From 7c00f26e746aef31dde19464549260573e5a48a3 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 25 Dec 2018 23:49:16 +0100
Subject: [PATCH] net/haproxy: support multiple CAs in servers

For historical reasons we only supported a single CA in servers.
This artificial limit is finally removed. As a side effect it was
also possible to drop the previously added CA export code.

This loosely refs #1074 (and hopefully doesn't break it again).
---
 .../OPNsense/HAProxy/forms/dialogServer.xml   |  5 ++--
 .../app/models/OPNsense/HAProxy/HAProxy.xml   |  3 ++-
 .../scripts/OPNsense/HAProxy/exportCerts.php  | 23 +++++--------------
 .../templates/OPNsense/HAProxy/haproxy.conf   |  2 +-
 4 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
index abaea38ab..77fe51e4f 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
@@ -46,8 +46,9 @@
     <field>
         <id>server.sslCA</id>
         <label>SSL Verify CA</label>
-        <type>dropdown</type>
-        <help><![CDATA[This certificate authority will be used to verify server's certificate. <br/>To import additional CAs, go to <a href="/system_certmanager.php">Certificate Manager</a>.]]></help>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <help><![CDATA[These CAs will be used to verify server's certificate. <br/>To import additional CAs, go to <a href="/system_certmanager.php">Certificate Manager</a>.]]></help>
         <hint>Type CA name or choose from list.</hint>
     </field>
     <field>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 646297858..cbb44ae18 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -1053,7 +1053,8 @@
                 <sslCA type="CertificateField">
                     <Required>N</Required>
                     <Type>ca</Type>
-                    <ValidationMessage>Please select a valid CA from the list.</ValidationMessage>
+                    <Multiple>Y</Multiple>
+                    <ValidationMessage>Please select one or more CAs from the list.</ValidationMessage>
                 </sslCA>
                 <sslCRL type="CertificateField">
                     <Required>N</Required>
diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
index 7f6be4131..8518643ba 100755
--- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
+++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
@@ -85,26 +85,15 @@ foreach ($configNodes as $key => $value) {
                                         }
                                         // generate pem file for individual certs
                                         // (not supported for CRLs)
-                                        if (($type == 'cert') or ($type == 'ca')) {
+                                        if ($type == 'cert') {
                                             $output_pem_filename = $export_path . $cert_refid . ".pem";
                                             file_put_contents($output_pem_filename, $pem_content);
                                             chmod($output_pem_filename, 0600);
                                             echo "exported $type to " . $output_pem_filename . "\n";
-
-                                            /* For future reference, CAs are used in two ways:
-                                             * 1. for server SSL verification:
-                                             *     *one* CA cert + private key in a .pem file
-                                             * 2. for SSL client authentication:
-                                             *     *multiple* CA certs + private keys in a .calist file
-                                             * The jinja template decides wether the .pem or .calist file will be used.
-                                             */
-                                            if ($type == 'ca') {
-                                                $crtlist[] = $pem_content;
-                                            } else {
-                                                $crtlist[] = $output_pem_filename;
-                                            }
+                                             $crtlist[] = $output_pem_filename;
                                         } else {
-                                            // CRLs need to be put in a single file, lists are not supported.
+                                            // In contrast to certificates, CA/CRL content needs to be put in a single file.
+                                            // A list of individual files is not supported by HAproxy.
                                             $crtlist[] = $pem_content;
                                         }
                                     }
@@ -112,8 +101,8 @@ foreach ($configNodes as $key => $value) {
                             }
                         }
                         // generate list file
-                        // (only supported for frontends)
-                        if ($key == 'frontends') {
+                        // (only supported for frontends and servers)
+                        if (($key == 'frontends') or ($key == 'servers')) {
                             // ignore if list is empty
                             if (empty($crtlist)) {
                                 continue;
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index f1639c652..aea5457cf 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -1336,7 +1336,7 @@ backend {{backend.name}}
 {%               do server_options.append('verify required') %}
 {#               # check for SSL CA #}
 {%               if server_data.sslCA|default("") != "" %}
-{%                 do server_options.append('ca-file /tmp/haproxy/ssl/' ~ server_data.sslCA ~ '.pem') %}
+{%                 do server_options.append('ca-file /tmp/haproxy/ssl/' ~ server_data.id ~ '.calist') %}
 {%               endif %}
 {#               # check for SSL CRL #}
 {%               if server_data.sslCRL|default("") != "" %}