Merge pull request #3157 from fraenki/acme_314

security/acme-client: release 3.14

security/acme-client/pkg-descr

@@ -8,6 +8,22 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+3.14
+NOTE: Users of Selfhost need to manually fix their configuration, see
+https://github.com/acmesh-official/acme.sh/wiki/dnsapi2#151-use-selfhost-dns-api
+
+Added:
+* add support for Google CA (#3029)
+* add support for querying public DNS services (#3079)
+
+Fixed:
+* fix Selfhost DNS API (#3122)
+* fix invalid cert state due to deploy error (#3120)
+
+Changed:
+* change default DNS sleep time to 0 (#3079)
+* remove saved deploy hook from acme.sh config files (#3120)
+
 3.13
 
 Added:
@@ -23,7 +39,7 @@ Added:
 * new automation: upload certificate to Vault (#2796)
 
 Fixed:
-* Re-order function parameters due to PHP8 deprecation notice (#3043)
+* re-order function parameters due to PHP8 deprecation notice (#3043)
 
 Changed:
 * simplyfi DNS service names
@@ -32,7 +48,7 @@ Changed:
 3.11
 
 Fixed:
-* Add missing <style> field for TransIP (#2981)
+* add missing <style> field for TransIP (#2981)
 
 3.10
 

security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php

@@ -149,9 +149,6 @@ class ServiceController extends ApiControllerBase
             // generate template
             $backend->configdRun('template reload OPNsense/AcmeClient');
 
-            // now setup the environment
-            $backend->configdRun("acmeclient setup");
-
             // (res)start daemon
             if ($mdlAcme->settings->enabled->__toString() == 1) {
                 if ($runStatus['status'] == "running" && !$force_restart) {
@@ -177,8 +174,6 @@ class ServiceController extends ApiControllerBase
         $backend = new Backend();
         // first generate template based on current configuration
         $backend->configdRun('template reload OPNsense/AcmeClient');
-        // now setup the environment
-        $backend->configdRun("acmeclient setup");
         // finally run the syntax check
         $response = $backend->configdRun("acmeclient configtest");
         return array("result" => $response);
@@ -192,8 +187,6 @@ class ServiceController extends ApiControllerBase
     public function signallcertsAction()
     {
         $backend = new Backend();
-        // first setup the environment
-        $backend->configdRun("acmeclient setup");
         // run the command
         $response = $backend->configdRun("acmeclient sign-all-certs");
         return array("result" => $response);

security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml

@@ -128,8 +128,7 @@
         <id>validation.dns_sleep</id>
         <label>DNS Sleep Time</label>
         <type>text</type>
-        <help>The time in seconds to wait for all the TXT records to take effect after adding them to the DNS API. Defaults to 120 seconds.
-            For public DNS validation each 10 seconds up to 20 minutes, instead of fixed DNS sleep time set value to 0.</help>
+        <help>The time in seconds to wait for all the TXT records to take effect after adding them to the DNS API. Defaults to 0 seconds, which causes Acme Client to check public DNS services every 10 seconds for up to 20 minutes. If set to a non-zero value, a fixed DNS sleep time will be used and the local DNS servers will be queried instead. A DNS sleep time of 120 seconds or more is recommended for some DNS APIs.</help>
         <hint>0 for public DNS check or 1-84600s</hint>
     </field>
     <field>
@@ -1070,7 +1069,7 @@
         <id>validation.dns_selfhost_map</id>
         <label>RID Mapping</label>
         <type>textbox</type>
-        <help>Please create the TXT Record with Subdomain _acme-challenge first, than you can get the ID from the edit page. Up to two RIDs per fulldomain are supported but at least one must be set, e.g. _acme-challenge.domain.net:RID:RID</help>
+        <help>Please create the TXT record with subdomain _acme-challenge first, than you can get the ID from the edit page. Up to two RIDs per fulldomain are supported but at least one must be set, e.g. _acme-challenge.domain.net:RID:RID2</help>
     </field>
     <field>
         <label>Servercow</label>

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php

@@ -150,6 +150,33 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
             return false;
         }
 
+        // acme.sh records the last used deploy hook and would automatically
+        // use it on the next run. This information must be removed from the
+        // configuration file. Otherwise it would be impossible to disable
+        // or remove a deploy hook from the GUI.
+        foreach (glob(self::ACME_HOME_DIR . '/*/*.conf') as $filename) {
+            // Skip openssl config files.
+            if (preg_match('/.*.csr.conf/i', $filename)) {
+                continue;
+            }
+
+            // Read contents from file.
+            $contents = file_get_contents($filename);
+
+            // Check if deploy hook string can be found.
+            if (strpos($contents, self::ACME_DEPLOY_HOOK_STRING) !== false) {
+                // Replace the whole line with an empty string.
+                $contents = preg_replace('(' . self::ACME_DEPLOY_HOOK_STRING . '.*)', '', $contents);
+
+                // Write changes to the file.
+                if (!file_put_contents($filename, $contents)) {
+                    LeUtils::log_error('clearing recorded deploy hook from acme.sh failed (' . $filename . ')');
+                } else {
+                    LeUtils::log_debug('cleared recorded deploy deploy hook from acme.sh (' . $filename . ')', $this->debug);
+                }
+            }
+        }
+
         // Check result
         if ($result) {
             LeUtils::log_error('running acme.sh deploy hook failed (' . $this->getType() . ')');

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php

@@ -59,6 +59,9 @@ abstract class LeCommon
     public const ACME_KEY_DIR = '/var/etc/acme-client/keys/%s/';
     public const ACME_KEY_FILE = '/var/etc/acme-client/keys/%s/private.key';
 
+    // acme.sh internals
+    public const ACME_DEPLOY_HOOK_STRING = 'Le_DeployHook=';
+
     // Runtime parameters for acme.sh
     protected $acme_args = array(); # command line arguments to be passed to acme.sh
     protected $acme_env = array();  # environment variables to be used when running acme.sh

security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml

@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>3.3.0</version>
+    <version>3.4.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
@@ -148,6 +148,8 @@
                     <OptionValues>
                         <buypass>Buypass</buypass>
                         <buypass_test>Buypass Test CA</buypass_test>
+                        <google>Google</google>
+                        <google_test>Google Test CA</google_test>
                         <letsencrypt>Let's Encrypt [default]</letsencrypt>
                         <letsencrypt_test>Let's Encrypt Test CA</letsencrypt_test>
                         <sslcom>SSL.com</sslcom>
@@ -507,7 +509,7 @@
                 <dns_sleep type="IntegerField">
                     <MinimumValue>0</MinimumValue>
                     <MaximumValue>84600</MaximumValue>
-                    <default>120</default>
+                    <default>0</default>
                     <ValidationMessage>Please specify a value between 0 and 84600 seconds.</ValidationMessage>
                     <Required>Y</Required>
                 </dns_sleep>

security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt

@@ -254,6 +254,7 @@ POSSIBILITY OF SUCH DAMAGE.
             <ul>
               <li>{{ lang._("%sLet's Encrypt:%s A free, automated, and open certificate authority, run for the public's benefit. It is a service provided by the Internet Security Research Group (ISRG). Read more about the ACME protocol in %stheir documentation%s.") | format('<b>', '</b>', '<a href="https://letsencrypt.org/how-it-works/" target="_blank">', '</a>') }}</li>
               <li>{{ lang._('%sBuypass:%s A commercial, european certificate authority, based in Norway. Check out %stheir documentation%s for details about rate-limits and the usage policy.') | format('<b>', '</b>', '<a href="https://www.buypass.com/ssl/resources/go-ssl-technical-specification" target="_blank">', '</a>') }}</li>
+              <li>{{ lang._('%sGoogle:%s A commercial certificate authority. More information is available from %stheir documentation%s.') | format('<b>', '</b>', '<a href="https://cloud.google.com/certificate-manager/docs/overview" target="_blank">', '</a>') }}</li>
               <li>{{ lang._('%sSSL.com:%s A commercial, globally trusted certificate authority. They provide an %sextensive guide%s for using their paid services with the ACME protocol.') | format('<b>', '</b>', '<a href="https://www.ssl.com/guide/ssl-tls-certificate-issuance-and-revocation-with-acme/" target="_blank">', '</a>') }}</li>
               <li>{{ lang._("%sZeroSSL:%s A commercial, european certificate authority, based in Austria. They provide a feature overview on %stheir website%s for users of Let's Encrypt.") | format('<b>', '</b>', '<a href="https://zerossl.com/letsencrypt-alternative/" target="_blank">', '</a>') }}</li>
             </ul>

security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh

@@ -3,7 +3,7 @@
 ACME_BASE="/var/etc/acme-client"
 ACME_DIRS="/var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/configs /var/etc/acme-client/challenges /var/etc/acme-client/home"
 
-# Generating dirs if missing and setting owner and mode (recursively)
+# Generate required directories and set owner/mode recursively.
 for directory in ${ACME_DIRS}; do
     mkdir -p ${directory}
     chown -R root:wheel ${directory}
@@ -16,7 +16,7 @@ if [ -L /var/etc/acme-client/home/dns_opnsense.sh ]; then
     unlink /var/etc/acme-client/home/dns_opnsense.sh
 fi
 
-# Setting owner and mode for base and immediate children (non recursive)
+# Set owner/mode for base and immediate children (non recursive).
 chown root:wheel ${ACME_BASE} ${ACME_BASE}/*
 chmod 750 ${ACME_BASE} ${ACME_BASE}/*
 

security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf

@@ -1,8 +1,3 @@
-[setup]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh
-parameters:
-type:script_output
-
 ##########################################
 ## lighttpd actions
 ##########################################
@@ -42,7 +37,7 @@ message:testing acme_http_challenge configuration
 ##########################################
 
 [sign-cert]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
 parameters:%s
 type:script
 message:signing or renewing a certificate
@@ -66,25 +61,25 @@ type:script
 message:removing a certificate private key
 
 [sign-all-certs]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
 parameters:
 type:script
 message:signing or renewing all certificates
 
 [run-automation]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
 parameters:%s
 type:script
 message:running automations for a certificate
 
 [import]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
 parameters:%s
 type:script
 message:running import for a certificate
 
 [cron-auto-renew]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters:
 type:script
 message:cronjob running to sign or renew certificates

security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d

@@ -2,7 +2,7 @@
 acme_http_challenge_enable=YES
 acme_http_challenge_conf="/var/etc/lighttpd-acme-challenge.conf"
 acme_http_challenge_pidfile="/var/run/lighttpd-acme-challenge.pid"
-#acme_http_challenge_setup="/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh"
+acme_http_challenge_setup="/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh"
 {% else %}
 acme_http_challenge_enable=NO
 {% endif %}