pfSense

 * system_crlmanager.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2004-2016 Rubicon Communications, LLC (Netgate)

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 *

 * 1. Redistributions of source code must retain the above copyright notice,

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *

 * 3. All advertising materials mentioning features or use of this software

 *

 * 4. The names "pfSense" and "pfSense Project" must not be used to

 *

 * 5. Products derived from this software may not be called "pfSense"

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *

 * "This product includes software developed by the pfSense Project

 *

 * THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 */

require_once("guiconfig.inc");

require_once("certs.inc");

require_once("openvpn.inc");

global $openssl_crl_status;

$crl_methods = array(

if (ctype_alnum($_GET['id'])) {

	$id = $_GET['id'];

}

	$id = $_POST['id'];

}

if (!is_array($config['ca'])) {

	$config['ca'] = array();

}

if (!is_array($config['cert'])) {

	$config['cert'] = array();

}

if (!is_array($config['crl'])) {

	$config['crl'] = array();

}

foreach ($a_crl as $cid => $acrl) {

		unset ($a_crl[$cid]);

	}

$act = $_GET['act'];

if ($_POST['act']) {

	$act = $_POST['act'];

}

if (!empty($id)) {

	$thiscrl =& lookup_crl($id);

}

// If we were given an invalid crlref in the id, no sense in continuing as it would only cause errors.

	$class = "danger";

}

	$name = htmlspecialchars($thiscrl['descr']);

	if (crl_in_use($id)) {

		$savemsg = sprintf(gettext("Certificate Revocation List %s is in use and cannot be deleted."), $name);

		$class = "danger";

	} else {

		foreach ($a_crl as $cid => $acrl) {

				unset($a_crl[$cid]);

			}

		write_config("Deleted CRL {$name}.");

		$savemsg = sprintf(gettext("Certificate Revocation List %s successfully deleted."), $name);

		$class = "success";

	}

}

	crl_update($thiscrl);

	$exp_name = urlencode("{$thiscrl['descr']}.crl");

	$exp_size = strlen($exp_data);

if ($act == "addcert") {

			$reason = (empty($pconfig['crlreason'])) ? OCSP_REVOKED_STATUS_UNSPECIFIED : $pconfig['crlreason'];

			// refresh IPsec and OpenVPN CRLs

			openvpn_refresh_crls();

			vpn_ipsec_configure();

			write_config("Revoked cert {$cert['descr']} in CRL {$crl['descr']}.");

			pfSenseHeader("system_crlmanager.php");

			exit;

		}

	if (!is_array($thiscrl['cert'])) {

		pfSenseHeader("system_crlmanager.php");

	$found = false;

	$certname = htmlspecialchars($thiscert['descr']);

	if (cert_unrevoke($thiscert, $thiscrl)) {

		$savemsg = sprintf(gettext("Deleted Certificate %s from CRL %s."), $certname, $crlname);

		$class = "success";

		// refresh IPsec and OpenVPN CRLs

		openvpn_refresh_crls();

		vpn_ipsec_configure();

		write_config($savemsg);

	} else {

		$savemsg = sprintf(gettext("Failed to delete Certificate %s from CRL %s."), $certname, $crlname);

		$class = "danger";

	}

}

if ($_POST) {

	$input_errors = array();

	$pconfig = $_POST;

	if (($pconfig['method'] == "existing") || ($act == "editimported")) {

		$reqdfields = explode(" ", "descr crltext");

		$reqdfieldsn = array(

			gettext("Descriptive name"),

	}

		$reqdfields = explode(" ", "descr caref");

		$reqdfieldsn = array(

			gettext("Descriptive name"),

	}

	do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);

	if (preg_match("/[\?\>\<\&\/\\\"\']/", $pconfig['descr'])) {

	/* save modifications */

		if ($thiscrl) {

			$crl =& $thiscrl;

		} else {

		$crl['descr'] = $pconfig['descr'];

		if ($act != "editimported") {

		if (($pconfig['method'] == "existing") || ($act == "editimported")) {

			$crl['text'] = base64_encode($pconfig['crltext']);

		}

		if (!$thiscrl) {

			$a_crl[] = $crl;

		}

		write_config("Saved CRL {$crl['descr']}");

		// refresh IPsec and OpenVPN CRLs

		openvpn_refresh_crls();

		vpn_ipsec_configure();

		pfSenseHeader("system_crlmanager.php");

$pgtitle = array(gettext("System"), gettext("Certificate Manager"), gettext("Certificate Revocation"));

$pglinks = array("", "system_camanager.php", "system_crlmanager.php");

	$pglinks[] = "@self";

}

include("head.inc");

//<![CDATA[

	method = document.iform.method.value;

		case "internal":

			document.getElementById("existing").style.display="none";

		case "existing":

			document.getElementById("existing").style.display="";

//]]>

</script>

<?php

	$list = array();

	foreach ($crl_methods as $method => $desc) {

			continue;

		}

		$list[$method] = $desc;

	}

}

	$list = array();

	foreach ($a_ca as $ca) {

		$list[$ca['refid']] = $ca['descr'];

	}

	$list = array();

	foreach ($ca_certs as $cert) {

		$list[$cert['refid']] = $cert['descr'];

	}

}

if ($input_errors) {

	print_input_errors($input_errors);

}

if ($savemsg) {

	print_info_box($savemsg, $class);

}

$tab_array = array();

		$section = new Form_Section('Create new Revocation List');

		$section->addInput(new Form_Select(

			'*Method',

			$pconfig['method'],

	}

	$section->addInput(new Form_Input(

		'*Descriptive name',

		'text',

		'*Certificate Authority',

		$pconfig['caref'],

	$form->add($section);

	$section = new Form_Section('Existing Certificate Revocation List');

	$section->addInput(new Form_Textarea(

		'*CRL data',

		$pconfig['crltext']

	$form->add($section);

	$section = new Form_Section('Internal Certificate Revocation List');

	$section->addInput(new Form_Input(

	$section->addInput(new Form_Input(

		['min' => '0', 'max' => '9999']

	));

	if (isset($id) && $thiscrl) {

		));

	}

	print($form);

	$form = new Form();

	$section->addInput(new Form_Input(

		'*Descriptive name',

		'text',

	$section->addInput(new Form_Textarea(

		'*CRL data',

		$pconfig['crltext']

	$section->addInput(new Form_Input(

	$section->addInput(new Form_Input(

	$form->add($section);

	print($form);

} elseif ($act == "edit") {

	$form = new Form(false);

?>

	<div class="panel panel-default">

<?php

	if (!is_array($crl['cert']) || (count($crl['cert']) == 0)) {

		print_info_box(gettext("No certificates found for this CRL."), 'danger');

	} else {

?>

			<table class="table table-striped table-hover table-condensed">

					<tr>

						<th><?=gettext("Certificate Name")?></th>

					</tr>

				</thead>

<?php

		foreach ($crl['cert'] as $i => $cert):

			$name = htmlspecialchars($cert['descr']);

					<tr>

							<?=$name; ?>

						</td>

						<td class="listlr">

							<?=$openssl_crl_status[$cert["reason"]]; ?>

						</td>

							<?=date("D M j G:i:s T Y", $cert["revoke_time"]); ?>

						</td>

						<td class="list">

							<a href="system_crlmanager.php?act=delcert&amp;id=<?=$crl['refid']; ?>&amp;certref=<?=$cert['refid']; ?>">

							</a>

<?php

<?php

		</div>

	foreach ($a_cert as $cert) {

		if ($cert['caref'] == $crl['caref'] && !is_cert_revoked($cert, $id)) {

			$ca_certs[] = $cert;

		}

	if (count($ca_certs) == 0) {

		print_info_box(gettext("No certificates found for this CA."), 'danger');

	} else {

		$section = new Form_Section('Choose a Certificate to Revoke');

		$group = new Form_Group(null);

		$group->add(new Form_Select(

		$group->add(new Form_Select(

		$group->add(new Form_Button(

			'Add',

			null,

		$section->add($group);

		$section->addInput(new Form_Input(

		$section->addInput(new Form_Input(

		$section->addInput(new Form_Input(

		$form->add($section);

	print($form);

			<table class="table table-striped table-hover table-condensed table-rowdblclickedit">

				<thead>

					<tr>

						<th><?=gettext("Name")?></th>

						<th><?=gettext("Actions")?></th>

					</tr>

				</thead>

	foreach ($a_crl as $crl) {

		$ca_crl_map[$crl['caref']][] = $crl['refid'];

	}

	foreach ($a_ca as $ca):

		$name = htmlspecialchars($ca['descr']);

		if ($ca['prv']) {

			$cainternal = "YES";

		} else {

			$cainternal = "NO";

		}

?>

					<tr>

						<td colspan="4">

						</td>

						<td>

<?php

		if ($cainternal == "YES"):

							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>" class="btn btn-xs btn-success">

								<i class="fa fa-plus icon-embed-btn"></i>

								<?=gettext("Add or Import CRL")?>

							</a>

<?php

		else:

							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>&amp;importonly=yes" class="btn btn-xs btn-success">

								<i class="fa fa-plus icon-embed-btn"></i>

								<?=gettext("Add or Import CRL")?>

							</a>

		endif;

						</td>

<?php

			foreach ($ca_crl_map[$ca['refid']] as $crl):

				$tmpcrl = lookup_crl($crl);

					<tr>

						<td><?=$tmpcrl['descr']; ?></td>

						<td><i class="fa fa-<?=($internal) ? "check" : "times"; ?>"></i></td>

						<td><?=($internal) ? count($tmpcrl['cert']) : "Unknown (imported)"; ?></td>

						<td><i class="fa fa-<?=($inuse) ? "check" : "times"; ?>"></i></td>

						<td>

							<a href="system_crlmanager.php?act=exp&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-download" title="<?=gettext("Export CRL")?>"></a>

<?php

				if ($internal): ?>

							<a href="system_crlmanager.php?act=edit&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>"></a>

<?php

				else:

							<a href="system_crlmanager.php?act=editimported&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>"></a>