From fd42c211a69a3a46114d5f3fbfc2d727b0a92ad5 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 9 Mar 2017 17:27:23 +0100 Subject: [PATCH] security/acme-client: log acme status for each cert --- .../OPNsense/AcmeClient/certificates.volt | 6 ++-- .../OPNsense/AcmeClient/certhelper.php | 35 +++++++++++++++++++ 2 files changed, 39 insertions(+), 2 deletions(-) diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt index f806c2225..ae895b92d 100644 --- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt +++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt @@ -91,9 +91,11 @@ POSSIBILITY OF SUCH DAMAGE. } else if (row.statusCode == "200") { return "OK"; } else if (row.statusCode == "250") { - return "OK (renewed)"; + return "cert revoked"; + } else if (row.statusCode == "300") { + return "configuration error"; } else if (row.statusCode == "400") { - return "failed"; + return "validation failed"; } else if (row.statusCode == "500") { return "internal error"; } else { diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php index 225ab4f66..058004bd4 100755 --- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php +++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php @@ -158,6 +158,7 @@ function cert_action_validator($opt_cert_id) } else { //echo "DEBUG: account registration failed\n"; log_error("AcmeClient: account registration failed"); + log_cert_acme_status($certObj, $modelObj, '400'); if (isset($options["A"])) { continue; // skip to next item } @@ -166,6 +167,7 @@ function cert_action_validator($opt_cert_id) } else { //echo "DEBUG: account not found\n"; log_error("AcmeClient: account not found"); + log_cert_acme_status($certObj, $modelObj, '300'); if (isset($options["A"])) { continue; // skip to next item } @@ -193,10 +195,12 @@ function cert_action_validator($opt_cert_id) // Start acme client to revoke the certificate $rev_result = revoke_cert($certObj, $valObj, $acctObj); if (!$rev_result) { + log_cert_acme_status($certObj, $modelObj, '250'); return(0); // Success! } else { // Revocation failure log_error("AcmeClient: revocation for certificate failed"); + log_cert_acme_status($certObj, $modelObj, '400'); if (isset($options["A"])) { continue; // skip to next item } @@ -215,8 +219,10 @@ function cert_action_validator($opt_cert_id) //echo "DEBUG: cert import done\n"; // Prepare certificate for restart action $restart_certs[] = $certObj; + log_cert_acme_status($certObj, $modelObj, '200'); } else { log_error("AcmeClient: unable to import certificate: " . (string)$certObj->name); + log_cert_acme_status($certObj, $modelObj, '500'); if (isset($options["A"])) { continue; // skip to next item } @@ -227,6 +233,7 @@ function cert_action_validator($opt_cert_id) } else { // validation failure log_error("AcmeClient: validation for certificate failed: " . (string)$certObj->name); + log_cert_acme_status($certObj, $modelObj, '400'); if (isset($options["A"])) { continue; // skip to next item } @@ -234,6 +241,7 @@ function cert_action_validator($opt_cert_id) } } else { log_error("AcmeClient: invalid validation method specified: " . (string)$valObj->method); + log_cert_acme_status($certObj, $modelObj, '300'); if (isset($options["A"])) { continue; // skip to next item } @@ -241,6 +249,7 @@ function cert_action_validator($opt_cert_id) } } else { log_error("AcmeClient: validation method not found for cert " . $certObj->name); + log_cert_acme_status($certObj, $modelObj, '300'); if (isset($options["A"])) { continue; // skip to next item } @@ -1010,6 +1019,32 @@ function run_restart_actions($certlist, $modelObj) return($return); } +/* Update certificate object to log the status of the current acme run. + * Supported status codes are: + * 100 pending + * 200 issue/renew OK + * 250 certificate revoked + * 300 configuration error (validation method, account, ...) + * 400 issue/renew failed + * 500 internal error (code issues, bad luck, unexpected errors, ...) + * Feel free to add more status codes to make it more useful. +*/ +function log_cert_acme_status($certObj, $modelObj, $statusCode) +{ + $uuid = $certObj->attributes()->uuid; + $node = $modelObj->getNodeByReference('certificates.certificate.' . $uuid); + if ($node != null) { + $node->statusCode = $statusCode; + $node->statusLastUpdate = time(); + // serialize to config and save + $modelObj->serializeToConfig(); + Config::getInstance()->save(); + } else { + log_error("AcmeClient: unable to update acme status for certificate " . (string)$certObj->name); + return(1); + } +} + // taken from certs.inc function local_cert_get_subject_array($str_crt, $decode = true) {