Merge pull request #2551 from fraenki/acme_320

security/acme-client: release 3.2
2026-05-22 18:44:07 -07:00 · 2021-09-30 12:25:55 +02:00
parent 6a58548140 774374a49e
commit a2a950eec5
7 changed files with 66 additions and 4 deletions
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		3.1
+PLUGIN_VERSION=		3.2
 PLUGIN_COMMENT=		ACME Client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh py${PLUGIN_PYTHON}-dns-lexicon
@@ -8,6 +8,14 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================

+3.2
+
+Added:
+* add button to (re-) import a certificate into the trust storage
+
+Fixed:
+* associate certificates with the correct CA when multiple CAs use the same name (#2550)
+
 3.1

 Changed:
@@ -172,4 +172,23 @@ class CertificatesController extends ApiMutableModelControllerBase
        }
        return $result;
    }
+
+    /**
+     * (re-) import the certificate by uuid
+     * @param $uuid item unique id
+     * @return array status
+     */
+    public function importAction($uuid)
+    {
+        $result = array("result" => "failed");
+        $mdlAcme = new AcmeClient();
+        if ($uuid != null) {
+            $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid);
+            if ($node != null) {
+                $backend = new Backend();
+                $response = $backend->configdRun("acmeclient import ${uuid}");
+            }
+        }
+        return $result;
+    }
 }
@@ -159,7 +159,7 @@ class LeCertificate extends LeCommon
        foreach (Config::getInstance()->object()->ca as $cacrt) {
            $cacrt_subject = cert_get_subject($cacrt->crt, true);
            $cacrt_issuer = cert_get_issuer($cacrt->crt, true);
-            if (($ca_subject == $cacrt_subject) and ($ca_issuer == $cacrt_issuer)) {
+            if (($ca_subject === $cacrt_subject) and ($ca_issuer === $cacrt_issuer)) {
                // Use old refid instead of generating a new one
                $ca['refid'] = (string)$cacrt->refid;
                $ca_found = true;
@@ -257,6 +257,12 @@ class LeCertificate extends LeCommon
        // Prepare certificate for import
        cert_import($cert, $cert_content, $key_content);

+        // Overwrite caref in order to use the correct CA (GH #2550).
+        // This is required because cert_import() uses lookup_ca_by_subject()
+        // to find a matching CA. If multiple CAs are using the same name, the
+        // first CA wins, but it may still be the wrong CA.
+        $cert['caref'] = (string)$ca['refid'];
+
        // Check if cert was found in config
        if ($cert_found == true) {
            // Update existing cert
@@ -49,6 +49,7 @@ POSSIBILITY OF SUCH DAMAGE.
            revoke:'/api/acmeclient/certificates/revoke/',
            removekey:'/api/acmeclient/certificates/removekey/',
            automation:'/api/acmeclient/certificates/automation/',
+            import:'/api/acmeclient/certificates/import/',
        };

        var gridopt = {
@@ -62,6 +63,7 @@ POSSIBILITY OF SUCH DAMAGE.
                    return "<button type=\"button\" title=\"{{ lang._('Edit certificate') }}\" class=\"btn btn-xs btn-default command-edit bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-pencil\"></span></button> " +
                        "<button type=\"button\" title=\"{{ lang._('Copy certificate') }}\" class=\"btn btn-xs btn-default command-copy bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-clone\"></span></button>" +
                        "<button type=\"button\" title=\"{{ lang._('Issue or renew certificate') }}\" class=\"btn btn-xs btn-default command-sign bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-repeat\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('(Re-) Import certificate') }}\" class=\"btn btn-xs btn-default command-import bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-certificate\"></span></button>" +
                        "<button type=\"button\" title=\"{{ lang._('Run automations') }}\" class=\"btn btn-xs btn-default command-automation bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-paper-plane\"></span></button>" +
                        "<button type=\"button\" title=\"{{ lang._('Revoke certificate') }}\" class=\"btn btn-xs btn-default command-revoke bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-power-off\"></span></button>" +
                        "<button type=\"button\" title=\"{{ lang._('Reset certificate') }}\" class=\"btn btn-xs btn-default command-removekey bootgrid-tooltip\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-history\"></span></button>" +
@@ -397,6 +399,25 @@ POSSIBILITY OF SUCH DAMAGE.
                }
            });

+            // import certificate into trust storage
+            grid_certificates.find(".command-import").on("click", function(e)
+            {
+                if (gridParams['import'] != undefined) {
+                    var uuid=$(this).data("row-id");
+                    stdDialogConfirm('{{ lang._('Confirmation Required') }}',
+                        '{{ lang._('(Re-) import the selected certificate and associated CA certificates into the trust storage?') }}',
+                        '{{ lang._('Yes') }}', '{{ lang._('Cancel') }}', function() {
+                        ajaxCall(url=gridParams['import'] + uuid,
+                            sendData={},callback=function(data,status){
+                                // reload grid after sign
+                                $("#"+gridId).bootgrid("reload");
+                            });
+                    });
+                } else {
+                    console.log("[grid] action import missing")
+                }
+            });
+
        });

        // Hide options that are irrelevant in this context.
@@ -463,7 +484,7 @@ POSSIBILITY OF SUCH DAMAGE.
                <th data-column-id="lastUpdate" data-type="string" data-formatter="certdate">{{ lang._('Issue/Renewal Date') }}</th>
                <th data-column-id="statusCode" data-type="string" data-formatter="acmestatus">{{ lang._('Last ACME Status') }}</th>
                <th data-column-id="statusLastUpdate" data-type="string" data-formatter="acmestatusdate">{{ lang._('Last ACME Run') }}</th>
-                <th data-column-id="commands" data-width="11em" data-formatter="commands" data-sortable="false">{{ lang._('Commands') }}</th>
+                <th data-column-id="commands" data-width="13em" data-formatter="commands" data-sortable="false">{{ lang._('Commands') }}</th>
                <th data-column-id="uuid" data-type="string" data-identifier="true"  data-visible="false">{{ lang._('ID') }}</th>
            </tr>
            </thead>
@@ -171,7 +171,9 @@ function main()
        }
    } elseif ($options['mode'] === 'import' && isset($options['cert'])) {
        $cert = new LeCertificate($options['cert']);
-        $cert->import();
+        // Set $skip_validation to allow import even when validation
+        // is currently failing.
+        $cert->import(true);
    } elseif ($options['mode'] === 'revoke' && isset($options['cert'])) {
        $cert = new LeCertificate($options['cert']);
        $cert->revoke();
@@ -77,6 +77,12 @@ parameters:%s
 type:script
 message:running automations for a certificate

+[import]
+command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
+parameters:%s
+type:script
+message:running import for a certificate
+
 [cron-auto-renew]
 command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters: