From 296382b5f541f903e41fecfae8cde0d25d8adadc Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sat, 27 Jul 2024 22:18:27 +0200 Subject: [PATCH 1/6] security/acme-client: fix missing log entries in GUI --- security/acme-client/pkg-descr | 3 +++ .../src/opnsense/mvc/app/views/OPNsense/AcmeClient/logs.volt | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index fc19354bf..433586dc6 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,9 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +Fixed: +* fix empty System Log + 4.4 Fixed: diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/logs.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/logs.volt index 78f1d5e6f..debf4ef22 100644 --- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/logs.volt +++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/logs.volt @@ -1,4 +1,5 @@ {# + # Copyright (c) 2024 Frank Wall # Copyright (c) 2019 Deciso B.V. # All rights reserved. # @@ -37,7 +38,7 @@ rowCount:[20,50,100,200,500,1000,-1], requestHandler: function(request){ // Show only log entries that match 'AcmeClient' - request['searchPhrase'] = 'AcmeClient'; + request['searchPhrase'] = 'acmeclient'; return request; }, }, From c44b1e47aa8220aaf5df05af77c6ef7e71a63573 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sat, 27 Jul 2024 22:18:46 +0200 Subject: [PATCH 2/6] security/acme-client: bump version --- security/acme-client/Makefile | 2 +- security/acme-client/pkg-descr | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index d4b6e46e6..bf86a1de3 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= acme-client -PLUGIN_VERSION= 4.4 +PLUGIN_VERSION= 4.5 PLUGIN_COMMENT= ACME Client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 433586dc6..026be3a67 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -8,6 +8,8 @@ WWW: https://github.com/acmesh-official/acme.sh Plugin Changelog ================ +4.5 + Fixed: * fix empty System Log From 7ce10697f2edd59b4f773edc2b2fc6af347f869e Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sat, 27 Jul 2024 22:38:25 +0200 Subject: [PATCH 3/6] security/acme-client: adjust HAProxy related logging, fixes #3860 --- security/acme-client/pkg-descr | 1 + .../AcmeClient/Api/SettingsController.php | 28 +++++++++---------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 026be3a67..f9eafa908 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -12,6 +12,7 @@ Plugin Changelog Fixed: * fix empty System Log +* avoid unnecessary error log messages (#3860) 4.4 diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/SettingsController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/SettingsController.php index f631fb8bb..695239e5b 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/SettingsController.php +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/SettingsController.php @@ -134,12 +134,6 @@ class SettingsController extends ApiMutableModelControllerBase if ($this->request->isPost()) { $mdlAcme = $this->getModel(); - // Check if the required plugin is installed - if ((string)$mdlAcme->isPluginInstalled('haproxy') != "1") { - $this->getLogger()->error("AcmeClient: HAProxy plugin is NOT installed, skipping integration"); - return($result); - } - // Setup only if AcmeClient and HAProxy integration is enabled. // NOTE: We provide HAProxy integration no matter if the HAProxy plugin // is actually enabled or not. This should avoid confusion. @@ -147,6 +141,12 @@ class SettingsController extends ApiMutableModelControllerBase (string)$mdlAcme->settings->haproxyIntegration == "1" and (string)$mdlAcme->settings->enabled == "1" ) { + // Check if the required plugin is installed + if ((string)$mdlAcme->isPluginInstalled('haproxy') != "1") { + $this->getLogger()->error("AcmeClient: HAProxy plugin is NOT installed, skipping integration"); + return($result); + } + $mdlHAProxy = new \OPNsense\HAProxy\HAProxy(); $backend = new Backend(); @@ -209,7 +209,7 @@ class SettingsController extends ApiMutableModelControllerBase // Check if HAProxy integration is already complete. if ($integration_found and $integration_complete) { - $this->getLogger()->error("AcmeClient: HAProxy integration is complete"); + $this->getLogger()->notice("AcmeClient: HAProxy integration is complete"); } else { $integration_changes = true; /** @@ -226,25 +226,25 @@ class SettingsController extends ApiMutableModelControllerBase // Remove obsolete backend item if (!empty($backend_ref)) { if ($mdlHAProxy->backends->backend->del($backend_ref)) { - $this->getLogger()->error("AcmeClient: HAProxy integration: deleted obsolete backend item"); + $this->getLogger()->info("AcmeClient: HAProxy integration: deleted obsolete backend item"); } } // Remove obsolete server item if (!empty($server_ref)) { if ($mdlHAProxy->servers->server->del($server_ref)) { - $this->getLogger()->error("AcmeClient: HAProxy integration: deleted obsolete server item"); + $this->getLogger()->info("AcmeClient: HAProxy integration: deleted obsolete server item"); } } // Remove obsolete action item if (!empty($action_ref)) { if ($mdlHAProxy->actions->action->del($action_ref)) { - $this->getLogger()->error("AcmeClient: HAProxy integration: deleted obsolete action item"); + $this->getLogger()->info("AcmeClient: HAProxy integration: deleted obsolete action item"); } } // Remove obsolete ACL item if (!empty($acl_ref)) { if ($mdlHAProxy->acls->acl->del($acl_ref)) { - $this->getLogger()->error("AcmeClient: HAProxy integration: deleted obsolete ACL item"); + $this->getLogger()->info("AcmeClient: HAProxy integration: deleted obsolete ACL item"); } } // TODO: Remove obsolete ACL link from frontends @@ -253,7 +253,7 @@ class SettingsController extends ApiMutableModelControllerBase // will be overwritten later anyway. $result['result'] = "repaired"; } else { - $this->getLogger()->error("AcmeClient: HAProxy integration initializing"); + $this->getLogger()->info("AcmeClient: HAProxy integration initializing"); $result['result'] = "new"; } @@ -354,7 +354,7 @@ class SettingsController extends ApiMutableModelControllerBase } // Add modified list of linked Actions to frontend. $frontend->linkedActions = $_actions; - $this->getLogger()->error("AcmeClient: HAProxy integration: updating frontend {$_frontend}"); + $this->getLogger()->info("AcmeClient: HAProxy integration: updating frontend {$_frontend}"); // We need to write changes to config. $integration_changes = true; } @@ -365,7 +365,7 @@ class SettingsController extends ApiMutableModelControllerBase // Changes made to configuration? if ($integration_changes === true) { - $this->getLogger()->error("AcmeClient: HAProxy integration: saving updated configuration"); + $this->getLogger()->info("AcmeClient: HAProxy integration: saving updated configuration"); // Save updated configuration. // Do NOT validate because the current in-memory model doesn't know about the // HAProxy items just created. From 6318a3aea13e2d4b13654d126e268222bd958ce6 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sat, 27 Jul 2024 22:47:59 +0200 Subject: [PATCH 4/6] security/acme-client: fix log severity, closes #3955 --- security/acme-client/pkg-descr | 1 + .../opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php | 2 +- .../opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index f9eafa908..1573627ff 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -13,6 +13,7 @@ Plugin Changelog Fixed: * fix empty System Log * avoid unnecessary error log messages (#3860) +* don't log errors for successful commands (#3955) 4.4 diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php index 7ff90ceda..5443f60bb 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php @@ -228,7 +228,7 @@ class LeAccount extends LeCommon $this->fixConfig(); // Update account status. - LeUtils::log_error('account registration successful for ' . $this->config->name); + LeUtils::log_debug('account registration successful for ' . $this->config->name); $this->setStatus(200); } else { LeUtils::log_debug('account already registered: ' . (string)$this->config->name, $this->debug); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php index abc57c4e5..e4ed20c78 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php @@ -209,7 +209,7 @@ class LeUtils // Get exit code $result = proc_close($proc); - log_error(sprintf("AcmeClient: The shell command returned exit code '%d': '%s'", $result, $proc_cmd)); + log_debug(sprintf("AcmeClient: The shell command returned exit code '%d': '%s'", $result, $proc_cmd)); return($result); } else { log_error(sprintf("AcmeClient: Unable to prepare shell command '%s'", $proc_cmd)); From 1d5bb7781db65dcd25dd74949492bd3bd36ec696 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sat, 27 Jul 2024 23:18:50 +0200 Subject: [PATCH 5/6] security/acme-client: fix more PHP deprecation messages, closes #4008 --- security/acme-client/pkg-descr | 1 + .../AcmeClient/Api/AccountsController.php | 2 +- .../AcmeClient/Api/CertificatesController.php | 10 ++++----- .../library/OPNsense/AcmeClient/LeAccount.php | 4 ++-- .../AcmeClient/LeAutomationFactory.php | 6 ++--- .../OPNsense/AcmeClient/LeCertificate.php | 12 +++++----- .../library/OPNsense/AcmeClient/LeCommon.php | 8 +++---- .../library/OPNsense/AcmeClient/LeUtils.php | 6 ++--- .../OPNsense/AcmeClient/LeValidation/Base.php | 4 ++-- .../AcmeClient/LeValidation/DnsGcloud.php | 18 +++++++-------- .../AcmeClient/LeValidation/DnsNsupdate.php | 4 ++-- .../AcmeClient/LeValidation/DnsTransip.php | 2 +- .../AcmeClient/LeValidation/HttpOpnsense.php | 22 +++++++++---------- .../AcmeClient/LeValidation/TlsalpnAcme.php | 22 +++++++++---------- .../AcmeClient/LeValidationFactory.php | 6 ++--- 15 files changed, 64 insertions(+), 63 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index 1573627ff..fe4be7ab6 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -14,6 +14,7 @@ Fixed: * fix empty System Log * avoid unnecessary error log messages (#3860) * don't log errors for successful commands (#3955) +* fix more PHP deprecation messages (#4008) 4.4 diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/AccountsController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/AccountsController.php index 922850399..120e7cd9c 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/AccountsController.php +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/AccountsController.php @@ -92,7 +92,7 @@ class AccountsController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('accounts.account.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient register-account ${uuid}"); + $response = $backend->configdRun("acmeclient register-account {$uuid}"); return array("response" => $response); } } diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php index e72baa630..b76adefd7 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/CertificatesController.php @@ -104,7 +104,7 @@ class CertificatesController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient sign-cert ${uuid}"); + $response = $backend->configdRun("acmeclient sign-cert {$uuid}"); return array("response" => $response); } } @@ -125,7 +125,7 @@ class CertificatesController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient remove-key ${uuid}"); + $response = $backend->configdRun("acmeclient remove-key {$uuid}"); } } return $result; @@ -146,7 +146,7 @@ class CertificatesController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient revoke-cert ${uuid}"); + $response = $backend->configdRun("acmeclient revoke-cert {$uuid}"); return array("response" => $response); } } @@ -167,7 +167,7 @@ class CertificatesController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient run-automation ${uuid}"); + $response = $backend->configdRun("acmeclient run-automation {$uuid}"); } } return $result; @@ -186,7 +186,7 @@ class CertificatesController extends ApiMutableModelControllerBase $node = $mdlAcme->getNodeByReference('certificates.certificate.' . $uuid); if ($node != null) { $backend = new Backend(); - $response = $backend->configdRun("acmeclient import ${uuid}"); + $response = $backend->configdRun("acmeclient import {$uuid}"); } } return $result; diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php index 5443f60bb..682c2ed7f 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php @@ -131,7 +131,7 @@ class LeAccount extends LeCommon // Read account key file $account_key_content = @file_get_contents($account_key_file); if (empty($account_key_content) || ($account_key_content == false)) { - LeUtils::log_error("unable to read account key from file ${account_key_file}"); + LeUtils::log_error("unable to read account key from file {$account_key_file}"); $this->setStatus(500); return false; } @@ -257,7 +257,7 @@ class LeAccount extends LeCommon // Convert array back to ini file format $new_account_conf = array(); foreach ($account_conf as $key => $value) { - $new_account_conf[] = "${key}='${value}'"; + $new_account_conf[] = "{$key}='{$value}'"; } // Write changes back to file diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationFactory.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationFactory.php index 044b5d840..ec068df48 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationFactory.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationFactory.php @@ -1,7 +1,7 @@ getNodeByReference(self::CONFIG_PATH . '.' . $uuid); if ($obj == null) { - LeUtils::log_error("automation not found: ${uuid}"); + LeUtils::log_error("automation not found: {$uuid}"); return null; } @@ -75,7 +75,7 @@ class LeAutomationFactory } } - LeUtils::log_error("automation not supported: " . (string)$obj->type . " (${uuid})"); + LeUtils::log_error("automation not supported: " . (string)$obj->type . " ({$uuid})"); return null; } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php index 0b319d34b..9df9e8808 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php @@ -130,7 +130,7 @@ class LeCertificate extends LeCommon clearstatcache(); // don't let the cache fool us foreach (array($this->cert_file, $this->cert_key_file, $this->cert_chain_file, $this->cert_fullchain_file) as $file) { if (!is_file($file)) { - LeUtils::log_error("unable to import certificate " . $this->config->name . ", file not found: ${file}"); + LeUtils::log_error("unable to import certificate " . $this->config->name . ", file not found: {$file}"); Config::getInstance()->unlock(); return false; } @@ -191,7 +191,7 @@ class LeCertificate extends LeCommon } } else { // Create new CA - LeUtils::log("importing ACME CA: ${ca_cn}"); + LeUtils::log("importing ACME CA: {$ca_cn}"); $newca = Config::getInstance()->object()->addChild('ca'); foreach (array_keys($ca) as $cacfg) { $newca->addChild($cacfg, (string)$ca[$cacfg]); @@ -288,7 +288,7 @@ class LeCertificate extends LeCommon $newcert->addChild($certcfg, (string)$cert[$certcfg]); } } - LeUtils::log("${import_log_message} ACME X.509 certificate: ${cert_cn}"); + LeUtils::log("{$import_log_message} ACME X.509 certificate: {$cert_cn}"); /** * Step 3: update configuration @@ -361,7 +361,7 @@ class LeCertificate extends LeCommon LeUtils::log('auto renewal is disabled for certificate: ' . (string)$this->config->name); return false; } - LeUtils::log("${acme_action} certificate: " . (string)$this->config->name); + LeUtils::log("{$acme_action} certificate: " . (string)$this->config->name); LeUtils::log('using CA: ' . $this->ca); // Ensure that account is registered. @@ -375,7 +375,7 @@ class LeCertificate extends LeCommon $configdir = (string)sprintf(self::ACME_CONFIG_DIR, (string)$this->config->id); foreach (array($certdir, $keydir, $configdir) as $dir) { if (!is_dir($dir)) { - LeUtils::log_debug("creating directory: ${dir}", $this->debug); + LeUtils::log_debug("creating directory: {$dir}", $this->debug); mkdir($dir, 0700, true); } } @@ -606,7 +606,7 @@ class LeCertificate extends LeCommon $automation->run(); } } else { - LeUtils::log_error("ignoring invalid automation: ${auto_uuid}"); + LeUtils::log_error("ignoring invalid automation: {$auto_uuid}"); } } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php index d224cf9fa..7f60fe066 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php @@ -125,9 +125,9 @@ abstract class LeCommon { // Get config object $model = new \OPNsense\AcmeClient\AcmeClient(); - $obj = $model->getNodeByReference("${path}.${uuid}"); + $obj = $model->getNodeByReference("{$path}.{$uuid}"); if ($obj == null) { - LeUtils::log_error("config of type ${path} not found: ${uuid}"); + LeUtils::log_error("config of type {$path} not found: {$uuid}"); return false; } // Store config objects @@ -153,9 +153,9 @@ abstract class LeCommon { // Get account config object $model = new \OPNsense\AcmeClient\AcmeClient(); - $obj = $model->getNodeByReference("accounts.account.${uuid}"); + $obj = $model->getNodeByReference("accounts.account.{$uuid}"); if (empty($obj) || $obj == null) { - LeUtils::log_error("unable to set CA, account not found: ${uuid}"); + LeUtils::log_error("unable to set CA, account not found: {$uuid}"); return false; } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php index e4ed20c78..90db37293 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php @@ -155,7 +155,7 @@ class LeUtils */ public static function log($msg) { - syslog(LOG_NOTICE, "AcmeClient: ${msg}"); + syslog(LOG_NOTICE, "AcmeClient: {$msg}"); } /** @@ -164,7 +164,7 @@ class LeUtils public static function log_debug($msg, bool $debug = false) { if ($debug) { - syslog(LOG_NOTICE, "AcmeClient: ${msg}"); + syslog(LOG_NOTICE, "AcmeClient: {$msg}"); } } @@ -173,7 +173,7 @@ class LeUtils */ public static function log_error($msg) { - syslog(LOG_ERR, "AcmeClient: ${msg}"); + syslog(LOG_ERR, "AcmeClient: {$msg}"); } /** diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php index 03e229f01..b28effbb6 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php @@ -58,7 +58,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon // Get account object to query ID $account = new LeAccount($accountuuid); if (empty($account) || $account == null) { - LeUtils::log_error("unable to load account information: ${accountuuid}"); + LeUtils::log_error("unable to load account information: {$accountuuid}"); return false; } @@ -164,7 +164,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon // will never change. $acmecmd = self::ACME_CMD . ' ' - . "--${acme_action} " + . "--{$acme_action} " . implode(' ', $this->acme_args) . ' ' . LeUtils::execSafe('--accountconf %s', $account_conf_file); LeUtils::log_debug('running acme.sh command: ' . (string)$acmecmd, $this->debug); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsGcloud.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsGcloud.php index 5b3f35ce1..e22558eed 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsGcloud.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsGcloud.php @@ -1,7 +1,7 @@ config->id); - $gcloud_config = "acme-${val_id}"; - $gcloud_key_file = '/tmp/acme_' . (string)$this->config->dns_service . "_${val_id}.json"; + $gcloud_config = "acme-{$val_id}"; + $gcloud_key_file = '/tmp/acme_' . (string)$this->config->dns_service . "_{$val_id}.json"; file_put_contents($gcloud_key_file, (string)$this->config->dns_gcloud_key); chmod($gcloud_key_file, 0600); $proc_env['CLOUDSDK_PYTHON'] = '/usr/local/bin/python3'; @@ -75,11 +75,11 @@ class DnsGcloud extends Base implements LeValidationInterface $proc_env['CLOUDSDK_CORE_PROJECT'] = $gcloud_project; // Ensure that a working gcloud config exists. - LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations create ${gcloud_config}", $proc_env); - LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations activate ${gcloud_config}", $proc_env); - LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet auth activate-service-account --key-file=${gcloud_key_file}", $proc_env); - LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set account ${gcloud_account}", $proc_env); - LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set project ${gcloud_project}", $proc_env); + LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations create {$gcloud_config}", $proc_env); + LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config configurations activate {$gcloud_config}", $proc_env); + LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet auth activate-service-account --key-file={$gcloud_key_file}", $proc_env); + LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set account {$gcloud_account}", $proc_env); + LeUtils::run_shell_command("/usr/local/bin/gcloud --quiet config set project {$gcloud_project}", $proc_env); // Save config for acme client. $this->acme_env['CLOUDSDK_PYTHON'] = '/usr/local/bin/python3'; diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNsupdate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNsupdate.php index 4d6f349d5..999276751 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNsupdate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsNsupdate.php @@ -1,7 +1,7 @@ cert_id); - $secret_key_filename = "${configdir}/secret.key"; + $secret_key_filename = "{$configdir}/secret.key"; $secret_key_data = (string)$this->config->dns_nsupdate_key . "\n"; file_put_contents($secret_key_filename, $secret_key_data); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsTransip.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsTransip.php index 5811202e5..4d9dc3b5f 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsTransip.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsTransip.php @@ -40,7 +40,7 @@ class DnsTransip extends Base implements LeValidationInterface public function prepare() { $configdir = (string)sprintf(self::ACME_CONFIG_DIR, $this->cert_id); - $secret_key_filename = "${configdir}/secret.key"; + $secret_key_filename = "{$configdir}/secret.key"; $secret_key_data = (string)$this->config->dns_transip_key . "\n"; file_put_contents($secret_key_filename, $secret_key_data); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php index 7c133f44b..81838ffdd 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php @@ -1,7 +1,7 @@ cert_name; foreach ($dnslist as $fqdn) { // NOTE: This may take some time. - $ip_found = gethostbyname("${fqdn}."); + $ip_found = gethostbyname("{$fqdn}."); if (!empty($ip_found)) { $iplist[] = (string)$ip_found; } @@ -96,16 +96,16 @@ class HttpOpnsense extends Base implements LeValidationInterface // IPv4 $_dst = '127.0.0.1'; $_family = 'inet'; - LeUtils::log("using IPv4 address: ${ip}"); + LeUtils::log("using IPv4 address: {$ip}"); } elseif (($_ipv6_enabled == true) && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) { // IPv6 $_dst = '::1'; $_family = 'inet6'; - LeUtils::log("using IPv6 address: ${ip}"); + LeUtils::log("using IPv6 address: {$ip}"); } else { continue; // skip broken entries } - $anchor_rules .= "rdr pass ${_family} proto tcp from any to ${ip} port 80 -> ${_dst} port ${local_http_port}\n"; + $anchor_rules .= "rdr pass {$_family} proto tcp from any to {$ip} port 80 -> {$_dst} port {$local_http_port}\n"; } } else { LeUtils::log_error("no IP addresses found to setup port forward"); @@ -120,12 +120,12 @@ class HttpOpnsense extends Base implements LeValidationInterface // Create temporary port forward to allow acme challenges to get through $anchor_setup = "rdr-anchor \"acme-client\"\n"; - file_put_contents("${configdir}/acme_anchor_setup", $anchor_setup); - chmod("${configdir}/acme_anchor_setup", 0600); - mwexec("/sbin/pfctl -f ${configdir}/acme_anchor_setup"); - file_put_contents("${configdir}/acme_anchor_rules", $anchor_rules); - chmod("${configdir}/acme_anchor_rules", 0600); - mwexec("/sbin/pfctl -a acme-client -f ${configdir}/acme_anchor_rules"); + file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup); + chmod("{$configdir}/acme_anchor_setup", 0600); + mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup"); + file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules); + chmod("{$configdir}/acme_anchor_rules", 0600); + mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules"); } public function cleanup() diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php index d0fbbfd9c..9904e5d31 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php @@ -1,7 +1,7 @@ cert_name; foreach ($dnslist as $fqdn) { // NOTE: This may take some time. - $ip_found = gethostbyname("${fqdn}."); + $ip_found = gethostbyname("{$fqdn}."); if (!empty($ip_found)) { $iplist[] = (string)$ip_found; } @@ -97,16 +97,16 @@ class TlsalpnAcme extends Base implements LeValidationInterface // IPv4 $_dst = '127.0.0.1'; $_family = 'inet'; - LeUtils::log("using IPv4 address: ${ip}"); + LeUtils::log("using IPv4 address: {$ip}"); } elseif (($_ipv6_enabled == true) && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) { // IPv6 $_dst = '::1'; $_family = 'inet6'; - LeUtils::log("using IPv6 address: ${ip}"); + LeUtils::log("using IPv6 address: {$ip}"); } else { continue; // skip broken entries } - $anchor_rules .= "rdr pass ${_family} proto tcp from any to ${ip} port 443 -> ${_dst} port ${local_tls_port}\n"; + $anchor_rules .= "rdr pass {$_family} proto tcp from any to {$ip} port 443 -> {$_dst} port {$local_tls_port}\n"; } } else { LeUtils::log_error("no IP addresses found to setup port forward"); @@ -121,12 +121,12 @@ class TlsalpnAcme extends Base implements LeValidationInterface // Create temporary port forward to allow acme challenges to get through $anchor_setup = "rdr-anchor \"acme-client\"\n"; - file_put_contents("${configdir}/acme_anchor_setup", $anchor_setup); - chmod("${configdir}/acme_anchor_setup", 0600); - mwexec("/sbin/pfctl -f ${configdir}/acme_anchor_setup"); - file_put_contents("${configdir}/acme_anchor_rules", $anchor_rules); - chmod("${configdir}/acme_anchor_rules", 0600); - mwexec("/sbin/pfctl -a acme-client -f ${configdir}/acme_anchor_rules"); + file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup); + chmod("{$configdir}/acme_anchor_setup", 0600); + mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup"); + file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules); + chmod("{$configdir}/acme_anchor_rules", 0600); + mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules"); } public function cleanup() diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidationFactory.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidationFactory.php index 06e8be49b..ea12db6fa 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidationFactory.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidationFactory.php @@ -1,7 +1,7 @@ getNodeByReference(self::CONFIG_PATH . '.' . $uuid); if ($obj == null) { - LeUtils::log_error("challenge type not found: ${uuid}"); + LeUtils::log_error("challenge type not found: {$uuid}"); return null; } @@ -87,7 +87,7 @@ class LeValidationFactory } } } - LeUtils::log_error("challenge type not supported: " . (string)$search_name . " (${uuid})"); + LeUtils::log_error("challenge type not supported: " . (string)$search_name . " ({$uuid})"); return null; } } From f60f835ccabbca108dfed0c2f040bd5d181731c0 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 28 Jul 2024 14:02:00 +0200 Subject: [PATCH 6/6] security/acme-client: fix PHP error; don't hide useful messages --- .../mvc/app/library/OPNsense/AcmeClient/LeAccount.php | 2 +- .../opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php index 682c2ed7f..e643696f2 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php @@ -228,7 +228,7 @@ class LeAccount extends LeCommon $this->fixConfig(); // Update account status. - LeUtils::log_debug('account registration successful for ' . $this->config->name); + LeUtils::log('account registration successful for ' . $this->config->name); $this->setStatus(200); } else { LeUtils::log_debug('account already registered: ' . (string)$this->config->name, $this->debug); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php index 90db37293..7514ed656 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php @@ -209,10 +209,10 @@ class LeUtils // Get exit code $result = proc_close($proc); - log_debug(sprintf("AcmeClient: The shell command returned exit code '%d': '%s'", $result, $proc_cmd)); + self::log(sprintf("AcmeClient: The shell command returned exit code '%d': '%s'", $result, $proc_cmd)); return($result); } else { - log_error(sprintf("AcmeClient: Unable to prepare shell command '%s'", $proc_cmd)); + self::log_error(sprintf("AcmeClient: Unable to prepare shell command '%s'", $proc_cmd)); return(-999); } }