netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/acme-client: make DNS alias mode configurable, refs #1301

Browse Source
This commit is contained in:
Frank Wall
2019-09-10 23:34:07 +02:00
parent 174e536eff
commit 4fd4c77bdf
4 changed files with 88 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
+28
View File
@@ -70,4 +70,32 @@
<type>text</type>
<help><![CDATA[Specifies the days to renew the cert. The max value is 60 days.]]></help>
</field>
<field>
<id>certificate.aliasmode</id>
<label>DNS Alias Mode</label>
<type>dropdown</type>
<help><![CDATA[Configure DNS alias mode to validate the certificate.]]></help>
</field>
<field>
<label>DNS Alias Mode</label>
<type>header</type>
<style>aliasmode aliasmode_domain</style>
</field>
<field>
<id>certificate.domainalias</id>
<label>Domain Alias</label>
<type>text</type>
<help><![CDATA[When setting DNS alias mode to "Domain Alias", enter the domain name that should be used for certificate validation. Please refer to the <a href="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode">acme.sh documentation</a> for further information.]]></help>
</field>
<field>
<label>DNS Alias Mode</label>
<type>header</type>
<style>aliasmode aliasmode_challenge</style>
</field>
<field>
<id>certificate.challengealias</id>
<label>Challenge Alias</label>
<type>text</type>
<help><![CDATA[When setting DNS alias mode to "Challenge Alias", enter the domain name that should be used for certificate validation. Please refer to the <a href="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode">acme.sh documentation</a> for further information.]]></help>
</field>
</form>
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+16
View File
@@ -243,6 +243,22 @@
<MaximumValue>60</MaximumValue>
<default>60</default>
</renewInterval>
<aliasmode type="OptionField">
<Required>Y</Required>
<default>none</default>
<OptionValues>
<none>Not using DNS alias mode</none>
<automatic>Automatic Mode (uses DNS lookups)</automatic>
<domain>Domain alias mode</domain>
<challenge>Challenge alias mode</challenge>
</OptionValues>
</aliasmode>
<domainalias type="TextField">
<Required>N</Required>
</domainalias>
<challengealias type="TextField">
<Required>N</Required>
</challengealias>
<!-- hidden field; ID of the certificate in Cert Manager -->
<certRefId type="TextField">
<Required>N</Required>
security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt
+10
View File
@@ -379,6 +379,16 @@ POSSIBILITY OF SUCH DAMAGE.
});
// Hide options that are irrelevant in this context.
$('#DialogCertificate').on('shown.bs.modal', function (e) {
$("#certificate\\.aliasmode").change(function(){
$(".aliasmode").hide();
$(".aliasmode_"+$(this).val()).show();
});
$("#certificate\\.aliasmode").change();
})
/***********************************************************************
* Commands
**********************************************************************/
security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php
+34 -9
View File
@@ -893,24 +893,49 @@ function run_acme_validation($certObj, $valObj, $acctObj)
// Prepare altNames
$altnames = "";
//Find Alias for main domain
// Main domain: Use DNS alias mode for domain validation?
// https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
$name = "_acme-challenge." . ltrim((string)$certObj->name, '*.');
if ($dst = dns_get_record($name, DNS_CNAME )) {
$altnames .= "--domain-alias " .$dst[0]['target'] . " ";
if ($val_method == 'dns01') {
switch ((string)$valObj->aliasmode) {
case 'automatic':
$name = "_acme-challenge." . ltrim((string)$certObj->name, '*.');
if ($dst = dns_get_record($name, DNS_CNAME )) {
$altnames .= "--domain-alias " . $dst[0]['target'] . " ";
}
break;
case 'domain':
$altnames .= "--domain-alias " . (string)$certObj->domainalias . " ";
break;
case 'challenge':
$altnames .= "--challenge-alias " . (string)$certObj->challengealias . " ";
break;
}
}
if (!empty((string)$certObj->altNames)) {
$_altnames = explode(",", (string)$certObj->altNames);
foreach (explode(",", (string)$certObj->altNames) as $altname) {
$altnames .= "--domain ${altname} ";
//Find Alias
// https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
$name="_acme-challenge." . ltrim($altname, '*.');
if ($dst = dns_get_record($name, DNS_CNAME )) {
$altnames .= "--domain-alias " .$dst[0]['target'] . " ";
// altNames: Use DNS alias mode for domain validation?
// https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
if ($val_method == 'dns01') {
switch ((string)$valObj->aliasmode) {
case 'automatic':
$name = "_acme-challenge." . ltrim($altname, '*.');
if ($dst = dns_get_record($name, DNS_CNAME )) {
$altnames .= "--domain-alias " . $dst[0]['target'] . " ";
}
break;
case 'domain':
$altnames .= "--domain-alias " . (string)$certObj->domainalias . " ";
break;
case 'challenge':
$altnames .= "--challenge-alias " . (string)$certObj->challengealias . " ";
break;
}
}
}
}