From a56b2acd3e671a2392ce3db97c8ee930f0f5d9f9 Mon Sep 17 00:00:00 2001
From: fhloston <fhloston@users.noreply.github.com>
Date: Thu, 24 Sep 2020 17:00:15 +0200
Subject: [PATCH] stunnel: add protocol support to stunnel (#2022)

---
 security/stunnel/Makefile                              |  2 +-
 .../OPNsense/Stunnel/forms/dialogService.xml           |  6 ++++++
 .../mvc/app/models/OPNsense/Stunnel/Stunnel.xml        | 10 +++++++++-
 .../service/templates/OPNsense/Stunnel/stunnel.conf    |  3 +++
 4 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index c79e12bfb..ed8d72bbb 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		stunnel
-PLUGIN_VERSION=		1.0.1
+PLUGIN_VERSION=		1.0.2
 PLUGIN_COMMENT=		stunnel TLS proxy
 PLUGIN_MAINTAINER=	ad@opnsense.org
 PLUGIN_DEPENDS=		stunnel
diff --git a/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml b/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
index 9d3230280..368810bf7 100644
--- a/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
+++ b/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
@@ -29,6 +29,12 @@
         <type>text</type>
         <help>The port to forward traffic to.</help>
     </field>
+    <field>
+        <id>service.protocol</id>
+        <label>Protocol</label>
+        <type>dropdown</type>
+        <help>The application protocol to negotiate TLS.</help>
+    </field>
     <field>
         <id>service.servercert</id>
         <label>Certificate</label>
diff --git a/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml b/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
index 7c8fea715..4f5689ae8 100644
--- a/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
+++ b/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/Stunnel</mount>
-    <version>1.0.1</version>
+    <version>1.0.2</version>
     <description>
         Stunnel TLS encryption proxy
     </description>
@@ -45,6 +45,14 @@
                     <ValidationMessage>port needs to be an integer value between 1 and 65535</ValidationMessage>
                     <Required>Y</Required>
                 </connect_port>
+                <protocol type="OptionField">
+                    <OptionValues>
+                        <imap>IMAP</imap>
+                        <pop3>POP3</pop3>
+                        <smtp>SMTP</smtp>
+                    </OptionValues>
+                    <Required>N</Required>
+                </protocol>
                 <cacert type="CertificateField">
                     <Required>N</Required>
                     <multiple>Y</multiple>
diff --git a/security/stunnel/src/opnsense/service/templates/OPNsense/Stunnel/stunnel.conf b/security/stunnel/src/opnsense/service/templates/OPNsense/Stunnel/stunnel.conf
index 1179e6bf1..d9f28b339 100644
--- a/security/stunnel/src/opnsense/service/templates/OPNsense/Stunnel/stunnel.conf
+++ b/security/stunnel/src/opnsense/service/templates/OPNsense/Stunnel/stunnel.conf
@@ -19,6 +19,9 @@ logId = unique
 [{{service['@uuid']}}]
 accept = {% if service.accept_address %}{{service.accept_address}}:{% endif %}{{service.accept_port}}
 connect = {% if service.connect_address.find(":") > -1 %}[{{service.connect_address}}]{% else %}{{service.connect_address}}{% endif %}:{{service.connect_port}}
+{% if service.protocol %}
+protocol = {{service.protocol}}
+{% endif %}
 cert = /usr/local/etc/stunnel/certs/{{service['@uuid']}}.crt
 {%       if service.cacert|default('') != '' %}
 CAfile = /usr/local/etc/stunnel/certs/{{service['@uuid']}}.ca