pfSense

<?php

/*

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * Copyright (c) 2014-2019 Rubicon Communications, LLC (Netgate)

 *

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

##|+PRIV

##|*IDENT=page-system-crlmanager

##|*NAME=System: CRL Manager

##|*DESCR=Allow access to the 'System: CRL Manager' page.

##|*MATCH=system_crlmanager.php*

##|-PRIV

$default_lifetime = min(9999, $max_lifetime);

	"internal" => gettext("Create an internal Certificate Revocation List"),

	"existing" => gettext("Import an existing Certificate Revocation List"));

	$id = $_REQUEST['id'];

$a_ca = &$config['ca'];

$a_cert = &$config['cert'];

$a_crl = &$config['crl'];

	if (!isset($acrl['refid'])) {

}

 * 'del' action must be submitted via POST. */

if ((!empty($act) &&

    ($act != 'new') &&

    !$thiscrl) ||

    (($act == 'del') && empty($_POST))) {

	pfSenseHeader("system_camanager.php");

	$savemsg = gettext("Invalid CRL reference.");

	case 'del':

		$name = htmlspecialchars($thiscrl['descr']);

		if (crl_in_use($id)) {

			$savemsg = sprintf(gettext("Certificate Revocation List %s is in use and cannot be deleted."), $name);

			$class = "danger";

		} else {

			foreach ($a_crl as $cid => $acrl) {

				if ($acrl['refid'] == $thiscrl['refid']) {

					unset($a_crl[$cid]);

				}

			$savemsg = sprintf(gettext("Certificate Revocation List %s successfully deleted."), $name);

			$class = "success";

	case 'new':

		$pconfig['method'] = $_REQUEST['method'];

		$pconfig['caref'] = $_REQUEST['caref'];

		$pconfig['lifetime'] = $default_lifetime;

		$pconfig['serial'] = "0";

		$crlca =& lookup_ca($pconfig['caref']);

		if (!$crlca) {

			$input_errors[] = gettext('Invalid CA');

			unset($act);

	case 'addcert':

		unset($input_errors);

		$pconfig = $_REQUEST;

		$revoke_list = array();

		if (!$pconfig['crlref'] || (!$pconfig['certref'] && !$pconfig['revokeserial'])) {

			pfSenseHeader("system_crlmanager.php");

			exit;

		}

		$crl =& lookup_crl($pconfig['crlref']);

		if (!is_array($pconfig['certref'])) {

			$pconfig['certref'] = array();

		}

		if (empty($pconfig['certref']) && empty($pconfig['revokeserial'])) {

			$input_errors[] = gettext("Select one or more certificates or enter a serial number to revoke.");

			$input_errors[] = gettext("Cannot revoke certificates for an imported/external CRL.");

		}

		foreach ($pconfig['certref'] as $rcert) {

			$cert = lookup_cert($rcert);

			if ($crl['caref'] == $cert['caref']) {

				$revoke_list[] = $cert;

			} else {

				$input_errors[] = gettext("CA mismatch between the Certificate and CRL. Unable to Revoke.");

			}

		}

		foreach (explode(' ', $pconfig['revokeserial']) as $serial) {

			if (empty($serial)) {

				continue;

			}

			$vserial = cert_validate_serial($serial, true, true);

			if ($vserial != null) {

				$revoke_list[] = $vserial;

			} else {

				$input_errors[] = gettext("Invalid serial in list (Must be ASN.1 integer compatible decimal or hex string).");

			}

		}

		if (!$input_errors) {

			$reason = (empty($pconfig['crlreason'])) ? 0 : $pconfig['crlreason'];

			foreach ($revoke_list as $cert) {

				cert_revoke($cert, $crl, $reason);

			}

			// refresh IPsec and OpenVPN CRLs

			openvpn_refresh_crls();

			vpn_ipsec_configure();

			write_config("Revoked certificate(s) in CRL {$crl['descr']}.");

			pfSenseHeader("system_crlmanager.php");

			exit;

	case 'delcert':

		if (!is_array($thiscrl['cert'])) {

			pfSenseHeader("system_crlmanager.php");

			exit;

		foreach ($thiscrl['cert'] as $acert) {

			if ($acert['refid'] == $_REQUEST['certref']) {

				$found = true;

				$thiscert = $acert;

			}

			pfSenseHeader("system_crlmanager.php");

			exit;

		}

		$certname = htmlspecialchars($thiscert['descr']);

		$crlname = htmlspecialchars($thiscrl['descr']);

		if (cert_unrevoke($thiscert, $thiscrl)) {

			$savemsg = sprintf(gettext('Deleted Certificate %1$s from CRL %2$s.'), $certname, $crlname);

			$class = "success";

			// refresh IPsec and OpenVPN CRLs

			openvpn_refresh_crls();

			vpn_ipsec_configure();

			write_config($savemsg);

		} else {

			$savemsg = sprintf(gettext('Failed to delete Certificate %1$s from CRL %2$s.'), $certname, $crlname);

			$class = "danger";

		}

		$act="edit";

		break;

	case 'exp':

		/* Exporting the CRL contents*/

		crl_update($thiscrl);

		send_user_download('data', base64_decode($thiscrl['text']), "{$thiscrl['descr']}.crl");

		break;

	default:

		break;

	/* input validation */

			gettext("Certificate Revocation List data"));

	if ($pconfig['method'] == "internal") {

			gettext("Certificate Authority"));

		array_push($input_errors, "The field 'Descriptive Name' contains invalid characters.");

	}

		$input_errors[] = gettext("Lifetime is longer than the maximum allowed value. Use a shorter lifetime.");

	}

		$input_errors[] = gettext("Please enter a valid integer serial number.");

	}

	if (!$input_errors) {

		$result = false;

			$crl = array();

			$crl['refid'] = uniqid();

		}

			$crl['caref'] = $pconfig['caref'];

			$crl['method'] = $pconfig['method'];

		}

		if ($pconfig['method'] == "internal") {

			$crl['serial'] = empty($pconfig['serial']) ? 9999 : $pconfig['serial'];

		}

	}

}

if ($act == "new" || $act == gettext("Save") || $input_errors || $act == "edit") {

	$pgtitle[] = gettext('Edit');

?>

<script type="text/javascript">

function method_change() {

	switch (method) {

			document.getElementById("internal").style.display="";

			break;

			document.getElementById("internal").style.display="none";

			break;

	}

}

	return($list);

function build_ca_list() {

	global $a_ca;

	return($list);

}

function build_cacert_list() {

		if ((isset($cert['caref']) && !empty($cert['caref'])) &&

		    ($cert['caref'] == $crl['caref']) &&

		    !is_cert_revoked($cert, $id)) {

			$list[$cert['refid']] = $cert['descr'];

		}

	return($list);

$tab_array[] = array(gettext("CAs"), false, "system_camanager.php");

$tab_array[] = array(gettext("Certificates"), false, "system_certmanager.php");

$tab_array[] = array(gettext("Certificate Revocation"), true, "system_crlmanager.php");

display_top_tabs($tab_array);

		'Certificate Authority',

		$crlca['descr'],

	));

			'method',

	}

		'descr',

		$pconfig['descr']

	));

		'hidden',

		$pconfig['caref']

	$section->addClass('existing');

		'crltext',

		))->setHelp('Paste a Certificate Revocation List in X.509 CRL format here.');

	$section->addClass('internal');

		'lifetime',

		'Lifetime (Days)',

		'number',

		$pconfig['lifetime'],

		'serial',

		'Serial',

		'number',

		$pconfig['serial'],

	$form->add($section);

			null,

			'hidden',

			$id

} elseif ($act == "editimported") {

	$section = new Form_Section('Edit Imported Certificate Revocation List');

		'descr',

		$pconfig['descr']

	));

		'crltext',

	))->setHelp('Paste a Certificate Revocation List in X.509 CRL format here.');

		null,

		'hidden',

		$id

	));

		null,

		'hidden',

		'editimported'

	));

	$crl = $thiscrl;

						<th><?=gettext("Revocation Reason")?></th>

						<th><?=gettext("Revoked At")?></th>

						<th></th>

				<tbody>

			$serial = crl_get_entry_serial($cert);

			if (empty($serial)) {

				$serial = gettext("Invalid");

			} ?>

						<td><?=$name; ?></td>

						<td><?=$openssl_crl_status[$cert['reason']]; ?></td>

						<td><?=date("D M j G:i:s T Y", $cert['revoke_time']); ?></td>

						</td>

					</tr>

		endforeach;

?>

				</tbody>

			</table>

	}

?>

	</div>

<?php

		'crlreason',

		'Reason',

		-1,

		$openssl_crl_status

		))->setHelp('Select the reason for which the certificates are being revoked.');

	$cacert_list = build_cacert_list();

	if (count($cacert_list) == 0) {

			'certref',

			'Revoke Certificates',

			$pconfig['certref'],

			$cacert_list,

			true

			))->addClass('multiselect')

			->setHelp('Hold down CTRL (PC)/COMMAND (Mac) key to select multiple items.');

		'revokeserial',

		'Revoke by Serial',

		'text',

		$pconfig['revokeserial']

	))->setHelp('List of certificate serial numbers to revoke (separated by spaces)');

		'submit',

		'Add',

		null,

		'fa-plus'

		))->addClass('btn-success btn-sm');

		'id',

		null,

		'hidden',

		$crl['refid']

	));

		'act',

		null,

		'hidden',

		'addcert'

	));

		'crlref',

		null,

		'hidden',

		$crl['refid']

	));

} else {

?>

	<div class="panel panel-default">

						<th><?=gettext("Internal")?></th>

						<th><?=gettext("Certificates")?></th>

						<th><?=gettext("In Use")?></th>

				<tbody>

<?php

	$pluginparams['type'] = 'certificates';

	$pluginparams['event'] = 'used_crl';

	$certificates_used_by_packages = pkg_call_plugins('plugin_certificates', $pluginparams);

	$ca_crl_map = array();

	$i = 0;

				$internal = is_crl_internal($tmpcrl);

					$tmpcrl['cert'] = array();

				}

?>

						<?php echo cert_usedby_description($tmpcrl['refid'], $certificates_used_by_packages); ?>

						</td>

?>

?>

?>