From c3b6d586e90235cf9afb04c5879259c61251027e Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 21 Oct 2022 17:25:56 +0200
Subject: [PATCH] security/acme-client: remove saved deploy hook from acme.sh
 config files, fixes #3120

---
 security/acme-client/pkg-descr                |  4 ++-
 .../OPNsense/AcmeClient/LeAutomation/Base.php | 27 +++++++++++++++++++
 .../library/OPNsense/AcmeClient/LeCommon.php  |  3 +++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a4e9781b0..1e45db84a 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -18,9 +18,11 @@ Added:
 
 Fixed:
 * fix Selfhost DNS API (#3122)
+* fix invalid cert state due to deploy error (#3120)
 
 Changed:
-* change default DNS sleep time to 0 (3079)
+* change default DNS sleep time to 0 (#3079)
+* remove saved deploy hook from acme.sh config files (#3120)
 
 3.13
 
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
index 1f11081fa..4f79aa471 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
@@ -150,6 +150,33 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
             return false;
         }
 
+        // acme.sh records the last used deploy hook and would automatically
+        // use it on the next run. This information must be removed from the
+        // configuration file. Otherwise it would be impossible to disable
+        // or remove a deploy hook from the GUI.
+        foreach (glob(self::ACME_HOME_DIR . '/*/*.conf') as $filename) {
+            // Skip openssl config files.
+            if (preg_match('/.*.csr.conf/i', $filename)) {
+                continue;
+            }
+
+            // Read contents from file.
+            $contents = file_get_contents($filename);
+
+            // Check if deploy hook string can be found.
+            if (strpos($contents, self::ACME_DEPLOY_HOOK_STRING) !== false) {
+                // Replace the whole line with an empty string.
+                $contents = preg_replace('(' . self::ACME_DEPLOY_HOOK_STRING . '.*)', '', $contents);
+
+                // Write changes to the file.
+                if (!file_put_contents($filename, $contents)) {
+                    LeUtils::log_error('clearing recorded deploy hook from acme.sh failed (' . $filename . ')');
+                } else {
+                    LeUtils::log_debug('cleared recorded deploy deploy hook from acme.sh (' . $filename . ')', $this->debug);
+                }
+            }
+        }
+
         // Check result
         if ($result) {
             LeUtils::log_error('running acme.sh deploy hook failed (' . $this->getType() . ')');
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index 631fab0c4..bf278b7aa 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -59,6 +59,9 @@ abstract class LeCommon
     public const ACME_KEY_DIR = '/var/etc/acme-client/keys/%s/';
     public const ACME_KEY_FILE = '/var/etc/acme-client/keys/%s/private.key';
 
+    // acme.sh internals
+    public const ACME_DEPLOY_HOOK_STRING = 'Le_DeployHook=';
+
     // Runtime parameters for acme.sh
     protected $acme_args = array(); # command line arguments to be passed to acme.sh
     protected $acme_env = array();  # environment variables to be used when running acme.sh