Merge pull request #2565 from fraenki/acme_330

security/acme-client: release 3.3

security/acme-client/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		3.2
+PLUGIN_VERSION=		3.3
 PLUGIN_COMMENT=		ACME Client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh py${PLUGIN_PYTHON}-dns-lexicon

security/acme-client/pkg-descr

@@ -8,6 +8,18 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+3.3
+
+Added:
+* add support for custom ACME CAs (#2529)
+* add support for Porkbun API (#2561)
+
+Fixed:
+* fix ACME Client reset (#2562)
+
+Changed:
+* change default Challenge Type from HTTP-01 to DNS-01
+
 3.2
 
 Added:

security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml

@@ -33,9 +33,14 @@
         <type>dropdown</type>
         <help><![CDATA[The ACME CA that should be used for this account and all associated certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
     </field>
+    <field>
+        <label>CA Options</label>
+        <type>header</type>
+        <style>ca_options ca_options_custom</style>
+    </field>
     <field>
         <id>account.custom_ca</id>
-        <label>Custom ACME CA URL</label>
+        <label>Custom CA URL</label>
         <type>text</type>
         <help><![CDATA[The HTTPS URL of the custom ACME CA that should be used for this account and all associated certificates. If using your own CA, make sure the Root CA is added to OPNsense's trust store. For example: https://acme-v02.api.letsencrypt.org/directory or https://ca.internal/acme/directory]]></help>
     </field>

security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml

@@ -1338,4 +1338,19 @@
         <label>Key</label>
         <type>text</type>
     </field>
+    <field>
+        <label>Porkbun API</label>
+        <type>header</type>
+        <style>table_dns table_dns_porkbun</style>
+    </field>
+    <field>
+        <id>validation.dns_porkbun_key</id>
+        <label>API Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_porkbun_secret</id>
+        <label>Secret API Key</label>
+        <type>password</type>
+    </field>
 </form>

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPorkbun.php

@@ -0,0 +1,45 @@
+<?php
+
+/*
+ * Copyright (C) 2021 Frank Wall
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Porkbun API
+ * @package OPNsense\AcmeClient
+ */
+class DnsPorkbun extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['PORKBUN_API_KEY'] = (string)$this->config->dns_porkbun_key;
+        $this->acme_env['PORKBUN_SECRET_API_KEY'] = (string)$this->config->dns_porkbun_secret;
+    }
+}

security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml

@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>3.0.0</version>
+    <version>3.1.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
@@ -152,7 +152,7 @@
                 <custom_ca type="TextField">
                     <Required>N</Required>
                     <mask>/^https?:\/\/.*[^\/]$/</mask>
-                    <ValidationMessage>The url must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
+                    <ValidationMessage>The URL must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
                 </custom_ca>
                 <eab_kid type="TextField">
                     <Required>N</Required>
@@ -335,7 +335,7 @@
                 </description>
                 <method type="OptionField">
                     <Required>Y</Required>
-                    <default>http01</default>
+                    <default>dns01</default>
                     <OptionValues>
                         <http01>HTTP-01</http01>
                         <dns01>DNS-01</dns01>
@@ -386,7 +386,7 @@
                 </http_haproxyFrontends>
                 <dns_service type="OptionField">
                     <Required>Y</Required>
-                    <default>dns_nsupdate</default>
+                    <default>dns_freedns</default>
                     <OptionValues>
                         <dns_1984hosting>1984Hosting API</dns_1984hosting>
                         <dns_acmedns>ACME DNS API</dns_acmedns>
@@ -454,6 +454,7 @@
                         <dns_ovh>OVH, kimsufi, soyoustart and runabove API</dns_ovh>
                         <dns_pdns>PowerDNS.com API</dns_pdns>
                         <dns_pleskxml>Plesk XML API</dns_pleskxml>
+                        <dns_porkbun>Porkbun API</dns_porkbun>
                         <dns_schlundtech>SchlundTech</dns_schlundtech>
                         <dns_selectel>selectel.com / selectel.ru domain API</dns_selectel>
                         <dns_servercow>Servercow API v1</dns_servercow>
@@ -884,6 +885,12 @@
                 <dns_pdns_token type="TextField">
                     <Required>N</Required>
                 </dns_pdns_token>
+                <dns_porkbun_key type="TextField">
+                    <Required>N</Required>
+                </dns_porkbun_key>
+                <dns_porkbun_secret type="TextField">
+                    <Required>N</Required>
+                </dns_porkbun_secret>
                 <dns_sl_key type="TextField">
                     <Required>N</Required>
                 </dns_sl_key>

security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt

@@ -317,6 +317,16 @@ POSSIBILITY OF SUCH DAMAGE.
 
         });
 
+        // hook into on-show event for dialog to extend layout.
+        $('#DialogAccount').on('shown.bs.modal', function (e) {
+            // hide options that are irrelevant for the selected CA
+            $("#account\\.ca").change(function(){
+                $(".ca_options").hide();
+                $(".ca_options_"+$(this).val()).show();
+            });
+            $("#account\\.ca").change();
+        })
+
     });
 
 </script>