ocserv: support custom server SSL certificate

Add UCI options for the path to the server's SSL certificate and
private key. This enables the use of a certificate provided by an
external certificate authority instead of the default self-signed
certificate.

The self-signed certificate is still produced if it doesn't already
exist, and is used by default. So this change should be transparent to
existing users.

Fixes #23099.

Signed-off-by: Jack Lovell <redacted>

diff --git a/net/ocserv/Makefile b/net/ocserv/Makefile
index 864eea4a94fc378916078b40a27e06d0b2a11d67..a794be65bf4ac4077b178f9e19dfd56a0ddbcac4 100644 (file)
--- a/net/ocserv/Makefile
+++ b/net/ocserv/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ocserv
 PKG_VERSION:=1.4.1
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_BUILD_FLAGS:=no-mips16
 
 PKG_BUILD_DIR :=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

diff --git a/net/ocserv/README b/net/ocserv/README
index a883a07667755d2772f41f3557f23d52ecff093e..995c6eb9261f99d7641ed08c9539eef524d63b0d 100644 (file)
--- a/net/ocserv/README
+++ b/net/ocserv/README
@@ -7,7 +7,10 @@ It is recommended to setup a dynamic DNS address with openwrt prior
 to starting the server. That is because during the first startup
 a certificate file which will contain the dynamic DNS name will be
 created. You can always regenerate the certificate by deleting
-/etc/ocserv/server-key.pem.
+/etc/ocserv/server-key.pem. Alternatively, an externally-supplied
+certificate may be provided (obtained for example from Let's Encrypt
+using the acme package); this too will require the server's DNS name
+to match that of the certicate.
 
 There are two approaches to setup the VPN. The proxy-arp approach (1)
 which provides clients with addresses of the LAN, and the "forwarding"
@@ -179,6 +182,28 @@ config rule
 Note, that the last two rules, enable connections to port 443 from the
 Internet. That is the port used by OpenConnect VPN.
 
+Using an externally-supplied server certificate
+===============================================
+
+By default, a self-signed SSL certificate is used to identify the server.
+A certificate obtained by an external Certificate Authority (such as
+Let's Encrypt) may be used instead.
+
+First, obtain the certificate and private key (for example using acme):
+it will be installed somewhere like `/etc/acme/<your-dns-name>`. The two
+relevant files are <your-dns-name>.key for the private key, and
+fullchain.cer for the certificate containing the full chain of trust.
+
+Then add the following configuration to the ocserv configuration file:
+
+```
+----/etc/config/ocserv-------------------------------------------
+config ocserv 'config'
+       option server_key <path-to-server-key.key>
+       option server_cert <path-to-fullchain-cert.cer>
+```
+
+
 
 Starting the server
 ===================

diff --git a/net/ocserv/files/ocserv.conf.template b/net/ocserv/files/ocserv.conf.template
index 0d3cc69568fa468d74adddaacebec1472935e54e..82c6c748fbeb4fe199ec5c7a68e66f107bd7cf4e 100644 (file)
--- a/net/ocserv/files/ocserv.conf.template
+++ b/net/ocserv/files/ocserv.conf.template
@@ -99,8 +99,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = /etc/ocserv/server-cert.pem
-server-key = /etc/ocserv/server-key.pem
+server-cert = |SERVER_CERT|
+server-key = |SERVER_KEY|
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).

diff --git a/net/ocserv/files/ocserv.init b/net/ocserv/files/ocserv.init
index 63b0b4f179db9421082501a334a3b65e42a1aa52..a0218d766e9afb2bbbbcbe00ed9f55d93b4db689 100755 (executable)
--- a/net/ocserv/files/ocserv.init
+++ b/net/ocserv/files/ocserv.init
@@ -23,6 +23,8 @@ setup_config() {
        config_get ping_leases  $1 ping_leases "0"
        config_get split_dns    $1 split_dns "0"
        config_get default_domain  $1 default_domain ""
+       config_get server_cert  $1 server_cert "/etc/ocserv/server-cert.pem"
+       config_get server_key   $1 server_key "/etc/ocserv/server-key.pem"
 
        # Enable proxy arp, and make sure that ping leases is set to true in that case,
        # to prevent conflicts.
@@ -103,6 +105,8 @@ setup_config() {
            -e "s~|NETMASK|~$netmask~g" \
            -e "s~|IPV6ADDR|~$ip6addr~g" \
            -e "s~|ENABLE_IPV6|~$enable_ipv6~g" \
+           -e "s~|SERVER_CERT|~$server_cert~g" \
+           -e "s~|SERVER_KEY|~$server_key~g" \
            /etc/ocserv/ocserv.conf.template > /var/etc/ocserv.conf
 
        test -f /etc/ocserv/ocserv.conf.local && cat /etc/ocserv/ocserv.conf.local >> /var/etc/ocserv.conf
@@ -170,9 +174,9 @@ start_service() {
                        --outfile /etc/ocserv/ca.pem >/dev/null 2>&1
        }
 
-       #generate server certificate/key
+       #generate default server certificate/key
        [ ! -f /etc/ocserv/server-key.pem ] && [ -x /usr/bin/certtool ] && {
-               logger -t ocserv "Generating server certificate..."
+               logger -t ocserv "Generating default server certificate..."
                mkdir -p /etc/ocserv/pki/
                certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/server-key.pem >/dev/null 2>&1
                echo "cn=$hostname" >/etc/ocserv/pki/server.tmpl