From 25ec135f0a20cecb94471860cf9bd27c0ee60588 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Fri, 2 Aug 2024 09:27:13 +0200 Subject: [PATCH] security/acme-client: backend result changes slightly --- .../OPNsense/AcmeClient/LeValidation/HttpOpnsense.php | 9 +++++++-- .../OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php index 81838ffdd..d834b1075 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php @@ -74,8 +74,13 @@ class HttpOpnsense extends Base implements LeValidationInterface if (!empty((string)$this->config->http_opn_interface)) { $backend = new \OPNsense\Core\Backend(); $response = json_decode($backend->configdpRun('interface address', [(string)$this->config->http_opn_interface])); - if (!empty($response->address)) { - $iplist[] = $response->address; + // XXX Returns both IPv4 and IPv6 now. While "[0]" and + // "[1]" should remain in this order it would make sense + // to ensure "family" matches "inet" or "inet6" and/or + // pull both addresses for missing IPv6 support depending + // on how this should work. + if (!empty($response[0]->address)) { + $iplist[] = $response[0]->address; } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php index 9904e5d31..b5d97581b 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php @@ -75,8 +75,13 @@ class TlsalpnAcme extends Base implements LeValidationInterface if (!empty((string)$this->config->tlsalpn_acme_interface)) { $backend = new \OPNsense\Core\Backend(); $response = json_decode($backend->configdpRun('interface address', [(string)$this->config->tlsalpn_acme_interface])); - if (!empty($response->address)) { - $iplist[] = $response->address; + // XXX Returns both IPv4 and IPv6 now. While "[0]" and + // "[1]" should remain in this order it would make sense + // to ensure "family" matches "inet" or "inet6" and/or + // pull both addresses for missing IPv6 support depending + // on how this should work. + if (!empty($response[0]->address)) { + $iplist[] = $response[0]->address; } }