src/PVE/ACME/DNSChallenge.pm

   1 package PVE::ACME::DNSChallenge;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Digest::SHA qw(sha256);
   7 use PVE::Tools;
   8
   9 use base qw(PVE::ACME::Challenge);
  10
  11 my $ACME_PATH = '/usr/share/proxmox-acme/proxmox-acme';
  12
  13 sub supported_challenge_types {
  14     return ["dns-01"];
  15 }
  16
  17 sub type {
  18     return 'dns';
  19 }
  20
  21 # describe the data schema of the supported plugins
  22 my $plugins = {
  23     'acmedns' => {},
  24     'acmeproxy' => {},
  25     'active24' => {},
  26     'ad' => {},
  27     'ali' => {},
  28     'autodns' => {},
  29     'aws' => {},
  30     'azure' => {},
  31     'cf' => {},
  32     'clouddns' => {},
  33     'cloudns' => {},
  34     'cn' => {},
  35     'conoha' => {},
  36     'constellix' => {},
  37     'cx' => {},
  38     'cyon' => {},
  39     'da' => {},
  40     'ddnss' => {},
  41     'desec' => {},
  42     'dgon' => {},
  43     'dnsimple' => {},
  44     'do' => {},
  45     'doapi' => {},
  46     'domeneshop' => {},
  47     'dp' => {},
  48     'dpi' => {},
  49     'dreamhost' => {},
  50     'duckdns' => {},
  51     'durabledns' => {},
  52     'dyn' => {},
  53     'dynu' => {},
  54     'dynv6' => {},
  55     'easydns' => {},
  56     'euserv' => {},
  57     'exoscale' => {},
  58     'freedns' => {},
  59     'gandi_livedns' => {},
  60     'gcloud' => {},
  61     'gd' => {},
  62     'gdnsdk' => {},
  63     'he' => {},
  64     'hexonet' => {},
  65     'hostingde' => {},
  66     'infoblox' => {},
  67     'internetbs' => {},
  68     'inwx' => {},
  69     'ispconfig' => {},
  70     'jd' => {},
  71     'kas' => {},
  72     'kinghost' => {},
  73     'knot' => {},
  74     'leaseweb' => {},
  75     'lexicon' => {},
  76     'linode' => {},
  77     'linode_v4' => {},
  78     'loopia' => {},
  79     'lua' => {},
  80     'maradns' => {},
  81     'me' => {},
  82     'miab' => {},
  83     'misaka' => {},
  84     'myapi' => {},
  85     'mydevil' => {},
  86     'mydnsjp' => {},
  87     'namecheap' => {},
  88     'namecom' => {},
  89     'namesilo' => {},
  90     'nederhost' => {},
  91     'neodigit' => {},
  92     'netcup' => {},
  93     'nic' => {},
  94     'nsd' => {},
  95     'nsone' => {},
  96     'nsupdate' => {},
  97     'nw' => {},
  98     'one' => {},
  99     'online' => {},
 100     'openprovider' => {},
 101     'opnsense' => {},
 102     'ovh' => {
 103         'OVH_END_POINT' => {
 104             description => "The OVH endpoint",
 105             type => 'string',
 106         },
 107         'OVH_AK' => {
 108             description => "The application key.",
 109             type => 'string',
 110         },
 111         'OVH_AS' => {
 112             description => "The application secret.",
 113             type => 'string',
 114         },
 115     },
 116     'pdns' => {
 117         'PDNS_Url' => {
 118             description => "The PowerDNS API endpoint.",
 119             type => 'string',
 120         },
 121         'PDNS_ServerId'=> {
 122             type => 'string',
 123         },
 124         'PDNS_Token'=> {
 125             type => 'string',
 126         },
 127         'PDNS_Ttl'=> {
 128             type => 'integer',
 129         },
 130     },
 131     'pleskxml' => {},
 132     'pointhq' => {},
 133     'rackspace' => {},
 134     'rcode0' => {},
 135     'regru' => {},
 136     'schlundtech' => {},
 137     'selectel' => {},
 138     'servercow' => {},
 139     'tele3' => {},
 140     'ultra' => {},
 141     'unoeuro' => {},
 142     'variomedia' => {},
 143     'vscale' => {},
 144     'vultr' => {},
 145     'yandex' => {},
 146     'zilore' => {},
 147     'zone' => {},
 148     'zonomi' => {},
 149 };
 150
 151 sub get_supported_plugins {
 152     return $plugins;
 153 }
 154
 155 sub properties {
 156     return {
 157         api => {
 158             description => "API plugin name",
 159             type => 'string',
 160             enum => [sort keys %$plugins],
 161         },
 162         data => {
 163             type => 'string',
 164             description => 'DNS plugin data.',
 165         },
 166         'validation-delay' => {
 167             type => 'integer',
 168             description => 'Extra delay in seconds to wait before requesting validation.'
 169                 .' Allows to cope with a long TTL of DNS records.',
 170             # low default, but our bet is that the acme-challenge domain isn't
 171             # cached at all, so it hopefully shouldn't run into TTL issues
 172             default => 30,
 173             optional => 1,
 174             minimum => 0,
 175             maximum => 2 * 24 * 60 * 60,
 176         }
 177     };
 178 }
 179
 180 sub options {
 181     return {
 182         api => {},
 183         data => { optional => 1 },
 184         nodes => { optional => 1 },
 185         disable => { optional => 1 },
 186         'validation-delay' => { optional => 1 },
 187     };
 188 }
 189
 190 my $proxmox_acme_command = sub {
 191     my ($self, $acme, $auth, $data, $action) = @_;
 192
 193     die "No plugin data for DNSChallenge\n" if !defined($data->{plugin});
 194
 195     my $alias = $data->{alias};
 196     my $domain = $auth->{identifier}->{value};
 197
 198     my $challenge = $self->extract_challenge($auth->{challenges});
 199     my $key_auth = $acme->key_authorization($challenge->{token});
 200
 201     my $txtvalue = PVE::ACME::encode(sha256($key_auth));
 202     my $dnsplugin = $data->{plugin}->{api};
 203     my $plugin_conf_string = $data->{plugin}->{data};
 204
 205     # for security reasons, we execute the command as nobody
 206     # we can't verify that the code of the DNSPlugins are harmless.
 207     my $cmd = ["setpriv", "--reuid", "nobody", "--regid", "nogroup", "--clear-groups", "--reset-env", "--"];
 208
 209     # The order of the parameters passed to proxmox-acme is important
 210     # proxmox-acme <setup|teardown> $plugin <$domain|$alias> $txtvalue [$plugin_conf_string]
 211     push @$cmd, "/bin/bash", $ACME_PATH, $action, $dnsplugin;
 212     if ($alias) {
 213         push @$cmd, $alias;
 214     } else {
 215         push @$cmd, $domain;
 216     }
 217     my $input = "$txtvalue\n";
 218     $input .= "$plugin_conf_string\n" if $plugin_conf_string;
 219
 220     PVE::Tools::run_command($cmd, input => $input);
 221
 222     $data->{url} = $challenge->{url};
 223
 224     return $domain;
 225 };
 226
 227 sub setup {
 228     my ($self, $acme, $auth, $data) = @_;
 229
 230     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'setup');
 231     print "Add TXT record: _acme-challenge.$domain\n";
 232
 233     # FIXME: probe ourself for propagation of TXT record, while not 100%
 234     # failsafe it's good enough of a heuristic to do away with fixed sleep
 235     # intervalls - original acme.sh employs that heuristic too.
 236     my $delay = $data->{'validation-delay'} // 30;
 237     if ($delay > 0) {
 238         print "Sleeping $delay seconds to wait for TXT record propagation\n";
 239         sleep($delay); # don't care for EINTR
 240     }
 241 }
 242
 243 sub teardown {
 244     my ($self, $acme, $auth, $data) = @_;
 245
 246     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'teardown');
 247     print "Remove TXT record: _acme-challenge.$domain\n";
 248 }
 249
 250 1;