pconfig['descr']

	));

		'crltext',

		'CRL data',

		$pconfig['crltext']

	))->setHelp('Paste a Certificate Revocation List in X.509 CRL format here.');

		'id',

		null,

		'hidden',

		$id

	));

		'act',

		null,

		'hidden',

		'editimported'

	));

	$crl = $thiscrl;

		<div class="panel-heading"><h2 class="panel-title"><?=gettext("Currently Revoked Certificates for CRL") . ': ' . $crl['descr']?></h2></div>

		<div class="panel-body table-responsive">

		print_info_box(gettext("No Certificates Found for this CRL."), 'danger');

	else {

				<thead>

						<th><?=gettext("Revocation Reason")?></th>

						<th><?=gettext("Revoked At")?></th>

						<th></th>

				<tbody>

			$name = htmlspecialchars($cert['descr']);

?>

						<td class="listlr">

						<td class="listlr">

						</td>

					</tr>

		endforeach;

?>

				</tbody>

			</table>

	</div>

<?php

	$ca_certs = array();

	foreach($a_cert as $cert)

		if ($cert['caref'] == $crl['caref'])

			$ca_certs[] = $cert;

		print_info_box(gettext("No Certificates Found for this CA."), 'danger');

	else

	$group = new Form_Group(null);

		'certref',

		null,

		$pconfig['certref'],

		'crlreason',

		null,

		-1,

		$openssl_crl_status

		))->setHelp('Reason');

		'submit',

		'Add'

		))->removeClass('btn-primary')->addClass('btn-success btn-sm');

		'id',

		null,

		'hidden',

		$crl['refid']

	));

		'act',

		null,

		'hidden',

		'addcert'

	));

		'crlref',

		null,

		'hidden',

		$crl['refid']

	));

	print($form);

} else {

?>

	<div class="panel panel-default">

		<div class="panel-heading"><h2 class="panel-title"><?=gettext("Additional Certificate Revocation Lists")?></h2></div>

		<div class="panel-body table-responsive">

			<table class="table table-striped table-hover table-condensed">

				<thead>

						<th><?=gettext("Internal")?></th>

						<th><?=gettext("Certificates")?></th>

						<th><?=gettext("In Use")?></th>

						<th></th>

				<tbody>

<?php

	// Map CRLs to CAs in one pass

	$ca_crl_map = array();

	foreach($a_crl as $crl)

		$ca_crl_map[$crl['caref']][] = $crl['refid'];

	$i = 0;

	foreach($a_ca as $ca):

		$name = htmlspecialchars($ca['descr']);

		if($ca['prv']) {

			$cainternal = "YES";

							<?=$name?>

							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>" class="btn btn-xs btn-success">

							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>&amp;importonly=yes" class="btn btn-xs btn-success">

<?php

					</tr>

		if (is_array($ca_crl_map[$ca['refid']])):

			foreach($ca_crl_map[$ca['refid']] as $crl):

				$tmpcrl = lookup_crl($crl);

				$internal = is_crl_internal($tmpcrl);

				$inuse = crl_in_use($tmpcrl['refid']);

?>

						<td><?=($internal) ? "YES" : "NO"; ?></td>

						<td><?=($internal) ? count($tmpcrl['cert']) : "Unknown (imported)"; ?></td>

						<td><?=($inuse) ? "YES" : "NO"; ?></td>

						<td>

							<a href="system_crlmanager.php?act=exp&amp;id=<?=$tmpcrl['refid']?>" class="btn btn-xs btn-success">

							<a href="system_crlmanager.php?act=edit&amp;id=<?=$tmpcrl['refid']?>" class="btn btn-xs btn-info">

								<?=gettext("Edit CRL")?>

							<a href="system_crlmanager.php?act=editimported&amp;id=<?=$tmpcrl['refid']?>" class="btn btn-xs btn-info">

								<?=gettext("Edit CRL")?>

							<a href="system_crlmanager.php?act=del&amp;id=<?=$tmpcrl['refid']?>" class="btn btn-xs btn-danger">

								<?=gettext("Delete CRL")?>

					</tr>

				$i++;

				endforeach;

			endif;

			$i++;

		endforeach;

			</table>

		</div>

	</div>

<?php