From def11a4cd0fb31262950fd8ef1eeebcec3ca6652 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 6 Sep 2017 12:06:40 +0200 Subject: [PATCH 1/3] security/acme-client: make log level configurable, refs #69 --- .../OPNsense/AcmeClient/forms/settings.xml | 7 +++++++ .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml | 11 ++++++++++- .../scripts/OPNsense/AcmeClient/certhelper.php | 9 ++++++--- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml index 8f5debb9d..d6f30156f 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml @@ -37,4 +37,11 @@ true + + acmeclient.settings.logLevel + + dropdown + + true + diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index da8ba20ec..fb4407378 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -1,7 +1,7 @@ //OPNsense/AcmeClient - 1.0.0 + 1.1.0 a secure Let's Encrypt plugin @@ -101,6 +101,15 @@ N N + + Y + normal + + normal + extended + debug + + diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php index 8fadfe68b..dfbb5674d 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php @@ -286,12 +286,18 @@ function eval_optional_acme_args() $configObj = Config::getInstance()->object(); $acme_args = array(); + // Force certificate renewal? $acme_args[] = isset($options["F"]) ? "--force" : null; + // Use LE staging environment? $acme_args[] = $configObj->OPNsense->AcmeClient->settings->environment == "stg" ? "--staging" : null; $acme_args[] = isset($options["S"]) ? "--staging" : null; // for debug purpose + // Set log level + $acme_args[] = $configObj->OPNsense->AcmeClient->settings->logLevel == "normal" ? "--log-level 1" : "--log-level 2"; + $acme_args[] = $configObj->OPNsense->AcmeClient->settings->logLevel == "debug" ? "--debug" : null; + // Remove empty and duplicate elements from array return(array_unique(array_filter($acme_args))); } @@ -390,7 +396,6 @@ function run_acme_account_registration($acctObj, $certObj, $modelObj) $acmecmd = "/usr/local/sbin/acme.sh " . implode(" ", $acme_args) . " " . "--registeraccount " - . "--log-level 2 " . "--home /var/etc/acme-client/home " . "--accountconf " . $account_conf_file; //echo "DEBUG: executing command: " . $acmecmd . "\n"; @@ -739,7 +744,6 @@ function run_acme_validation($certObj, $valObj, $acctObj) . "--domain " . (string)$certObj->name . " " . $altnames . $acme_validation . " " - . "--log-level 2 " . "--home /var/etc/acme-client/home " . "--keylength 4096 " . "--accountconf " . $account_conf_file . " " @@ -804,7 +808,6 @@ function revoke_cert($certObj, $valObj, $acctObj) . implode(" ", $acme_args) . " " . "--revoke " . "--domain " . (string)$certObj->name . " " - . "--log-level 2 " . "--home /var/etc/acme-client/home " . "--keylength 4096 " . "--accountconf " . $account_conf_file; From f3b7044c46f3daab9f659b338933d5ba91fbf115 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 7 Sep 2017 13:37:06 +0200 Subject: [PATCH 2/3] security/acme-client: write import events to system log, refs #256 --- .../src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php | 1 + 1 file changed, 1 insertion(+) diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php index dfbb5674d..226d552ce 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php @@ -982,6 +982,7 @@ function import_certificate($certObj, $modelObj) // Write changes to config // TODO: Legacy code, should be replaced with code from OPNsense framework write_config("${import_log_message} Let's Encrypt SSL certificate: ${cert_cn}"); + log_error("AcmeClient: ${import_log_message} Let's Encrypt SSL certificate: ${cert_cn}"); // Update (acme) certificate object (through MVC framework) $uuid = $certObj->attributes()->uuid; From c4d17472c1a5ebae4c8d88b8224e5ea515ccc0cb Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Mon, 11 Sep 2017 15:59:22 +0200 Subject: [PATCH 3/3] security/acme-client: bump version --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index 4b6be15b0..fa595026a 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 1.9 +PLUGIN_VERSION= 1.10 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh bind911