netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/acme-client: add basic IPv6 support for auto port fwd, refs #1590

Browse Source
This commit is contained in:
Frank Wall
2019-12-29 22:32:38 +01:00
parent d00308d048
commit 9e0051766d
2 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php
+21 -3
View File
@@ -587,16 +587,34 @@ function run_acme_validation($certObj, $valObj, $acctObj)
}
}
// Check wether IPv6 support is enabled
$configObj = Config::getInstance()->object();
if (isset($configObj->system->ipv6allow) && ($configObj->system->ipv6allow == "1")) {
$_ipv6_enabled = true;
} else {
$_ipv6_enabled = false;
}
// Generate rules for all IP addresses
$anchor_rules = "";
if (!empty($iplist)) {
$dedup_iplist = array_unique($iplist);
// Add one rule for every IP
foreach ($dedup_iplist as $ip) {
if ($ip == '.') {
continue; // skip broken entries
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
// IPv4
$_dst = '127.0.0.1';
$_family = 'inet';
log_error("AcmeClient: using IPv4 address: ${ip}");
} elseif (($_ipv6_enabled == true) && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
// IPv6
$_dst = 'fe80::1';
$_family = 'inet6';
log_error("AcmeClient: using IPv6 address: ${ip}");
} else {
continue; // skip broken entries
}
$anchor_rules .= "rdr pass inet proto tcp from any to ${ip} port 80 -> 127.0.0.1 port ${local_http_port}\n";
$anchor_rules .= "rdr pass ${_family} proto tcp from any to ${ip} port 80 -> ${_dst} port ${local_http_port}\n";
}
} else {
log_error("AcmeClient: no IP addresses found to setup port forward");
security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/lighttpd-acme-challenge.conf
+5
View File
@@ -64,6 +64,11 @@ server.bind = "127.0.0.1"
server.port = {{OPNsense.AcmeClient.settings.challengePort}}
$SERVER["socket"] == "127.0.0.1:{{OPNsense.AcmeClient.settings.challengePort}}" { }
{% if helpers.exists('system.ipv6allow') and system.ipv6allow|default("0") == "1" %}
# IPv6
$SERVER["socket"] == "[::1]:{{OPNsense.AcmeClient.settings.challengePort}}" { }
{% endif %}
# to help the rc.scripts
server.pid-file = "/var/run/lighttpd-acme-challenge.pid"