Project

General

Profile

Download (16.8 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
    system_camanager.php
4

    
5
    Copyright (C) 2008 Shrew Soft Inc.
6
    All rights reserved.
7

    
8
    Redistribution and use in source and binary forms, with or without
9
    modification, are permitted provided that the following conditions are met:
10

    
11
    1. Redistributions of source code must retain the above copyright notice,
12
       this list of conditions and the following disclaimer.
13

    
14
    2. Redistributions in binary form must reproduce the above copyright
15
       notice, this list of conditions and the following disclaimer in the
16
       documentation and/or other materials provided with the distribution.
17

    
18
    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
19
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27
    POSSIBILITY OF SUCH DAMAGE.
28
*/
29
/*
30
	pfSense_MODULE:	certificate_managaer
31
*/
32

    
33
##|+PRIV
34
##|*IDENT=page-system-camanager
35
##|*NAME=System: CA Manager
36
##|*DESCR=Allow access to the 'System: CA Manager' page.
37
##|*MATCH=system_camanager.php*
38
##|-PRIV
39

    
40
require("guiconfig.inc");
41
require_once("certs.inc");
42

    
43
$ca_methods = array(
44
	"existing" => gettext("Import an existing Certificate Authority"),
45
	"internal" => gettext("Create an internal Certificate Authority"));
46

    
47
$ca_keylens = array( "512", "1024", "2048", "4096");
48

    
49
$pgtitle = array(gettext("System"), gettext("Certificate Authority Manager"));
50

    
51
$id = $_GET['id'];
52
if (isset($_POST['id']))
53
	$id = $_POST['id'];
54

    
55
if (!is_array($config['system']['ca']))
56
	$config['system']['ca'] = array();
57

    
58
$a_ca =& $config['system']['ca'];
59

    
60
if (!is_array($config['system']['cert']))
61
	$config['system']['cert'] = array();
62

    
63
$a_cert =& $config['system']['cert'];
64

    
65
$act = $_GET['act'];
66
if ($_POST['act'])
67
	$act = $_POST['act'];
68

    
69
if ($act == "del") {
70

    
71
	if (!$a_ca[$id]) {
72
		pfSenseHeader("system_camanager.php");
73
		exit;
74
	}
75

    
76
	$index = count($a_cert) - 1;
77
	for (;$index >=0; $index--)
78
		if ($a_cert[$index]['caref'] == $a_ca[$id]['refid'])
79
			unset($a_cert[$index]);
80

    
81
	$name = $a_ca[$id]['name'];
82
	unset($a_ca[$id]);
83
	write_config();
84
	$savemsg = sprintf(gettext("Certificate Authority %s successfully deleted"), $name) . "<br/>";
85
}
86

    
87
if ($act == "new") {
88
	$pconfig['method'] = $_GET['method'];
89
	$pconfig['keylen'] = "2048";
90
	$pconfig['lifetime'] = "3650";
91
	$pconfig['dn_commonname'] = "internal-ca";
92
}
93

    
94
if ($act == "exp") {
95

    
96
	if (!$a_ca[$id]) {
97
		pfSenseHeader("system_camanager.php");
98
		exit;
99
	}
100

    
101
	$exp_name = urlencode("{$a_ca[$id]['name']}.crt");
102
	$exp_data = base64_decode($a_ca[$id]['crt']);
103
	$exp_size = strlen($exp_data);
104

    
105
	header("Content-Type: application/octet-stream");
106
	header("Content-Disposition: attachment; filename={$exp_name}");
107
	header("Content-Length: $exp_size");
108
	echo $exp_data;
109
	exit;
110
}
111

    
112
if ($act == "expkey") {
113

    
114
	if (!$a_ca[$id]) {
115
		pfSenseHeader("system_camanager.php");
116
		exit;
117
	}
118

    
119
	$exp_name = urlencode("{$a_ca[$id]['name']}.key");
120
	$exp_data = base64_decode($a_ca[$id]['prv']);
121
	$exp_size = strlen($exp_data);
122

    
123
	header("Content-Type: application/octet-stream");
124
	header("Content-Disposition: attachment; filename={$exp_name}");
125
	header("Content-Length: $exp_size");
126
	echo $exp_data;
127
	exit;
128
}
129

    
130
if ($_POST) {
131

    
132
	unset($input_errors);
133
	$pconfig = $_POST;
134

    
135
	/* input validation */
136
	if ($pconfig['method'] == "existing") {
137
		$reqdfields = explode(" ", "name cert");
138
		$reqdfieldsn = array(
139
				gettext("Descriptive name"),
140
				gettext("Certificate data"));
141
	}
142
	if ($pconfig['method'] == "internal") {
143
		$reqdfields = explode(" ",
144
				"name keylen lifetime dn_country dn_state dn_city ".
145
				"dn_organization dn_email dn_commonname");
146
		$reqdfieldsn = array(
147
				gettext("Descriptive name"),
148
				gettext("Key length"),
149
				gettext("Lifetime"),
150
				gettext("Distinguished name Country Code"),
151
				gettext("Distinguished name State or Province"),
152
				gettext("Distinguished name City"),
153
				gettext("Distinguished name Organization"),
154
				gettext("Distinguished name Email Address"),
155
				gettext("Distinguished name Common Name"));
156
	}
157

    
158
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
159

    
160
	/* if this is an AJAX caller then handle via JSON */
161
	if (isAjax() && is_array($input_errors)) {
162
		input_errors2Ajax($input_errors);
163
		exit;
164
	}
165

    
166
	/* save modifications */
167
	if (!$input_errors) {
168

    
169
		$ca = array();
170
		$ca['refid'] = uniqid();
171
		if (isset($id) && $a_ca[$id])
172
			$ca = $a_ca[$id];
173

    
174
	    $ca['name'] = $pconfig['name'];
175

    
176
		if ($pconfig['method'] == "existing")
177
			ca_import($ca, $pconfig['cert'], $pconfig['key']);
178

    
179
		if ($pconfig['method'] == "internal")
180
		{
181
			$dn = array(
182
				'countryName' => $pconfig['dn_country'],
183
				'stateOrProvinceName' => $pconfig['dn_state'],
184
				'localityName' => $pconfig['dn_city'],
185
				'organizationName' => $pconfig['dn_organization'],
186
				'emailAddress' => $pconfig['dn_email'],
187
				'commonName' => $pconfig['dn_commonname']);
188

    
189
			ca_create($ca, $pconfig['keylen'], $pconfig['lifetime'], $dn);
190
		}
191

    
192
		if (isset($id) && $a_ca[$id])
193
			$a_ca[$id] = $ca;
194
		else
195
			$a_ca[] = $ca;
196

    
197
		write_config();
198

    
199
//		pfSenseHeader("system_camanager.php");
200
	}
201
}
202

    
203
include("head.inc");
204
?>
205

    
206
<body link="#000000" vlink="#000000" alink="#000000" onload="<?= $jsevents["body"]["onload"] ?>">
207
<?php include("fbegin.inc"); ?>
208
<script type="text/javascript">
209
<!--
210

    
211
function method_change() {
212

    
213
	method = document.iform.method.selectedIndex;
214

    
215
	switch (method) {
216
		case 0:
217
			document.getElementById("existing").style.display="";
218
			document.getElementById("internal").style.display="none";
219
			break;
220
		case 1:
221
			document.getElementById("existing").style.display="none";
222
			document.getElementById("internal").style.display="";
223
			break;
224
	}
225
}
226

    
227
//-->
228
</script>
229
<?php
230
	if ($input_errors)
231
		print_input_errors($input_errors);
232
	if ($savemsg)
233
		print_info_box($savemsg);
234
?>
235
<table width="100%" border="0" cellpadding="0" cellspacing="0">
236
	<tr>
237
		<td>
238
		<?php
239
			$tab_array = array();
240
			$tab_array[] = array(gettext("CAs"), true, "system_camanager.php");
241
			$tab_array[] = array(gettext("Certificates"), false, "system_certmanager.php");
242
			display_top_tabs($tab_array);
243
		?>
244
		</td>
245
	</tr>
246
	<tr>
247
		<td id="mainarea">
248
			<div class="tabcont">
249

    
250
				<?php if ($act == "new" || $act == gettext("Save") || $input_errors): ?>
251

    
252
				<form action="system_camanager.php" method="post" name="iform" id="iform">
253
					<table width="100%" border="0" cellpadding="6" cellspacing="0">
254
						<tr>
255
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Descriptive name");?></td>
256
							<td width="78%" class="vtable">
257
								<input name="name" type="text" class="formfld unknown" id="name" size="20" value="<?=htmlspecialchars($pconfig['name']);?>"/>
258
							</td>
259
						</tr>
260
						<?php if (!isset($id)): ?>
261
						<tr>
262
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Method");?></td>
263
							<td width="78%" class="vtable">
264
								<select name='method' id='method' class="formselect" onchange='method_change()'>
265
								<?php
266
									foreach($ca_methods as $method => $desc):
267
									$selected = "";
268
									if ($pconfig['method'] == $method)
269
										$selected = "selected";
270
								?>
271
									<option value="<?=$method;?>"<?=$selected;?>><?=$desc;?></option>
272
								<?php endforeach; ?>
273
								</select>
274
							</td>
275
						</tr>
276
						<?php endif; ?>
277
					</table>
278

    
279
					<table width="100%" border="0" cellpadding="6" cellspacing="0" id="existing">
280
						<tr>
281
							<td colspan="2" class="list" height="12"></td>
282
						</tr>
283
						<tr>
284
							<td colspan="2" valign="top" class="listtopic"><?=gettext("Existing Certificate Authority");?></td>
285
						</tr>
286

    
287
						<tr>
288
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Certificate data");?></td>
289
							<td width="78%" class="vtable">
290
								<textarea name="cert" id="cert" cols="65" rows="7" class="formfld_cert"><?=$pconfig['cert'];?></textarea>
291
								<br>
292
								<?=gettext("Paste a certificate in X.509 PEM format here.");?></td>
293
							</td>
294
						</tr>
295
						<tr>
296
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Certificate Private Key");?><br/><?=gettext("(optional)");?></td>
297
							<td width="78%" class="vtable">
298
								<textarea name="key" id="key" cols="65" rows="7" class="formfld_cert"><?=$pconfig['key'];?></textarea>
299
								<br>
300
								<?=gettext("Paste the private key for the above certificate here. This is optional in most cases, but required if you need to generate a Certificate Revocation List (CRL).");?></td>
301
							</td>
302
						</tr>
303
					</table>
304

    
305
					<table width="100%" border="0" cellpadding="6" cellspacing="0" id="internal">
306
						<tr>
307
							<td colspan="2" class="list" height="12"></td>
308
						</tr>
309
						<tr>
310
							<td colspan="2" valign="top" class="listtopic"><?=gettext("Internal Certificate Authority");?></td>
311
						</tr>
312
						<tr>
313
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Key length");?></td>
314
							<td width="78%" class="vtable">
315
								<select name='keylen' id='keylen' class="formselect">
316
								<?php
317
									foreach( $ca_keylens as $len):
318
									$selected = "";
319
									if ($pconfig['keylen'] == $len)
320
										$selected = "selected";
321
								?>
322
									<option value="<?=$len;?>"<?=$selected;?>><?=$len;?></option>
323
								<?php endforeach; ?>
324
								</select>
325
								<?=gettext("bits");?>
326
							</td>
327
						</tr>
328
						<tr>
329
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Lifetime");?></td>
330
							<td width="78%" class="vtable">
331
								<input name="lifetime" type="text" class="formfld unknown" id="lifetime" size="5" value="<?=htmlspecialchars($pconfig['lifetime']);?>"/>
332
								<?=gettext("days");?>
333
							</td>
334
						</tr>
335
						<tr>
336
							<td width="22%" valign="top" class="vncellreq"><?=gettext("Distinguished name");?></td>
337
							<td width="78%" class="vtable">
338
								<table border="0" cellspacing="0" cellpadding="2">
339
									<tr>
340
										<td align="right"><?=gettext("Country Code");?> : &nbsp;</td>
341
										<td align="left">
342
											<input name="dn_country" type="text" class="formfld unknown" maxlength="2" size="2" value="<?=htmlspecialchars($pconfig['dn_country']);?>"/>
343
											&nbsp;
344
											<em><?=gettext("ex:");?></em>
345
											&nbsp;
346
											<?=gettext("US");?>
347
											<em><?=gettext("( two letters )");?></em>
348
										</td>
349
									</tr>
350
									<tr>
351
										<td align="right"><?=gettext("State or Province");?> : &nbsp;</td>
352
										<td align="left">
353
											<input name="dn_state" type="text" class="formfld unknown" size="40" value="<?=htmlspecialchars($pconfig['dn_state']);?>"/>
354
											&nbsp;
355
											<em><?=gettext("ex:");?></em>
356
											&nbsp;
357
											<?=gettext("Texas");?>
358
										</td>
359
									</tr>
360
									<tr>
361
										<td align="right"><?=gettext("City");?> : &nbsp;</td>
362
										<td align="left">
363
											<input name="dn_city" type="text" class="formfld unknown" size="40" value="<?=htmlspecialchars($pconfig['dn_city']);?>"/>
364
											&nbsp;
365
											<em><?=gettext("ex:");?></em>
366
											&nbsp;
367
											<?=gettext("Austin");?>
368
										</td>
369
									</tr>
370
									<tr>
371
										<td align="right"><?=gettext("Organization");?> : &nbsp;</td>
372
										<td align="left">
373
											<input name="dn_organization" type="text" class="formfld unknown" size="40" value="<?=htmlspecialchars($pconfig['dn_organization']);?>"/>
374
											&nbsp;
375
											<em><?=gettext("ex:");?></em>
376
											&nbsp;
377
											<?=gettext("My Company Inc.");?>
378
										</td>
379
									</tr>
380
									<tr>
381
										<td align="right"><?=gettext("Email Address");?> : &nbsp;</td>
382
										<td align="left">
383
											<input name="dn_email" type="text" class="formfld unknown" size="25" value="<?=htmlspecialchars($pconfig['dn_email']);?>"/>
384
											&nbsp;
385
											<em><?=gettext("ex:");?></em>
386
											&nbsp;
387
											<?=gettext("admin@mycompany.com");?>
388
										</td>
389
									</tr>
390
									<tr>
391
										<td align="right"><?=gettext("Common Name");?> : &nbsp;</td>
392
										<td align="left">
393
											<input name="dn_commonname" type="text" class="formfld unknown" size="25" value="<?=htmlspecialchars($pconfig['dn_commonname']);?>"/>
394
											&nbsp;
395
											<em><?=gettext("ex:");?></em>
396
											&nbsp;
397
											<?=gettext("internal-ca");?>
398
										</td>
399
									</tr>
400
								</table>
401
							</td>
402
						</tr>
403
					</table>
404

    
405
					<table width="100%" border="0" cellpadding="6" cellspacing="0">
406
						<tr>
407
							<td width="22%" valign="top">&nbsp;</td>
408
							<td width="78%">
409
								<input id="submit" name="save" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />
410
								<?php if (isset($id) && $a_ca[$id]): ?>
411
								<input name="id" type="hidden" value="<?=$id;?>" />
412
								<?php endif;?>
413
							</td>
414
						</tr>
415
					</table>
416
				</form>
417

    
418
				<?php else: ?>
419

    
420
				<table width="100%" border="0" cellpadding="0" cellspacing="0">
421
					<tr>
422
						<td width="20%" class="listhdrr"><?=gettext("Name");?></td>
423
						<td width="10%" class="listhdrr"><?=gettext("Internal");?></td>
424
						<td width="10%" class="listhdrr"><?=gettext("Issuer");?></td>
425
						<td width="10%" class="listhdrr"><?=gettext("Certificates");?></td>
426
						<td width="40%" class="listhdrr"><?=gettext("Distinguished Name");?></td>
427
						<td width="10%" class="list"></td>
428
					</tr>
429
					<?php
430
						$i = 0;
431
						foreach($a_ca as $ca):
432
							$name = htmlspecialchars($ca['name']);
433
							$subj = cert_get_subject($ca['crt']);
434
							$issuer = cert_get_issuer($ca['crt']);
435
							if($subj == $issuer)
436
							  $issuer_name = "<em>" . gettext("self-signed") . "</em>";
437
							else
438
							  $issuer_name = "<em>" . gettext("external") . "</em>";
439
							$subj = htmlspecialchars($subj);
440
							$issuer = htmlspecialchars($issuer);
441
							$certcount = 0;
442

    
443
							$issuer_ca = lookup_ca($ca['caref']);
444
							if ($issuer_ca)
445
								$issuer_name = $issuer_ca['name'];
446

    
447
							// TODO : Need gray certificate icon
448

    
449
							if($ca['prv']) {
450
								$caimg = "/themes/{$g['theme']}/images/icons/icon_frmfld_cert.png";
451
								$internal = "YES";
452

    
453
							} else {
454
								$caimg = "/themes/{$g['theme']}/images/icons/icon_frmfld_cert.png";
455
								$internal = "NO";
456
							}
457
							foreach ($a_cert as $cert)
458
								if ($cert['caref'] == $ca['refid'])
459
									$certcount++;
460
  						foreach ($a_ca as $cert)
461
  							if ($cert['caref'] == $ca['refid'])
462
  								$certcount++;
463
					?>
464
					<tr>
465
						<td class="listlr">
466
							<table border="0" cellpadding="0" cellspacing="0">
467
								<tr>
468
									<td align="left" valign="center">
469
										<img src="<?=$caimg;?>" alt="CA" title="CA" border="0" height="16" width="16" />
470
									</td>
471
									<td align="left" valign="middle">
472
										<?=$name;?>
473
									</td>
474
								</tr>
475
							</table>
476
						</td>
477
						<td class="listr"><?=$internal;?>&nbsp;</td>
478
						<td class="listr"><?=$issuer_name;?>&nbsp;</td>
479
						<td class="listr"><?=$certcount;?>&nbsp;</td>
480
						<td class="listr"><?=$subj;?>&nbsp;</td>
481
						<td valign="middle" nowrap class="list">
482
							<a href="system_camanager.php?act=exp&id=<?=$i;?>")">
483
								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_down.gif" title="<?=gettext("export ca");?>" alt="<?=gettext("export ca");?>" width="17" height="17" border="0" />
484
							</a>
485
							<?php if ($ca['prv']): ?>
486
							<a href="system_camanager.php?act=expkey&id=<?=$i;?>")">
487
								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_down.gif" title="<?=gettext("export ca private key");?>" alt="<?=gettext("export ca private key");?>" width="17" height="17" border="0" />
488
							</a>
489
							<?php endif; ?>
490
							<a href="system_camanager.php?act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this Certificate Authority and all associated certificates?");?>')">
491
								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_x.gif" title="<?=gettext("delete ca");?>" alt="<?=gettext("delete ca"); ?>" width="17" height="17" border="0" />
492
							</a>
493
						</td>
494
					</tr>
495
					<?php
496
							$i++;
497
						endforeach;
498
					?>
499
					<tr>
500
						<td class="list" colspan="5"></td>
501
						<td class="list">
502
							<a href="system_camanager.php?act=new">
503
								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_plus.gif" title="<?=gettext("add or import ca");?>" alt="<?=gettext("add ca");?>" width="17" height="17" border="0" />
504
							</a>
505
						</td>
506
					</tr>
507
					<tr>
508
						<td colspan="5">
509
							<p>
510
								<?=gettext("Additional trusted Certificate Authorities can be added here.");?>
511
							</p>
512
						</td>
513
					</tr>
514
				</table>
515

    
516
				<?php endif; ?>
517

    
518
			</div>
519
		</td>
520
	</tr>
521
</table>
522
<?php include("fend.inc");?>
523
<script type="text/javascript">
524
<!--
525

    
526
method_change();
527

    
528
//-->
529
</script>
530

    
531
</body>
(180-180/222)