From ae697392293e4a7fb3e9ed0450a559adccbab2e6 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 28 Sep 2021 17:21:07 +0200 Subject: [PATCH 1/5] security/acme-client: expose import feature to GUI --- security/acme-client/pkg-descr | 5 +++++ .../AcmeClient/Api/CertificatesController.php | 19 +++++++++++++++++ .../OPNsense/AcmeClient/certificates.volt | 21 +++++++++++++++++++ .../conf/actions.d/actions_acmeclient.conf | 6 ++++++ 4 files changed, 51 insertions(+) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 724aae3e7..832ae46ab 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +3.2 + +Added: +* add button to (re-) import a certificate into the trust storage + 3.1 Changed: diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php index 5a56a56a0..e72baa630 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php @@ -172,4 +172,23 @@ class CertificatesController extends ApiMutableModelControllerBase } return $result; } + + /** + * (re-) import the certificate by uuid + * @param $uuid item unique id + * @return array status + */ + public function importAction($uuid) + { + $result = array("result" => "failed"); + $mdlAcme = new AcmeClient(); + if ($uuid != null) { + $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); + if ($node != null) { + $backend = new Backend(); + $response = $backend->configdRun("acmeclient import ${uuid}"); + } + } + return $result; + } } diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt index 334e7914b..f74432af6 100644 --- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt +++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt @@ -49,6 +49,7 @@ POSSIBILITY OF SUCH DAMAGE. revoke:'/api/acmeclient/certificates/revoke/', removekey:'/api/acmeclient/certificates/removekey/', automation:'/api/acmeclient/certificates/automation/', + import:'/api/acmeclient/certificates/import/', }; var gridopt = { @@ -62,6 +63,7 @@ POSSIBILITY OF SUCH DAMAGE. return " " + "" + "" + + "" + "" + "" + "" + @@ -397,6 +399,25 @@ POSSIBILITY OF SUCH DAMAGE. } }); + // import certificate into trust storage + grid_certificates.find(".command-import").on("click", function(e) + { + if (gridParams['import'] != undefined) { + var uuid=$(this).data("row-id"); + stdDialogConfirm('{{ lang._('Confirmation Required') }}', + '{{ lang._('(Re-) import the selected certificate into the trust storage?') }}', + '{{ lang._('Yes') }}', '{{ lang._('Cancel') }}', function() { + ajaxCall(url=gridParams['import'] + uuid, + sendData={},callback=function(data,status){ + // reload grid after sign + $("#"+gridId).bootgrid("reload"); + }); + }); + } else { + console.log("[grid] action import missing") + } + }); + }); // Hide options that are irrelevant in this context. diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf index 8f379a6da..7af68eaa4 100644 --- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf +++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf @@ -77,6 +77,12 @@ parameters:%s type:script message:running automations for a certificate +[import] +command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert +parameters:%s +type:script +message:running import for a certificate + [cron-auto-renew] command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron parameters: From e7f9320ff223d79979a3c1481d7c9121d94417f6 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 28 Sep 2021 17:21:26 +0200 Subject: [PATCH 2/5] security/acme-client: bump version --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index 465cc2578..def551fa6 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 3.1 +PLUGIN_VERSION= 3.2 PLUGIN_COMMENT= ACME Client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon From 9220a4149940cd9f020a678e2c954c6a62c0ba01 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 28 Sep 2021 18:01:14 +0200 Subject: [PATCH 3/5] security/acme-client: minor improvements for import feature --- .../mvc/app/views/OPNsense/AcmeClient/certificates.volt | 2 +- .../src/opnsense/scripts/OPNsense/AcmeClient/lecert.php | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt index f74432af6..f7eae4892 100644 --- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt +++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt @@ -405,7 +405,7 @@ POSSIBILITY OF SUCH DAMAGE. if (gridParams['import'] != undefined) { var uuid=$(this).data("row-id"); stdDialogConfirm('{{ lang._('Confirmation Required') }}', - '{{ lang._('(Re-) import the selected certificate into the trust storage?') }}', + '{{ lang._('(Re-) import the selected certificate and associated CA certificates into the trust storage?') }}', '{{ lang._('Yes') }}', '{{ lang._('Cancel') }}', function() { ajaxCall(url=gridParams['import'] + uuid, sendData={},callback=function(data,status){ diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php index 76fb546cf..73bb87ee2 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/lecert.php @@ -171,7 +171,9 @@ function main() } } elseif ($options['mode'] === 'import' && isset($options['cert'])) { $cert = new LeCertificate($options['cert']); - $cert->import(); + // Set $skip_validation to allow import even when validation + // is currently failing. + $cert->import(true); } elseif ($options['mode'] === 'revoke' && isset($options['cert'])) { $cert = new LeCertificate($options['cert']); $cert->revoke(); From 247408e50a95cb7770bf4c91558aed9d9738dc6a Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 28 Sep 2021 18:08:54 +0200 Subject: [PATCH 4/5] security/acme-client: fix CA association, closes #2550 --- security/acme-client/pkg-descr | 3 +++ .../mvc/app/library/OPNsense/AcmeClient/LeCertificate.php | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 832ae46ab..a7dc6c18e 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -13,6 +13,9 @@ Plugin Changelog Added: * add button to (re-) import a certificate into the trust storage +Fixed: +* associate certificates with the correct CA when multiple CAs use the same name (#2550) + 3.1 Changed: diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php index cfe13498d..9aaf313be 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php @@ -159,7 +159,7 @@ class LeCertificate extends LeCommon foreach (Config::getInstance()->object()->ca as $cacrt) { $cacrt_subject = cert_get_subject($cacrt->crt, true); $cacrt_issuer = cert_get_issuer($cacrt->crt, true); - if (($ca_subject == $cacrt_subject) and ($ca_issuer == $cacrt_issuer)) { + if (($ca_subject === $cacrt_subject) and ($ca_issuer === $cacrt_issuer)) { // Use old refid instead of generating a new one $ca['refid'] = (string)$cacrt->refid; $ca_found = true; @@ -257,6 +257,12 @@ class LeCertificate extends LeCommon // Prepare certificate for import cert_import($cert, $cert_content, $key_content); + // Overwrite caref in order to use the correct CA (GH #2550). + // This is required because cert_import() uses lookup_ca_by_subject() + // to find a matching CA. If multiple CAs are using the same name, the + // first CA wins, but it may still be the wrong CA. + $cert['caref'] = (string)$ca['refid']; + // Check if cert was found in config if ($cert_found == true) { // Update existing cert From 774374a49e261c43ff70ee6f02346177951f2b3d Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 28 Sep 2021 18:24:07 +0200 Subject: [PATCH 5/5] security/acme-client: fix width of commands column --- .../mvc/app/views/OPNsense/AcmeClient/certificates.volt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt index f7eae4892..c0483969b 100644 --- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt +++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt @@ -484,7 +484,7 @@ POSSIBILITY OF SUCH DAMAGE. {{ lang._('Issue/Renewal Date') }} {{ lang._('Last ACME Status') }} {{ lang._('Last ACME Run') }} - {{ lang._('Commands') }} + {{ lang._('Commands') }} {{ lang._('ID') }}