security/acme-client: deprecate lexicon, refs #2920

This commit is contained in:
Frank Wall
2024-01-17 22:52:17 +01:00
parent a99bfebb71
commit 1eae27c69f
4 changed files with 371 additions and 56 deletions
+54
View File
@@ -14,6 +14,10 @@ NOTE: This is a new major release with backwards-incompatible changes.
Downgrade to older releases is not supported. Be sure to create a
full backup and include /var/etc/acme-client.
NOTE: Lexicon is deprecated and most configurations are converted
to native acme.sh DNS APIs. However, in some case manual reconfiguration
may be necessary.
Added:
* add nic.ru DNS API (#3684)
* add Aurora DNS API
@@ -27,12 +31,62 @@ Added:
Changed:
* use a dedicated acme.sh runtime directory for every cert (#3127)
* migrate lexicon provider aliyun to acme.sh DNS API (#2920)
* migrate lexicon provider aurora to acme.sh DNS API (#2920)
* migrate lexicon provider azure to acme.sh DNS API (#2920)
* migrate lexicon provider cloudflare to acme.sh DNS API (#2920)
* migrate lexicon provider cloudns to acme.sh DNS API (#2920)
* migrate lexicon provider cloudxns to acme.sh DNS API (#2920)
* migrate lexicon provider conoha to acme.sh DNS API (#2920)
* migrate lexicon provider constellix to acme.sh DNS API (#2920)
* migrate lexicon provider digitalocean to acme.sh DNS API (#2920)
* migrate lexicon provider directadmin to acme.sh DNS API (#2920)
* migrate lexicon provider dnsimple to acme.sh DNS API (#2920)
* migrate lexicon provider dnsmadeeasy to acme.sh DNS API (#2920)
* migrate lexicon provider dnspod to acme.sh DNS API (#2920)
* migrate lexicon provider dreamhost to acme.sh DNS API (#2920)
* migrate lexicon provider easydns to acme.sh DNS API (#2920)
* migrate lexicon provider exoscale to acme.sh DNS API (#2920)
* migrate lexicon provider gandi to acme.sh DNS API (#2920)
* migrate lexicon provider godaddy to acme.sh DNS API (#2920)
* migrate lexicon provider googleclouddns to acme.sh DNS API (#2920)
* migrate lexicon provider gratisdns to acme.sh DNS API (#2920)
* migrate lexicon provider henet to acme.sh DNS API (#2920)
* migrate lexicon provider hetzner to acme.sh DNS API (#2920)
* migrate lexicon provider infoblox to acme.sh DNS API (#2920)
* migrate lexicon provider internetbs to acme.sh DNS API (#2920)
* migrate lexicon provider inwx to acme.sh DNS API (#2920)
* migrate lexicon provider linode to acme.sh DNS API (#2920)
* migrate lexicon provider linode4 to acme.sh DNS API (#2920)
* migrate lexicon provider luadns to acme.sh DNS API (#2920)
* migrate lexicon provider namecheap to acme.sh DNS API (#2920)
* migrate lexicon provider namesilo to acme.sh DNS API (#2920)
* migrate lexicon provider netcup to acme.sh DNS API (#2920)
* migrate lexicon provider nfsn to acme.sh DNS API (#2920)
* migrate lexicon provider nsone to acme.sh DNS API (#2920)
* migrate lexicon provider online to acme.sh DNS API (#2920)
* migrate lexicon provider ovh to acme.sh DNS API (#2920)
* migrate lexicon provider plesk to acme.sh DNS API (#2920)
* migrate lexicon provider pointhq to acme.sh DNS API (#2920)
* migrate lexicon provider powerdns to acme.sh DNS API (#2920)
* migrate lexicon provider rackspace to acme.sh DNS API (#2920)
* migrate lexicon provider rage4 to acme.sh DNS API (#2920)
* migrate lexicon provider route53 to acme.sh DNS API (#2920)
* migrate lexicon provider transip to acme.sh DNS API (#2920)
* migrate lexicon provider vultr to acme.sh DNS API (#2920)
* migrate lexicon provider yandex to acme.sh DNS API (#2920)
* migrate lexicon provider zeit to acme.sh DNS API (#2920)
* migrate lexicon provider zilore to acme.sh DNS API (#2920)
* migrate lexicon provider zonomi to acme.sh DNS API (#2920)
Fixed:
* fix sporadic command failure with gcloud DNS API (#3745)
* fix errors when the same Common Name is used multiple times (#3127)
* fix crash on invalid automations (#3752)
Deprecated:
* deprecate support for lexicon DNS APIs (no removal date yet)
3.20
Added:
@@ -788,12 +788,7 @@
<help>Specify the location of the generated TSIG Key inside the TSIG file using grep and cut, example: grep \# /etc/knot/acme.key | cut -d' ' -f2</help>
</field>
<field>
<label>lexicon</label>
<type>header</type>
<style>table_dns table_dns_lexicon</style>
</field>
<field>
<label>NOTE: A DNS sleep time of at least 1000 may be required.</label>
<label>lexicon (DEPRECATED)</label>
<type>header</type>
<style>table_dns table_dns_lexicon</style>
</field>
@@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/AcmeClient</mount>
<version>4.0.0</version>
<version>4.1.0</version>
<description>A secure ACME Client plugin</description>
<items>
<settings>
@@ -481,7 +481,7 @@
<dns_kinghost>KingHost</dns_kinghost>
<dns_knot>Knot (knsupdate)</dns_knot>
<dns_leaseweb>LeaseWeb</dns_leaseweb>
<dns_lexicon>lexicon</dns_lexicon>
<dns_lexicon>lexicon (DEPRECATED)</dns_lexicon>
<dns_linode>Linode (v3 / Deprecated)</dns_linode>
<dns_linode_v4>Linode (v4)</dns_linode_v4>
<dns_loopia>Loopia</dns_loopia>
@@ -787,67 +787,67 @@
<Required>N</Required>
<default>cloudflare</default>
<OptionValues>
<aliyun>Aliyun.com</aliyun>
<aurora>AuroraDNS</aurora>
<aliyun>Aliyun.com (UNSUPPORTED)</aliyun>
<aurora>AuroraDNS (UNSUPPORTED)</aurora>
<auto>Auto API</auto>
<azure>Azure</azure>
<cloudflare>CloudFlare</cloudflare>
<cloudns>ClouDNS</cloudns>
<cloudxns>CloudXNS</cloudxns>
<conoha>ConoHa</conoha>
<constellix>Constellix</constellix>
<digitalocean>DigitalOcean</digitalocean>
<dinahosting>Dinahosting</dinahosting>
<directadmin>DirectAdmin</directadmin>
<dnsimple>DNSimple</dnsimple>
<dnsmadeeasy>DnsMadeEasy</dnsmadeeasy>
<azure>Azure (UNSUPPORTED)</azure>
<cloudflare>CloudFlare (UNSUPPORTED)</cloudflare>
<cloudns>ClouDNS (UNSUPPORTED)</cloudns>
<cloudxns>CloudXNS (UNSUPPORTED)</cloudxns>
<conoha>ConoHa (UNSUPPORTED)</conoha>
<constellix>Constellix (UNSUPPORTED)</constellix>
<digitalocean>DigitalOcean (UNSUPPORTED)</digitalocean>
<dinahosting>Dinahosting (UNSUPPORTED)</dinahosting>
<directadmin>DirectAdmin (UNSUPPORTED)</directadmin>
<dnsimple>DNSimple (UNSUPPORTED)</dnsimple>
<dnsmadeeasy>DnsMadeEasy (UNSUPPORTED)</dnsmadeeasy>
<dnspark>DNSPark</dnspark>
<dnspod>DNSPod</dnspod>
<dreamhost>Dreamhost</dreamhost>
<easydns>EasyDNS</easydns>
<dnspod>DNSPod (UNSUPPORTED)</dnspod>
<dreamhost>Dreamhost (UNSUPPORTED)</dreamhost>
<easydns>EasyDNS (UNSUPPORTED)</easydns>
<easyname>Easyname</easyname>
<exoscale>ExoScale</exoscale>
<gandi>Gandi</gandi>
<exoscale>ExoScale (UNSUPPORTED)</exoscale>
<gandi>Gandi (UNSUPPORTED)</gandi>
<gehirn>Gehirn</gehirn>
<glesys>Glesys</glesys>
<godaddy>GoDaddy</godaddy>
<googleclouddns>Google Cloud</googleclouddns>
<gratisdns>GratisDNS</gratisdns>
<henet>Hurricane Electric</henet>
<hetzner>Hetzner</hetzner>
<godaddy>GoDaddy (UNSUPPORTED)</godaddy>
<googleclouddns>Google Cloud (UNSUPPORTED)</googleclouddns>
<gratisdns>GratisDNS (UNSUPPORTED)</gratisdns>
<henet>Hurricane Electric (UNSUPPORTED)</henet>
<hetzner>Hetzner (UNSUPPORTED)</hetzner>
<hover>Hover</hover>
<infoblox>Infoblox</infoblox>
<internetbs>Internet.bs</internetbs>
<inwx>INWX</inwx>
<linode>Linode (v3 / Deprecated)</linode>
<linode4>Linode (v4)</linode4>
<infoblox>Infoblox (UNSUPPORTED)</infoblox>
<internetbs>Internet.bs (UNSUPPORTED)</internetbs>
<inwx>INWX (UNSUPPORTED)</inwx>
<linode>Linode v3 (UNSUPPORTED)</linode>
<linode4>Linode v4 (UNSUPPORTED)</linode4>
<localzone>Localzone</localzone>
<luadns>LuaDNS</luadns>
<luadns>LuaDNS (UNSUPPORTED)</luadns>
<memset>Memset</memset>
<namecheap>Namecheap</namecheap>
<namesilo>Namesilo</namesilo>
<netcup>Netcup</netcup>
<nfsn>NFSN</nfsn>
<nsone>NS1</nsone>
<namecheap>Namecheap (UNSUPPORTED)</namecheap>
<namesilo>Namesilo (UNSUPPORTED)</namesilo>
<netcup>Netcup (UNSUPPORTED)</netcup>
<nfsn>NFSN (UNSUPPORTED)</nfsn>
<nsone>NS1 (UNSUPPORTED)</nsone>
<onapp>OnApp</onapp>
<online>Online</online>
<ovh>OVH</ovh>
<plesk>Plesk</plesk>
<pointhq>PointHQ</pointhq>
<powerdns>PowerDNS</powerdns>
<rackspace>Rackspace</rackspace>
<rage4>Rage4</rage4>
<route53>Route 53</route53>
<online>Online (UNSUPPORTED)</online>
<ovh>OVH (UNSUPPORTED)</ovh>
<plesk>Plesk (UNSUPPORTED)</plesk>
<pointhq>PointHQ (UNSUPPORTED)</pointhq>
<powerdns>PowerDNS (UNSUPPORTED)</powerdns>
<rackspace>Rackspace (UNSUPPORTED)</rackspace>
<rage4>Rage4 (UNSUPPORTED)</rage4>
<route53>Route 53 (UNSUPPORTED)</route53>
<safedns>SafeDNS</safedns>
<sakuracloud>SakuraCloud</sakuracloud>
<softlayer>Softlayer</softlayer>
<subreg>Subreg</subreg>
<transip>Transip</transip>
<vultr>Vultr</vultr>
<yandex>Yandex</yandex>
<zeit>Zeit</zeit>
<zilore>Zilore</zilore>
<zonomi>Zonomi</zonomi>
<transip>Transip (UNSUPPORTED)</transip>
<vultr>Vultr (UNSUPPORTED)</vultr>
<yandex>Yandex (UNSUPPORTED)</yandex>
<zeit>Zeit (UNSUPPORTED)</zeit>
<zilore>Zilore (UNSUPPORTED)</zilore>
<zonomi>Zonomi (UNSUPPORTED)</zonomi>
</OptionValues>
</dns_lexicon_provider>
<dns_lexicon_user type="TextField">
@@ -0,0 +1,266 @@
<?php
/**
* Copyright (C) 2024 Frank Wall
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
namespace OPNsense\AcmeClient\Migrations;
use OPNsense\Base\BaseModelMigration;
class M4_1_0 extends BaseModelMigration
{
public function run($model)
{
// Migrate validations from "lexicon" to native acme.sh DNS API
foreach ($model->getNodeByReference('validations.validation')->iterateItems() as $validation) {
$dns_service = (string)$validation->dns_service;
$dns_lexicon_provider = (string)$validation->dns_lexicon_provider;
if (!empty($dns_lexicon_provider) && ($dns_service === 'dns_lexicon')) {
// Migrate old lexicon values to DNS API values.
switch ($dns_lexicon_provider) {
case 'aliyun':
$validation->dns_service = 'dns_ali';
$validation->dns_ali_key = (string)$validation->dns_lexicon_user;
$validation->dns_ali_secret = (string)$validation->dns_lexicon_token;
break;
case 'aurora':
$validation->dns_service = 'dns_aurora';
$validation->dns_aurora_key = (string)$validation->dns_lexicon_user;
$validation->dns_aurora_secret = (string)$validation->dns_lexicon_token;
break;
case 'cloudflare':
$validation->dns_service = 'dns_cf';
$validation->dns_cf_key = (string)$validation->dns_lexicon_user;
$validation->dns_cf_token = (string)$validation->dns_lexicon_token;
break;
case 'cloudns':
$validation->dns_service = 'dns_cloudns';
$validation->dns_cloudns_auth_id = (string)$validation->dns_lexicon_user;
$validation->dns_cloudns_auth_password = (string)$validation->dns_lexicon_token;
break;
case 'cloudxns':
$validation->dns_service = 'dns_cx';
$validation->dns_cx_key = (string)$validation->dns_lexicon_user;
$validation->dns_cx_secret = (string)$validation->dns_lexicon_token;
break;
case 'conoha':
$validation->dns_service = 'dns_conoha';
$validation->dns_conoha_user = (string)$validation->dns_lexicon_user;
$validation->dns_conoha_password = (string)$validation->dns_lexicon_token;
break;
case 'constellix':
$validation->dns_service = 'dns_constellix';
$validation->dns_constellix_key = (string)$validation->dns_lexicon_user;
$validation->dns_constellix_secret = (string)$validation->dns_lexicon_token;
break;
case 'digitalocean':
$validation->dns_service = 'dns_dgon';
$validation->dns_dgon_key = (string)$validation->dns_lexicon_token;
break;
case 'directadmin':
$validation->dns_service = 'dns_da';
$validation->dns_da_key = (string)$validation->dns_lexicon_token;
break;
case 'dnsimple':
$validation->dns_service = 'dns_dnsimple';
$validation->dns_dnsimple_token = (string)$validation->dns_lexicon_token;
break;
case 'dnsmadeeasy':
$validation->dns_service = 'dns_me';
$validation->dns_me_key = (string)$validation->dns_lexicon_user;
$validation->dns_me_secret = (string)$validation->dns_lexicon_token;
break;
case 'dnspod':
$validation->dns_service = 'dns_dp';
$validation->dns_dp_id = (string)$validation->dns_lexicon_user;
$validation->dns_dp_key = (string)$validation->dns_lexicon_token;
break;
case 'dreamhost':
$validation->dns_service = 'dns_dreamhost';
// FIXME: parameter prefix should match $dns_service
$validation->dns_dh_key = (string)$validation->dns_lexicon_token;
break;
case 'easydns':
$validation->dns_service = 'dns_easydns';
$validation->dns_easydns_apikey = (string)$validation->dns_lexicon_user;
$validation->dns_easydns_apitoken = (string)$validation->dns_lexicon_token;
break;
case 'exoscale':
$validation->dns_service = 'dns_exoscale';
$validation->dns_exoscale_key = (string)$validation->dns_lexicon_user;
$validation->dns_exoscale_secret = (string)$validation->dns_lexicon_token;
break;
case 'gandi':
$validation->dns_service = 'dns_gandi_livedns';
$validation->dns_gandi_livedns_key = (string)$validation->dns_lexicon_user;
$validation->dns_gandi_livedns_token = (string)$validation->dns_lexicon_token;
break;
case 'godaddy':
$validation->dns_service = 'dns_gd';
$validation->dns_gd_key = (string)$validation->dns_lexicon_user;
$validation->dns_gd_secret = (string)$validation->dns_lexicon_token;
break;
case 'googleclouddns':
$validation->dns_service = 'dns_gcloud';
$validation->dns_gcloud_key = (string)$validation->dns_lexicon_token;
break;
case 'gratisdns':
$validation->dns_service = 'dns_gdnsdk';
$validation->dns_gdnsdk_user = (string)$validation->dns_lexicon_user;
$validation->dns_gdnsdk_password = (string)$validation->dns_lexicon_token;
break;
case 'henet':
$validation->dns_service = 'dns_he';
$validation->dns_he_user = (string)$validation->dns_lexicon_user;
$validation->dns_he_password = (string)$validation->dns_lexicon_token;
break;
case 'hetzner':
$validation->dns_service = 'dns_hetzner';
$validation->dns_hetzner_token = (string)$validation->dns_lexicon_token;
break;
case 'infoblox':
$validation->dns_service = 'dns_infoblox';
$validation->dns_infoblox_credentials = (string)$validation->dns_lexicon_token;
break;
case 'internetbs':
$validation->dns_service = 'dns_internetbs';
$validation->dns_internetbs_key = (string)$validation->dns_lexicon_user;
$validation->dns_internetbs_password = (string)$validation->dns_lexicon_token;
break;
case 'inwx':
$validation->dns_service = 'dns_inwx';
$validation->dns_inwx_user = (string)$validation->dns_lexicon_user;
$validation->dns_inwx_password = (string)$validation->dns_lexicon_token;
break;
case 'linode':
$validation->dns_service = 'dns_linode';
$validation->dns_linode_key = (string)$validation->dns_lexicon_token;
break;
case 'linode4':
$validation->dns_service = 'dns_linode_v4';
$validation->dns_linode_v4_key = (string)$validation->dns_lexicon_token;
break;
case 'luadns':
$validation->dns_service = 'dns_lua';
$validation->dns_lua_email = (string)$validation->dns_lexicon_user;
$validation->dns_lua_key = (string)$validation->dns_lexicon_token;
break;
case 'namecheap':
$validation->dns_service = 'dns_namecheap';
$validation->dns_namecheap_user = (string)$validation->dns_lexicon_user;
$validation->dns_namecheap_api = (string)$validation->dns_lexicon_token;
break;
case 'namesilo':
$validation->dns_service = 'dns_namesilo';
$validation->dns_namesilo_key = (string)$validation->dns_lexicon_token;
break;
case 'netcup':
$validation->dns_service = 'dns_netcup';
$validation->dns_netcup_key = (string)$validation->dns_lexicon_user;
$validation->dns_netcup_pw = (string)$validation->dns_lexicon_token;
break;
case 'nfsn':
$validation->dns_service = 'dns_njalla';
$validation->dns_njalla_token = (string)$validation->dns_lexicon_token;
break;
case 'nsone':
$validation->dns_service = 'dns_nsone';
$validation->dns_nsone_key = (string)$validation->dns_lexicon_token;
break;
case 'online':
$validation->dns_service = 'dns_online';
$validation->dns_online_key = (string)$validation->dns_lexicon_token;
break;
case 'ovh':
$validation->dns_service = 'dns_ovh';
$validation->dns_ovh_app_key = (string)$validation->dns_lexicon_user;
$validation->dns_ovh_app_secret = (string)$validation->dns_lexicon_token;
break;
case 'plesk':
$validation->dns_service = 'dns_pleskxml';
$validation->dns_pleskxml_user = (string)$validation->dns_lexicon_user;
$validation->dns_pleskxml_pass = (string)$validation->dns_lexicon_token;
break;
case 'pointhq':
$validation->dns_service = 'dns_pointhq';
$validation->dns_pointhq_email = (string)$validation->dns_lexicon_user;
$validation->dns_pointhq_key = (string)$validation->dns_lexicon_token;
break;
case 'powerdns':
$validation->dns_service = 'dns_pdns';
$validation->dns_pdns_serverid = (string)$validation->dns_lexicon_user;
$validation->dns_pdns_token = (string)$validation->dns_lexicon_token;
break;
case 'rackspace':
$validation->dns_service = 'dns_rackspace';
$validation->dns_rackspace_user = (string)$validation->dns_lexicon_user;
$validation->dns_rackspace_key = (string)$validation->dns_lexicon_token;
break;
case 'rage4':
$validation->dns_service = 'dns_rage4';
$validation->dns_rage4_user = (string)$validation->dns_lexicon_user;
$validation->dns_rage4_token = (string)$validation->dns_lexicon_token;
break;
case 'route53':
$validation->dns_service = 'dns_aws';
$validation->dns_aws_id = (string)$validation->dns_lexicon_user;
$validation->dns_aws_secret = (string)$validation->dns_lexicon_token;
break;
case 'transip':
$validation->dns_service = 'dns_transip';
$validation->dns_transip_username = (string)$validation->dns_lexicon_user;
$validation->dns_transip_key = (string)$validation->dns_lexicon_token;
break;
case 'vultr':
$validation->dns_service = 'dns_vultr';
$validation->dns_vultr_key = (string)$validation->dns_lexicon_token;
break;
case 'yandex':
$validation->dns_service = 'dns_yandex';
$validation->dns_yandex_token = (string)$validation->dns_lexicon_token;
break;
case 'zeit':
// URL points to zilore, so we'll use this DNS API as a replacement.
$validation->dns_service = 'dns_zilore';
$validation->dns_zilore_key = (string)$validation->dns_lexicon_token;
break;
case 'zilore':
$validation->dns_service = 'dns_zilore';
$validation->dns_zilore_key = (string)$validation->dns_lexicon_token;
break;
case 'zonomi':
$validation->dns_service = 'dns_zonomi';
// FIXME: parameter prefix should match $dns_service
$validation->dns_zm_key = (string)$validation->dns_lexicon_token;
break;
}
}
}
}
}