From 42ac21d898e0d2f87b149b6d49d9a91c95f2450e Mon Sep 17 00:00:00 2001
From: doktornotor <notordoktor@gmail.com>
Date: Fri, 27 Nov 2015 22:05:50 +0100
Subject: Add client cert auth option, fix input validations, improve
 descriptions

---
 config/squid3/34/squid_reverse_general.xml | 84 ++++++++++++++++++++++--------
 1 file changed, 62 insertions(+), 22 deletions(-)

diff --git a/config/squid3/34/squid_reverse_general.xml b/config/squid3/34/squid_reverse_general.xml
index 90babcd0..def3b55c 100755
--- a/config/squid3/34/squid_reverse_general.xml
+++ b/config/squid3/34/squid_reverse_general.xml
@@ -42,7 +42,7 @@
 	]]>
 	</copyright>
 	<name>squidreversegeneral</name>
-	<version>0.3.8</version>
+	<version>0.4.5</version>
 	<title>Reverse Proxy Server: General</title>
 	<include_file>/usr/local/pkg/squid.inc</include_file>
 	<tabs>
@@ -78,16 +78,18 @@
 			<type>listtopic</type>
 		</field>
 		<field>
-			<fielddescr>Reverse Proxy Interface</fielddescr>
+			<fielddescr>Reverse Proxy Interface(s)</fielddescr>
 			<fieldname>reverse_interface</fieldname>
 			<description>
 				<![CDATA[
-				The interface(s) the reverse-proxy server will bind to.<br/>
-				Use CTRL + click to select multiple interfaces.
+				The interface(s) the reverse-proxy server will bind to (usually WAN).<br/>
+				Use CTRL + click to select multiple interfaces.<br/><br/>
+				<strong><span class="errmsg">Important:</span><br/></strong>
+				<strong>To use Squid as a reverse proxy ONLY:</strong> After saving configuration here, you must tick the 'Enable Squid Proxy' checkbox under Services - Squid Proxy Server - General and click Save there.<br/>
+				<strong>To disable the reverse proxy ONLY (without disabling Squid completely):</strong> Unselect all 'Reverse Proxy Interface(s)', uncheck both 'Enable HTTP Reverse Proxy' and 'Enable HTTPS Reverse Proxy' below and click Save.
 				]]>
 			</description>
 			<type>interfaces_selection</type>
-			<required/>
 			<default_value>wan</default_value>
 			<multiple/>
 		</field>
@@ -97,7 +99,8 @@
 			<description>
 				<![CDATA[
 				Squid will additionally bind to these user-defined IPs for reverse proxy operation. Useful for virtual IPs such as CARP.<br/>
-				<strong>Note: Separate entries by semi-colons (;)</strong>
+				Note: Separate entries by semi-colons (;)<br/><br/>
+				<strong><span class="errmsg">Important:</span> Any entry here must be a valid, locally configured IP address.</strong>
 				]]>
 			</description>
 			<type>input</type>
@@ -108,7 +111,6 @@
 			<fieldname>reverse_external_fqdn</fieldname>
 			<description>The external fully qualified domain name of the WAN IP address.</description>
 			<type>input</type>
-			<required/>
 			<size>70</size>
 		</field>
 		<field>
@@ -123,17 +125,16 @@
 			<type>listtopic</type>
 		</field>
 		<field>
-			<fielddescr>Enable HTTP Reverse Mode</fielddescr>
+			<fielddescr>Enable HTTP Reverse Proxy</fielddescr>
 			<fieldname>reverse_http</fieldname>
 			<description>
 				<![CDATA[
 				If checked, the proxy server will act in HTTP reverse mode.<br/>
-				<strong>Note: You must add a proper firewall rule with destination 'WAN Address'.</strong>
+				<strong><span class="errmsg">Important:</span> You must add a proper firewall rule with destination matching the 'Reverse Proxy Interface(s)' address.</strong>
 				]]>
 			</description>
 			<type>checkbox</type>
 			<enablefields>reverse_http_port,reverse_http_defsite</enablefields>
-			<required/>
 			<default_value>off</default_value>
 		</field>
 		<field>
@@ -141,7 +142,7 @@
 			<fieldname>reverse_http_port</fieldname>
 			<description>
 				<![CDATA[
-				This is the port the HTTP reverse proxy will listen on. Default value will be used if left empty.<br/>
+				This is the port the HTTP reverse proxy will listen on.<br/>
 				Default: 80
 				]]>
 			</description>
@@ -159,7 +160,7 @@
 				]]>
 			</description>
 			<type>input</type>
-			<size>60</size>
+			<size>70</size>
 		</field>
 		<field>
 			<name>Squid Reverse HTTPS Settings</name>
@@ -171,12 +172,11 @@
 			<description>
 				<![CDATA[
 				If checked, the proxy server will act in HTTPS reverse mode.<br/>
-				<strong>Note: You must add a proper firewall rule with destination 'WAN Address'.</strong>
+				<strong><span class="errmsg">Important:</span> You must add a proper firewall rule with destination matching the 'Reverse Proxy Interface(s)' address.</strong>
 				]]>
 			</description>
 			<type>checkbox</type>
-			<enablefields>reverse_https_port,reverse_https_defsite,reverse_ssl_cert,reverse_int_ca,reverse_ignore_ssl_valid,reverse_owa,reverse_owa_ip,reverse_owa_webservice,reverse_owa_activesync,reverse_owa_rpchttp,reverse_owa_mapihttp,reverse_owa_autodiscover,reverse_ssl_chain</enablefields>
-			<required/>
+			<enablefields>reverse_https_port,reverse_https_defsite,reverse_ssl_cert,reverse_int_ca,reverse_ignore_ssl_valid,reverse_check_clientca,reverse_owa</enablefields>
 			<default_value>off</default_value>
 		</field>
 		<field>
@@ -184,7 +184,7 @@
 			<fieldname>reverse_https_port</fieldname>
 			<description>
 				<![CDATA[
-				This is the port the HTTPS reverse proxy will listen on. Default value will be used if left empty.<br/>
+				This is the port the HTTPS reverse proxy will listen on.<br/>
 				Default: 443
 				]]>
 			</description>
@@ -198,20 +198,22 @@
 			<description>
 				<![CDATA[
 				This is the HTTPS reverse proxy default site.<br/>
-				Note: Leave empty to use 'External FQDN' value specified above.
+				Note: Leave empty to use 'External FQDN' value specified in 'Squid Reverse Proxy General Settings'.
 				]]>
 			</description>
 			<type>input</type>
-			<size>60</size>
+			<size>70</size>
 		</field>
 		<field>
 			<fielddescr>Reverse SSL Certificate</fielddescr>
 			<fieldname>reverse_ssl_cert</fieldname>
 			<description>Choose the SSL Server Certificate here.</description>
 			<type>select_source</type>
-			<source>$config['cert']</source>
+			<source><![CDATA[$config['cert']]]></source>
 			<source_name>descr</source_name>
 			<source_value>refid</source_value>
+			<show_disable_value>none</show_disable_value>
+			<default_value>none</default_value>
 		</field>
 		<field>
 			<fielddescr>Intermediate CA Certificate (If Needed)</fielddescr>
@@ -233,6 +235,43 @@
 			<type>checkbox</type>
 			<default_value>on</default_value>
 		</field>
+		<field>
+			<fielddescr>Check Client Certificate</fielddescr>
+			<fieldname>reverse_check_clientca</fieldname>
+			<description>If checked, clients need a client certificate to authenticate.</description>
+			<type>checkbox</type>  
+			<default_value>off</default_value>
+		</field>
+		<field>
+			<fielddescr>Client Certificate CA</fielddescr>
+			<fieldname>reverse_ssl_clientca</fieldname>
+			<description>Choose the CA used to issue client authentication certificates.</description>
+	    	<type>select_source</type>
+			<source><![CDATA[$config['ca']]]></source>
+			<source_name>descr</source_name>
+			<source_value>refid</source_value>
+			<show_disable_value>none</show_disable_value>
+			<default_value>none</default_value>
+		</field>
+		<field>
+			<fielddescr>Client Certificate Revocation List</fielddescr>
+			<fieldname>reverse_ssl_clientcrl</fieldname>
+			<description>
+				<![CDATA[
+				Choose the CRL used for client certificates revocation. If set to 'none', no CRL validation will be performed.<br/>
+				<strong>Note: This must match the 'Client Certificate CA' selected above!</strong><br/><br/>
+				<strong><span class="errmsg">Important:</span></strong> After updating the CRL in System - Cert Manager - Certificate Revocation, remember to press the 'Refresh CRL' button below.<br/>
+				Otherwise, the updated CRL will not have any effect on Squid reverse proxy users!<br/><br/>
+				<input name='refresh_crl' id='refresh_crl' type='submit' value='Refresh CRL' />
+				]]>
+			</description>
+	    	<type>select_source</type>
+			<source><![CDATA[$config['crl']]]></source>
+			<source_name>descr</source_name>
+			<source_value>refid</source_value>
+			<show_disable_value>none</show_disable_value>
+			<default_value>none</default_value>
+		</field>
 		<field>
 			<name>OWA Reverse Proxy General Settings</name>
 			<type>listtopic</type>
@@ -245,12 +284,12 @@
 			<enablefields>reverse_owa_ip,reverse_owa_activesync,reverse_owa_rpchttp,reverse_owa_mapihttp,reverse_owa_webservice,reverse_owa_autodiscover</enablefields>
 		</field>
 		<field>
-			<fielddescr>CAS-Array / OWA Frontend IP Address</fielddescr>
+			<fielddescr>CAS-Array / OWA Frontend IP Address(es)</fielddescr>
 			<fieldname>reverse_owa_ip</fieldname>
 			<description>
 				<![CDATA[
 				These are the internal IPs of the CAS-Array (OWA frontend servers).<br/>
-				<strong>Note: Separate entries by semi-colons (;)</strong>
+				Note: Separate entries by semi-colons (;)
 				]]>
 			</description>
 			<type>input</type>
@@ -305,7 +344,8 @@
 	<custom_php_validation_command>
 		<![CDATA[
 		if (!empty($_POST) && !squid_enabled()) {
-			$input_errors[] = "Squid is disabled. You must enable Squid proxy under Services - Squid Proxy Server - General.";
+			$errmsg = "Squid is disabled. You must enable Squid proxy under Services - Squid Proxy Server - General.";
+			file_notice("squidreversegeneral", $errmsg, "Squid Reverse Proxy", "");
 		}
 		squid_validate_reverse($_POST, $input_errors);
 		]]>
-- 
cgit v1.2.3