Thanks Jimp, much cleaner :-).
You could probably do a job on this too. It's a (very) basic perl script to identify user certs in a config.xml and dump them to separate files to make it easier to reintroduce a particular cert to the config.xml. I'm putting it here in case it's useful to someone else. It makes heavy assumptions about the config.xml structure and I don't know what quotemeta will do on a windows box so YMMV. Written for clarity rather than efficiency.
#!/usr/bin/perl
use strict;
use warnings;
## pfSenseUserCertDumper.pl
## Script to pull out user certs from a pfsense config backup.
## use as follows:
##
## perl pfSenseUserCertDumper.pl config.xml
##
## Output will be of the form certref.certdescription.usercert
## No provision has been made for multiple arguments
my $line;
my $cachecontents;
my $certrefid;
my $certdesc;
my $certdumpfile;
my $certdumpcontents;
my $isusercert;
my $filename = $ARGV[0];
open FILE,"<$filename" or die "Cannot read the file $filename: $!\n";
while ($line = <file>)
{
if ($certdumpcontents)
{
# We are capturing contents, so append
$certdumpcontents.=$line;
if ($line =~ m/\<refid\>(.*?)\<\/refid\>\n/)
{
# Capture cert ref for dump filename
$certrefid = $1;
}
if ($line =~ m/\[CDATA\[(.*?)\]/)
{
# Capture cert desc for dump filename, quotemeta to deal with
# special characters
$certdesc = quotemeta $1;
}
if ($line =~ m/\<type\>user\<\/type\>\n/)
{
# Not interested in non-user certs. Set flag if user cert.
$isusercert=1;
}
}
if ($line =~ m/\<cert\>\n/)
{
# Start of a cert. Start capturing.
$certdumpcontents.=$line;
}
if ($line =~ m/\<\/cert\>\n/ && $certdumpcontents)
{
# End of cert data.
if ($isusercert)
{
$certdumpfile=$certrefid.'.'.$certdesc.'.usercert';
open CERTDUMPFILE, ">$certdumpfile";
print CERTDUMPFILE "$certdumpcontents";
close CERTDUMPFILE;
# Job done, turn off isusercert flag
undef $isusercert;
}
# Clear assigned variables ahead of next cert.
undef $certdumpfile;
undef $certrefid;
undef $certdesc;
undef $certdumpcontents;
}
}</cert\></type\></refid\></file>
Thanks again,
Simon
