<?php

if(!isset($_GET['id']) and !isset($_POST['id'])) {
	if($GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg']) {
		$savemsg=$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg'];
		unset($GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg']);
		write_config();
	}
	
}

if(isset($_GET['id'])) {
	$config['installedpackages']['stunnelcerts']['config'][$_GET['id']]['cert_chain']=
		base64_decode($config['installedpackages']['stunnelcerts']['config'][$_GET['id']]['cert_chain']);
	$config['installedpackages']['stunnelcerts']['config'][$_GET['id']]['cert_key']=
		base64_decode($config['installedpackages']['stunnelcerts']['config'][$_GET['id']]['cert_key']);
}

$certs=$config['installedpackages']['stunnelcerts']['config'];
is_array($certs) ? $num_certs=count($certs) : $num_certs=0;
if(!isset($_GET['id']) and !isset($_POST['id']) and $num_certs) {
	for ($i=0;$i<$num_certs;$i++) {
		$cert=$certs[$i];
		$_info=openssl_x509_parse(base64_decode($cert['cert_chain']));
		$valid=floor(($_info['validTo_time_t']-time())/86400);
		if($cert['cert_chain']) {
			if(!openssl_x509_check_private_key(base64_decode($cert['cert_chain']), base64_decode($cert['cert_key']))) {
				$_status='<font color="#AA0000"><b>Invalid key/cert!</b></font>';
			} elseif($valid<30) {
				$_status='<font color="#B27D4B">Expires in '.$valid.' days!</font>';
			} else {
				$_status='<font color="#008800">OK ('.$valid.' days)</font>';
			}
			$config['installedpackages']['stunnelcerts']['config'][$i]['status']=$_status;
		} else {
			unset($config['installedpackages']['stunnelcerts']['config'][$i]);
		}
	}
}


$tunnels=$config['installedpackages']['stunnel']['config'];
is_array($tunnels) ? $num_tunnels=count($tunnels) : $num_tunnels=0;
if(!isset($_GET['id']) and $num_tunnels) {
	for ($i=0;$i<$num_tunnels;$i++) {
		$tunnel=$tunnels[$i];
		if($tunnel['certificate']) {
			$certid=0;
			if(is_array($config['installedpackages']['stunnelcerts']['config'])) {
				foreach($config['installedpackages']['stunnelcerts']['config'] as $cert) {
					if($tunnel['certificate']==$cert['filename'])
						$config['installedpackages']['stunnel']['config'][$i]['certificatelink']=
							'<a href="/pkg_edit.php?xml=stunnel_certs.xml&act=edit&id='.$certid.'">'.$cert['description'].'</a>';
					$certid++;
				}
			}
		}
	}
}

function stunnel_printcsr() {
#	$GLOBALS['savemsg']="<pre>" . print_r($GLOBALS['config']['installedpackages']['stunnelcerts']['config'],true) . "</pre>";
}

function stunnel_addcerts($config) {
	$certs=$config['installedpackages']['stunnelcerts']['config'];
	$tunnels=$config['installedpackages']['stunnel']['config'];
	?>
	<script type="text/javascript">
	function addcerts() {
		<?php
	
		foreach($certs as $cert) {
			echo("document.forms['iform'].certificate.appendChild(new Option('".$cert['description']."', '".$cert['filename']."'));");
		}
		
		?>
	}
	addcerts();
	for (var i=0; i < document.forms['iform'].certificate.length; i++) {
		<?php
		$filename=$tunnels[$_GET['id']]['certificate'];
		echo('if (document.forms["iform"].certificate[i].value == "'.$filename.'") {');
		?>
			document.forms['iform'].certificate[i].selected = true;
		} else {
			document.forms['iform'].certificate[i].selected = false;
		}	
	}

	</script>
	<?php
}

function stunnel_disablefields() {
	?>
	<script type="text/javascript">
		document.forms['iform'].subject.readOnly=true;
		document.forms['iform'].filename.readOnly=true;
		document.forms['iform'].expiry.readOnly=true;
	</script>
	<?php
}

function stunnel_delete($config) {
	$cert=$config['installedpackages']['stunnelcerts']['config'][$_GET['id']];
	if(isset($_GET['id'])) {
		unlink_if_exists('/usr/local/etc/stunnel/'.$cert['filename'].'pem');
		unlink_if_exists('/usr/local/etc/stunnel/'.$cert['filename'].'key');
		unlink_if_exists('/usr/local/etc/stunnel/'.$cert['filename'].'chain');
	}
}

function stunnel_save($config) {
	$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg']='';
	conf_mount_rw();
	config_lock();
	$fout = fopen("/usr/local/etc/stunnel/stunnel.conf","w");
	fwrite($fout, "cert = /usr/local/etc/stunnel/stunnel.pem \n");
	fwrite($fout, "chroot = /var/tmp/stunnel \n");
	fwrite($fout, "setuid = stunnel \n");
	fwrite($fout, "setgid = stunnel \n");
	foreach($config['installedpackages']['stunnel']['config'] as $pkgconfig) {
		fwrite($fout, "\n[" . $pkgconfig['description'] . "]\n");
		if($pkgconfig['certificate']) {
			if(file_exists('/usr/local/etc/stunnel/'.$pkgconfig['certificate'].'.key') and
			   file_exists('/usr/local/etc/stunnel/'.$pkgconfig['certificate'].'.chain')) {
				fwrite($fout, "key = /usr/local/etc/stunnel/" . $pkgconfig['certificate'] . ".key\n");
				fwrite($fout, "cert = /usr/local/etc/stunnel/" . $pkgconfig['certificate'] . ".chain\n");
			}
		}
		if($pkgconfig['sourceip']) fwrite($fout, "local = " . $pkgconfig['sourceip'] . "\n");
		fwrite($fout, "accept = " . $pkgconfig['localip'] . ":" . $pkgconfig['localport'] . "\n");
		fwrite($fout, "connect = " . $pkgconfig['redirectip'] . ":" . $pkgconfig['redirectport'] . "\n");
		fwrite($fout, "TIMEOUTclose = 0\n\n");
	}
	fclose($fout);
	conf_mount_ro();
	config_unlock();
	system("/usr/local/etc/rc.d/stunnel.sh stop 2>/dev/null");
	system("/usr/local/etc/rc.d/stunnel.sh start 2>/dev/null");
}
function stunnel_save_cert($config) {
	$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg']='';
	if(isset($_POST['id'])) {
#		echo "<pre>";
#		print_r($_POST);
#		echo "</pre>";

		if(!$_POST['cert_chain']) {
			$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg'].="Certificate chain must be specified!<br>";
		} if(!$_POST['cert_key']) {
			$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg'].="RSA Key must be specified!<br>";
		}
		if($_POST['cert_chain'] and $_POST['cert_key']) {
			$_cert=openssl_x509_parse($_POST['cert_chain']);
#			echo("<pre>");
#			print_r($_cert);
#			echo("</pre>");
			if($_cert['hash']) {
				if(openssl_x509_check_private_key($_POST['cert_chain'], $_POST['cert_key'])) {
					file_put_contents('/usr/local/etc/stunnel/'.$_cert['hash'].'.key',
						$_POST['cert_key']);
					file_put_contents('/usr/local/etc/stunnel/'.$_cert['hash'].'.chain',
						$_POST['cert_chain']);
					file_put_contents('/usr/local/etc/stunnel/'.$_cert['hash'].'.pem',
						$_POST['cert_key']."\n".$_POST['cert_chain']);
					system('chown stunnel:stunnel /usr/local/etc/stunnel/*');
					chmod('/usr/local/etc/stunnel/'.$_cert['hash'].'.key', 0600);
					chmod('/usr/local/etc/stunnel/'.$_cert['hash'].'.pem', 0600);

					$_POST['filename']=$_cert['hash'];
					$_POST['expiry_raw']=$_cert['validTo_time_t'];
					$_POST['expiry']=date('Y-m-d', $_cert['validTo_time_t']);
					$_POST['subject']=$_cert['name'];
				} else {
					$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg'].="Certificate and key do not match!<br>";
					$_POST['filename']='';
				}
			} else {
				$GLOBALS['config']['installedpackages']['stunnelcerts']['savemsg'].="Couldn't parse certificate!<br>";
				$_POST['expiry_raw']='';
				$_POST['expiry']='';
				$_POST['subject']='';
				$_POST['filename']='';
			}
		}
		$_POST['cert_key']=base64_encode($_POST['cert_key']);
		$_POST['cert_chain']=base64_encode($_POST['cert_chain']);
		$_fname=$GLOBALS['config']['installedpackages']['stunnelcerts']['config'][$_POST['id']]['filename'];
		if($_fname and $_fname!=$_POST['filename']) {
			unlink_if_exists('/usr/local/etc/stunnel/'.$_fname.'.chain');
			unlink_if_exists('/usr/local/etc/stunnel/'.$_fname.'.key');
			unlink_if_exists('/usr/local/etc/stunnel/'.$_fname.'.pem');
		}
	}
}

function stunnel_install() {
	safe_mkdir("/usr/local/etc/stunnel");
	system("/usr/bin/openssl req -new -x509 -days 365 -nodes -out /usr/local/etc/stunnel/stunnel.pem -keyout /usr/local/etc/stunnel/stunnel.pem 2>/dev/null");
	chmod("/usr/local/etc/stunnel/stunnel.pem", 0600);
	make_dirs("/var/tmp/stunnel/var/tmp/run/stunnel");
	system("/usr/sbin/chown -R stunnel:stunnel /var/tmp/stunnel");
	$_rcfile['file']='stunnel.sh';
	$_rcfile['start'].="/usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf \n\t";
	$_rcfile['stop'].="killall stunnel \n\t";
	write_rcfile($_rcfile);
	unlink_if_exists("/usr/local/etc/rc.d/stunnel");
	
	conf_mount_rw();
	config_lock();
	$fout = fopen("/usr/local/etc/stunnel/stunnel.conf","w");
	fwrite($fout, "cert = /usr/local/etc/stunnel/stunnel.pem \n");
	fwrite($fout, "chroot = /var/tmp/stunnel \n");
	fwrite($fout, "setuid = stunnel \n");
	fwrite($fout, "setgid = stunnel \n");
	if($config['installedpackages']['stunnel']['config']) {
		foreach($config['installedpackages']['stunnel']['config'] as $pkgconfig) {
			fwrite($fout, "\n[" . $pkgconfig['description'] . "]\n");
			if($pkgconfig['sourceip']) fwrite($fout, "local = " . $pkgconfig['sourceip'] . "\n");
			fwrite($fout, "accept = " . $pkgconfig['localip'] . ":" . $pkgconfig['localport'] . "\n");
			fwrite($fout, "connect = " . $pkgconfig['redirectip'] . ":" . $pkgconfig['redirectport'] . "\n");
			fwrite($fout, "TIMEOUTclose = 0\n\n");
		}
	}
	fclose($fout);
	conf_mount_ro();
	config_unlock();
}

function stunnel_deinstall() {
	rmdir_recursive("/var/tmp/stunnel");
	rmdir_recursive("/usr/local/etc/stunnel*");
	unlink_if_exists("/usr/local/etc/rc.d/stunnel.sh");
}

?>