Merge pull request #2226 from fraenki/acme_240

security/acme-client: release 2.4
2026-05-22 18:44:07 -07:00 · 2021-02-15 22:17:34 +01:00
parent ff935d691d fcecc897a2
commit c9b22e40d0
14 changed files with 288 additions and 134 deletions
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		2.3
+PLUGIN_VERSION=		2.4
 PLUGIN_COMMENT=		Let's Encrypt client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh py${PLUGIN_PYTHON}-dns-lexicon
@@ -8,6 +8,23 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================

+2.4
+
+Added:
+* add new page to show AcmeClient entries from system log
+* add tooltips for certificate command buttons (#2188)
+
+Fixed:
+* fix missing "--ecc" parameter when renewing ECC certs (#2223)
+* fix log file location (#2227)
+* fix GUI log formatting (by using the syslog log)
+* fix OCSP setting not honored (#2234)
+
+Changed:
+* let acme.sh log through syslog
+* revamp logs page, move acme.sh log to a sub tab
+* remove legacy logs page
+
 2.3

 Added:
@@ -71,6 +71,15 @@ function acmeclient_services()
    return $services;
 }

+function acmeclient_syslog()
+{
+    $logfacilities = array();
+    $logfacilities['acmeclient'] = array(
+        'facility' => array('acmeclient', 'acme.sh')
+    );
+    return $logfacilities;
+}
+
 /**
 *  NOTE: Does NOT support configuration sync (xmlrpc). The required acme.sh
 *        state files are missing on the secondary node and thus all attempts
@@ -0,0 +1,45 @@
+<?php
+
+/**
+ *    Copyright (C) 2021 Frank Wall
+ *    Copyright (C) 2015 Deciso B.V.
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\AcmeClient;
+
+/**
+ * Class LogsController
+ * @package OPNsense\AcmeClient
+ */
+class LogsController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        // choose template
+        $this->view->pick('OPNsense/AcmeClient/logs');
+    }
+}
@@ -656,6 +656,7 @@ class LeCertificate extends LeCommon
            $val->setNames($this->config->name, $this->config->altNames, $this->config->aliasmode, $this->config->domainalias, $this->config->challengealias);
            $val->setRenewal((int)$this->config->renewInterval);
            $val->setForce($this->force);
+            $val->setOcsp((string)$this->config->ocsp == 1 ? true : false);
            // strip prefix from key value
            $val->setKey(substr($this->config->keyLength, 4));
            $val->prepare();
@@ -153,26 +153,36 @@ abstract class LeCommon

        switch ($loglevel) {
            case 'extended':
+                $this->acme_args[] = '--syslog 6';
                $this->acme_args[] = '--log-level 2';
                $this->debug = false;
                break;
            case 'debug':
+                $this->acme_args[] = '--syslog 7';
                $this->acme_args[] = '--debug';
                $this->debug = true;
                break;
            case 'debug2':
+                $this->acme_args[] = '--syslog 7';
                $this->acme_args[] = '--debug 2';
                $this->debug = true;
                break;
            case 'debug3':
+                $this->acme_args[] = '--syslog 7';
                $this->acme_args[] = '--debug 3';
                $this->debug = true;
                break;
            default:
+                $this->acme_args[] = '--syslog 6';
                $this->acme_args[] = '--log-level 1';
                $this->debug = false;
                break;
        }
+
+        // Set log file
+        // NOTE: This log file is no longer exposed to the GUI. However, it may
+        // still turn out to be useful for debug purposes in rare egde cases.
+        $this->acme_args[] = LeUtils::execSafe('--log %s', self::ACME_LOG_FILE);
    }

    /**
@@ -137,7 +137,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
        if ($this->cert_keylength == 'ec256' || $this->cert_keylength == 'ec384') {
            if ($renew == true) {
                // If it's a renew then pass --ecc to acme client to locate the correct cert directory
-                $acme_args[] = '--ecc';
+                $this->acme_args[] = '--ecc';
            }
        }

@@ -9,7 +9,10 @@
          <Validations VisibleName="Challenge Types" order="30" url="/ui/acmeclient/validations"/>
          <Certificates order="40" url="/ui/acmeclient/certificates"/>
          <Automations VisibleName="Automations" order="50" url="/ui/acmeclient/actions"/>
-          <LogFile VisibleName="Log File" order="60" url="/diag_logs_acmeclient.php"/>
+          <Logs VisibleName="Log Files" order="60" url="/ui/acmeclient/logs">
+              <SystemLog VisibleName="System Log" order="10" url="/ui/acmeclient/logs"/>
+              <AcmeLog VisibleName="Acme Log" order="20" url="/ui/diagnostics/log/core/acmeclient"/>
+          </Logs>
      </LEAcmeClient>
    </Services>
 </menu>
@@ -59,13 +59,13 @@ POSSIBILITY OF SUCH DAMAGE.
            url: '/api/acmeclient/certificates/search',
            formatters: {
                "commands": function (column, row) {
-                    return "<button type=\"button\" class=\"btn btn-xs btn-default command-edit\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-pencil\"></span></button> " +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-copy\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-clone\"></span></button>" +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-sign\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-repeat\"></span></button>" +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-automation\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-paper-plane\"></span></button>" +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-revoke\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-power-off\"></span></button>" +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-removekey\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-history\"></span></button>" +
-                        "<button type=\"button\" class=\"btn btn-xs btn-default command-delete\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-trash-o\"></span></button>";
+                    return "<button type=\"button\" title=\"{{ lang._('edit certificate') }}\" class=\"btn btn-xs btn-default command-edit\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-pencil\"></span></button> " +
+                        "<button type=\"button\" title=\"{{ lang._('copy certificate') }}\" class=\"btn btn-xs btn-default command-copy\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-clone\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('issue or renew certificate') }}\" class=\"btn btn-xs btn-default command-sign\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-repeat\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('run automations') }}\" class=\"btn btn-xs btn-default command-automation\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-paper-plane\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('revoke certificate') }}\" class=\"btn btn-xs btn-default command-revoke\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-power-off\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('reset certificate') }}\" class=\"btn btn-xs btn-default command-removekey\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-history\"></span></button>" +
+                        "<button type=\"button\" title=\"{{ lang._('remove certificate') }}\" class=\"btn btn-xs btn-default command-delete\" data-row-id=\"" + row.uuid + "\"><span class=\"fa fa-trash-o\"></span></button>";
                },
                "rowtoggle": function (column, row) {
                    if (parseInt(row[column.id], 2) == 1) {
@@ -0,0 +1,130 @@
+{#
+ # Copyright (c) 2019 Deciso B.V.
+ # All rights reserved.
+ #
+ # Redistribution and use in source and binary forms, with or without modification,
+ # are permitted provided that the following conditions are met:
+ #
+ # 1.  Redistributions of source code must retain the above copyright notice,
+ #     this list of conditions and the following disclaimer.
+ #
+ # 2.  Redistributions in binary form must reproduce the above copyright notice,
+ #     this list of conditions and the following disclaimer in the documentation
+ #     and/or other materials provided with the distribution.
+ #
+ # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ # AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ # AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ # POSSIBILITY OF SUCH DAMAGE.
+ #}
+
+<script>
+    $( document ).ready(function() {
+      // get entries from system log for 'AcmeClient'
+      let grid_systemlog = $("#grid-systemlog").UIBootgrid({
+          options:{
+              // Hide nonfunctional search field
+              navigation:2,
+              sorting:false,
+              rowSelect: false,
+              selection: false,
+              rowCount:[20,50,100,200,500,1000,-1],
+              requestHandler: function(request){
+                  // Show only log entries that match 'AcmeClient'
+                  request['searchPhrase'] = 'AcmeClient';
+                  return request;
+              },
+          },
+          search:'/api/diagnostics/log/core/system'
+      });
+
+      // get entries from acmeclient.log
+      let grid_acmelog = $("#grid-acmelog").UIBootgrid({
+          options:{
+              sorting:false,
+              rowSelect: false,
+              selection: false,
+              rowCount:[20,50,100,200,500,1000,-1],
+          },
+          search:'/api/diagnostics/log/core/acmeclient'
+      });
+
+      grid_systemlog.on("loaded.rs.jquery.bootgrid", function(){
+          $(".action-page").click(function(event){
+              event.preventDefault();
+              $("#grid-systemlog").bootgrid("search",  "");
+              let new_page = parseInt((parseInt($(this).data('row-id')) / $("#grid-log").bootgrid("getRowCount")))+1;
+              $("input.search-field").val("");
+              // XXX: a bit ugly, but clearing the filter triggers a load event.
+              setTimeout(function(){
+                  $("ul.pagination > li:last > a").data('page', new_page).click();
+              }, 100);
+          });
+      });
+
+      grid_acmelog.on("loaded.rs.jquery.bootgrid", function(){
+          $(".action-page").click(function(event){
+              event.preventDefault();
+              $("#grid-acmelog").bootgrid("search",  "");
+              let new_page = parseInt((parseInt($(this).data('row-id')) / $("#grid-log").bootgrid("getRowCount")))+1;
+              $("input.search-field").val("");
+              // XXX: a bit ugly, but clearing the filter triggers a load event.
+              setTimeout(function(){
+                  $("ul.pagination > li:last > a").data('page', new_page).click();
+              }, 100);
+          });
+      });
+    });
+</script>
+
+
+<ul class="nav nav-tabs" role="tablist" id="maintabs">
+    <li class="active"><a data-toggle="tab" href="#systemlog"><b>{{ lang._('System Log') }}</b></a></li>
+    <li><a data-toggle="tab" href="#acmelog">{{ lang._('Acme Log') }}</a></li>
+</ul>
+
+<div class="content-box tab-content">
+
+    <div id="systemlog" class="tab-pane fade in active">
+        <div class="content-box" style="padding-bottom: 1.5em;">
+            <div  class="col-sm-12">
+                <table id="grid-systemlog" class="table table-condensed table-hover table-striped table-responsive" data-store-selection="true">
+                    <thead>
+                    <tr>
+                        <th data-column-id="timestamp" data-width="11em" data-type="string">{{ lang._('Date') }}</th>
+                        <th data-column-id="process_name" data-width="11em" data-type="string">{{ lang._('Process') }}</th>
+                        <th data-column-id="line" data-type="string">{{ lang._('Line') }}</th>
+                    </tr>
+                    </thead>
+                    <tbody>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+    <div id="acmelog" class="tab-pane fade">
+        <div class="content-box" style="padding-bottom: 1.5em;">
+            <div  class="col-sm-12">
+                <table id="grid-acmelog" class="table table-condensed table-hover table-striped table-responsive" data-store-selection="true">
+                    <thead>
+                    <tr>
+                        <th data-column-id="timestamp" data-width="11em" data-type="string">{{ lang._('Date') }}</th>
+                        <th data-column-id="process_name" data-width="11em" data-type="string">{{ lang._('Process') }}</th>
+                        <th data-column-id="line" data-type="string">{{ lang._('Line') }}</th>
+                    </tr>
+                    </thead>
+                    <tbody>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
+</div>
@@ -0,0 +1,63 @@
+"""
+    Copyright (c) 2021 Frank Wall
+    Copyright (c) 2020 Ad Schellevis <ad@opnsense.org>
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+"""
+import re
+import datetime
+from . import BaseLogFormat
+
+class AcmeclientLogFormat(BaseLogFormat):
+    def __init__(self, filename):
+        super(AcmeclientLogFormat, self).__init__(filename)
+        # XXX This is ugly, but it's the only way to override the line() method.
+        self._priority = 1
+        self._startup_timestamp = datetime.datetime.now()
+
+    def match(self, line):
+        return self._filename.find('acmeclient') > -1 and len(line) > 15 and re.match(r'(?:[01]\d|2[0123]):(?:[012345]\d):(?:[012345]\d)', line[7:15])
+
+    def timestamp(self, line):
+        # syslog format, strip timestamp and return actual log data
+        ts = datetime.datetime.strptime("%s %s" % (self._startup_timestamp.year, line[0:15]), "%Y %b %d %H:%M:%S")
+        ts = ts.replace(year=self._startup_timestamp.year)
+        if (self._startup_timestamp - ts).days < 0:
+            # likely previous year, (month for this year not reached yet)
+            ts = ts.replace(year=ts.year - 1)
+        return ts.isoformat()
+
+    @staticmethod
+    def line(line):
+        # parse [date] [hostname] [process_name] [line] format
+        response = line[16:]
+        tmp = response.find(':')
+        pre = response[tmp+1:].strip() if tmp > -1 else response[response.find(' ')+1:].strip()
+        # strip the duplicate date from the line
+        return pre[30:].strip()
+
+    @staticmethod
+    def process_name(line):
+        response = line[16:]
+        tmp = response.find(':')
+        return response[:tmp].strip().split()[-1] if tmp > -1 else ""
@@ -1,7 +0,0 @@
-<?php
-
-$logfile = '/var/log/acme.sh.log';
-$logclog = false;
-$logsplit = 6;
-
-require_once 'diag_logs_template_acme-client.inc';
@@ -1,117 +0,0 @@
-<?php
-
-/*
- * Copyright (C) 2014-2015 Deciso B.V.
- * Copyright (C) 2012 Seth Mos <seth.mos@dds.nl>
- * Copyright (C) 2004-2009 Scott Ullrich <sullrich@gmail.com>
- * Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice,
- *    this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
- * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-require_once("guiconfig.inc");
-require_once("system.inc");
-require_once("interfaces.inc");
-
-/* expects $logfile to point to the system path */
-/* expects $logclog to be true or false */
-
-require_once 'diag_logs_common.inc';
-
-$filtertext = '';
-$nentries = 50;
-
-if (isset($config['syslog']['nentries'])) {
-    $nentries = $config['syslog']['nentries'];
-}
-
-if (!empty($_POST['clear'])) {
-    if ($logclog) {
-        system_clear_clog($logfile);
-    } else {
-        system_clear_log($logfile);
-    }
-}
-
-if (isset($_POST['filtertext'])) {
-    $filtertext = $_POST['filtertext'];
-}
-
-include("head.inc");
-?>
-
-<body>
-<?php include("fbegin.inc"); ?>
-  <section class="page-content-main">
-    <div class="container-fluid">
-      <div class="row">
-        <section class="col-xs-12">
-          <p>
-            <form method="post">
-              <div class="input-group">
-                <div class="input-group-addon"><i class="fa fa-search"></i></div>
-                <input type="text" class="form-control" id="filtertext" name="filtertext" placeholder="<?= html_safe(gettext('Search for a specific message...')) ?>" value="<?= html_safe($filtertext) ?>"/>
-              </div>
-            </form>
-          </p>
-          <div class="table-responsive content-box tab-content">
-            <table class="table table-striped">
-              <tr>
-                <th class="col-md-2 col-sm-3 col-xs-4"><?= gettext('Date') ?></th>
-                <th class="col-md-10 col-sm-9 col-xs-8"><?= gettext('Message') ?></th>
-              </tr>
-              <?php if (isset($logpills)): ?>
-              <tr>
-                <td colspan="2">
-                  <ul class="nav nav-pills" role="tablist">
-                    <?php foreach ($logpills as $pill): ?>
-                    <li role="presentation" <?php if (str_replace('amp;','', $pill[2]) == $_SERVER['REQUEST_URI']):?>class="active"<?php endif; ?>><a href="<?=$pill[2];?>"><?=$pill[0];?></a></li>
-                    <?php endforeach; ?>
-                  </ul>
-                </td>
-              </tr>
-              <?php endif; ?>
-              <?php
-                if ($logclog) {
-                    dump_clog($logfile, $nentries, $filtertext);
-                } else {
-                    dump_log($logfile, $nentries, $filtertext);
-                }
-              ?>
-              <tr>
-                <td colspan="2">
-                  <form method="post">
-<?php                   if (isset($mode)): ?>
-                    <input type="hidden" name="mode" id="mode" value="<?= html_safe($mode) ?>"/>
-<?php                   endif; ?>
-                    <input name="clear" type="submit" class="btn btn-primary" value="<?= html_safe(gettext('Clear log')) ?>"/>
-                  </form>
-                </td>
-              </tr>
-            </table>
-          </div>
-        </section>
-      </div>
-    </div>
-  </section>
-<?php include("foot.inc"); ?>