From 244833b86710d2319431fad9bc85f073d450875e Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Sat, 22 Apr 2023 18:26:04 +0200
Subject: [PATCH] security/stunnel - flush CRL when requested, the code persist
 the CRL was isolated in
 https://github.com/opnsense/core/commit/7fec5111bdbd50e80944aa8f808fe6f26e9a9441,
 the old openssl_crl_* functions where deprecated some time ago. closes
 https://github.com/opnsense/plugins/issues/3401

---
 .../src/etc/inc/plugins.inc.d/stunnel.inc        | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/security/stunnel/src/etc/inc/plugins.inc.d/stunnel.inc b/security/stunnel/src/etc/inc/plugins.inc.d/stunnel.inc
index ad0a37973..af102b1e8 100644
--- a/security/stunnel/src/etc/inc/plugins.inc.d/stunnel.inc
+++ b/security/stunnel/src/etc/inc/plugins.inc.d/stunnel.inc
@@ -94,24 +94,14 @@ function stunnel_refresh_crls()
                         proc_close($process);
                     }
                     if ($ca_hash) {
-                        $crlres = openssl_crl_new($ca_crt, 0, 9999);
                         if (!empty($configObj->crl)) {
                             foreach ($configObj->crl as $crl) {
-                                if ($crl->caref == $cacert && !empty((string)$crl->cert)) {
-                                    foreach ($crl->cert as $cert) {
-                                        openssl_crl_revoke_cert(
-                                            $crlres,
-                                            base64_decode((string)$cert->crt),
-                                            (string)$cert->revoke_time,
-                                            (string)$cert->reason
-                                        );
-                                    }
+                                if ($crl->caref == $cacert && !empty((string)$crl->text)) {
+                                    file_put_contents("/var/run/stunnel/certs/{$ca_hash}.r0", (string)$crl->text);
+                                    break;
                                 }
                             }
                         }
-                        $crl_text = "";
-                        openssl_crl_export($crlres, $crl_text, $ca_key);
-                        file_put_contents("/var/run/stunnel/certs/{$ca_hash}.r0", $crl_text);
                     }
                 }
             }