Extra CAs file for per-IP SSL keys

diff --git a/webmin/CHANGELOG b/webmin/CHANGELOG
index c8bcb54..a03ad2c 100644 (file)
--- a/webmin/CHANGELOG
+++ b/webmin/CHANGELOG
@@ -108,3 +108,4 @@ Added fields to the Index Page Options page to control the display of Webmin and
 Moved settings related to Webmin's built-in webserver to the new Web Server Options page.
 The client-side expiry time for static files served by Webmin can now be configured on the Web Server Options page, and can be customized on a per-file basis.
 A chained certificate file supplied by a CA can now be easily uploaded using the Upload certificate tab on the SSL Encryption page.
+Chained certificate files can now be set for per-IP address SSL keys, rather than the global chained list always being used.

diff --git a/webmin/edit_ipkey.cgi b/webmin/edit_ipkey.cgi
index 835eb81..d5e76c1 100755 (executable)
--- a/webmin/edit_ipkey.cgi
+++ b/webmin/edit_ipkey.cgi
@@ -31,6 +31,19 @@ print &ui_table_row($text{'ssl_cert'},
                                $text{'ssl_cert_def'})."\n".
                    &file_chooser_button("cert"));
 
+$mode = $ipkey->{'extracas'} eq "none" ? 2 :
+       $ipkey->{'extracas'} ? 1 : 0;
+print &ui_table_row($text{'ssl_extracas'},
+       &ui_radio("extracas_mode", $mode,
+                 [ [ 0, $text{'ssl_extracasdef'} ],
+                   [ 2, $text{'ssl_extracasnone'} ],
+                   [ 1, $text{'ssl_extracasbelow'} ] ])."<br>\n".
+       &ui_textarea("extracas",
+                    $mode == 1 ? join("\n",split(/\s+/, $ipkey->{'extracas'}))
+                               : "",
+                    3, 60)." ".
+       &file_chooser_button("extracas", 0, undef, undef, 1));
+
 print &ui_table_end();
 if ($in{'new'}) {
        print &ui_form_end([ [ "create", $text{'create'} ] ]);

diff --git a/webmin/edit_ssl.cgi b/webmin/edit_ssl.cgi
index 0ee4751..56a7aaa 100755 (executable)
--- a/webmin/edit_ssl.cgi
+++ b/webmin/edit_ssl.cgi
@@ -67,7 +67,8 @@ print &ui_table_row($text{'ssl_cipher_list'},
 
 print &ui_table_row($text{'ssl_extracas'},
        &ui_textarea("extracas", join("\n",split(/\s+/, $miniserv{'extracas'})),
-                    3, 60));
+                    3, 60)." ".
+       &file_chooser_button("extracas", 0, undef, undef, 1));
 
 print &ui_table_end();
 print &ui_form_end([ [ "", $text{'save'} ] ]);
@@ -106,7 +107,8 @@ if (@ipkeys) {
                        "<a href='edit_ipkey.cgi?idx=$k->{'index'}'>".
                        join(", ", @{$k->{'ips'}})."</a>",
                        "<tt>$k->{'key'}</tt>",
-                       $k->{'cert'} ? "<tt>$k->{'cert'}</tt>" : "<br>"
+                       $k->{'cert'} ? "<tt>$k->{'cert'}</tt>"
+                                    : $text{'ssl_cert_def'},
                        ]);
                }
        print &ui_columns_end();

diff --git a/webmin/lang/en b/webmin/lang/en
index b5e5bc1..fe15435 100644 (file)
--- a/webmin/lang/en
+++ b/webmin/lang/en
@@ -320,6 +320,9 @@ ssl_cert_def=Same file as private key
 ssl_cert_oth=Separate file
 ssl_redirect=Redirect non-SSL requests to SSL mode?
 ssl_extracas=Additional certificate files<br>(for chained certificates)
+ssl_extracasdef=Same as global SSL settings
+ssl_extracasnone=None for this IP address
+ssl_extracasbelow=Entered below ..
 ssl_err=Failed to save SSL options
 ssl_ekey=The SSL private key file $1 does not exist or does not contain a PEM format key
 ssl_ecert=The SSL certificate file $1 does not exist or does not contain a PEM format certificate
@@ -750,6 +753,8 @@ ipkey_ips=For connections to IP addresses
 ipkey_err=Failed to save SSL key
 ipkey_eip='$1' is not a valid IP address
 ipkey_eips=No IP addresses entered
+ipkey_eextracas=No additional certificate files entered
+ipkey_eextraca=Additional certificate file $1 does not exist
 
 descs_title=Module Titles
 descs_info=This page allows you to specify alternate titles for Webmin modules, to override their standard descriptions.

diff --git a/webmin/save_ipkey.cgi b/webmin/save_ipkey.cgi
index 8d96237..a40c5ab 100755 (executable)
--- a/webmin/save_ipkey.cgi
+++ b/webmin/save_ipkey.cgi
@@ -29,6 +29,20 @@ else {
        &validate_key_cert($in{'key'}, $in{'cert_def'} ? undef : $in{'cert'});
        $ipkey->{'key'} = $in{'key'};
        $ipkey->{'cert'} = $in{'cert_def'} ? undef : $in{'cert'};
+       if ($in{'extracas_mode'} == 0) {
+               delete($ipkey->{'extracas'});
+               }
+       elsif ($in{'extracas_mode'} == 2) {
+               $ipkey->{'extracas'} = 'none';
+               }
+       else {
+               @files = split(/\s+/, $in{'extracas'});
+               @files || &error($text{'ipkey_eextracas'});
+               foreach $f (@files) {
+                       -r $f || &error(&text('ipkey_eextraca', $f));
+                       }
+               $ipkey->{'extracas'} = join(' ', @files);
+               }
 
        # Save or add
        if ($in{'new'}) {

diff --git a/webmin/webmin-lib.pl b/webmin/webmin-lib.pl
index 8a4f323..c787d5b 100755 (executable)
--- a/webmin/webmin-lib.pl
+++ b/webmin/webmin-lib.pl
@@ -951,9 +951,10 @@ my @rv;
 foreach my $k (keys %{$_[0]}) {
        if ($k =~ /^ipkey_(\S+)/) {
                my $ipkey = { 'ips' => [ split(/,/, $1) ],
-                                'key' => $_[0]->{$k},
-                                'index' => scalar(@rv) };
+                             'key' => $_[0]->{$k},
+                             'index' => scalar(@rv) };
                $ipkey->{'cert'} = $_[0]->{'ipcert_'.$1};
+               $ipkey->{'extracas'} = $_[0]->{'ipextracas_'.$1};
                push(@rv, $ipkey);
                }
        }
@@ -979,6 +980,15 @@ foreach $k (@{$_[1]}) {
        if ($k->{'cert'}) {
                $_[0]->{'ipcert_'.$ips} = $k->{'cert'};
                }
+       else {
+               delete($_[0]->{'ipcert_'.$ips});
+               }
+       if ($k->{'extracas'}) {
+               $_[0]->{'ipextracas_'.$ips} = $k->{'extracas'};
+               }
+       else {
+               delete($_[0]->{'ipextracas_'.$ips});
+               }
        }
 }