Refresh OpenVPN CRL files when a CRL has a cert added/removed. Ticket #555

1 files changed, 31 insertions, 0 deletions

diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index b25b257..341044c 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -904,4 +904,35 @@ function openvpn_get_active_clients() {
 	}
 	return $clients;
 }
+
+function openvpn_refresh_crls() {
+	global $g, $config;
+
+	if (!file_exists($g['varetc_path']."/openvpn"))
+		return;
+
+	if (is_array($config['openvpn']['openvpn-server'])) {
+		foreach ($config['openvpn']['openvpn-server'] as $settings) {
+			if (empty($settings))
+				continue;
+			if (isset($settings['disable']))
+				continue;
+			// Write the settings for the keys
+			switch($settings['mode']) {
+				case 'p2p_tls':
+				case 'server_tls':
+				case 'server_tls_user':
+				case 'server_user':
+					if (!empty($settings['crlref'])) {
+						$crl = lookup_crl($settings['crlref']);
+						$fpath = $g['varetc_path']."/openvpn/server{$settings['vpnid']}.crl-verify";
+						file_put_contents($fpath, base64_decode($crl['text']));
+						@chmod($fpath, 0644);
+					}
+					break;
+			}
+		}
+	}
+}
+
 ?>