From f951f9b7c554aa3d224d989c5b86b9c0c7ae4670 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 11 Oct 2022 13:39:58 +0200
Subject: [PATCH 1/6] security/acme-client: add support for Google CA, refs
 #3029

---
 security/acme-client/pkg-descr                               | 5 +++++
 .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml        | 2 ++
 .../opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt | 1 +
 3 files changed, 8 insertions(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 6ce18d780..648a07c0f 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+3.14
+
+Added:
+* add support for Google CA (#3029)
+
 3.13
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 4222cc253..cfaa8e67a 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -148,6 +148,8 @@
                     <OptionValues>
                         <buypass>Buypass</buypass>
                         <buypass_test>Buypass Test CA</buypass_test>
+                        <google>Google</google>
+                        <google_test>Google Test CA</google_test>
                         <letsencrypt>Let's Encrypt [default]</letsencrypt>
                         <letsencrypt_test>Let's Encrypt Test CA</letsencrypt_test>
                         <sslcom>SSL.com</sslcom>
diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
index fb111608b..287d8ad06 100644
--- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
+++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
@@ -254,6 +254,7 @@ POSSIBILITY OF SUCH DAMAGE.
             <ul>
               <li>{{ lang._("%sLet's Encrypt:%s A free, automated, and open certificate authority, run for the public's benefit. It is a service provided by the Internet Security Research Group (ISRG). Read more about the ACME protocol in %stheir documentation%s.") | format('<b>', '</b>', '<a href="https://letsencrypt.org/how-it-works/" target="_blank">', '</a>') }}</li>
               <li>{{ lang._('%sBuypass:%s A commercial, european certificate authority, based in Norway. Check out %stheir documentation%s for details about rate-limits and the usage policy.') | format('<b>', '</b>', '<a href="https://www.buypass.com/ssl/resources/go-ssl-technical-specification" target="_blank">', '</a>') }}</li>
+              <li>{{ lang._('%sGoogle:%s A commercial certificate authority. More information is available from %stheir documentation%s.') | format('<b>', '</b>', '<a href="https://cloud.google.com/certificate-manager/docs/overview" target="_blank">', '</a>') }}</li>
               <li>{{ lang._('%sSSL.com:%s A commercial, globally trusted certificate authority. They provide an %sextensive guide%s for using their paid services with the ACME protocol.') | format('<b>', '</b>', '<a href="https://www.ssl.com/guide/ssl-tls-certificate-issuance-and-revocation-with-acme/" target="_blank">', '</a>') }}</li>
               <li>{{ lang._("%sZeroSSL:%s A commercial, european certificate authority, based in Austria. They provide a feature overview on %stheir website%s for users of Let's Encrypt.") | format('<b>', '</b>', '<a href="https://zerossl.com/letsencrypt-alternative/" target="_blank">', '</a>') }}</li>
             </ul>

From f007b8af8a96c7378b86ac0aa7f0411d3dd95764 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 11 Oct 2022 13:50:59 +0200
Subject: [PATCH 2/6] security/acme-client: post-merge fixes for #3122

---
 security/acme-client/pkg-descr                           | 9 +++++++--
 .../OPNsense/AcmeClient/forms/dialogValidation.xml       | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 648a07c0f..a484ee4dc 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -9,10 +9,15 @@ Plugin Changelog
 ================
 
 3.14
+NOTE: Users of Selfhost need to manually fix their configuration, see
+https://github.com/acmesh-official/acme.sh/wiki/dnsapi2#151-use-selfhost-dns-api
 
 Added:
 * add support for Google CA (#3029)
 
+Fixed:
+* fix Selfhost DNS API (#3122)
+
 3.13
 
 Added:
@@ -28,7 +33,7 @@ Added:
 * new automation: upload certificate to Vault (#2796)
 
 Fixed:
-* Re-order function parameters due to PHP8 deprecation notice (#3043)
+* re-order function parameters due to PHP8 deprecation notice (#3043)
 
 Changed:
 * simplyfi DNS service names
@@ -37,7 +42,7 @@ Changed:
 3.11
 
 Fixed:
-* Add missing <style> field for TransIP (#2981)
+* add missing <style> field for TransIP (#2981)
 
 3.10
 
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 9dc7f8afc..5791474e6 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1070,7 +1070,7 @@
         <id>validation.dns_selfhost_map</id>
         <label>RID Mapping</label>
         <type>textbox</type>
-        <help>Please create the TXT Record with Subdomain _acme-challenge first, than you can get the ID from the edit page. Up to two RIDs per fulldomain are supported but at least one must be set, e.g. _acme-challenge.domain.net:RID:RID</help>
+        <help>Please create the TXT record with subdomain _acme-challenge first, than you can get the ID from the edit page. Up to two RIDs per fulldomain are supported but at least one must be set, e.g. _acme-challenge.domain.net:RID:RID2</help>
     </field>
     <field>
         <label>Servercow</label>

From 42553ab3e591bc86af5c1956774bcdb0527e09d2 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 11 Oct 2022 14:27:09 +0200
Subject: [PATCH 3/6] security/acme-client: change default DNS sleep time to 0,
 refs #3079

---
 security/acme-client/pkg-descr                                | 4 ++++
 .../OPNsense/AcmeClient/forms/dialogValidation.xml            | 3 +--
 .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml         | 4 ++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a484ee4dc..a4e9781b0 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -14,10 +14,14 @@ https://github.com/acmesh-official/acme.sh/wiki/dnsapi2#151-use-selfhost-dns-api
 
 Added:
 * add support for Google CA (#3029)
+* add support for querying public DNS services (#3079)
 
 Fixed:
 * fix Selfhost DNS API (#3122)
 
+Changed:
+* change default DNS sleep time to 0 (3079)
+
 3.13
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 5791474e6..1c9efe004 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -128,8 +128,7 @@
         <id>validation.dns_sleep</id>
         <label>DNS Sleep Time</label>
         <type>text</type>
-        <help>The time in seconds to wait for all the TXT records to take effect after adding them to the DNS API. Defaults to 120 seconds.
-            For public DNS validation each 10 seconds up to 20 minutes, instead of fixed DNS sleep time set value to 0.</help>
+        <help>The time in seconds to wait for all the TXT records to take effect after adding them to the DNS API. Defaults to 0 seconds, which causes Acme Client to check public DNS services every 10 seconds for up to 20 minutes. If set to a non-zero value, a fixed DNS sleep time will be used and the local DNS servers will be queried instead. A DNS sleep time of 120 seconds or more is recommended for some DNS APIs.</help>
         <hint>0 for public DNS check or 1-84600s</hint>
     </field>
     <field>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index cfaa8e67a..118c96369 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>3.3.0</version>
+    <version>3.4.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
@@ -509,7 +509,7 @@
                 <dns_sleep type="IntegerField">
                     <MinimumValue>0</MinimumValue>
                     <MaximumValue>84600</MaximumValue>
-                    <default>120</default>
+                    <default>0</default>
                     <ValidationMessage>Please specify a value between 0 and 84600 seconds.</ValidationMessage>
                     <Required>Y</Required>
                 </dns_sleep>

From b94aefde74334951abead644de49fb2fffaf246f Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 21 Oct 2022 15:21:47 +0200
Subject: [PATCH 4/6] security/acme-client: migrate to NAME_setup use, closes
 #3113

refs https://github.com/opnsense/core/issues/5917
---
 .../OPNsense/AcmeClient/Api/ServiceController.php |  7 -------
 .../opnsense/scripts/OPNsense/AcmeClient/setup.sh |  4 ++--
 .../conf/actions.d/actions_acmeclient.conf        | 15 +++++----------
 3 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
index de54eeeea..0e1a34a23 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
@@ -149,9 +149,6 @@ class ServiceController extends ApiControllerBase
             // generate template
             $backend->configdRun('template reload OPNsense/AcmeClient');
 
-            // now setup the environment
-            $backend->configdRun("acmeclient setup");
-
             // (res)start daemon
             if ($mdlAcme->settings->enabled->__toString() == 1) {
                 if ($runStatus['status'] == "running" && !$force_restart) {
@@ -177,8 +174,6 @@ class ServiceController extends ApiControllerBase
         $backend = new Backend();
         // first generate template based on current configuration
         $backend->configdRun('template reload OPNsense/AcmeClient');
-        // now setup the environment
-        $backend->configdRun("acmeclient setup");
         // finally run the syntax check
         $response = $backend->configdRun("acmeclient configtest");
         return array("result" => $response);
@@ -192,8 +187,6 @@ class ServiceController extends ApiControllerBase
     public function signallcertsAction()
     {
         $backend = new Backend();
-        // first setup the environment
-        $backend->configdRun("acmeclient setup");
         // run the command
         $response = $backend->configdRun("acmeclient sign-all-certs");
         return array("result" => $response);
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
index 43140eea7..fd9b73425 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
@@ -3,7 +3,7 @@
 ACME_BASE="/var/etc/acme-client"
 ACME_DIRS="/var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/configs /var/etc/acme-client/challenges /var/etc/acme-client/home"
 
-# Generating dirs if missing and setting owner and mode (recursively)
+# Generate required directories and set owner/mode recursively.
 for directory in ${ACME_DIRS}; do
     mkdir -p ${directory}
     chown -R root:wheel ${directory}
@@ -16,7 +16,7 @@ if [ -L /var/etc/acme-client/home/dns_opnsense.sh ]; then
     unlink /var/etc/acme-client/home/dns_opnsense.sh
 fi
 
-# Setting owner and mode for base and immediate children (non recursive)
+# Set owner/mode for base and immediate children (non recursive).
 chown root:wheel ${ACME_BASE} ${ACME_BASE}/*
 chmod 750 ${ACME_BASE} ${ACME_BASE}/*
 
diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
index 4faf4b687..7c47bdf85 100644
--- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
@@ -1,8 +1,3 @@
-[setup]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh
-parameters:
-type:script_output
-
 ##########################################
 ## lighttpd actions
 ##########################################
@@ -42,7 +37,7 @@ message:testing acme_http_challenge configuration
 ##########################################
 
 [sign-cert]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
 parameters:%s
 type:script
 message:signing or renewing a certificate
@@ -66,25 +61,25 @@ type:script
 message:removing a certificate private key
 
 [sign-all-certs]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
 parameters:
 type:script
 message:signing or renewing all certificates
 
 [run-automation]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
 parameters:%s
 type:script
 message:running automations for a certificate
 
 [import]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
 parameters:%s
 type:script
 message:running import for a certificate
 
 [cron-auto-renew]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters:
 type:script
 message:cronjob running to sign or renew certificates

From 07fde35bfcfc8c633d02efbbf8de80a6040013be Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 21 Oct 2022 15:42:56 +0200
Subject: [PATCH 5/6] security/acme-client: re-enable NAME_setup use, refs
 4e01cb2333acd997b01e6a10a9c447b1ccf520dc

---
 .../opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d b/security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d
index 6d1991e9d..96d20f1bc 100644
--- a/security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d
+++ b/security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/rc.conf.d
@@ -2,7 +2,7 @@
 acme_http_challenge_enable=YES
 acme_http_challenge_conf="/var/etc/lighttpd-acme-challenge.conf"
 acme_http_challenge_pidfile="/var/run/lighttpd-acme-challenge.pid"
-#acme_http_challenge_setup="/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh"
+acme_http_challenge_setup="/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh"
 {% else %}
 acme_http_challenge_enable=NO
 {% endif %}

From c3b6d586e90235cf9afb04c5879259c61251027e Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 21 Oct 2022 17:25:56 +0200
Subject: [PATCH 6/6] security/acme-client: remove saved deploy hook from
 acme.sh config files, fixes #3120

---
 security/acme-client/pkg-descr                |  4 ++-
 .../OPNsense/AcmeClient/LeAutomation/Base.php | 27 +++++++++++++++++++
 .../library/OPNsense/AcmeClient/LeCommon.php  |  3 +++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a4e9781b0..1e45db84a 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -18,9 +18,11 @@ Added:
 
 Fixed:
 * fix Selfhost DNS API (#3122)
+* fix invalid cert state due to deploy error (#3120)
 
 Changed:
-* change default DNS sleep time to 0 (3079)
+* change default DNS sleep time to 0 (#3079)
+* remove saved deploy hook from acme.sh config files (#3120)
 
 3.13
 
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
index 1f11081fa..4f79aa471 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
@@ -150,6 +150,33 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
             return false;
         }
 
+        // acme.sh records the last used deploy hook and would automatically
+        // use it on the next run. This information must be removed from the
+        // configuration file. Otherwise it would be impossible to disable
+        // or remove a deploy hook from the GUI.
+        foreach (glob(self::ACME_HOME_DIR . '/*/*.conf') as $filename) {
+            // Skip openssl config files.
+            if (preg_match('/.*.csr.conf/i', $filename)) {
+                continue;
+            }
+
+            // Read contents from file.
+            $contents = file_get_contents($filename);
+
+            // Check if deploy hook string can be found.
+            if (strpos($contents, self::ACME_DEPLOY_HOOK_STRING) !== false) {
+                // Replace the whole line with an empty string.
+                $contents = preg_replace('(' . self::ACME_DEPLOY_HOOK_STRING . '.*)', '', $contents);
+
+                // Write changes to the file.
+                if (!file_put_contents($filename, $contents)) {
+                    LeUtils::log_error('clearing recorded deploy hook from acme.sh failed (' . $filename . ')');
+                } else {
+                    LeUtils::log_debug('cleared recorded deploy deploy hook from acme.sh (' . $filename . ')', $this->debug);
+                }
+            }
+        }
+
         // Check result
         if ($result) {
             LeUtils::log_error('running acme.sh deploy hook failed (' . $this->getType() . ')');
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index 631fab0c4..bf278b7aa 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -59,6 +59,9 @@ abstract class LeCommon
     public const ACME_KEY_DIR = '/var/etc/acme-client/keys/%s/';
     public const ACME_KEY_FILE = '/var/etc/acme-client/keys/%s/private.key';
 
+    // acme.sh internals
+    public const ACME_DEPLOY_HOOK_STRING = 'Le_DeployHook=';
+
     // Runtime parameters for acme.sh
     protected $acme_args = array(); # command line arguments to be passed to acme.sh
     protected $acme_env = array();  # environment variables to be used when running acme.sh