netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/acme-client: add support for custom ACME EAB kid/hmac

Browse Source
This commit is contained in:
Frank Wall
2021-08-06 11:27:34 +02:00
parent 58b6c71018
commit 6ebbaf7555
5 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/pkg-descr
+1
View File
@@ -14,6 +14,7 @@ Added:
* add support for new ACME CA's: buypass, buypass_test, sslcom, zerossl (#2361)
* add introduction pages and an option to hide them
* add tooltips for account command buttons (#2188)
* add support for custom ACME EAB kid/hmac when registering accounts
Changed:
* rename plugin from "Let's Encrypt client" to "ACME Client" (#2361)
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
+16
View File
@@ -23,4 +23,20 @@
<type>text</type>
<help>Optional e-mail address for this account.</help>
</field>
<field>
<label>Optional EAB Credentials</label>
<type>header</type>
</field>
<field>
<id>account.eab_kid</id>
<label>Key Identifier</label>
<type>text</type>
<help><![CDATA[An optional value provided by the CA when using ACME External Account Binding (EAB).]]></help>
</field>
<field>
<id>account.eab_hmac</id>
<label>HMAC Key</label>
<type>password</type>
<help><![CDATA[An optional value provided by the CA when using ACME External Account Binding (EAB).]]></help>
</field>
</form>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
+1 -1
View File
@@ -15,7 +15,7 @@
<id>acmeclient.settings.ca</id>
<label>ACME CA</label>
<type>dropdown</type>
<help><![CDATA[The ACME CA that should be used to issue or renew certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server">acme.sh documentation</a> for a list of supported CAs.]]></help>
<help><![CDATA[The ACME CA that should be used to issue or renew certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
</field>
<field>
<id>acmeclient.settings.haproxyIntegration</id>
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
+7
View File
@@ -212,6 +212,13 @@ class LeAccount extends LeCommon
if (!($this->isRegistered())) {
LeUtils::log_debug('starting account registration for ' . (string)$this->config->name, $this->debug);
// Check if ACME External Account Binding (EAB) is enabled
if (!empty((string)$this->config->eab_kid) && !empty((string)$this->config->eab_hmac) {
LeUtils::log_debug('enabling ACME EAB for this account', $this->debug);
$this->acme_args[] = LeUtils::execSafe('--eab-kid %s', $this->config->eab_kid);
$this->acme_args[] = LeUtils::execSafe('--eab-hmac-key %s', $this->config->eab_hmac);
}
// Preparation to run acme client
$proc_env = $this->acme_env; // env variables for proc_open()
$proc_env['PATH'] = $this::ACME_ENV_PATH;
security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+10
View File
@@ -148,6 +148,16 @@
<email type="EmailField">
<Required>N</Required>
</email>
<eab_kid type="TextField">
<Required>N</Required>
<mask>/^.{1,8192}$/u</mask>
<ValidationMessage>Should be a string between 1 and 8192 characters.</ValidationMessage>
</eab_kid>
<eab_hmac type="TextField">
<Required>N</Required>
<mask>/^.{1,8192}$/u</mask>
<ValidationMessage>Should be a string between 1 and 8192 characters.</ValidationMessage>
</eab_hmac>
<!-- hidden field; the private key for this account -->
<key type="TextField">
<Required>N</Required>