From 437d4135494d3d40106de9a07dfd35e13b5fdfde Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 7 Oct 2021 00:17:11 +0200
Subject: [PATCH 1/6] security/acme-client: update changelog

---
 security/acme-client/pkg-descr | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a7dc6c18e..26febc7e6 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -8,6 +8,11 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+3.3
+
+Fixed:
+* fix ACME Client reset (#2562)
+
 3.2
 
 Added:

From 3c5efa554516848c30ecd84f0da77c9a39d9f5d0 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 7 Oct 2021 00:17:28 +0200
Subject: [PATCH 2/6] security/acme-client: bump version

---
 security/acme-client/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile
index def551fa6..59f807ac8 100644
--- a/security/acme-client/Makefile
+++ b/security/acme-client/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		acme-client
-PLUGIN_VERSION=		3.2
+PLUGIN_VERSION=		3.3
 PLUGIN_COMMENT=		ACME Client
 PLUGIN_MAINTAINER=	opnsense@moov.de
 PLUGIN_DEPENDS=		acme.sh py${PLUGIN_PYTHON}-dns-lexicon

From 35ae215ebe27df34f62dd493a709d6ded56eb014 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 7 Oct 2021 01:01:17 +0200
Subject: [PATCH 3/6] security/acme-client: hide custom CA URL field when not
 required, refs #2529

---
 .../OPNsense/AcmeClient/forms/dialogAccount.xml        |  7 ++++++-
 .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml  |  2 +-
 .../mvc/app/views/OPNsense/AcmeClient/accounts.volt    | 10 ++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
index c19bff4f8..0b9139308 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
@@ -33,9 +33,14 @@
         <type>dropdown</type>
         <help><![CDATA[The ACME CA that should be used for this account and all associated certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
     </field>
+    <field>
+        <label>CA Options</label>
+        <type>header</type>
+        <style>ca_options ca_options_custom</style>
+    </field>
     <field>
         <id>account.custom_ca</id>
-        <label>Custom ACME CA URL</label>
+        <label>Custom CA URL</label>
         <type>text</type>
         <help><![CDATA[The HTTPS URL of the custom ACME CA that should be used for this account and all associated certificates. If using your own CA, make sure the Root CA is added to OPNsense's trust store. For example: https://acme-v02.api.letsencrypt.org/directory or https://ca.internal/acme/directory]]></help>
     </field>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 0ec434d22..0ae3d6720 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -152,7 +152,7 @@
                 <custom_ca type="TextField">
                     <Required>N</Required>
                     <mask>/^https?:\/\/.*[^\/]$/</mask>
-                    <ValidationMessage>The url must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
+                    <ValidationMessage>The URL must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
                 </custom_ca>
                 <eab_kid type="TextField">
                     <Required>N</Required>
diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
index dfa7eb6cf..d9e417ebd 100644
--- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
+++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/accounts.volt
@@ -317,6 +317,16 @@ POSSIBILITY OF SUCH DAMAGE.
 
         });
 
+        // hook into on-show event for dialog to extend layout.
+        $('#DialogAccount').on('shown.bs.modal', function (e) {
+            // hide options that are irrelevant for the selected CA
+            $("#account\\.ca").change(function(){
+                $(".ca_options").hide();
+                $(".ca_options_"+$(this).val()).show();
+            });
+            $("#account\\.ca").change();
+        })
+
     });
 
 </script>

From 85997b73ebde8534d901aa3ebacc99d65a76aeb3 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 7 Oct 2021 01:02:20 +0200
Subject: [PATCH 4/6] security/acme-client: update changelog

---
 security/acme-client/pkg-descr | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 26febc7e6..bf40e15c9 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -10,6 +10,9 @@ Plugin Changelog
 
 3.3
 
+Added:
+* add support for custom ACME CAs (#2529)
+
 Fixed:
 * fix ACME Client reset (#2562)
 

From 93b33f05dc9ffd717698748151350aa4dd890696 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 10 Oct 2021 22:35:26 +0200
Subject: [PATCH 5/6] security/acme-client: add support for Porkbun API, closes
 #2561

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsPorkbun.php    | 45 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  9 +++-
 4 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPorkbun.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index bf40e15c9..7479fda31 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -12,6 +12,7 @@ Plugin Changelog
 
 Added:
 * add support for custom ACME CAs (#2529)
+* add support for Porkbun API (#2561)
 
 Fixed:
 * fix ACME Client reset (#2562)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 4faa6b778..2f8e45bd4 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1338,4 +1338,19 @@
         <label>Key</label>
         <type>text</type>
     </field>
+    <field>
+        <label>Porkbun API</label>
+        <type>header</type>
+        <style>table_dns table_dns_porkbun</style>
+    </field>
+    <field>
+        <id>validation.dns_porkbun_key</id>
+        <label>API Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_porkbun_secret</id>
+        <label>Secret API Key</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPorkbun.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPorkbun.php
new file mode 100644
index 000000000..872b85baf
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPorkbun.php
@@ -0,0 +1,45 @@
+<?php
+
+/*
+ * Copyright (C) 2021 Frank Wall
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Porkbun API
+ * @package OPNsense\AcmeClient
+ */
+class DnsPorkbun extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['PORKBUN_API_KEY'] = (string)$this->config->dns_porkbun_key;
+        $this->acme_env['PORKBUN_SECRET_API_KEY'] = (string)$this->config->dns_porkbun_secret;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 0ae3d6720..f5292f522 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>3.0.0</version>
+    <version>3.1.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
@@ -454,6 +454,7 @@
                         <dns_ovh>OVH, kimsufi, soyoustart and runabove API</dns_ovh>
                         <dns_pdns>PowerDNS.com API</dns_pdns>
                         <dns_pleskxml>Plesk XML API</dns_pleskxml>
+                        <dns_porkbun>Porkbun API</dns_porkbun>
                         <dns_schlundtech>SchlundTech</dns_schlundtech>
                         <dns_selectel>selectel.com / selectel.ru domain API</dns_selectel>
                         <dns_servercow>Servercow API v1</dns_servercow>
@@ -884,6 +885,12 @@
                 <dns_pdns_token type="TextField">
                     <Required>N</Required>
                 </dns_pdns_token>
+                <dns_porkbun_key type="TextField">
+                    <Required>N</Required>
+                </dns_porkbun_key>
+                <dns_porkbun_secret type="TextField">
+                    <Required>N</Required>
+                </dns_porkbun_secret>
                 <dns_sl_key type="TextField">
                     <Required>N</Required>
                 </dns_sl_key>

From dca4c6ea4cd4a3a4ac4b948fbbbb5c68d183814a Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 10 Oct 2021 22:40:22 +0200
Subject: [PATCH 6/6] security/acme-client: change default Challenge Type from
 HTTP-01 to DNS-01

---
 security/acme-client/pkg-descr                                | 3 +++
 .../mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml         | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 7479fda31..304aa7509 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -17,6 +17,9 @@ Added:
 Fixed:
 * fix ACME Client reset (#2562)
 
+Changed:
+* change default Challenge Type from HTTP-01 to DNS-01
+
 3.2
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index f5292f522..5bac98072 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -335,7 +335,7 @@
                 </description>
                 <method type="OptionField">
                     <Required>Y</Required>
-                    <default>http01</default>
+                    <default>dns01</default>
                     <OptionValues>
                         <http01>HTTP-01</http01>
                         <dns01>DNS-01</dns01>
@@ -386,7 +386,7 @@
                 </http_haproxyFrontends>
                 <dns_service type="OptionField">
                     <Required>Y</Required>
-                    <default>dns_nsupdate</default>
+                    <default>dns_freedns</default>
                     <OptionValues>
                         <dns_1984hosting>1984Hosting API</dns_1984hosting>
                         <dns_acmedns>ACME DNS API</dns_acmedns>