netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4383 from fraenki/acme_470

Browse Source 
security/acme-client: release 4.7
This commit is contained in:
Frank Wall
2024-12-18 13:23:13 +01:00
committed by GitHub
parent ee2eda08ed 6b1700bd23
commit 09453eadf9
11 changed files with 130 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= acme-client
PLUGIN_VERSION= 4.6
PLUGIN_VERSION= 4.7
PLUGIN_COMMENT= ACME Client
PLUGIN_MAINTAINER= opnsense@moov.de
PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon
security/acme-client/pkg-descr
+15
View File
@@ -8,6 +8,21 @@ WWW: https://github.com/acmesh-official/acme.sh
Plugin Changelog
================
4.7
Added:
* Add support for MyDNS.JP DNS API (#4328)
* Add support for fornex DNS API (#4389)
* Add support for OTP Code to Synology deploy hook (#4045)
* Add support for Shared Secret to INWX DNS API (#3942)
Changed:
* Convert Synology deploy hook variables to uppercase (#4286)
Fixed:
* SFTP/SSH automation results in fatal PHP error (#4363)
* Typo in INWX password field name
4.6
Added:
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAction.xml
+6
View File
@@ -225,6 +225,12 @@
<type>text</type>
<help>If Synology DSM has OTP enabled, then the device name has to be provided so that no OTP is required when running the automation.</help>
</field>
<field>
<id>action.acme_synology_dsm_otpcode</id>
<label>OTP Code</label>
<type>text</type>
<help>If Synology DSM has OTP enabled, then a OTP may be required.</help>
</field>
<field>
<id>action.acme_synology_dsm_create</id>
<label>Create certificates</label>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+7 -1
View File
@@ -690,10 +690,16 @@
<type>text</type>
</field>
<field>
<id>validation.dns_inws_password</id>
<id>validation.dns_inwx_password</id>
<label>Password</label>
<type>password</type>
</field>
<field>
<id>validation.dns_inwx_shared_secret</id>
<label>Shared Secret</label>
<type>password</type>
<help>When 2FA is enabled, the Shared Secret must be provided. Note that this feature requires the package oath-toolkit, which must be installed manually.</help>
</field>
<field>
<label>IONOS domain API</label>
<type>header</type>
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php
+13 -10
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2021 Frank Wall
* Copyright (C) 2021-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -38,20 +38,23 @@ class AcmeSynologyDsm extends Base implements LeAutomationInterface
{
public function prepare()
{
$this->acme_env['SYNO_Certificate'] = 'OPNsense ACME cert ' . $this->cert_id;
$this->acme_env['SYNO_Hostname'] = (string)$this->config->acme_synology_dsm_hostname;
$this->acme_env['SYNO_Port'] = (string)$this->config->acme_synology_dsm_port;
$this->acme_env['SYNO_Scheme'] = (string)$this->config->acme_synology_dsm_scheme;
$this->acme_env['SYNO_Username'] = (string)$this->config->acme_synology_dsm_username;
$this->acme_env['SYNO_Password'] = (string)$this->config->acme_synology_dsm_password;
$this->acme_env['SYNO_CERTIFICATE'] = 'OPNsense ACME cert ' . $this->cert_id;
$this->acme_env['SYNO_HOSTNAME'] = (string)$this->config->acme_synology_dsm_hostname;
$this->acme_env['SYNO_PORT'] = (string)$this->config->acme_synology_dsm_port;
$this->acme_env['SYNO_SCHEME'] = (string)$this->config->acme_synology_dsm_scheme;
$this->acme_env['SYNO_USERNAME'] = (string)$this->config->acme_synology_dsm_username;
$this->acme_env['SYNO_PASSWORD'] = (string)$this->config->acme_synology_dsm_password;
if (!empty((string)$this->config->acme_synology_dsm_create)) {
$this->acme_env['SYNO_Create'] = (string)$this->config->acme_synology_dsm_create;
$this->acme_env['SYNO_CREATE'] = (string)$this->config->acme_synology_dsm_create;
}
if (!empty((string)$this->config->acme_synology_dsm_deviceid)) {
$this->acme_env['SYNO_Device_ID'] = (string)$this->config->acme_synology_dsm_deviceid;
$this->acme_env['SYNO_DEVICE_ID'] = (string)$this->config->acme_synology_dsm_deviceid;
}
if (!empty((string)$this->config->acme_synology_dsm_devicename)) {
$this->acme_env['SYNO_Device_Name'] = (string)$this->config->acme_synology_dsm_devicename;
$this->acme_env['SYNO_DEVICE_NAME'] = (string)$this->config->acme_synology_dsm_devicename;
}
if (!empty((string)$this->config->acme_synology_dsm_otpcode)) {
$this->acme_env['SYNO_OTP_CODE'] = (string)$this->config->acme_synology_dsm_otpcode;
}
$this->acme_args[] = '--deploy-hook synology_dsm';
return true;
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInwx.php
+10 -2
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -29,6 +29,7 @@
namespace OPNsense\AcmeClient\LeValidation;
use OPNsense\AcmeClient\LeValidationInterface;
use OPNsense\AcmeClient\LeUtils;
use OPNsense\Core\Config;
/**
@@ -40,6 +41,13 @@ class DnsInwx extends Base implements LeValidationInterface
public function prepare()
{
$this->acme_env['INWX_User'] = (string)$this->config->dns_inwx_user;
$this->acme_env['INWX_Password'] = (string)$this->config->dns_inws_password;
$this->acme_env['INWX_Password'] = (string)$this->config->dns_inwx_password;
if (!empty((string)$this->config->dns_inwx_shared_secret)) {
if ((string)$this->model->isPackageInstalled('oath-toolkit') != '1') {
LeUtils::log_error('Required package oath-toolkit is NOT installed. Please install the package or remove the INWX Shared Secret.');
return false;
}
$this->acme_env['INWX_Shared_Secret'] = (string)$this->config->dns_inwx_shared_secret;
}
}
}
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.php
+16 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2024 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -101,4 +101,19 @@ class AcmeClient extends BaseModel
$backend = new Backend();
return trim($backend->configdRun('firmware plugin ' . escapeshellarg($name)));
}
/**
* check if the specfied package is installed
* @param $name package name
* @return bool is the package installed
*/
public function isPackageInstalled($name)
{
$backend = new Backend();
$_package_list = $backend->configdRun('firmware local');
if (preg_match("/^$name\|\|.*/m", $_package_list)) {
return 1;
}
return 0;
}
}
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+13 -1
View File
@@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/AcmeClient</mount>
<version>4.1.0</version>
<version>4.2.0</version>
<description>A secure ACME Client plugin</description>
<items>
<settings>
@@ -746,9 +746,16 @@
<dns_inwx_user type="TextField">
<Required>N</Required>
</dns_inwx_user>
<!-- TODO: old value, should be removed -->
<dns_inws_password type="TextField">
<Required>N</Required>
</dns_inws_password>
<dns_inwx_password type="TextField">
<Required>N</Required>
</dns_inwx_password>
<dns_inwx_shared_secret type="TextField">
<Required>N</Required>
</dns_inwx_shared_secret>
<dns_ionos_prefix type="TextField">
<Required>N</Required>
</dns_ionos_prefix>
@@ -1506,6 +1513,11 @@
<mask>/^.{1,1024}$/u</mask>
<ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
</acme_synology_dsm_devicename>
<acme_synology_dsm_otpcode type="TextField">
<Required>N</Required>
<mask>/^.{1,1024}$/u</mask>
<ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
</acme_synology_dsm_otpcode>
<acme_fritzbox_url type="TextField">
<Required>N</Required>
<mask>/^.{1,1024}$/u</mask>
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_2_0.php
+47
View File
@@ -0,0 +1,47 @@
<?php
/**
* Copyright (C) 2024 Frank Wall
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
namespace OPNsense\AcmeClient\Migrations;
use OPNsense\Base\BaseModelMigration;
class M4_2_0 extends BaseModelMigration
{
public function run($model)
{
foreach ($model->getNodeByReference('validations.validation')->iterateItems() as $validation) {
$dns_service = (string)$validation->dns_service;
if ($dns_service === 'dns_inwx') {
// Migrate data from misspelled item to new one
$validation->dns_inwx_password = (string)$validation->dns_inws_password;
}
}
}
}
security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php
+1 -1
View File
@@ -189,7 +189,7 @@ function runRemoteCommand(array $options, &$error): ?array
$identity_type = trim(($options["identity-type"] ?? ""));
$host = trim(($options["host"] ?? ""));
$host_key = ($options["host-key"] ?? "");
$port = $options["port"] ?? 22;
$port = !empty($options["port"]) ? $options["port"] : SSHKeys::DEFAULT_PORT;
$username = $options["user"] ?? false;
$command = $options["run"] ?? "";
security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php
+1 -1
View File
@@ -317,7 +317,7 @@ function connectWithServer(array $options, &$error): ?SftpClient
$identity_type = trim(($options["identity-type"] ?? "")) ?: SSHKeys::DEFAULT_IDENTITY_TYPE;
$host = trim(($options["host"] ?? ""));
$host_key = ($options["host-key"] ?? "");
$port = $options["port"] ?? 22;
$port = !empty($options["port"]) ? $options["port"] : SSHKeys::DEFAULT_PORT;
$username = $options["user"];
$sftp = new SftpClient(configPath(), $identity_type);