From abcd19c64c9987be4d1e50105b174b5c4856df74 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 29 Jan 2019 18:59:47 +0100
Subject: [PATCH 1/2] security/acme-client: add new button to wipe config+data,
 closes #243

---
 .../AcmeClient/Api/ServiceController.php      | 27 +++++++++++++
 .../views/OPNsense/AcmeClient/settings.volt   | 39 ++++++++++++++++++-
 .../conf/actions.d/actions_acmeclient.conf    |  6 +++
 3 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
index f064d0445..185c492ae 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
@@ -194,4 +194,31 @@ class ServiceController extends ApiControllerBase
         $response = $backend->configdRun("acmeclient sign-all-certs");
         return array("result" => $response);
     }
+
+    /**
+     * Remove ALL certificate data and configuration and reset ALL states
+     * @return array
+     * @throws \Exception
+     */
+    public function resetAction()
+    {
+        $model = new AcmeClient();
+        // reset certificate states
+        foreach ($model->getNodeByReference('certificates.certificate')->iterateItems() as $cert) {
+            $cert->lastUpdate = null;
+            $cert->statusCode = null;
+            $cert->statusLastUpdate = null;
+        }
+        // reset account states
+        foreach ($model->getNodeByReference('accounts.account')->iterateItems() as $account) {
+            $account->lastUpdate = null;
+        }
+        // reset acme.sh data
+        $backend = new Backend();
+        $response = $backend->configdRun("acmeclient reset-acme-client");
+        // serialize to config and save
+        $model->serializeToConfig();
+        Config::getInstance()->save();
+        return array("result" => $response);
+    }
 }
diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
index ebfaa029f..08d8932b8 100644
--- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
+++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/settings.volt
@@ -1,6 +1,6 @@
 {#
 
-Copyright (C) 2017 Frank Wall
+Copyright (C) 2017-2019 Frank Wall
 OPNsense® is Copyright © 2014-2015 by Deciso B.V.
 All rights reserved.
 
@@ -184,6 +184,42 @@ POSSIBILITY OF SUCH DAMAGE.
             });
         });
 
+        // Reset certificate data (aka wipe everything)
+        $("#resetAct").click(function(){
+
+            // set progress animation
+            $('[id*="resetAct_progress"]').each(function(){
+                $(this).addClass("fa fa-spinner fa-pulse");
+            });
+
+            BootstrapDialog.show({
+                type: BootstrapDialog.TYPE_DANGER,
+                title: "{{ lang._('Wipe all certificate and account data') }}",
+                message: "{{ lang._('This will remove ALL certificates, private keys, CSRs from acme client and reset all certificate and account states. However, existing certificates will remain in OPNsense trust storage. The acme client will automatically regenerate everything on its next scheduled run. This is most useful when importing a config backup to a new firewall. Continue?') }}",
+                buttons: [{
+                    label: '{{ lang._('Continue') }}',
+                    cssClass: 'btn-primary',
+                    action: function(dlg){
+                        ajaxCall(url="/api/acmeclient/service/reset", sendData={}, callback=function(data,status) {
+                        });
+
+                        dlg.close();
+                    }
+                }, {
+                    icon: 'fa fa-trash-o',
+                    label: '{{ lang._('Abort') }}',
+                    action: function(dlg){
+                        dlg.close();
+                    }
+                }]
+            });
+
+            // when done, disable progress animation
+            $('[id*="resetAct_progress"]').each(function(){
+                $(this).removeClass("fa fa-spinner fa-pulse");
+            });
+
+        });
     });
 
 </script>
@@ -201,6 +237,7 @@ POSSIBILITY OF SUCH DAMAGE.
         <hr/>
         <button class="btn btn-primary" id="reconfigureAct" type="button"><b>{{ lang._('Apply') }}</b><i id="reconfigureAct_progress" class=""></i></button>
         <button class="btn btn-primary" id="configtestAct" type="button"><b>{{ lang._('Test Config') }}</b><i id="configtestAct_progress" class=""></i></button>
+        <button class="btn btn-primary" id="resetAct" type="button"><b>{{ lang._('Reset acme client') }}</b><i id="resetAct_progress" class=""></i></button>
         <br/>
     </div>
     <div class="col-md-12">
diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
index b44a19be7..eddddd48a 100644
--- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
@@ -71,3 +71,9 @@ command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/upload_highwinds.php
 parameters:-c %s -a %s
 type:script
 message:uploading a certificate to highwinds
+
+[reset-acme-client]
+command:/usr/bin/find /var/etc/acme-client/home /var/etc/acme-client/configs /var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/accounts -type f -delete
+parameters:
+type:script
+message:wiping acme client config and data

From db17ec067fe6fea58d7571f2e31ebcaa38d0f26d Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 30 Jan 2019 12:29:27 +0100
Subject: [PATCH 2/2] security/acme-client: bump version

---
 security/acme-client/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile
index da392e57d..7013df934 100644
--- a/security/acme-client/Makefile
+++ b/security/acme-client/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		1.19
+PLUGIN_VERSION=		1.20
 PLUGIN_COMMENT=		Let's Encrypt client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh bind912