netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2199 from fraenki/acme_230

Browse Source 
security/acme-client: release 2.3
This commit is contained in:
Frank Wall
2021-01-24 22:08:54 +01:00
committed by GitHub
parent 85d6a3ac1a 7c0b4717dc
commit 5a4f715cb6
12 changed files with 101 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= acme-client
PLUGIN_VERSION= 2.2
PLUGIN_VERSION= 2.3
PLUGIN_COMMENT= Let's Encrypt client
PLUGIN_MAINTAINER= opnsense@moov.de
PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon
security/acme-client/pkg-descr
+9
View File
@@ -8,6 +8,15 @@ WWW: https://github.com/acmesh-official/acme.sh
Plugin Changelog
================
2.3
Added:
* add support for Infomaniak domain API (#2169)
Fixed:
* fix "auto renewal" options not working in certificate and plugin settings (#2178)
* fix Aliyun DNS API (#2200)
2.2
Added:
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
+2 -2
View File
@@ -7,7 +7,7 @@
<id>certificate.enabled</id>
<label>Enabled</label>
<type>checkbox</type>
<help>Enable this certificate</help>
<help>Enable this certificate. When disabled, no attemps to issue or renew the certificate will be made.</help>
</field>
<field>
<id>certificate.name</id>
@@ -50,7 +50,7 @@
<id>certificate.autoRenewal</id>
<label>Auto Renewal</label>
<type>checkbox</type>
<help>Enable automatic renewal for this certificate to prevent expiration.</help>
<help>Enable automatic renewal for this certificate to prevent expiration. When disabled, the cron job will ignore this certificate. Note that it is still possible to renew the certificate from the GUI.</help>
</field>
<field>
<id>certificate.renewInterval</id>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+10
View File
@@ -1237,4 +1237,14 @@
<label>Password</label>
<type>password</type>
</field>
<field>
<label>Infomaniak DNS API</label>
<type>header</type>
<style>table_dns table_dns_infomaniak</style>
</field>
<field>
<id>validation.dns_infomaniak_token</id>
<label>API Token</label>
<type>password</type>
</field>
</form>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
+1 -1
View File
@@ -9,7 +9,7 @@
<id>acmeclient.settings.autoRenewal</id>
<label>Auto Renewal</label>
<type>checkbox</type>
<help><![CDATA[Enable automatic renewal for certificates to prevent expiration. This will add a cronjob to the system. You may want to customize the cronjob schedule to your needs, because re-issueing a certificate may lead to a short downtime, depending on the selected challenge type and service.]]></help>
<help><![CDATA[Enable automatic renewal for certificates to prevent expiration. This will add a cron job to the system. You may want to customize the cron job schedule to your needs, because re-issueing a certificate may lead to a short downtime, depending on the selected challenge type and service.]]></help>
</field>
<field>
<id>acmeclient.settings.environment</id>
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+21 -5
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -45,14 +45,17 @@ class LeCertificate extends LeCommon
public const CONFIG_PATH = 'certificates.certificate';
/*
* create the object by collecting and storing all required data
* Create the object by collecting and storing all required data
* @param $uuid string the UUID of the configuration object
* @param $force bool whether to enforce issue/renewal of the cert
* @param $cron bool run from cron job
*/
public function __construct(string $uuid, bool $force = false)
public function __construct(string $uuid, bool $force = false, bool $cron = false)
{
// Store basic information
$this->uuid = $uuid;
$this->force = $force;
$this->cron = $cron;
// Get config object
$this->loadConfig(self::CONFIG_PATH, $this->uuid);
@@ -318,13 +321,13 @@ class LeCertificate extends LeCommon
// Issue or renew?
if (!empty((string)$this->config->lastUpdate) and !($this->force)) {
$acme_action = "renew";
$acme_action = 'renew';
$renew = true;
} else {
// Default: Issue a new certificate.
// If "force" is specified, forcefully re-issue the cert, no matter if it's required.
// NOTE: This is useful when switching from acme staging to production servers.
$acme_action = "issue";
$acme_action = 'issue';
$renew = false;
}
@@ -334,6 +337,19 @@ class LeCertificate extends LeCommon
LeUtils::log("issue/renewal not required for certificate: " . (string)$this->config->name);
return false;
}
// Get auto renewal plugin setting.
$configObj = Config::getInstance()->object();
$auto_renewal = $configObj->OPNsense->AcmeClient->settings->autoRenewal;
// Check if called by auto renewal process.
if (($acme_action == 'renew') and ($this->cron == 1) and ($auto_renewal == 0)) {
LeUtils::log('auto renewal is globally disabled, skipping certificate: ' . (string)$this->config->name);
return false;
} elseif (($acme_action == 'renew') and ($this->cron == 1) and ((string)$this->config->autoRenewal == 0)) {
LeUtils::log('auto renewal is disabled for certificate: ' . (string)$this->config->name);
return false;
}
LeUtils::log("${acme_action} certificate: " . (string)$this->config->name);
// Ensure that account is registered.
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+2 -1
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -80,6 +80,7 @@ abstract class LeCommon
protected $command_args; # optional args for configdRun()
// Basic object information
protected $cron; # Run from cron job
protected $config; # AcmeClient config object
protected $debug; # Debug logging (bool)
protected $environment; # Let's Encrypt environment (uses shortnames)
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php
+1 -1
View File
@@ -40,6 +40,6 @@ class DnsAli extends Base implements LeValidationInterface
public function prepare()
{
$this->acme_env['Ali_Key'] = (string)$this->config->dns_ali_key;
$this->acme_env['Ali_Secret'] = (string)$this->config->dns_ali_key;
$this->acme_env['Ali_Secret'] = (string)$this->config->dns_ali_secret;
}
}
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInfomaniak.php
+44
View File
@@ -0,0 +1,44 @@
<?php
/*
* Copyright (C) 2021 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
namespace OPNsense\AcmeClient\LeValidation;
use OPNsense\AcmeClient\LeValidationInterface;
use OPNsense\Core\Config;
/**
* Infomaniak DNS API
* @package OPNsense\AcmeClient
*/
class DnsInfomaniak extends Base implements LeValidationInterface
{
public function prepare()
{
$this->acme_env['INFOMANIAK_API_TOKEN'] = (string)$this->config->dns_infomaniak_token;
}
}
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+4
View File
@@ -405,6 +405,7 @@
<dns_hostingde>hosting.de API</dns_hostingde>
<dns_he>Hurricane Electric</dns_he>
<dns_infoblox>Infoblox API</dns_infoblox>
<dns_infomaniak>Infomaniak API</dns_infomaniak>
<dns_inwx>INWX XMLRPC API</dns_inwx>
<dns_ispconfig>ISPConfig 3.1+ API</dns_ispconfig>
<dns_joker>Joker API</dns_joker>
@@ -949,6 +950,9 @@
<dns_desec_name type="TextField">
<Required>N</Required>
</dns_desec_name>
<dns_infomaniak_token type="TextField">
<Required>N</Required>
</dns_infomaniak_token>
</validation>
</validations>
<actions>
security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
+5 -3
View File
@@ -2,7 +2,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2019 Juergen Kellerer
* All rights reserved.
*
@@ -78,6 +78,7 @@ const STATIC_OPTIONS = <<<TXT
--all Work with ALL enabled certificates
--account The account UUID when working with an Lets Encrypt account
--force Force certain operations (i.e. renew)
--cron Special mode when running from cron (i.e. consider auto renew settings)
TXT;
// Examples that will be display in usage information.
@@ -138,8 +139,9 @@ function validateMode($mode)
function main()
{
// Parse command line arguments
$options = getopt('h', ['account:', 'all', 'cert:', 'force', 'help', 'mode:']);
$options = getopt('h', ['account:', 'all', 'cert:', 'cron', 'force', 'help', 'mode:']);
$force = isset($options['force']) ? true : false;
$cron = isset($options['cron']) ? true : false;
// Verify mode and arguments
if (
@@ -158,7 +160,7 @@ function main()
// Iterate over all certificates
foreach ($acme->certificates->children() as $certCfg) {
$cert_uuid = (string)$certCfg->attributes()['uuid'];
$cert = new LeCertificate($cert_uuid, $force);
$cert = new LeCertificate($cert_uuid, $force, $cron);
// NOTE: Disabled certificates are automatically ignored by LeCertificate.
$cert->issue();
}
security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+1 -1
View File
@@ -78,7 +78,7 @@ type:script
message:running automations for a certificate
[cron-auto-renew]
command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
parameters:
type:script
message:cronjob running to sign or renew certificates