netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Squashed commit of the following:

Browse Source 
commit e873aa41591442e16ec0581fa8b6e8696a1821ff
Author: Ad Schellevis <ad@opnsense.org>
Date:   Mon Jul 4 14:23:32 2022 +0200

    security/stunnel: Add option to chain intermediate CAs (https://github.com/opnsense/plugins/pull/2854), better explain impact and add move to advanced

commit 1e86212ad759a10ae3c229d709a5718ab79208d5
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date:   Mon Feb 21 09:52:26 2022 +0800

    security/stunnel: Allow GUI usage of restart action

    For example, we can now select "Restart Stunnel" from
    `Service/ACME-Client/Automations>Run-Command>System-or-Plugin-Command`
    in GUI.

commit 005af925b1e4c96022953757297c5a0782a81825
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date:   Mon Feb 21 09:45:28 2022 +0800

    security/stunnel: Add option to chain intermediate CAs

    Add an option, defaults disabled, to chain intermediate CAs which is
    required when using ACME cert.
This commit is contained in:
Ad Schellevis
2022-07-04 14:36:27 +02:00
parent a2afc161b5
commit d162124a4f
5 changed files with 29 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/stunnel/Makefile
+1 -2
View File
@@ -1,6 +1,5 @@
PLUGIN_NAME= stunnel
PLUGIN_VERSION= 1.0.4
PLUGIN_REVISION= 1
PLUGIN_VERSION= 1.0.5
PLUGIN_COMMENT= Stunnel TLS proxy
PLUGIN_MAINTAINER= ad@opnsense.org
PLUGIN_DEPENDS= stunnel
security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
+11
View File
@@ -41,6 +41,17 @@
<type>dropdown</type>
<help><![CDATA[Select a certificate to use for this service.]]></help>
</field>
<field>
<id>service.chainIntermediateCAs</id>
<label>Chain intermediate CAs</label>
<type>checkbox</type>
<advanced>true</advanced>
<help><![CDATA[
Bundle the selected certificate with its intermediate certificate authorities together to form a certificate chain.
If you plan to use PKI to identify clients, you usually don't want to enable this as it expands the trust chain to all
certificates created by any of the parent certificates.
]]></help>
</field>
<field>
<id>service.cacert</id>
<label>CA to validate connections to</label>
security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
+5 -1
View File
@@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/Stunnel</mount>
<version>1.0.3</version>
<version>1.0.4</version>
<description>
Stunnel TLS encryption proxy
</description>
@@ -81,6 +81,10 @@
<Type>cert</Type>
<ValidationMessage>Please select a valid certificate from the list</ValidationMessage>
</servercert>
<chainIntermediateCAs type="BooleanField">
<default>0</default>
<Required>Y</Required>
</chainIntermediateCAs>
<description type="TextField">
<Required>N</Required>
<mask>/^([\t\n\v\f\r 0-9a-zA-Z.\-,_\x{00A0}-\x{FFFF}]){0,255}$/u</mask>
security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php
+11 -2
View File
@@ -28,6 +28,8 @@
*/
require_once('plugins.inc');
require_once('config.inc');
require_once('certs.inc');
require_once("legacy_bindings.inc");
use OPNsense\Stunnel\Stunnel;
@@ -43,8 +45,15 @@ foreach ($stunnel->services->service->iterateItems() as $service) {
$srv_certid = (string)$service->servercert;
foreach ($configObj->cert as $cert) {
if ($srv_certid == (string)$cert->refid) {
$all_certs["{$base_path}/{$this_uuid}.crt"] =
base64_decode((string)$cert->crt) . "\n" . base64_decode((string)$cert->prv);
$all_certs["{$base_path}/{$this_uuid}.crt"] = base64_decode((string)$cert->crt);
if (!empty((string)$service->chainIntermediateCAs)) {
$certArr = (array)$cert;
$chain = ca_chain($certArr);
if (!empty($chain)) {
$all_certs["{$base_path}/{$this_uuid}.crt"] .= $chain;
}
}
$all_certs["{$base_path}/{$this_uuid}.crt"] .= "\n" . base64_decode((string)$cert->prv);
}
}
if (!empty((string)$service->cacert)) {
security/stunnel/src/opnsense/service/conf/actions.d/actions_stunnel.conf
+1
View File
@@ -32,6 +32,7 @@ command:
parameters:
type:script
message:stunnel service restart
description:Restart Stunnel
[status]
command:/usr/local/etc/rc.d/stunnel status; /usr/local/etc/rc.d/identd_stunnel onestatus; exit 0