From 577fe529b2cb26758b244c4bffde24a67421d0e6 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 10 Oct 2019 13:17:55 +0200 Subject: [PATCH 1/9] security/acme-client: add support for Loopia DNS API, closes #1529 --- .../AcmeClient/forms/dialogValidation.xml | 20 +++++++++++++++++++ .../models/OPNsense/AcmeClient/AcmeClient.xml | 11 ++++++++++ .../OPNsense/AcmeClient/certhelper.php | 5 +++++ 3 files changed, 36 insertions(+) diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 27a097063..fb66169e4 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -590,6 +590,26 @@ text + + + header + + + + validation.dns_loopia_api + + text + + + validation.dns_loopia_user + + text + + + validation.dns_loopia_password + + text + header diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index 1afa9d4f8..a103fabb3 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -390,6 +390,7 @@ Knot (knsupdate) DNS API lexicon DNS API Linode API + Loopia API LuaDNS.com API Name.com API Namecheap API @@ -612,6 +613,16 @@ N + + N + https://api.loopia.se/RPCSERV + + + N + + + N + N diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php index 23b02c021..40f468fb4 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php @@ -784,6 +784,11 @@ function run_acme_validation($certObj, $valObj, $acctObj) // Linode can take up to 15 to update DNS records $acme_hook_options[] = "--dnssleep 960"; break; + case 'dns_loopia': + $proc_env['LOOPIA_Api'] = (string)$valObj->dns_loopia_api; + $proc_env['LOOPIA_User'] = (string)$valObj->dns_loopia_user; + $proc_env['LOOPIA_Password'] = (string)$valObj->dns_loopia_password; + break; case 'dns_lua': $proc_env['LUA_Key'] = (string)$valObj->dns_lua_key; $proc_env['LUA_Email'] = (string)$valObj->dns_lua_email; From 5866358adcd73220f556a39c53a6cf7f3a034887 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 12:43:29 +0200 Subject: [PATCH 2/9] security/acme-client: allow stg/prd accounts simultaneously, fixes #1528 --- .../models/OPNsense/AcmeClient/AcmeClient.xml | 2 +- .../OPNsense/AcmeClient/Migrations/M1_6_0.php | 89 +++++++++++++++++++ .../OPNsense/AcmeClient/certhelper.php | 9 +- 3 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index a103fabb3..51ebbc0fe 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -1,6 +1,6 @@ //OPNsense/AcmeClient - 1.5.0 + 1.6.0 A secure Let's Encrypt plugin diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php new file mode 100644 index 000000000..e54006abd --- /dev/null +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php @@ -0,0 +1,89 @@ +settings->environment; + $dir = '/var/etc/acme-client/accounts/'; + + // Search accounts + foreach ($model->getNodeByReference('accounts.account')->iterateItems() as $account) { + $account_id = (string)$account->id; + $account_dir = "${dir}${account_id}"; + $new_account_dir = "${dir}${account_id}_${env}"; + + // Check if account directory exists + // Accounts that haven't been used yet don't need to be migrated. + if (is_dir($account_dir)) { + + // Check if account configuration can be found. + $account_file = "${account_dir}/account.conf"; + if (is_file($account_file)) { + + // Parse config file and modify path information + $account_conf = parse_ini_file($account_file); + foreach ($account_conf as $key => $value) { + switch ($key) { + case 'ACCOUNT_KEY_PATH': + $account_conf[$key] = "${new_account_dir}/account.key"; + break; + case 'ACCOUNT_JSON_PATH': + $account_conf[$key] = "${new_account_dir}/account.json"; + break; + case 'CA_CONF': + $account_conf[$key] = "${new_account_dir}/ca.conf"; + break; + } + } + + // Convert array back to ini file format + $new_account_conf = array(); + foreach($account_conf as $key => $value) + { + $new_account_conf[] = "${key}='${value}'"; + } + + // Write changes back to file + file_put_contents($account_file, implode("\r\n", $new_account_conf)); + chmod($account_file, 0600); + + // Finally, rename account directory + rename($account_dir, $new_account_dir); + } + } + } + } +} diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php index 40f468fb4..8bde2c2f8 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php @@ -344,7 +344,8 @@ function run_acme_account_registration($acctObj, $certObj, $modelObj) $acme_args = eval_optional_acme_args(); // Collect account information - $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id; + $acme_env = (string)$modelObj->settings->environment; + $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id . "_${acme_env}"; $account_conf_file = $account_conf_dir . "/account.conf"; $account_key_file = $account_conf_dir . "/account.key"; $account_json_file = $account_conf_dir . "/account.json"; @@ -462,7 +463,8 @@ function run_acme_validation($certObj, $valObj, $acctObj) $modelObj = new OPNsense\AcmeClient\AcmeClient(); // Collect account information - $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id; + $acme_env = (string)$modelObj->settings->environment; + $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id . "_${acme_env}"; $account_conf_file = $account_conf_dir . "/account.conf"; // Generate certificate filenames @@ -1023,7 +1025,8 @@ function revoke_cert($certObj, $valObj, $acctObj) $acme_args = eval_optional_acme_args(); // Collect account information - $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id; + $acme_env = (string)$modelObj->settings->environment; + $account_conf_dir = "/var/etc/acme-client/accounts/" . $acctObj->id . "_${acme_env}"; $account_conf_file = $account_conf_dir . "/account.conf"; // Generate certificate filenames From ed309380ce628eb5d01d0690da696bf1894e02a1 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 12:43:52 +0200 Subject: [PATCH 3/9] security/acme-client: bump version --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index f61c388d5..b4acd2868 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 1.26 +PLUGIN_VERSION= 1.27 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh From f05a196966f570da0808841724bdd0734e4130c9 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 12:52:39 +0200 Subject: [PATCH 4/9] security/acme-client: re-add bind-tools for nsupdate support --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index b4acd2868..04fd8bb27 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -2,6 +2,6 @@ PLUGIN_NAME= acme-client PLUGIN_VERSION= 1.27 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_DEPENDS= acme.sh +PLUGIN_DEPENDS= acme.sh bind-tools .include "../../Mk/plugins.mk" From 68c4ca66e9a1416f1601cb5f99f436066f6184bb Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 12:54:15 +0200 Subject: [PATCH 5/9] security/acme-client: add lexicon for #1524 --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index 04fd8bb27..899a55ebd 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -2,6 +2,6 @@ PLUGIN_NAME= acme-client PLUGIN_VERSION= 1.27 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_DEPENDS= acme.sh bind-tools +PLUGIN_DEPENDS= acme.sh bind-tools py-dns-lexicon${PLUGIN_PYTHON} .include "../../Mk/plugins.mk" From 507f117e6323ee824eb76fa43f137e835afe0072 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 13:08:02 +0200 Subject: [PATCH 6/9] security/acme-client: bind-tools is already a acme.sh dependency --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index 899a55ebd..b8cc8ae0c 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -2,6 +2,6 @@ PLUGIN_NAME= acme-client PLUGIN_VERSION= 1.27 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_DEPENDS= acme.sh bind-tools py-dns-lexicon${PLUGIN_PYTHON} +PLUGIN_DEPENDS= acme.sh py-dns-lexicon${PLUGIN_PYTHON} .include "../../Mk/plugins.mk" From 50eabc759cb73c0c5bf8ad2c2294497b015d063a Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 11 Oct 2019 22:23:35 +0200 Subject: [PATCH 7/9] security/acme-client: fix plugin dependencies Co-Authored-By: Franco Fichtner --- security/acme-client/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index b8cc8ae0c..0ed3b7948 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -2,6 +2,6 @@ PLUGIN_NAME= acme-client PLUGIN_VERSION= 1.27 PLUGIN_COMMENT= Let's Encrypt client PLUGIN_MAINTAINER= opnsense@moov.de -PLUGIN_DEPENDS= acme.sh py-dns-lexicon${PLUGIN_PYTHON} +PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon .include "../../Mk/plugins.mk" From 6b7ffffb4d58573a719cc25b7735d3144c561ee4 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 20 Oct 2019 20:40:30 +0200 Subject: [PATCH 8/9] security/acme-client: file should have a trailing newline --- .../mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php index e54006abd..23687a345 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php @@ -77,7 +77,7 @@ class M1_6_0 extends BaseModelMigration } // Write changes back to file - file_put_contents($account_file, implode("\r\n", $new_account_conf)); + file_put_contents($account_file, implode("\r\n", $new_account_conf) . "\n"); chmod($account_file, 0600); // Finally, rename account directory From 16dfaed33047dda0965e81823bc0edb87c804eb0 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 20 Oct 2019 20:51:31 +0200 Subject: [PATCH 9/9] security/acme-client: style fix, use string concatenation --- .../mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php index 23687a345..c712cb51a 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php @@ -42,7 +42,7 @@ class M1_6_0 extends BaseModelMigration // Search accounts foreach ($model->getNodeByReference('accounts.account')->iterateItems() as $account) { $account_id = (string)$account->id; - $account_dir = "${dir}${account_id}"; + $account_dir = $dir . $account_id; $new_account_dir = "${dir}${account_id}_${env}"; // Check if account directory exists