From 6751020b8d08ef64d06fdce4b51e76e3837dd013 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 21 Jan 2021 00:12:38 +0100
Subject: [PATCH 1/5] security/acme-client: fix "auto renewal" options, closes
 #2178

---
 security/acme-client/pkg-descr                |  5 ++++
 .../OPNsense/AcmeClient/LeCertificate.php     | 26 +++++++++++++++----
 .../library/OPNsense/AcmeClient/LeCommon.php  |  3 ++-
 .../scripts/OPNsense/AcmeClient/lecert.php    |  8 +++---
 .../conf/actions.d/actions_acmeclient.conf    |  2 +-
 5 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index b559755f7..2bfdd9b4f 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+2.3
+
+Fixed:
+* fix "auto renewal" options not working in certificate and plugin settings (#2178)
+
 2.2
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
index 20ca63447..8e0be409e 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -45,14 +45,17 @@ class LeCertificate extends LeCommon
     public const CONFIG_PATH = 'certificates.certificate';
 
     /*
-     * create the object by collecting and storing all required data
+     * Create the object by collecting and storing all required data
      * @param $uuid string the UUID of the configuration object
+     * @param $force bool whether to enforce issue/renewal of the cert
+     * @param $cron bool run from cron job
      */
-    public function __construct(string $uuid, bool $force = false)
+    public function __construct(string $uuid, bool $force = false, bool $cron = false)
     {
         // Store basic information
         $this->uuid = $uuid;
         $this->force = $force;
+        $this->cron = $cron;
 
         // Get config object
         $this->loadConfig(self::CONFIG_PATH, $this->uuid);
@@ -318,13 +321,13 @@ class LeCertificate extends LeCommon
 
         // Issue or renew?
         if (!empty((string)$this->config->lastUpdate) and !($this->force)) {
-            $acme_action = "renew";
+            $acme_action = 'renew';
             $renew = true;
         } else {
             // Default: Issue a new certificate.
             // If "force" is specified, forcefully re-issue the cert, no matter if it's required.
             // NOTE: This is useful when switching from acme staging to production servers.
-            $acme_action = "issue";
+            $acme_action = 'issue';
             $renew = false;
         }
 
@@ -334,6 +337,19 @@ class LeCertificate extends LeCommon
             LeUtils::log("issue/renewal not required for certificate: " . (string)$this->config->name);
             return false;
         }
+
+        // Get auto renewal plugin setting.
+        $configObj = Config::getInstance()->object();
+        $auto_renewal = $configObj->OPNsense->AcmeClient->settings->autoRenewal;
+
+        // Check if called by auto renewal process.
+        if (($acme_action == 'renew') and ($this->cron == 1) and ($auto_renewal == 0)) {
+          LeUtils::log('auto renewal is globally disabled, skipping certificate: ' . (string)$this->config->name);
+          return false;
+        } elseif (($acme_action == 'renew') and ($this->cron == 1) and ((string)$this->config->autoRenewal == 0)) {
+          LeUtils::log('auto renewal is disabled for certificate: ' . (string)$this->config->name);
+          return false;
+        }
         LeUtils::log("${acme_action} certificate: " . (string)$this->config->name);
 
         // Ensure that account is registered.
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index 3ae1da021..c3ae40817 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -80,6 +80,7 @@ abstract class LeCommon
     protected $command_args;        # optional args for configdRun()
 
     // Basic object information
+    protected $cron;                # Run from cron job
     protected $config;              # AcmeClient config object
     protected $debug;               # Debug logging (bool)
     protected $environment;         # Let's Encrypt environment (uses shortnames)
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
index 3b3d61bda..3558d44dc 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
@@ -2,7 +2,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * Copyright (C) 2019 Juergen Kellerer
  * All rights reserved.
  *
@@ -78,6 +78,7 @@ const STATIC_OPTIONS = <<<TXT
 --all               Work with ALL enabled certificates
 --account           The account UUID when working with an Lets Encrypt account
 --force             Force certain operations (i.e. renew)
+--cron              Special mode when running from cron (i.e. consider auto renew settings)
 TXT;
 
 // Examples that will be display in usage information.
@@ -138,8 +139,9 @@ function validateMode($mode)
 function main()
 {
     // Parse command line arguments
-    $options = getopt('h', ['account:', 'all', 'cert:', 'force', 'help', 'mode:']);
+    $options = getopt('h', ['account:', 'all', 'cert:', 'cron', 'force', 'help', 'mode:']);
     $force = isset($options['force']) ? true : false;
+    $cron = isset($options['cron']) ? true : false;
 
     // Verify mode and arguments
     if (
@@ -158,7 +160,7 @@ function main()
             // Iterate over all certificates
             foreach ($acme->certificates->children() as $certCfg) {
                 $cert_uuid = (string)$certCfg->attributes()['uuid'];
-                $cert = new LeCertificate($cert_uuid, $force);
+                $cert = new LeCertificate($cert_uuid, $force, $cron);
                 // NOTE: Disabled certificates are automatically ignored by LeCertificate.
                 $cert->issue();
             }
diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
index 1b9069640..81a14363b 100644
--- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
@@ -78,7 +78,7 @@ type:script
 message:running automations for a certificate
 
 [cron-auto-renew]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
+command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters:
 type:script
 message:cronjob running to sign or renew certificates

From e2512a8fc29acbd7ef05f40b48d838e379a3c2e1 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 21 Jan 2021 01:09:43 +0100
Subject: [PATCH 2/5] security/acme-client: bump version

---
 security/acme-client/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile
index c64e3b48a..86b2e519e 100644
--- a/security/acme-client/Makefile
+++ b/security/acme-client/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		2.2
+PLUGIN_VERSION=		2.3
 PLUGIN_COMMENT=		Let's Encrypt client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh py${PLUGIN_PYTHON}-dns-lexicon

From bee24227874e793eff3886605d536797b516db0f Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 24 Jan 2021 21:43:47 +0100
Subject: [PATCH 3/5] security/acme-client: minor help text changes

---
 .../OPNsense/AcmeClient/forms/dialogCertificate.xml           | 4 ++--
 .../app/controllers/OPNsense/AcmeClient/forms/settings.xml    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
index 0fd183462..e387fc786 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
@@ -7,7 +7,7 @@
         <id>certificate.enabled</id>
         <label>Enabled</label>
         <type>checkbox</type>
-        <help>Enable this certificate</help>
+        <help>Enable this certificate. When disabled, no attemps to issue or renew the certificate will be made.</help>
     </field>
     <field>
         <id>certificate.name</id>
@@ -50,7 +50,7 @@
         <id>certificate.autoRenewal</id>
         <label>Auto Renewal</label>
         <type>checkbox</type>
-        <help>Enable automatic renewal for this certificate to prevent expiration.</help>
+        <help>Enable automatic renewal for this certificate to prevent expiration. When disabled, the cron job will ignore this certificate. Note that it is still possible to renew the certificate from the GUI.</help>
     </field>
     <field>
         <id>certificate.renewInterval</id>
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
index 28cee3b6c..ad0247d9e 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
@@ -9,7 +9,7 @@
         <id>acmeclient.settings.autoRenewal</id>
         <label>Auto Renewal</label>
         <type>checkbox</type>
-        <help><![CDATA[Enable automatic renewal for certificates to prevent expiration. This will add a cronjob to the system. You may want to customize the cronjob schedule to your needs, because re-issueing a certificate may lead to a short downtime, depending on the selected challenge type and service.]]></help>
+        <help><![CDATA[Enable automatic renewal for certificates to prevent expiration. This will add a cron job to the system. You may want to customize the cron job schedule to your needs, because re-issueing a certificate may lead to a short downtime, depending on the selected challenge type and service.]]></help>
     </field>
     <field>
         <id>acmeclient.settings.environment</id>

From 4850414eba70c0a95138c2daa58bde596f84dc57 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 24 Jan 2021 21:56:12 +0100
Subject: [PATCH 4/5] security/acme-client: add support for Infomaniak domain
 API, closes #2169

---
 security/acme-client/pkg-descr                |  3 ++
 .../AcmeClient/forms/dialogValidation.xml     | 10 +++++
 .../AcmeClient/LeValidation/DnsInfomaniak.php | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  4 ++
 4 files changed, 61 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInfomaniak.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 2bfdd9b4f..a0893c9f5 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -10,6 +10,9 @@ Plugin Changelog
 
 2.3
 
+Added:
+* add support for Infomaniak domain API (#2169)
+
 Fixed:
 * fix "auto renewal" options not working in certificate and plugin settings (#2178)
 
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index e6999e3a9..2bc5df97d 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1237,4 +1237,14 @@
         <label>Password</label>
         <type>password</type>
     </field>
+    <field>
+        <label>Infomaniak DNS API</label>
+        <type>header</type>
+        <style>table_dns table_dns_infomaniak</style>
+    </field>
+    <field>
+        <id>validation.dns_infomaniak_token</id>
+        <label>API Token</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInfomaniak.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInfomaniak.php
new file mode 100644
index 000000000..6fec5ea62
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInfomaniak.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2021 Frank Wall
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Infomaniak DNS API
+ * @package OPNsense\AcmeClient
+ */
+class DnsInfomaniak extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['INFOMANIAK_API_TOKEN'] = (string)$this->config->dns_infomaniak_token;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 02722c751..edbcfdfcd 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -405,6 +405,7 @@
                         <dns_hostingde>hosting.de API</dns_hostingde>
                         <dns_he>Hurricane Electric</dns_he>
                         <dns_infoblox>Infoblox API</dns_infoblox>
+                        <dns_infomaniak>Infomaniak API</dns_infomaniak>
                         <dns_inwx>INWX XMLRPC API</dns_inwx>
                         <dns_ispconfig>ISPConfig 3.1+ API</dns_ispconfig>
                         <dns_joker>Joker API</dns_joker>
@@ -949,6 +950,9 @@
                 <dns_desec_name type="TextField">
                     <Required>N</Required>
                 </dns_desec_name>
+                <dns_infomaniak_token type="TextField">
+                    <Required>N</Required>
+                </dns_infomaniak_token>
             </validation>
         </validations>
         <actions>

From 7c0b4717dc6f2ab863011250f5dc13c2712c4c57 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 24 Jan 2021 22:00:17 +0100
Subject: [PATCH 5/5] security/acme-client: fix Aliyun DNS API, closes #2200

---
 security/acme-client/pkg-descr                                  | 1 +
 .../mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a0893c9f5..ef9766b16 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -15,6 +15,7 @@ Added:
 
 Fixed:
 * fix "auto renewal" options not working in certificate and plugin settings (#2178)
+* fix Aliyun DNS API (#2200)
 
 2.2
 
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php
index 357757c6b..5c5da84e6 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAli.php
@@ -40,6 +40,6 @@ class DnsAli extends Base implements LeValidationInterface
     public function prepare()
     {
         $this->acme_env['Ali_Key'] = (string)$this->config->dns_ali_key;
-        $this->acme_env['Ali_Secret'] = (string)$this->config->dns_ali_key;
+        $this->acme_env['Ali_Secret'] = (string)$this->config->dns_ali_secret;
     }
 }