From 6751020b8d08ef64d06fdce4b51e76e3837dd013 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 21 Jan 2021 00:12:38 +0100
Subject: [PATCH] security/acme-client: fix "auto renewal" options, closes
 #2178

---
 security/acme-client/pkg-descr                |  5 ++++
 .../OPNsense/AcmeClient/LeCertificate.php     | 26 +++++++++++++++----
 .../library/OPNsense/AcmeClient/LeCommon.php  |  3 ++-
 .../scripts/OPNsense/AcmeClient/lecert.php    |  8 +++---
 .../conf/actions.d/actions_acmeclient.conf    |  2 +-
 5 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index b559755f7..2bfdd9b4f 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+2.3
+
+Fixed:
+* fix "auto renewal" options not working in certificate and plugin settings (#2178)
+
 2.2
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
index 20ca63447..8e0be409e 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -45,14 +45,17 @@ class LeCertificate extends LeCommon
     public const CONFIG_PATH = 'certificates.certificate';
 
     /*
-     * create the object by collecting and storing all required data
+     * Create the object by collecting and storing all required data
      * @param $uuid string the UUID of the configuration object
+     * @param $force bool whether to enforce issue/renewal of the cert
+     * @param $cron bool run from cron job
      */
-    public function __construct(string $uuid, bool $force = false)
+    public function __construct(string $uuid, bool $force = false, bool $cron = false)
     {
         // Store basic information
         $this->uuid = $uuid;
         $this->force = $force;
+        $this->cron = $cron;
 
         // Get config object
         $this->loadConfig(self::CONFIG_PATH, $this->uuid);
@@ -318,13 +321,13 @@ class LeCertificate extends LeCommon
 
         // Issue or renew?
         if (!empty((string)$this->config->lastUpdate) and !($this->force)) {
-            $acme_action = "renew";
+            $acme_action = 'renew';
             $renew = true;
         } else {
             // Default: Issue a new certificate.
             // If "force" is specified, forcefully re-issue the cert, no matter if it's required.
             // NOTE: This is useful when switching from acme staging to production servers.
-            $acme_action = "issue";
+            $acme_action = 'issue';
             $renew = false;
         }
 
@@ -334,6 +337,19 @@ class LeCertificate extends LeCommon
             LeUtils::log("issue/renewal not required for certificate: " . (string)$this->config->name);
             return false;
         }
+
+        // Get auto renewal plugin setting.
+        $configObj = Config::getInstance()->object();
+        $auto_renewal = $configObj->OPNsense->AcmeClient->settings->autoRenewal;
+
+        // Check if called by auto renewal process.
+        if (($acme_action == 'renew') and ($this->cron == 1) and ($auto_renewal == 0)) {
+          LeUtils::log('auto renewal is globally disabled, skipping certificate: ' . (string)$this->config->name);
+          return false;
+        } elseif (($acme_action == 'renew') and ($this->cron == 1) and ((string)$this->config->autoRenewal == 0)) {
+          LeUtils::log('auto renewal is disabled for certificate: ' . (string)$this->config->name);
+          return false;
+        }
         LeUtils::log("${acme_action} certificate: " . (string)$this->config->name);
 
         // Ensure that account is registered.
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index 3ae1da021..c3ae40817 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -80,6 +80,7 @@ abstract class LeCommon
     protected $command_args;        # optional args for configdRun()
 
     // Basic object information
+    protected $cron;                # Run from cron job
     protected $config;              # AcmeClient config object
     protected $debug;               # Debug logging (bool)
     protected $environment;         # Let's Encrypt environment (uses shortnames)
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
index 3b3d61bda..3558d44dc 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php
@@ -2,7 +2,7 @@
 <?php
 
 /*
- * Copyright (C) 2020 Frank Wall
+ * Copyright (C) 2020-2021 Frank Wall
  * Copyright (C) 2019 Juergen Kellerer
  * All rights reserved.
  *
@@ -78,6 +78,7 @@ const STATIC_OPTIONS = <<<TXT
 --all               Work with ALL enabled certificates
 --account           The account UUID when working with an Lets Encrypt account
 --force             Force certain operations (i.e. renew)
+--cron              Special mode when running from cron (i.e. consider auto renew settings)
 TXT;
 
 // Examples that will be display in usage information.
@@ -138,8 +139,9 @@ function validateMode($mode)
 function main()
 {
     // Parse command line arguments
-    $options = getopt('h', ['account:', 'all', 'cert:', 'force', 'help', 'mode:']);
+    $options = getopt('h', ['account:', 'all', 'cert:', 'cron', 'force', 'help', 'mode:']);
     $force = isset($options['force']) ? true : false;
+    $cron = isset($options['cron']) ? true : false;
 
     // Verify mode and arguments
     if (
@@ -158,7 +160,7 @@ function main()
             // Iterate over all certificates
             foreach ($acme->certificates->children() as $certCfg) {
                 $cert_uuid = (string)$certCfg->attributes()['uuid'];
-                $cert = new LeCertificate($cert_uuid, $force);
+                $cert = new LeCertificate($cert_uuid, $force, $cron);
                 // NOTE: Disabled certificates are automatically ignored by LeCertificate.
                 $cert->issue();
             }
diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
index 1b9069640..81a14363b 100644
--- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
@@ -78,7 +78,7 @@ type:script
 message:running automations for a certificate
 
 [cron-auto-renew]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
+command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters:
 type:script
 message:cronjob running to sign or renew certificates