From d162124a4f07f54a61b5786e9c79917267d5cc26 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 4 Jul 2022 14:36:27 +0200
Subject: [PATCH] Squashed commit of the following:

commit e873aa41591442e16ec0581fa8b6e8696a1821ff
Author: Ad Schellevis <ad@opnsense.org>
Date:   Mon Jul 4 14:23:32 2022 +0200

    security/stunnel: Add option to chain intermediate CAs (https://github.com/opnsense/plugins/pull/2854), better explain impact and add move to advanced

commit 1e86212ad759a10ae3c229d709a5718ab79208d5
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date:   Mon Feb 21 09:52:26 2022 +0800

    security/stunnel: Allow GUI usage of restart action

    For example, we can now select "Restart Stunnel" from
    `Service/ACME-Client/Automations>Run-Command>System-or-Plugin-Command`
    in GUI.

commit 005af925b1e4c96022953757297c5a0782a81825
Author: Johnny S. Lee <6614805+johnnyslee@users.noreply.github.com>
Date:   Mon Feb 21 09:45:28 2022 +0800

    security/stunnel: Add option to chain intermediate CAs

    Add an option, defaults disabled, to chain intermediate CAs which is
    required when using ACME cert.
---
 security/stunnel/Makefile                           |  3 +--
 .../OPNsense/Stunnel/forms/dialogService.xml        | 11 +++++++++++
 .../mvc/app/models/OPNsense/Stunnel/Stunnel.xml     |  6 +++++-
 .../src/opnsense/scripts/stunnel/generate_certs.php | 13 +++++++++++--
 .../service/conf/actions.d/actions_stunnel.conf     |  1 +
 5 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index f0a6ca8a2..c27c8c326 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -1,6 +1,5 @@
 PLUGIN_NAME=		stunnel
-PLUGIN_VERSION=		1.0.4
-PLUGIN_REVISION=	1
+PLUGIN_VERSION=		1.0.5
 PLUGIN_COMMENT=		Stunnel TLS proxy
 PLUGIN_MAINTAINER=	ad@opnsense.org
 PLUGIN_DEPENDS=		stunnel
diff --git a/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml b/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
index 2b7f7bb64..dc8008bd9 100644
--- a/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
+++ b/security/stunnel/src/opnsense/mvc/app/controllers/OPNsense/Stunnel/forms/dialogService.xml
@@ -41,6 +41,17 @@
         <type>dropdown</type>
         <help><![CDATA[Select a certificate to use for this service.]]></help>
     </field>
+    <field>
+        <id>service.chainIntermediateCAs</id>
+        <label>Chain intermediate CAs</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help><![CDATA[
+          Bundle the selected certificate with its intermediate certificate authorities together to form a certificate chain.
+          If you plan to use PKI to identify clients, you usually don't want to enable this as it expands the trust chain to all
+          certificates created by any of the parent certificates.
+          ]]></help>
+    </field>
     <field>
         <id>service.cacert</id>
         <label>CA to validate connections to</label>
diff --git a/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml b/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
index 13e2f02fd..d81c05a6a 100644
--- a/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
+++ b/security/stunnel/src/opnsense/mvc/app/models/OPNsense/Stunnel/Stunnel.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/Stunnel</mount>
-    <version>1.0.3</version>
+    <version>1.0.4</version>
     <description>
         Stunnel TLS encryption proxy
     </description>
@@ -81,6 +81,10 @@
                     <Type>cert</Type>
                     <ValidationMessage>Please select a valid certificate from the list</ValidationMessage>
                 </servercert>
+                <chainIntermediateCAs type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </chainIntermediateCAs>
                 <description type="TextField">
                     <Required>N</Required>
                     <mask>/^([\t\n\v\f\r 0-9a-zA-Z.\-,_\x{00A0}-\x{FFFF}]){0,255}$/u</mask>
diff --git a/security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php b/security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php
index 908e7dd70..7d1d8bdb4 100755
--- a/security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php
+++ b/security/stunnel/src/opnsense/scripts/stunnel/generate_certs.php
@@ -28,6 +28,8 @@
  */
 
 require_once('plugins.inc');
+require_once('config.inc');
+require_once('certs.inc');
 require_once("legacy_bindings.inc");
 
 use OPNsense\Stunnel\Stunnel;
@@ -43,8 +45,15 @@ foreach ($stunnel->services->service->iterateItems() as $service) {
         $srv_certid = (string)$service->servercert;
         foreach ($configObj->cert as $cert) {
             if ($srv_certid == (string)$cert->refid) {
-                $all_certs["{$base_path}/{$this_uuid}.crt"] =
-                    base64_decode((string)$cert->crt) . "\n" . base64_decode((string)$cert->prv);
+                $all_certs["{$base_path}/{$this_uuid}.crt"] = base64_decode((string)$cert->crt);
+                if (!empty((string)$service->chainIntermediateCAs)) {
+                    $certArr = (array)$cert;
+                    $chain = ca_chain($certArr);
+                    if (!empty($chain)) {
+                        $all_certs["{$base_path}/{$this_uuid}.crt"] .= $chain;
+                    }
+                }
+                $all_certs["{$base_path}/{$this_uuid}.crt"] .= "\n" . base64_decode((string)$cert->prv);
             }
         }
         if (!empty((string)$service->cacert)) {
diff --git a/security/stunnel/src/opnsense/service/conf/actions.d/actions_stunnel.conf b/security/stunnel/src/opnsense/service/conf/actions.d/actions_stunnel.conf
index 2ab897d8d..e869be423 100644
--- a/security/stunnel/src/opnsense/service/conf/actions.d/actions_stunnel.conf
+++ b/security/stunnel/src/opnsense/service/conf/actions.d/actions_stunnel.conf
@@ -32,6 +32,7 @@ command:
 parameters:
 type:script
 message:stunnel service restart
+description:Restart Stunnel
 
 [status]
 command:/usr/local/etc/rc.d/stunnel status; /usr/local/etc/rc.d/identd_stunnel onestatus; exit 0