mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add option to trust local CA entries. Implements #4068

Browse Source 
Similar to closed PR #3558 from overhacked, but with a number of
changes.
This commit is contained in:
jim-p 2019-10-31 16:28:52 -04:00
parent e78fe74d83
commit 7daab3d8dc
3 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
src/etc/inc/certs.inc
View File

@ -1898,6 +1898,11 @@ function cert_print_infoblock($cert) {
$certextinfo .= "<span class=\"text-{$lrclass}\">{$expstring}</span>";
$certextinfo .= '<br/>';
/* CA Trust store presence */
$certextinfo .= '<b>' . gettext("Trust Store: ") . '</b> ';
$certextinfo .= (isset($cert['trust']) && ($cert['trust'] == "enabled")) ? gettext('Included') : gettext('Excluded');
$certextinfo .= '<br/>';
/* Output the infoblock */
if (!empty($certextinfo)) { ?>
<div class="infoblock">
@ -1956,4 +1961,48 @@ function cert_notify_expiring() {
}
}
/****f* certs/ca_setup_trust_store
* NAME
* ca_setup_trust_store - Setup local CA trust store so that CA entries in the
* configuration may be trusted by the operating system.
* INPUTS
* None
* RESULT
* CAs marked as trusted in the configuration will be setup in the OS trust store.
******/
function ca_setup_trust_store() {
global $config;
/* This directory is trusted by OpenSSL on FreeBSD by default */
$trust_store_directory = '/etc/ssl/certs';
/* Create the directory if it does not already exist, and clean it up if it does. */
safe_mkdir($trust_store_directory);
unlink_if_exists("{$trust_store_directory}/*.0");
init_config_arr(array('ca'));
foreach ($config['ca'] as $ca) {
/* If the entry is invalid or is not trusted, skip it. */
if (!is_array($ca) ||
empty($ca['crt']) ||
!isset($ca['trust']) ||
($ca['trust'] != "enabled")) {
continue;
}
/* Decode the certificate contents */
$cert_contents = base64_decode($ca['crt']);
/* Get hash value to use for filename */
$cert_details = openssl_x509_parse($cert_contents);
$ca_filename = "{$trust_store_directory}/{$cert_details['hash']}.0";
/* Write CA to trust store and ensure it has correct permissions. */
file_put_contents($ca_filename, $cert_contents);
chmod($ca_filename, 0644);
chown($ca_filename, 'root');
chgrp($ca_filename, 'wheel');
}
}
?>

3
src/etc/rc.bootup
View File

@ -182,6 +182,9 @@ system_hosts_generate();
/* configure loopback interface */
interfaces_loopback_configure();
/* Setup Local CA Trust Store */
ca_setup_trust_store();
/* start syslogd */
system_syslogd_start();

12
src/usr/local/www/system_camanager.php
View File

@ -87,6 +87,7 @@ if ($_POST['act'] == "del") {
$name = $a_ca[$id]['descr'];
unset($a_ca[$id]);
write_config();
ca_setup_trust_store();
$savemsg = sprintf(gettext("Certificate Authority %s and its CRLs (if any) successfully deleted."), htmlspecialchars($name));
pfSenseHeader("system_camanager.php");
exit;
@ -102,6 +103,7 @@ if ($act == "edit") {
$pconfig['refid'] = $a_ca[$id]['refid'];
$pconfig['cert'] = base64_decode($a_ca[$id]['crt']);
$pconfig['serial'] = $a_ca[$id]['serial'];
$pconfig['trust'] = ($a_ca[$id]['trust'] == 'enabled');
if (!empty($a_ca[$id]['prv'])) {
$pconfig['key'] = base64_decode($a_ca[$id]['prv']);
}
@ -242,6 +244,7 @@ if ($_POST['save']) {
}
$ca['descr'] = $pconfig['descr'];
$ca['trust'] = ($pconfig['trust'] == 'yes') ? "enabled" : "disabled";
if ($act == "edit") {
$ca['descr'] = $pconfig['descr'];
@ -317,6 +320,7 @@ if ($_POST['save']) {
if (!$input_errors) {
write_config();
ca_setup_trust_store();
pfSenseHeader("system_camanager.php");
}
}
@ -575,6 +579,14 @@ $section->addInput(new Form_Input(
$pconfig['descr']
));
$section->addInput(new Form_Checkbox(
'trust',
'Trust Store',
'Add this Certificate Authority to the Operating System Trust Store',
$pconfig['trust']
))->setHelp('When enabled, the contents of the CA will be added to the trust ' .
'store so that they will be trusted by the operating system.');
if (!isset($id) || $act == "edit") {
$section->addInput(new Form_Select(
'method',