From 636a1f18bac74f9b4a793445ccda5764591da635 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 3 Dec 2024 23:11:28 +0100 Subject: [PATCH 1/5] security/acme-client: set default SFTP/SSH port if unset, fixes #4363 --- security/acme-client/pkg-descr | 5 +++++ .../opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php | 2 +- .../src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 0bcee071e..f6fb2be75 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +4.7 + +Fixed: +* SFTP/SSH automation results in fatal PHP error (#4363) + 4.6 Added: diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php index 9a16b8689..97e2b0809 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/run_remote_ssh.php @@ -189,7 +189,7 @@ function runRemoteCommand(array $options, &$error): ?array $identity_type = trim(($options["identity-type"] ?? "")); $host = trim(($options["host"] ?? "")); $host_key = ($options["host-key"] ?? ""); - $port = $options["port"] ?? 22; + $port = !empty($options["port"]) ? $options["port"] : SSHKeys::DEFAULT_PORT; $username = $options["user"] ?? false; $command = $options["run"] ?? ""; diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php index 5a11b3d60..052a1889c 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/upload_sftp.php @@ -317,7 +317,7 @@ function connectWithServer(array $options, &$error): ?SftpClient $identity_type = trim(($options["identity-type"] ?? "")) ?: SSHKeys::DEFAULT_IDENTITY_TYPE; $host = trim(($options["host"] ?? "")); $host_key = ($options["host-key"] ?? ""); - $port = $options["port"] ?? 22; + $port = !empty($options["port"]) ? $options["port"] : SSHKeys::DEFAULT_PORT; $username = $options["user"]; $sftp = new SftpClient(configPath(), $identity_type); From 9d528264d76a6deab9e9e75209876ffc6b1573dd Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 17 Dec 2024 17:00:25 +0100 Subject: [PATCH 2/5] security/acme-client: convert synology_dsm variables to uppercase, refs #4286 --- .../LeAutomation/AcmeSynologyDsm.php | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php index 3194f5745..8762bebf6 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php @@ -1,7 +1,7 @@ acme_env['SYNO_Certificate'] = 'OPNsense ACME cert ' . $this->cert_id; - $this->acme_env['SYNO_Hostname'] = (string)$this->config->acme_synology_dsm_hostname; - $this->acme_env['SYNO_Port'] = (string)$this->config->acme_synology_dsm_port; - $this->acme_env['SYNO_Scheme'] = (string)$this->config->acme_synology_dsm_scheme; - $this->acme_env['SYNO_Username'] = (string)$this->config->acme_synology_dsm_username; - $this->acme_env['SYNO_Password'] = (string)$this->config->acme_synology_dsm_password; + $this->acme_env['SYNO_CERTIFICATE'] = 'OPNsense ACME cert ' . $this->cert_id; + $this->acme_env['SYNO_HOSTNAME'] = (string)$this->config->acme_synology_dsm_hostname; + $this->acme_env['SYNO_PORT'] = (string)$this->config->acme_synology_dsm_port; + $this->acme_env['SYNO_SCHEME'] = (string)$this->config->acme_synology_dsm_scheme; + $this->acme_env['SYNO_USERNAME'] = (string)$this->config->acme_synology_dsm_username; + $this->acme_env['SYNO_PASSWORD'] = (string)$this->config->acme_synology_dsm_password; if (!empty((string)$this->config->acme_synology_dsm_create)) { - $this->acme_env['SYNO_Create'] = (string)$this->config->acme_synology_dsm_create; + $this->acme_env['SYNO_CREATE'] = (string)$this->config->acme_synology_dsm_create; } if (!empty((string)$this->config->acme_synology_dsm_deviceid)) { - $this->acme_env['SYNO_Device_ID'] = (string)$this->config->acme_synology_dsm_deviceid; + $this->acme_env['SYNO_DEVICE_ID'] = (string)$this->config->acme_synology_dsm_deviceid; } if (!empty((string)$this->config->acme_synology_dsm_devicename)) { - $this->acme_env['SYNO_Device_Name'] = (string)$this->config->acme_synology_dsm_devicename; + $this->acme_env['SYNO_DEVICE_NAME'] = (string)$this->config->acme_synology_dsm_devicename; } $this->acme_args[] = '--deploy-hook synology_dsm'; return true; From 675f682aeb90e34ca9d25ce0a7096e217849ce76 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 17 Dec 2024 17:02:25 +0100 Subject: [PATCH 3/5] security/acme-client: bump version + update changelog --- security/acme-client/Makefile | 2 +- security/acme-client/pkg-descr | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index 06cece8ad..e431857ae 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 4.6 +PLUGIN_VERSION= 4.7 PLUGIN_COMMENT= ACME Client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index f6fb2be75..19c9cb23a 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -10,6 +10,13 @@ Plugin Changelog 4.7 +Added: +* Add support for MyDNS.JP DNS API (#4328) +* Add support for fornex DNS API (#4389) + +Changed: +* Convert synology_dsm deploy hook variables to uppercase (#4286) + Fixed: * SFTP/SSH automation results in fatal PHP error (#4363) From 911bdce8b4c3c8f1fbc5b10d3a11f6d95de8a708 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 17 Dec 2024 17:22:20 +0100 Subject: [PATCH 4/5] security/acme-client: add OTP Code for Synology, refs #4045 --- security/acme-client/pkg-descr | 3 ++- .../controllers/OPNsense/AcmeClient/forms/dialogAction.xml | 6 ++++++ .../OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php | 3 +++ .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml | 5 +++++ 4 files changed, 16 insertions(+), 1 deletion(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 19c9cb23a..46af10d17 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -13,9 +13,10 @@ Plugin Changelog Added: * Add support for MyDNS.JP DNS API (#4328) * Add support for fornex DNS API (#4389) +* Add support for OTP Code to Synology deploy hook (#4045) Changed: -* Convert synology_dsm deploy hook variables to uppercase (#4286) +* Convert Synology deploy hook variables to uppercase (#4286) Fixed: * SFTP/SSH automation results in fatal PHP error (#4363) diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAction.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAction.xml index 09066d054..97d14b355 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAction.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAction.xml @@ -225,6 +225,12 @@ text If Synology DSM has OTP enabled, then the device name has to be provided so that no OTP is required when running the automation. + + action.acme_synology_dsm_otpcode + + text + If Synology DSM has OTP enabled, then a OTP may be required. + action.acme_synology_dsm_create diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php index 8762bebf6..48c520d9c 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/AcmeSynologyDsm.php @@ -53,6 +53,9 @@ class AcmeSynologyDsm extends Base implements LeAutomationInterface if (!empty((string)$this->config->acme_synology_dsm_devicename)) { $this->acme_env['SYNO_DEVICE_NAME'] = (string)$this->config->acme_synology_dsm_devicename; } + if (!empty((string)$this->config->acme_synology_dsm_otpcode)) { + $this->acme_env['SYNO_OTP_CODE'] = (string)$this->config->acme_synology_dsm_otpcode; + } $this->acme_args[] = '--deploy-hook synology_dsm'; return true; } diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index 49fd92867..93a1de578 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -1506,6 +1506,11 @@ /^.{1,1024}$/u Should be a string between 1 and 1024 characters. + + N + /^.{1,1024}$/u + Should be a string between 1 and 1024 characters. + N /^.{1,1024}$/u From 6b1700bd23c0816cee9e7634d1398c0150d53581 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 18 Dec 2024 10:46:45 +0100 Subject: [PATCH 5/5] security/acme-client: add support for INWX 2FA (#3942) requires https://github.com/opnsense/tools/pull/444 While here, fix a typo in the INWX password field name: inws -> inwx --- security/acme-client/pkg-descr | 2 + .../AcmeClient/forms/dialogValidation.xml | 8 +++- .../AcmeClient/LeValidation/DnsInwx.php | 12 ++++- .../models/OPNsense/AcmeClient/AcmeClient.php | 17 ++++++- .../models/OPNsense/AcmeClient/AcmeClient.xml | 9 +++- .../OPNsense/AcmeClient/Migrations/M4_2_0.php | 47 +++++++++++++++++++ 6 files changed, 90 insertions(+), 5 deletions(-) create mode 100644 security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_2_0.php diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 46af10d17..ff97285f0 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -14,12 +14,14 @@ Added: * Add support for MyDNS.JP DNS API (#4328) * Add support for fornex DNS API (#4389) * Add support for OTP Code to Synology deploy hook (#4045) +* Add support for Shared Secret to INWX DNS API (#3942) Changed: * Convert Synology deploy hook variables to uppercase (#4286) Fixed: * SFTP/SSH automation results in fatal PHP error (#4363) +* Typo in INWX password field name 4.6 diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 56b38f1de..702aa67c9 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -690,10 +690,16 @@ text - validation.dns_inws_password + validation.dns_inwx_password password + + validation.dns_inwx_shared_secret + + password + When 2FA is enabled, the Shared Secret must be provided. Note that this feature requires the package oath-toolkit, which must be installed manually. + header diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInwx.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInwx.php index f4e0533fb..736dd0c0e 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInwx.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInwx.php @@ -1,7 +1,7 @@ acme_env['INWX_User'] = (string)$this->config->dns_inwx_user; - $this->acme_env['INWX_Password'] = (string)$this->config->dns_inws_password; + $this->acme_env['INWX_Password'] = (string)$this->config->dns_inwx_password; + if (!empty((string)$this->config->dns_inwx_shared_secret)) { + if ((string)$this->model->isPackageInstalled('oath-toolkit') != '1') { + LeUtils::log_error('Required package oath-toolkit is NOT installed. Please install the package or remove the INWX Shared Secret.'); + return false; + } + $this->acme_env['INWX_Shared_Secret'] = (string)$this->config->dns_inwx_shared_secret; + } } } diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.php index 347cd471b..d775974d2 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.php +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.php @@ -1,7 +1,7 @@ configdRun('firmware plugin ' . escapeshellarg($name))); } + + /** + * check if the specfied package is installed + * @param $name package name + * @return bool is the package installed + */ + public function isPackageInstalled($name) + { + $backend = new Backend(); + $_package_list = $backend->configdRun('firmware local'); + if (preg_match("/^$name\|\|.*/m", $_package_list)) { + return 1; + } + return 0; + } } diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index 93a1de578..ab94015e5 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -1,6 +1,6 @@ //OPNsense/AcmeClient - 4.1.0 + 4.2.0 A secure ACME Client plugin @@ -746,9 +746,16 @@ N + N + + N + + + N + N diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_2_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_2_0.php new file mode 100644 index 000000000..f896a8e65 --- /dev/null +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_2_0.php @@ -0,0 +1,47 @@ +getNodeByReference('validations.validation')->iterateItems() as $validation) { + $dns_service = (string)$validation->dns_service; + if ($dns_service === 'dns_inwx') { + // Migrate data from misspelled item to new one + $validation->dns_inwx_password = (string)$validation->dns_inws_password; + } + } + } +}