From 2cf6ddcbb9e9aac46391678bf032f74295ee8d7d Mon Sep 17 00:00:00 2001
From: Nigel Graham <nigel@maven-group.org>
Date: Sun, 24 May 2009 08:36:21 +0200
Subject: Added support for certificate chains to manager so that lighty can
 deliver them via SSL.

---
 etc/inc/certs.inc | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)

(limited to 'etc/inc/certs.inc')

diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index b7c0e60..40c0922 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -41,6 +41,20 @@ function & lookup_ca($refid) {
 	return false;
 }
 
+function & lookup_ca_by_subject($subject) {
+	global $config;
+
+	if (is_array($config['system']['ca']))
+		foreach ($config['system']['ca'] as & $ca)
+		{
+			$ca_subject = cert_get_subject($ca['crt']);
+			if ($ca_subject == $subject)
+				return $ca;
+		}
+
+	return false;
+}
+
 function & lookup_cert($refid) {
 	global $config;
 
@@ -52,10 +66,70 @@ function & lookup_cert($refid) {
 	return false;
 }
 
+function ca_chain_array(& $cert) {
+	if($cert['caref']) {
+		$chain = array();
+		$cert =& lookup_ca($cert['caref']);
+		$chain[] = $cert;
+		while ($cert) {
+			$caref = $cert['caref'];
+			if($caref)
+				$cert =& lookup_ca($caref);
+			else
+				$cert = false;
+			if($cert)
+				$chain[] = $cert;
+		}
+		return $chain;
+	}
+	return false;
+}
+
+function ca_chain(& $cert) {
+	if($cert['caref']) {
+		$ca = "";
+		$cas = ca_chain($cert);
+		if (is_array($cas))
+			foreach ($cas as & $ca_cert)
+			{
+				$ca .= base64_decode($ca_cert['crt']);
+				$ca .= "\n";
+			}
+		return $ca;
+	}
+	return false;
+}
+
 function ca_import(& $ca, $str) {
+	global $config;
 
 	$ca['crt'] = base64_encode($str);
 
+	$subject = cert_get_subject($str, false);
+	$issuer = cert_get_issuer($str, false);
+	
+	// Find my issuer unless self-signed
+	if($issuer <> $subject) {
+		$issuer_crt =& lookup_ca_by_subject($issuer);
+		if($issuer_crt)
+			$ca['caref'] = $issuer_crt['refid'];
+	}
+
+	/* Correct if child certificate was loaded first */
+	if (is_array($config['system']['ca']))
+		foreach ($config['system']['ca'] as & $oca)
+		{
+			$issuer = cert_get_issuer($oca['crt']);
+			if($ca['refid']<>$oca['refid'] && $issuer==$subject)
+				$oca['caref'] = $ca['refid'];
+		}
+	if (is_array($config['system']['cert']))
+		foreach ($config['system']['cert'] as & $cert)
+		{
+			$issuer = cert_get_issuer($cert['crt']);
+			if($issuer==$subject)
+				$cert['caref'] = $ca['refid'];
+		}
 	return true;
 }
 
@@ -93,6 +167,15 @@ function cert_import(& $cert, $crt_str, $key_str) {
 	$cert['crt'] = base64_encode($crt_str);
 	$cert['prv'] = base64_encode($key_str);
 
+	$subject = cert_get_subject($crt_str, false);
+	$issuer = cert_get_issuer($crt_str, false);
+	
+	// Find my issuer unless self-signed
+	if($issuer <> $subject) {
+		$issuer_crt =& lookup_ca_by_subject($issuer);
+		if($issuer_crt)
+			$cert['caref'] = $issuer_crt['refid'];
+	}
 	return true;
 }
 
@@ -223,4 +306,24 @@ function cert_get_subject_array($crt) {
 	return $subject_array;
 }
 
+function cert_get_issuer($str_crt, $decode = true) {
+
+	if ($decode)
+		$str_crt = base64_decode($str_crt);
+
+	$inf_crt = openssl_x509_parse($str_crt);
+	$components = $inf_crt['issuer'];
+	
+	if (!is_array($components))
+		return "unknown";
+	foreach ($components as $a => $v) {
+		if (!strlen($issuer))
+			$issuer = "{$a}={$v}";
+		else
+			$issuer = "{$a}={$v}, {$issuer}";
+	}
+
+	return $issuer;
+}
+
 ?>
-- 
cgit v1.1


From 801247db0d1ac947b2f6a4f4de14686c8f0b459a Mon Sep 17 00:00:00 2001
From: Nigel Graham <nigel@maven-group.org>
Date: Tue, 26 May 2009 06:23:58 +0200
Subject: Fixed a problem in ca_chain that caused a segmentation fault.

---
 etc/inc/certs.inc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

(limited to 'etc/inc/certs.inc')

diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index 40c0922..0e2341c 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -69,16 +69,16 @@ function & lookup_cert($refid) {
 function ca_chain_array(& $cert) {
 	if($cert['caref']) {
 		$chain = array();
-		$cert =& lookup_ca($cert['caref']);
-		$chain[] = $cert;
+		$crt =& lookup_ca($cert['caref']);
+		$chain[] = $crt;
 		while ($cert) {
-			$caref = $cert['caref'];
+			$caref = $crt['caref'];
 			if($caref)
-				$cert =& lookup_ca($caref);
+				$crt =& lookup_ca($caref);
 			else
-				$cert = false;
-			if($cert)
-				$chain[] = $cert;
+				$crt = false;
+			if($crt)
+				$chain[] = $crt;
 		}
 		return $chain;
 	}
@@ -88,7 +88,7 @@ function ca_chain_array(& $cert) {
 function ca_chain(& $cert) {
 	if($cert['caref']) {
 		$ca = "";
-		$cas = ca_chain($cert);
+		$cas = ca_chain_array($cert);
 		if (is_array($cas))
 			foreach ($cas as & $ca_cert)
 			{
@@ -97,7 +97,7 @@ function ca_chain(& $cert) {
 			}
 		return $ca;
 	}
-	return false;
+	return "";
 }
 
 function ca_import(& $ca, $str) {
-- 
cgit v1.1


From 023f41803d42877e43241212923b22def948bf9c Mon Sep 17 00:00:00 2001
From: Nigel Graham <nigel@maven-group.org>
Date: Tue, 26 May 2009 06:45:04 +0200
Subject: Found another bug in ca_chain_array.

---
 etc/inc/certs.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'etc/inc/certs.inc')

diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index 0e2341c..936fc0a 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -71,7 +71,7 @@ function ca_chain_array(& $cert) {
 		$chain = array();
 		$crt =& lookup_ca($cert['caref']);
 		$chain[] = $crt;
-		while ($cert) {
+		while ($crt) {
 			$caref = $crt['caref'];
 			if($caref)
 				$crt =& lookup_ca($caref);
-- 
cgit v1.1