From 9e571ed7631f15718346e24b65f250b03205fee4 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 7 Jan 2025 23:43:42 +0100
Subject: [PATCH] net/haproxy: migrate cert export to Trust MVC

---
 net/haproxy/pkg-descr                             |  5 +++++
 .../scripts/OPNsense/HAProxy/exportCerts.php      | 15 +++++++--------
 .../scripts/OPNsense/HAProxy/exportErrorFiles.php |  2 --
 .../scripts/OPNsense/HAProxy/exportLuaScripts.php |  2 --
 .../scripts/OPNsense/HAProxy/exportMapFiles.php   |  2 --
 5 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr
index d3e0b934f..f6ed896fa 100644
--- a/net/haproxy/pkg-descr
+++ b/net/haproxy/pkg-descr
@@ -6,6 +6,11 @@ very high loads while needing persistence or Layer7 processing.
 Plugin Changelog
 ================
 
+4.5
+
+Changed:
+* migrate cert export to Trust MVC
+
 4.4
 
 Fixed:
diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
index 20b72fd3d..935844878 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
@@ -2,7 +2,7 @@
 <?php
 
 /*
- * Copyright (C) 2016-2024 Frank Wall
+ * Copyright (C) 2016-2025 Frank Wall
  * Copyright (C) 2015 Deciso B.V.
  * All rights reserved.
  *
@@ -28,12 +28,11 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-// Use legacy code to export certificates to the filesystem.
+require_once('script/load_phalcon.php');
 require_once("config.inc");
-require_once("certs.inc");
-require_once("legacy_bindings.inc");
 
 use OPNsense\Core\Config;
+use OPNsense\Trust\Store as CertStore;
 
 $export_path = '/tmp/haproxy/ssl/';
 
@@ -82,8 +81,9 @@ foreach ($configNodes as $key => $value) {
                                         $ocsp_conf = '';
                                         // CRLs require special export
                                         if ($type == 'crl') {
-                                            $crl =& lookup_crl($cert_refid);
-                                            $pem_content = base64_decode($crl['text']);
+                                            if (isset($cert->text)) {
+                                                $pem_content = base64_decode($cert->text);
+                                            }
                                         } else {
                                             $pem_content = str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->crt)));
                                             $pem_content .= "\n" . str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->prv)));
@@ -91,9 +91,8 @@ foreach ($configNodes as $key => $value) {
                                             $ocsp_conf = hasOcspInfo($pem_content) ? ' [ocsp-update on]' : '';
                                             // check if a CA is linked
                                             if (!empty((string)$cert->caref)) {
-                                                $cert = (array)$cert;
-                                                $ca = ca_chain($cert);
                                                 // append the CA to the certificate data
+                                                $ca = CertStore::getCaChain((string)$cert->caref));
                                                 $pem_content .= "\n" . $ca;
                                                 // additionally export CA to it's own file,
                                                 // not required for HAProxy, but makes OCSP handling easier
diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportErrorFiles.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportErrorFiles.php
index 9ffaa95d9..f5417c754 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportErrorFiles.php
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportErrorFiles.php
@@ -30,8 +30,6 @@
 
 // Use legacy code to export certificates to the filesystem.
 require_once("config.inc");
-require_once("certs.inc");
-require_once("legacy_bindings.inc");
 
 use OPNsense\Core\Config;
 
diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportLuaScripts.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportLuaScripts.php
index 840657281..30e8bd3b3 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportLuaScripts.php
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportLuaScripts.php
@@ -30,8 +30,6 @@
 
 // Use legacy code to export certificates to the filesystem.
 require_once("config.inc");
-require_once("certs.inc");
-require_once("legacy_bindings.inc");
 
 use OPNsense\Core\Config;
 
diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportMapFiles.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportMapFiles.php
index ee502e478..fe2e682f7 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportMapFiles.php
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportMapFiles.php
@@ -30,8 +30,6 @@
 
 // Use legacy code to export certificates to the filesystem.
 require_once("config.inc");
-require_once("certs.inc");
-require_once("legacy_bindings.inc");
 
 use OPNsense\Core\Config;