netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/acme-client: fix more PHP deprecation messages, closes #4008

Browse Source
This commit is contained in:
Frank Wall
2024-07-27 23:18:50 +02:00
parent 6318a3aea1
commit 1d5bb7781d
15 changed files with 64 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/pkg-descr
+1
View File
@@ -14,6 +14,7 @@ Fixed:
* fix empty System Log
* avoid unnecessary error log messages (#3860)
* don't log errors for successful commands (#3955)
* fix more PHP deprecation messages (#4008)
4.4
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/AccountsController.php
+1 -1
View File
@@ -92,7 +92,7 @@ class AccountsController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('accounts.account.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient register-account ${uuid}");
$response = $backend->configdRun("acmeclient register-account {$uuid}");
return array("response" => $response);
}
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php
+5 -5
View File
@@ -104,7 +104,7 @@ class CertificatesController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient sign-cert ${uuid}");
$response = $backend->configdRun("acmeclient sign-cert {$uuid}");
return array("response" => $response);
}
}
@@ -125,7 +125,7 @@ class CertificatesController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient remove-key ${uuid}");
$response = $backend->configdRun("acmeclient remove-key {$uuid}");
}
}
return $result;
@@ -146,7 +146,7 @@ class CertificatesController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient revoke-cert ${uuid}");
$response = $backend->configdRun("acmeclient revoke-cert {$uuid}");
return array("response" => $response);
}
}
@@ -167,7 +167,7 @@ class CertificatesController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient run-automation ${uuid}");
$response = $backend->configdRun("acmeclient run-automation {$uuid}");
}
}
return $result;
@@ -186,7 +186,7 @@ class CertificatesController extends ApiMutableModelControllerBase
$node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
if ($node != null) {
$backend = new Backend();
$response = $backend->configdRun("acmeclient import ${uuid}");
$response = $backend->configdRun("acmeclient import {$uuid}");
}
}
return $result;
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
+2 -2
View File
@@ -131,7 +131,7 @@ class LeAccount extends LeCommon
// Read account key file
$account_key_content = @file_get_contents($account_key_file);
if (empty($account_key_content) || ($account_key_content == false)) {
LeUtils::log_error("unable to read account key from file ${account_key_file}");
LeUtils::log_error("unable to read account key from file {$account_key_file}");
$this->setStatus(500);
return false;
}
@@ -257,7 +257,7 @@ class LeAccount extends LeCommon
// Convert array back to ini file format
$new_account_conf = array();
foreach ($account_conf as $key => $value) {
$new_account_conf[] = "${key}='${value}'";
$new_account_conf[] = "{$key}='{$value}'";
}
// Write changes back to file
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationFactory.php
+3 -3
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* Copyright (C) 2018 Deciso B.V.
* All rights reserved.
*
@@ -50,7 +50,7 @@ class LeAutomationFactory
$model = new \OPNsense\AcmeClient\AcmeClient();
$obj = $model->getNodeByReference(self::CONFIG_PATH . '.' . $uuid);
if ($obj == null) {
LeUtils::log_error("automation not found: ${uuid}");
LeUtils::log_error("automation not found: {$uuid}");
return null;
}
@@ -75,7 +75,7 @@ class LeAutomationFactory
}
}
LeUtils::log_error("automation not supported: " . (string)$obj->type . " (${uuid})");
LeUtils::log_error("automation not supported: " . (string)$obj->type . " ({$uuid})");
return null;
}
}
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+6 -6
View File
@@ -130,7 +130,7 @@ class LeCertificate extends LeCommon
clearstatcache(); // don't let the cache fool us
foreach (array($this->cert_file, $this->cert_key_file, $this->cert_chain_file, $this->cert_fullchain_file) as $file) {
if (!is_file($file)) {
LeUtils::log_error("unable to import certificate " . $this->config->name . ", file not found: ${file}");
LeUtils::log_error("unable to import certificate " . $this->config->name . ", file not found: {$file}");
Config::getInstance()->unlock();
return false;
}
@@ -191,7 +191,7 @@ class LeCertificate extends LeCommon
}
} else {
// Create new CA
LeUtils::log("importing ACME CA: ${ca_cn}");
LeUtils::log("importing ACME CA: {$ca_cn}");
$newca = Config::getInstance()->object()->addChild('ca');
foreach (array_keys($ca) as $cacfg) {
$newca->addChild($cacfg, (string)$ca[$cacfg]);
@@ -288,7 +288,7 @@ class LeCertificate extends LeCommon
$newcert->addChild($certcfg, (string)$cert[$certcfg]);
}
}
LeUtils::log("${import_log_message} ACME X.509 certificate: ${cert_cn}");
LeUtils::log("{$import_log_message} ACME X.509 certificate: {$cert_cn}");
/**
* Step 3: update configuration
@@ -361,7 +361,7 @@ class LeCertificate extends LeCommon
LeUtils::log('auto renewal is disabled for certificate: ' . (string)$this->config->name);
return false;
}
LeUtils::log("${acme_action} certificate: " . (string)$this->config->name);
LeUtils::log("{$acme_action} certificate: " . (string)$this->config->name);
LeUtils::log('using CA: ' . $this->ca);
// Ensure that account is registered.
@@ -375,7 +375,7 @@ class LeCertificate extends LeCommon
$configdir = (string)sprintf(self::ACME_CONFIG_DIR, (string)$this->config->id);
foreach (array($certdir, $keydir, $configdir) as $dir) {
if (!is_dir($dir)) {
LeUtils::log_debug("creating directory: ${dir}", $this->debug);
LeUtils::log_debug("creating directory: {$dir}", $this->debug);
mkdir($dir, 0700, true);
}
}
@@ -606,7 +606,7 @@ class LeCertificate extends LeCommon
$automation->run();
}
} else {
LeUtils::log_error("ignoring invalid automation: ${auto_uuid}");
LeUtils::log_error("ignoring invalid automation: {$auto_uuid}");
}
}
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+4 -4
View File
@@ -125,9 +125,9 @@ abstract class LeCommon
{
// Get config object
$model = new \OPNsense\AcmeClient\AcmeClient();
$obj = $model->getNodeByReference("${path}.${uuid}");
$obj = $model->getNodeByReference("{$path}.{$uuid}");
if ($obj == null) {
LeUtils::log_error("config of type ${path} not found: ${uuid}");
LeUtils::log_error("config of type {$path} not found: {$uuid}");
return false;
}
// Store config objects
@@ -153,9 +153,9 @@ abstract class LeCommon
{
// Get account config object
$model = new \OPNsense\AcmeClient\AcmeClient();
$obj = $model->getNodeByReference("accounts.account.${uuid}");
$obj = $model->getNodeByReference("accounts.account.{$uuid}");
if (empty($obj) || $obj == null) {
LeUtils::log_error("unable to set CA, account not found: ${uuid}");
LeUtils::log_error("unable to set CA, account not found: {$uuid}");
return false;
}
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php
+3 -3
View File
@@ -155,7 +155,7 @@ class LeUtils
*/
public static function log($msg)
{
syslog(LOG_NOTICE, "AcmeClient: ${msg}");
syslog(LOG_NOTICE, "AcmeClient: {$msg}");
}
/**
@@ -164,7 +164,7 @@ class LeUtils
public static function log_debug($msg, bool $debug = false)
{
if ($debug) {
syslog(LOG_NOTICE, "AcmeClient: ${msg}");
syslog(LOG_NOTICE, "AcmeClient: {$msg}");
}
}
@@ -173,7 +173,7 @@ class LeUtils
*/
public static function log_error($msg)
{
syslog(LOG_ERR, "AcmeClient: ${msg}");
syslog(LOG_ERR, "AcmeClient: {$msg}");
}
/**
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php
+2 -2
View File
@@ -58,7 +58,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
// Get account object to query ID
$account = new LeAccount($accountuuid);
if (empty($account) || $account == null) {
LeUtils::log_error("unable to load account information: ${accountuuid}");
LeUtils::log_error("unable to load account information: {$accountuuid}");
return false;
}
@@ -164,7 +164,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
// will never change.
$acmecmd = self::ACME_CMD
. ' '
. "--${acme_action} "
. "--{$acme_action} "
. implode(' ', $this->acme_args) . ' '
. LeUtils::execSafe('--accountconf %s', $account_conf_file);
LeUtils::log_debug('running acme.sh command: ' . (string)$acmecmd, $this->debug);
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsGcloud.php
+9 -9
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -56,7 +56,7 @@ class DnsGcloud extends Base implements LeValidationInterface
LeUtils::log_error('unable to extract project name from Google Cloud DNS JSON key');
return false;
} else {
LeUtils::log("Google Cloud DNS project name: ${gcloud_project}");
LeUtils::log("Google Cloud DNS project name: {$gcloud_project}");
}
} else {
LeUtils::log('no key for Google Cloud DNS was specified');
@@ -66,8 +66,8 @@ class DnsGcloud extends Base implements LeValidationInterface
// Preparations to run gcloud CLI.
// NOTE: Never versions of gcloud SDK no longer allow dots in config names.
$val_id = str_replace('.', '-', (string)$this->config->id);
$gcloud_config = "acme-${val_id}";
$gcloud_key_file = '/tmp/acme_' . (string)$this->config->dns_service . "_${val_id}.json";
$gcloud_config = "acme-{$val_id}";
$gcloud_key_file = '/tmp/acme_' . (string)$this->config->dns_service . "_{$val_id}.json";
file_put_contents($gcloud_key_file, (string)$this->config->dns_gcloud_key);
chmod($gcloud_key_file, 0600);
$proc_env['CLOUDSDK_PYTHON'] = '/usr/local/bin/python3';
@@ -75,11 +75,11 @@ class DnsGcloud extends Base implements LeValidationInterface
$proc_env['CLOUDSDK_CORE_PROJECT'] = $gcloud_project;
// Ensure that a working gcloud config exists.
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations create ${gcloud_config}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations activate ${gcloud_config}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet auth activate-service-account --key-file=${gcloud_key_file}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set account ${gcloud_account}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set project ${gcloud_project}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations create {$gcloud_config}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations activate {$gcloud_config}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet auth activate-service-account --key-file={$gcloud_key_file}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set account {$gcloud_account}", $proc_env);
LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set project {$gcloud_project}", $proc_env);
// Save config for acme client.
$this->acme_env['CLOUDSDK_PYTHON'] = '/usr/local/bin/python3';
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNsupdate.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -40,7 +40,7 @@ class DnsNsupdate extends Base implements LeValidationInterface
public function prepare()
{
$configdir = (string)sprintf(self::ACME_CONFIG_DIR, $this->cert_id);
$secret_key_filename = "${configdir}/secret.key";
$secret_key_filename = "{$configdir}/secret.key";
$secret_key_data = (string)$this->config->dns_nsupdate_key . "\n";
file_put_contents($secret_key_filename, $secret_key_data);
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsTransip.php
+1 -1
View File
@@ -40,7 +40,7 @@ class DnsTransip extends Base implements LeValidationInterface
public function prepare()
{
$configdir = (string)sprintf(self::ACME_CONFIG_DIR, $this->cert_id);
$secret_key_filename = "${configdir}/secret.key";
$secret_key_filename = "{$configdir}/secret.key";
$secret_key_data = (string)$this->config->dns_transip_key . "\n";
file_put_contents($secret_key_filename, $secret_key_data);
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php
+11 -11
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -55,7 +55,7 @@ class HttpOpnsense extends Base implements LeValidationInterface
$dnslist[] = $this->cert_name;
foreach ($dnslist as $fqdn) {
// NOTE: This may take some time.
$ip_found = gethostbyname("${fqdn}.");
$ip_found = gethostbyname("{$fqdn}.");
if (!empty($ip_found)) {
$iplist[] = (string)$ip_found;
}
@@ -96,16 +96,16 @@ class HttpOpnsense extends Base implements LeValidationInterface
// IPv4
$_dst = '127.0.0.1';
$_family = 'inet';
LeUtils::log("using IPv4 address: ${ip}");
LeUtils::log("using IPv4 address: {$ip}");
} elseif (($_ipv6_enabled == true) && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
// IPv6
$_dst = '::1';
$_family = 'inet6';
LeUtils::log("using IPv6 address: ${ip}");
LeUtils::log("using IPv6 address: {$ip}");
} else {
continue; // skip broken entries
}
$anchor_rules .= "rdr pass ${_family} proto tcp from any to ${ip} port 80 -> ${_dst} port ${local_http_port}\n";
$anchor_rules .= "rdr pass {$_family} proto tcp from any to {$ip} port 80 -> {$_dst} port {$local_http_port}\n";
}
} else {
LeUtils::log_error("no IP addresses found to setup port forward");
@@ -120,12 +120,12 @@ class HttpOpnsense extends Base implements LeValidationInterface
// Create temporary port forward to allow acme challenges to get through
$anchor_setup = "rdr-anchor \"acme-client\"\n";
file_put_contents("${configdir}/acme_anchor_setup", $anchor_setup);
chmod("${configdir}/acme_anchor_setup", 0600);
mwexec("/sbin/pfctl -f ${configdir}/acme_anchor_setup");
file_put_contents("${configdir}/acme_anchor_rules", $anchor_rules);
chmod("${configdir}/acme_anchor_rules", 0600);
mwexec("/sbin/pfctl -a acme-client -f ${configdir}/acme_anchor_rules");
file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup);
chmod("{$configdir}/acme_anchor_setup", 0600);
mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup");
file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules);
chmod("{$configdir}/acme_anchor_rules", 0600);
mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules");
}
public function cleanup()
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php
+11 -11
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2021 Frank Wall
* Copyright (C) 2021-2024 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -56,7 +56,7 @@ class TlsalpnAcme extends Base implements LeValidationInterface
$dnslist[] = $this->cert_name;
foreach ($dnslist as $fqdn) {
// NOTE: This may take some time.
$ip_found = gethostbyname("${fqdn}.");
$ip_found = gethostbyname("{$fqdn}.");
if (!empty($ip_found)) {
$iplist[] = (string)$ip_found;
}
@@ -97,16 +97,16 @@ class TlsalpnAcme extends Base implements LeValidationInterface
// IPv4
$_dst = '127.0.0.1';
$_family = 'inet';
LeUtils::log("using IPv4 address: ${ip}");
LeUtils::log("using IPv4 address: {$ip}");
} elseif (($_ipv6_enabled == true) && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
// IPv6
$_dst = '::1';
$_family = 'inet6';
LeUtils::log("using IPv6 address: ${ip}");
LeUtils::log("using IPv6 address: {$ip}");
} else {
continue; // skip broken entries
}
$anchor_rules .= "rdr pass ${_family} proto tcp from any to ${ip} port 443 -> ${_dst} port ${local_tls_port}\n";
$anchor_rules .= "rdr pass {$_family} proto tcp from any to {$ip} port 443 -> {$_dst} port {$local_tls_port}\n";
}
} else {
LeUtils::log_error("no IP addresses found to setup port forward");
@@ -121,12 +121,12 @@ class TlsalpnAcme extends Base implements LeValidationInterface
// Create temporary port forward to allow acme challenges to get through
$anchor_setup = "rdr-anchor \"acme-client\"\n";
file_put_contents("${configdir}/acme_anchor_setup", $anchor_setup);
chmod("${configdir}/acme_anchor_setup", 0600);
mwexec("/sbin/pfctl -f ${configdir}/acme_anchor_setup");
file_put_contents("${configdir}/acme_anchor_rules", $anchor_rules);
chmod("${configdir}/acme_anchor_rules", 0600);
mwexec("/sbin/pfctl -a acme-client -f ${configdir}/acme_anchor_rules");
file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup);
chmod("{$configdir}/acme_anchor_setup", 0600);
mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup");
file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules);
chmod("{$configdir}/acme_anchor_rules", 0600);
mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules");
}
public function cleanup()
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidationFactory.php
+3 -3
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2020-2024 Frank Wall
* Copyright (C) 2018 Deciso B.V.
* All rights reserved.
*
@@ -50,7 +50,7 @@ class LeValidationFactory
$model = new \OPNsense\AcmeClient\AcmeClient();
$obj = $model->getNodeByReference(self::CONFIG_PATH . '.' . $uuid);
if ($obj == null) {
LeUtils::log_error("challenge type not found: ${uuid}");
LeUtils::log_error("challenge type not found: {$uuid}");
return null;
}
@@ -87,7 +87,7 @@ class LeValidationFactory
}
}
}
LeUtils::log_error("challenge type not supported: " . (string)$search_name . " (${uuid})");
LeUtils::log_error("challenge type not supported: " . (string)$search_name . " ({$uuid})");
return null;
}
}