From adca02c4ea53e1f5076a4cb906e0797d4a6317e7 Mon Sep 17 00:00:00 2001
From: bcyrill <cyrill@bannwart.info>
Date: Tue, 3 Jul 2012 19:03:28 +0200
Subject: [PATCH] Implement certificate chain in Captive Portal

---
 etc/inc/captiveportal.inc                | 14 ++---
 etc/inc/certs.inc                        |  2 +-
 etc/inc/upgrade_config.inc               | 32 ++++++----
 usr/local/www/services_captiveportal.php | 76 +++++++-----------------
 4 files changed, 47 insertions(+), 77 deletions(-)

diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index ba9d7e4fc4..f0653ab7fe 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -455,18 +455,14 @@ function captiveportal_init_webgui_zone($cpcfg) {
 
 	if (isset($cpcfg['httpslogin'])) {
 		$cert = lookup_cert($cpcfg['certref']);
-		$cert_crt = base64_decode($cert['crt']);
-		$cert_prv = base64_decode($cert['prv']);
-		if (isset($cpcfg['caref'])) {
-			$ca = lookup_ca($cpcfg['caref']);
-			$ca_crt = base64_decode($ca['crt']);
-		}
-		else 
-			$ca_crt = "";
+		$crt = base64_decode($cert['crt']);
+		$key = base64_decode($cert['prv']);
+		$ca = ca_chain($cert);
+    
 		/* generate lighttpd configuration */
 		$listenporthttps = $cpcfg['listenporthttps'] ? $cpcfg['listenporthttps'] : ($cpcfg['zoneid'] + 1);
 		system_generate_lighty_config("{$g['varetc_path']}/lighty-{$cpzone}-CaptivePortal-SSL.conf",
-			$cert_crt, $cert_prv, $ca_crt, "lighty-{$cpzone}-CaptivePortal-SSL.pid", $listenporthttps, "/usr/local/captiveportal",
+			$crt, $key, $ca, "lighty-{$cpzone}-CaptivePortal-SSL.pid", $listenporthttps, "/usr/local/captiveportal",
 			"cert-portal.pem", "ca-portal.pem", "1", $use_fastcgi, $cpzone);
 	}
 
diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index 862e91bf26..ed1f25c966 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -533,7 +533,7 @@ function is_captiveportal_cert($certref) {
 	if (!is_array($config['captiveportal']))
 		return;
 	foreach ($config['captiveportal'] as $portal) {
-		if ($portal['enable'] && $portal['httpslogin_enable'] && ($portal['certref'] == $certref))
+		if (isset($portal['enable']) && isset($portal['httpslogin']) && ($portal['certref'] == $certref))
 			return true;
 	}
 	return false;
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index 88faba4713..700cd25745 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -2898,26 +2898,34 @@ function upgrade_088_to_089() {
         /* create cert entry */
         $cert = array();
         $cert['refid'] = uniqid();
-        $cert['descr'] = "Captive Portal SSL Cert - {$setting['zone']}";
+        $cert['descr'] = "Captive Portal Cert - {$setting['zone']}";
         $cert['crt'] = $setting['certificate'];
         $cert['prv'] = $setting['private-key'];
+        
+        if (!empty($setting['cacertificate'])) {
+          /* create ca entry */
+          $ca = array();
+          $ca['refid'] = uniqid();
+          $ca['descr'] = "Captive Portal CA - {$setting['zone']}";
+          $ca['crt'] = $setting['cacertificate'];
+          $config['ca'][] = $ca;
+          
+          /* add ca reference to certificate */
+          $cert['caref'] = $ca['refid'];
+          
+          /* create ca reference */
+          $setting['caref'] = $ca['refid'];
+        }
+        
         $config['cert'][] = $cert;
         
         /* create cert reference */
-        unset($setting['certificate']);
-        unset($setting['private-key']);
         $setting['certref'] = $cert['refid'];
         
-        /* create ca entry */
-        $ca = array();
-        $ca['refid'] = uniqid();
-        $ca['descr'] = "Captive Portal SSL CA - {$setting['zone']}";
-        $ca['crt'] = $setting['cacertificate'];
-        $config['ca'][] = $ca;
-
-        /* create ca reference */
+        unset($setting['certificate']);
+        unset($setting['private-key']);
         unset($setting['cacertificate']);
-        $setting['caref'] = $ca['refid'];
+        
       }
     }
   }
diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php
index dd59e7ad25..c49ea1ad32 100755
--- a/usr/local/www/services_captiveportal.php
+++ b/usr/local/www/services_captiveportal.php
@@ -108,7 +108,6 @@ if ($a_cp[$cpzone]) {
 	$pconfig['httpsname'] = $a_cp[$cpzone]['httpsname'];
 	$pconfig['preauthurl'] = strtolower($a_cp[$cpzone]['preauthurl']);
 	$pconfig['certref'] = $a_cp[$cpzone]['certref'];
-	$pconfig['caref'] = $a_cp[$cpzone]['caref'];
 	$pconfig['logoutwin_enable'] = isset($a_cp[$cpzone]['logoutwin_enable']);
 	$pconfig['peruserbw'] = isset($a_cp[$cpzone]['peruserbw']);
 	$pconfig['bwdefaultdn'] = $a_cp[$cpzone]['bwdefaultdn'];
@@ -265,7 +264,6 @@ if ($_POST) {
 		$newcp['bwdefaultdn'] = $_POST['bwdefaultdn'];
 		$newcp['bwdefaultup'] = $_POST['bwdefaultup'];
 		$newcp['certref'] = $_POST['certref'];
-		$newcp['caref'] = $_POST['caref'];
 		$newcp['logoutwin_enable'] = $_POST['logoutwin_enable'] ? true : false;
 		$newcp['nomacfilter'] = $_POST['nomacfilter'] ? true : false;
 		$newcp['noconcurrentlogins'] = $_POST['noconcurrentlogins'] ? true : false;
@@ -391,7 +389,6 @@ function enable_change(enable_change) {
 	document.iform.radmac_format.disabled = radius_endis;
 	document.iform.httpsname.disabled = https_endis;
 	document.iform.certref.disabled = https_endis;
-	document.iform.caref.disabled = https_endis;
 	document.iform.logoutwin_enable.disabled = endis;
 	document.iform.nomacfilter.disabled = endis;
 	document.iform.noconcurrentlogins.disabled = endis;
@@ -870,59 +867,28 @@ function enable_change(enable_change) {
         <input name="httpsname" type="text" class="formfld unknown" id="httpsname" size="30" value="<?=htmlspecialchars($pconfig['httpsname']);?>"><br>
 	<?php printf(gettext("This name will be used in the form action for the HTTPS POST and should match the Common Name (CN) in your certificate (otherwise, the client browser will most likely display a security warning). Make sure captive portal clients can resolve this name in DNS and verify on the client that the IP resolves to the correct interface IP on %s."), $g['product_name']);?> </td>
 	</tr>
-  <tr id="tls_ca">
-    <td width="22%" valign="top" class="vncell"><?=gettext("Certificate Authority"); ?></td>
-      <td width="78%" class="vtable">
-      <?php if (count($a_ca)): ?>
-      <select name='caref' class="formselect">
-        <option value=""><?=gettext("None"); ?></option>
-      <?php
-        foreach ($a_ca as $ca):
-          $selected = "";
-          if ($pconfig['caref'] == $ca['refid'])
-            $selected = "selected";
-      ?>
-        <option value="<?=$ca['refid'];?>" <?=$selected;?>><?=$ca['descr'];?></option>
-      <?php endforeach; ?>
-      </select>
-      <?php else: ?>
-        <b><?=gettext("No Certificate Authorities defined."); ?></b> <br/>Create one under <a href="system_camanager.php">System &gt; Cert Manager</a>.
-      <?php endif; ?>
-      </td>
-  </tr>
-  <tr id="tls_cert">
-    <td width="22%" valign="top" class="vncell"><?=gettext("Server Certificate"); ?></td>
-      <td width="78%" class="vtable">
-      <?php if (count($a_cert)): ?>
-      <select name='certref' class="formselect">
-        <option value=""><?=gettext("None"); ?></option>
-      <?php
-      foreach ($a_cert as $cert):
-        $selected = "";
-        $caname = "";
-        $inuse = "";
-        $revoked = "";
-        $ca = lookup_ca($cert['caref']);
-        if ($ca)
-          $caname = " (CA: {$ca['descr']})";
-        if ($pconfig['certref'] == $cert['refid'])
-          $selected = "selected";
-        if (cert_in_use($cert['refid']))
-          $inuse = " *In Use";
-        if (is_cert_revoked($cert))
-        $revoked = " *Revoked";
-      ?>
-        <option value="<?=$cert['refid'];?>" <?=$selected;?>><?=$cert['descr'] . $caname . $inuse . $revoked;?></option>
-      <?php endforeach; ?>
-      </select>
-      <?php else: ?>
-        <b><?=gettext("No Certificates defined."); ?></b> <br/>Create one under <a href="system_certmanager.php">System &gt; Cert Manager</a>.
-      <?php endif; ?>
-    </td>
-  </tr>
+	<tr id="ssl_opts">
+		<td width="22%" valign="top" class="vncell"><?=gettext("SSL Certificate"); ?></td>
+		<td width="78%" class="vtable">
+			<?php if (count($a_cert)): ?>
+			<select name="certref" id="certref" class="formselect">
+				<?php
+					foreach($a_cert as $cert):
+						$selected = "";
+						if ($pconfig['certref'] == $cert['refid'])
+							$selected = "selected";
+				?>
+				<option value="<?=$cert['refid'];?>"<?=$selected;?>><?=$cert['descr'];?></option>
+			<?php endforeach; ?>
+			</select>
+			<?php else: ?>
+				<b><?=gettext("No Certificates defined."); ?></b> <br/>Create one under <a href="system_certmanager.php">System &gt; Cert Manager</a>.
+			<?php endif; ?>
+		</td>
+	</tr>
 	<tr>
-	  <td width="22%" valign="top" class="vncell"><?=gettext("Portal page contents"); ?></td>
-	  <td width="78%" class="vtable">
+		<td width="22%" valign="top" class="vncell"><?=gettext("Portal page contents"); ?></td>
+		<td width="78%" class="vtable">
 		<?=$mandfldhtml;?><input type="file" name="htmlfile" class="formfld file" id="htmlfile"><br>
 		<?php
 			list($host) = explode(":", $_SERVER['HTTP_HOST']);