src/PVE/ACME/DNSChallenge.pm

   1 package PVE::ACME::DNSChallenge;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Digest::SHA qw(sha256);
   7 use JSON;
   8
   9 use PVE::Tools;
  10
  11 use PVE::ACME;
  12
  13 use base qw(PVE::ACME::Challenge);
  14
  15 my $ACME_PATH = '/usr/share/proxmox-acme/proxmox-acme';
  16
  17 sub supported_challenge_types {
  18     return ["dns-01"];
  19 }
  20
  21 sub type {
  22     return 'dns';
  23 }
  24
  25 my $DNS_API_CHALLENGE_SCHEMA_FN = '/usr/share/proxmox-acme/dns-challenge-schema.json';
  26
  27 my $plugin_cache;
  28 sub get_supported_plugins {
  29     if (!$plugin_cache) {
  30         $plugin_cache = -e $DNS_API_CHALLENGE_SCHEMA_FN # we allow this to be optional as not all users require
  31             ? from_json(PVE::Tools::file_get_contents($DNS_API_CHALLENGE_SCHEMA_FN))
  32             : {};
  33     }
  34     return $plugin_cache;
  35 }
  36
  37 sub properties {
  38     my $plugins = get_supported_plugins();
  39     return {
  40         api => {
  41             description => "API plugin name",
  42             type => 'string',
  43             enum => [sort keys %$plugins],
  44         },
  45         data => {
  46             type => 'string',
  47             description => 'DNS plugin data. (base64 encoded)',
  48         },
  49         'validation-delay' => {
  50             type => 'integer',
  51             description => 'Extra delay in seconds to wait before requesting validation.'
  52                 .' Allows to cope with a long TTL of DNS records.',
  53             # low default, but our bet is that the acme-challenge domain isn't
  54             # cached at all, so it hopefully shouldn't run into TTL issues
  55             default => 30,
  56             optional => 1,
  57             minimum => 0,
  58             maximum => 2 * 24 * 60 * 60,
  59         },
  60         'use-proxy' => {
  61             description => "Flag indicating whether a http proxy should be used.",
  62             type => 'boolean',
  63             optional => 1,
  64         },
  65     };
  66 }
  67
  68 sub options {
  69     return {
  70         api => {},
  71         data => { optional => 1 },
  72         nodes => { optional => 1 },
  73         disable => { optional => 1 },
  74         'validation-delay' => { optional => 1 },
  75         'use-proxy' => { optional => 1 },
  76     };
  77 }
  78
  79 my $proxmox_acme_command = sub {
  80     my ($self, $acme, $auth, $data, $action) = @_;
  81
  82     die "No plugin data for DNSChallenge\n" if !defined($data->{plugin});
  83
  84     my $alias = $data->{alias};
  85     my $domain = $auth->{identifier}->{value};
  86
  87     my $challenge = $self->extract_challenge($auth->{challenges});
  88     my $key_auth = $acme->key_authorization($challenge->{token});
  89
  90     my $txtvalue = PVE::ACME::encode(sha256($key_auth));
  91     my $dnsplugin = $data->{plugin}->{api};
  92     my $plugin_conf_string = $data->{plugin}->{data};
  93     my $proxy = $data->{plugin}->{proxy};
  94
  95     # for security reasons, we execute the command as nobody
  96     # we can't verify that the code of the DNSPlugins are harmless.
  97     my $cmd = ["setpriv", "--reuid", "nobody", "--regid", "nogroup", "--clear-groups", "--reset-env", "--"];
  98
  99     # The order of the parameters passed to proxmox-acme is important
 100     # proxmox-acme <setup|teardown> $plugin <$domain|$alias> $txtvalue [$plugin_conf_string]
 101     push @$cmd, "/bin/bash", $ACME_PATH, $action, $dnsplugin;
 102     if ($alias) {
 103         push @$cmd, $alias;
 104     } else {
 105         push @$cmd, $domain;
 106     }
 107     my $input = "$txtvalue\n";
 108     $input .= "$plugin_conf_string\n" if $plugin_conf_string;
 109     $input .= "https_proxy=$proxy\nhttp_proxy=$proxy\n" if $proxy;
 110
 111     PVE::Tools::run_command($cmd, input => $input);
 112
 113     $data->{url} = $challenge->{url};
 114
 115     return $domain;
 116 };
 117
 118 sub setup {
 119     my ($self, $acme, $auth, $data) = @_;
 120
 121     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'setup');
 122     print "Add TXT record: _acme-challenge.$domain\n";
 123
 124     my $delay = $data->{plugin}->{'validation-delay'} // 30;
 125     if ($delay > 0) {
 126         print "Sleeping $delay seconds to wait for TXT record propagation\n";
 127         sleep($delay); # don't care for EINTR
 128     }
 129 }
 130
 131 sub teardown {
 132     my ($self, $acme, $auth, $data) = @_;
 133
 134     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'teardown');
 135     print "Remove TXT record: _acme-challenge.$domain\n";
 136 }
 137
 138 1;