From a37538b636fba7b8cfd4bd3a676dc86abf61b2f5 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 13 Dec 2020 12:36:56 +0100 Subject: [PATCH 1/4] security/acme-client: use configured DNS sleep time for Namesilo, fixes #2121 --- security/acme-client/pkg-descr | 5 +++++ .../OPNsense/AcmeClient/forms/dialogValidation.xml | 5 +++++ .../library/OPNsense/AcmeClient/LeValidation/DnsNamesilo.php | 2 -- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index f96250468..df3044f38 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +2.2 + +Changed: +* BREAKING: use configured DNS sleep time for Namesilo instead of hardcoded value (#2121) + 2.1 Added: diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 7866682af..4ad41e7ea 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -752,6 +752,11 @@ header + + + header + + validation.dns_namesilo_key diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNamesilo.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNamesilo.php index 1cfa7f326..98eca7ccf 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNamesilo.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNamesilo.php @@ -40,7 +40,5 @@ class DnsNamesilo extends Base implements LeValidationInterface public function prepare() { $this->acme_env['Namesilo_Key'] = (string)$this->config->dns_namesilo_key; - // Namesilo applies changes to DNS records only every 15 minutes. - $this->acme_args[] = '--dnssleep 960'; } } From 0fe2422fa0a76248ba7c358cb170d31a7c894c65 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 13 Dec 2020 12:53:06 +0100 Subject: [PATCH 2/4] security/acme-client: remove all hardcoded DNS sleep times The report in #2121 made it clear that it was never a good idea to use a hardcoded value in the first place. It is very likely a breaking change for some users, so I've added notes to the GUI and the plugin changelog. --- security/acme-client/pkg-descr | 4 ++++ .../AcmeClient/forms/dialogValidation.xml | 20 +++++++++++++++++++ .../AcmeClient/LeValidation/DnsLexicon.php | 5 ----- .../AcmeClient/LeValidation/DnsLinode.php | 2 -- .../AcmeClient/LeValidation/DnsLinodeV4.php | 2 -- .../AcmeClient/LeValidation/DnsNetcup.php | 2 -- 6 files changed, 24 insertions(+), 11 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index df3044f38..549689228 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -12,6 +12,10 @@ Plugin Changelog Changed: * BREAKING: use configured DNS sleep time for Namesilo instead of hardcoded value (#2121) +* BREAKING: use configured DNS sleep time for Lexicon/Namesilo instead of hardcoded value +* BREAKING: use configured DNS sleep time for Linode instead of hardcoded value +* BREAKING: use configured DNS sleep time for Linode v4 instead of hardcoded value +* BREAKING: use configured DNS sleep time for Netcup instead of hardcoded value 2.1 diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 4ad41e7ea..00ca5e203 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -603,6 +603,11 @@ header + + + header + + validation.dns_lexicon_provider @@ -623,6 +628,11 @@ header + + + header + + validation.dns_linode_key @@ -633,6 +643,11 @@ header + + + header + + validation.dns_linode_v4_key @@ -767,6 +782,11 @@ header + + + header + + validation.dns_netcup_cid diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLexicon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLexicon.php index 2ffc6d1ec..0173baa30 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLexicon.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLexicon.php @@ -46,10 +46,5 @@ class DnsLexicon extends Base implements LeValidationInterface $this->acme_env['PROVIDER'] = $provider; $this->acme_env[$env_user] = (string)$this->config->dns_lexicon_user; $this->acme_env[$env_token] = (string)$this->config->dns_lexicon_token; - - if ((string)$this->config->dns_lexicon_provider == 'namesilo') { - // Namesilo applies changes to DNS records only every 15 minutes. - $this->acme_args[] = '--dnssleep 960'; - } } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinode.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinode.php index 2b2453b8b..e641fa483 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinode.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinode.php @@ -40,7 +40,5 @@ class DnsLinode extends Base implements LeValidationInterface public function prepare() { $this->acme_env['LINODE_API_KEY'] = (string)$this->config->dns_linode_key; - // Linode can take up to 15 to update DNS records - $this->acme_args[] = '--dnssleep 960'; } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinodeV4.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinodeV4.php index c69293a24..2bad2738a 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinodeV4.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsLinodeV4.php @@ -40,7 +40,5 @@ class DnsLinodeV4 extends Base implements LeValidationInterface public function prepare() { $this->acme_env['LINODE_V4_API_KEY'] = (string)$this->config->dns_linode_v4_key; - // Linode can take up to 15 to update DNS records - $this->acme_args[] = '--dnssleep 960'; } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNetcup.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNetcup.php index b4afca6cb..3c9955eda 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNetcup.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNetcup.php @@ -42,7 +42,5 @@ class DnsNetcup extends Base implements LeValidationInterface $this->acme_env['NC_CID'] = (string)$this->config->dns_netcup_cid; $this->acme_env['NC_Apikey'] = (string)$this->config->dns_netcup_key; $this->acme_env['NC_Apipw'] = (string)$this->config->dns_netcup_pw; - // netcup applies changes to DNS records only every 10 minutes. - $this->acme_args[] = '--dnssleep 600'; } } From 9c25ef44a5866986856c6b631cae821d562e6178 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 13 Dec 2020 13:06:26 +0100 Subject: [PATCH 3/4] security/acme-client: update changelog, refs #2130 --- security/acme-client/pkg-descr | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 549689228..67271d443 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -10,6 +10,9 @@ Plugin Changelog 2.2 +Fixed: +* fix DNS challenge alias mode (#2128, #2130) + Changed: * BREAKING: use configured DNS sleep time for Namesilo instead of hardcoded value (#2121) * BREAKING: use configured DNS sleep time for Lexicon/Namesilo instead of hardcoded value From 7bae0539c4f2f7190082f3f7f6694af00adb7079 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 13 Dec 2020 13:20:16 +0100 Subject: [PATCH 4/4] security/acme-client: add support for hexonet.com DNS API, closes #2134 --- security/acme-client/pkg-descr | 3 ++ .../AcmeClient/forms/dialogValidation.xml | 16 +++++++ .../AcmeClient/LeValidation/DnsHexonet.php | 45 +++++++++++++++++++ .../models/OPNsense/AcmeClient/AcmeClient.xml | 7 +++ 4 files changed, 71 insertions(+) create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsHexonet.php diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 67271d443..b559755f7 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -10,6 +10,9 @@ Plugin Changelog 2.2 +Added: +* add support for hexonet.com DNS API (#2134) + Fixed: * fix DNS challenge alias mode (#2128, #2130) diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 00ca5e203..e6999e3a9 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -1221,4 +1221,20 @@ text + + + header + + + + validation.dns_hexonet_login + + text + This should be a combination of the username and role ID. For example, when the username is "myuser" and role ID is "testrole", then "myuser!testrole" must be used here. + + + validation.dns_hexonet_password + + password + diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsHexonet.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsHexonet.php new file mode 100644 index 000000000..570b59dbf --- /dev/null +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsHexonet.php @@ -0,0 +1,45 @@ +acme_env['Hexonet_Login'] = (string)$this->config->dns_hexonet_login; + $this->acme_env['Hexonet_Password'] = (string)$this->config->dns_hexonet_password; + } +} diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index b87b20dbc..02722c751 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -401,6 +401,7 @@ Google Cloud DNS API GratisDNS.dk Hetzner DNS API + hexonet.com DNS API hosting.de API Hurricane Electric Infoblox API @@ -917,6 +918,12 @@ N + + N + + + N + N