proxmox-acme.git
11 months agobump version to 1.4.0
Thomas Lamprecht [Fri, 8 Oct 2021 09:17:02 +0000 (11:17 +0200)]
bump version to 1.4.0

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
11 months agoupdate acme.sh plugins to 3.0.1 and include new plugins in schema
Thomas Lamprecht [Fri, 8 Oct 2021 09:03:58 +0000 (11:03 +0200)]
update acme.sh plugins to 3.0.1 and include new plugins in schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
11 months agosupport downloading alternate chains
Fabian Grünbichler [Fri, 8 Oct 2021 08:18:21 +0000 (10:18 +0200)]
support downloading alternate chains

the current default chains end with an expired root certificate for
maximum compatibility with old Android versions. this breaks some other
older clients (openssl, gnutls) which don't expect chains to contain any
expired certificates, even if they are 'above' the trust anchor.

by setting $root, it is possible to specify which root the ACME provided
certificate chain should end with, downloading alternate chains as
necessary.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Reviewed-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Tested-by: Stoiko Ivanov <s.ivanov@proxmox.com>
12 months agoAdd DNS challenge schema for nsupdate.
Jens Meißner [Mon, 13 Sep 2021 13:57:49 +0000 (15:57 +0200)]
Add DNS challenge schema for nsupdate.

Signed-off-by: Jens Meißner <meissner@b1-systems.de>
13 months agobump version to 1.3.0
Fabian Grünbichler [Wed, 11 Aug 2021 10:26:39 +0000 (12:26 +0200)]
bump version to 1.3.0

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
13 months agoplugin-caller: pull in changes from upstream 3.0.0
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:29 +0000 (17:44 +0200)]
plugin-caller: pull in changes from upstream 3.0.0

Commits ae3dda0f8fc3071495cd1e8dff0fe4a339febb1c and
d70b759cb9c5b413cce92e65e841a54a65813962

implementing retrying get and post requests seem worth pulling in.

From a quick look through the diff the remaining changes (between
2.9.0 and 3.0.0) should not be relevant for us

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
13 months agoupdate to acme.sh dns plugins to 3.0.0
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:28 +0000 (17:44 +0200)]
update to acme.sh dns plugins to 3.0.0

fixes #3546

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
13 months agoacme client: fix #3536 untaint data returned from acme server
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:27 +0000 (17:44 +0200)]
acme client: fix #3536 untaint data returned from acme server

The data returned from the acme server (e.g. boulder) should be
considered tainted.

To see which places might need untainted I checked where $self->{ua}
was used (in $self->do) and a quick scan identified __get_result as
the consumer of the tainted data.
In all but one uses the data is decoded from json (which would die if the
result is not valid json).

The remaining use-case yields a certificate in PEM format (and is
handled at the caller of __get_result).

The issue is currently only visible if a proxy is set, because AFAICT
somewhere in SSLeay (or IO::Socket::SSL, which uses SSLeay) a taint
flag is not set on the return value.

A reproducer for the issue:
```

use strict;
use warnings;

use HTTP::Request;
use LWP::UserAgent;

$ENV{PATH} = "/usr/bin:/bin";

my $ua = LWP::UserAgent->new(env_proxy => 0);
my $request = HTTP::Request->new('GET', 'https://google.com/');
my $resp = $ua->request($request);
my $text = substr($resp->decoded_content, 0, 5);;
system("echo \"$text\""); # does work
$request = HTTP::Request->new('GET', 'http://neverssl.com/');
$resp = $ua->request($request);
$text = substr($resp->decoded_content, 0, 5);;
system("echo \"$text\""); # does not work
```

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
14 months agobump version to 1.2.0
Thomas Lamprecht [Fri, 16 Jul 2021 16:06:24 +0000 (18:06 +0200)]
bump version to 1.2.0

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
14 months agoupdate to acme.sh dns plugins to 2.9.0
Thomas Lamprecht [Fri, 16 Jul 2021 16:03:37 +0000 (18:03 +0200)]
update to acme.sh dns plugins to 2.9.0

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
14 months agoplugin-caller: make no-ops always successful
Stoiko Ivanov [Fri, 16 Jul 2021 13:43:05 +0000 (15:43 +0200)]
plugin-caller: make no-ops always successful

proxmox-acme is used to call the dns-plugins from acme.sh and has the
config editing (saving/clearing) turned int no-ops.

bash's `return` statement w/o argument returns the value of the last
executed command (the one before our no-op method was called) (see
`help return` in bash).
This leads to unexpected behavior in some plugins, which call one of
the methods as last statement join the next step with `&&`.

tested bash behavior with:
```
foo() { return; }; if [ -z 'x' ]; then :; else foo ; fi; echo $?
```

reported in our community-forum:
https://forum.proxmox.com/threads/pmg-acme-dns-with-cyon-failing-to-issue-certificate.92762

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
14 months agoplugin-caller: add missing methods from acme.sh
Stoiko Ivanov [Thu, 15 Jul 2021 13:56:57 +0000 (15:56 +0200)]
plugin-caller: add missing methods from acme.sh

As reported in our community forum [0] certain dns plugins use code
from `acme.sh`, which is currently not in our proxmox-acme.

I initially only added _sign and it's callees, but then though about
trying to get all missing methods somehow (only resethttp() was
missing in addition).

The heuristic used to get all missing methods was grepping for '\b_'
in all dns plugins and then removing:
* declarations in proxmox_acme (already present)
* methods declared in the plugins themselves
* $_.* (or ${_.*) - variable use
* comments

in shell:
```
present=$(awk 'BEGIN{ORS="|";} /^_/{ gsub(/\(\) {/, ""); print $0}' \
  src/proxmox-acme | | sed -r 's/\|$//')
local=$(awk 'BEGIN{ORS="|";} /^_/{ gsub(/\(\) {/, ""); print $0}' \
  src/acme.sh/dnsapi/dns*.sh | sed -r 's/\|$//')
grep '\b_' src/acme.sh/dnsapi/* | grep -Ev \
  "$present|$local|_[a-zA-Z0-9_-]+=|\\$\{?_|^src/acme.sh/dnsapi/.*sh:#"
```

[0] https://forum.proxmox.com/threads/proxmox-acme-with-transip-plugin-_sign-command-not-found.92582/

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
14 months agobump version to 1.1.1
Thomas Lamprecht [Mon, 5 Jul 2021 16:58:34 +0000 (18:58 +0200)]
bump version to 1.1.1

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
15 months agofix #3390: standalone: explicitly bind to '::'
Stoiko Ivanov [Wed, 12 May 2021 19:04:52 +0000 (21:04 +0200)]
fix #3390: standalone: explicitly bind to '::'

This patch follows 2f8be3bfda203065b22e60862e5f98d831a46921 from
pve-common:
Instead of not specifying a listen address, we first try to bind on
'::', which usually accepts connections for both ipv4 and ipv6,
and fall back to '0.0.0.0' if this fails (if ipv6 is disabled via
kernel commandline).

The arguments are the same for HTTP::Daemon as for IO::Socket::IP,
since the former has IO::Socket::IP as base.

Additionally, by setting 'V6Only' explicitly to '0', the listening
socket will also accept ipv4 connections, even if the sysctl
'net.ipv6.bindv6only' is set to 1 - the sysctl provides a default
value, which can be overridden by a socket-option (see ipv6(7) -
IPV6_ONLY).

setting this option results in the following setsockopt-call being
added:
setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4) = 0

AFAICT the socket option is available and overridable on Linux > 2.4
see [0] for an explanation of why this might not be wanted

Overriding the default setting set by an admin might be debateable,
but considering that the http-listener for the ACME challenge is
rather short-lived I think this is justified. The only other option
would be to create 2 listening sockets and binding on both - which
would mean reorganizing our perl-deamons to deal with multiple listen
sockets.

quickly tested on a publicly reachable test-machine of mine with:
* ipv6.domain.test (only AAAA record)
* ip46.domain.test (both AAAA and A)
* ipv4.domain.test (only A record)
with:
* sysctl net.ipv6.bindv6only=1 (for all 3 domains)
* disabling ipv6 via kernel-commandline (only ipv4 tested)
* disabling ipv6 via sysctl (only ipv4 tested)
* only configuring an ipv6 address (only ipv6 tested)

[0] https://man.openbsd.org/inet6.4
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
15 months agobuildsys: change upload dist to bullseye
Thomas Lamprecht [Tue, 8 Jun 2021 08:29:08 +0000 (10:29 +0200)]
buildsys: change upload dist to bullseye

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agobump version to 1.1.0
Thomas Lamprecht [Wed, 5 May 2021 07:57:46 +0000 (09:57 +0200)]
bump version to 1.1.0

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agod/control: fix descriptions
Thomas Lamprecht [Wed, 5 May 2021 08:47:42 +0000 (10:47 +0200)]
d/control: fix descriptions

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agosplit into two packages: a perl one and an acme.sh plugin one
Thomas Lamprecht [Wed, 5 May 2021 07:49:17 +0000 (09:49 +0200)]
split into two packages: a perl one and an acme.sh plugin one

Main reason for this split is PBS, which only needs the plugins and
would like to avoid the perl one (which pulls in pve-common too)

This includes a few small changes which are technically not direct
part of the split, but related enough:
* change source name of package from libproxmox-acme-perl to
  libproxmox-acme
* make lintian override for script exec permission narrower to avoid
  possible false negatives in the future, really only allow the
  dnsapi ones.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agomove DNS plugin schema to separate JSON based file
Thomas Lamprecht [Wed, 5 May 2021 12:07:35 +0000 (14:07 +0200)]
move DNS plugin schema to separate JSON based file

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agobuildsys: actually install new plugins
Thomas Lamprecht [Wed, 5 May 2021 12:32:05 +0000 (14:32 +0200)]
buildsys: actually install new plugins

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agodns challenge: add world4you schema
Lorenz Stechauner [Wed, 5 May 2021 08:26:42 +0000 (10:26 +0200)]
dns challenge: add world4you schema

Signed-off-by: Lorenz Stechauner <l.stechauner@proxmox.com>
16 months agoupdate acme.sh plugins to 2.8.9 and include new plugins in schema
Thomas Lamprecht [Wed, 5 May 2021 07:54:36 +0000 (09:54 +0200)]
update acme.sh plugins to 2.8.9 and include new plugins in schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
16 months agodebian: set source format correctly
Thomas Lamprecht [Wed, 5 May 2021 07:53:49 +0000 (09:53 +0200)]
debian: set source format correctly

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
18 months agobump version to 1.0.8
Thomas Lamprecht [Tue, 16 Mar 2021 16:11:51 +0000 (17:11 +0100)]
bump version to 1.0.8

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
18 months agodns: add new plugins to schema and install them
Thomas Lamprecht [Tue, 16 Mar 2021 16:04:35 +0000 (17:04 +0100)]
dns: add new plugins to schema and install them

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
18 months agoupdate acme.sh to current master
Thomas Lamprecht [Tue, 16 Mar 2021 15:56:54 +0000 (16:56 +0100)]
update acme.sh to current master

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
18 months agoadd missing 'use PVE::Acme' statement
Wolfgang Bumiller [Tue, 9 Mar 2021 14:13:54 +0000 (15:13 +0100)]
add missing 'use PVE::Acme' statement

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
21 months agobump version to 1.0.7
Thomas Lamprecht [Fri, 11 Dec 2020 17:55:33 +0000 (18:55 +0100)]
bump version to 1.0.7

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agoacme: define kapper.net and acme-dns schema
Thomas Lamprecht [Fri, 11 Dec 2020 18:10:13 +0000 (19:10 +0100)]
acme: define kapper.net and acme-dns schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agobuildsys: ensure new plugins also get installed
Thomas Lamprecht [Fri, 11 Dec 2020 17:54:11 +0000 (18:54 +0100)]
buildsys: ensure new plugins also get installed

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agoadd basic test so schema is in sync with available plugins
Thomas Lamprecht [Fri, 11 Dec 2020 17:50:22 +0000 (18:50 +0100)]
add basic test so schema is in sync with available plugins

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agodns challenge: add missing plugins to schema
Thomas Lamprecht [Fri, 11 Dec 2020 17:43:16 +0000 (18:43 +0100)]
dns challenge: add missing plugins to schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agobump version to 1.0.6
Thomas Lamprecht [Mon, 7 Dec 2020 10:59:17 +0000 (11:59 +0100)]
bump version to 1.0.6

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
21 months agoupdate acme.sh to 2.8.8
Thomas Lamprecht [Mon, 7 Dec 2020 10:53:57 +0000 (11:53 +0100)]
update acme.sh to 2.8.8

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.5
Fabian Grünbichler [Fri, 4 Sep 2020 12:01:17 +0000 (14:01 +0200)]
bump version to 1.0.5

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agofix #2732: use actual plugin config data
Thomas Lamprecht [Sat, 23 May 2020 22:24:44 +0000 (00:24 +0200)]
fix #2732: use actual plugin config data

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns challenge: add 'INWX' acme.sh schema
Thomas Lamprecht [Sat, 23 May 2020 21:55:35 +0000 (23:55 +0200)]
dns challenge: add 'INWX' acme.sh schema

https://bugzilla.proxmox.com/show_bug.cgi?id=2731

Requested-by: Claas Hilbrecht <Claas.Hilbrecht@linum.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.4
Thomas Lamprecht [Fri, 15 May 2020 18:07:01 +0000 (20:07 +0200)]
bump version to 1.0.4

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns challenge: describe digitalocean schema
Thomas Lamprecht [Fri, 15 May 2020 18:03:29 +0000 (20:03 +0200)]
dns challenge: describe digitalocean schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns challenge: add df (dyndnsfree.de) provider
Thomas Lamprecht [Fri, 15 May 2020 18:03:01 +0000 (20:03 +0200)]
dns challenge: add df (dyndnsfree.de) provider

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agoupdate acme.sh dns plugins to 2.8.6
Thomas Lamprecht [Fri, 15 May 2020 17:57:20 +0000 (19:57 +0200)]
update acme.sh dns plugins to 2.8.6

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agomake clean: clean more
Thomas Lamprecht [Fri, 15 May 2020 17:53:19 +0000 (19:53 +0200)]
make clean: clean more

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.3
Thomas Lamprecht [Thu, 7 May 2020 19:50:00 +0000 (21:50 +0200)]
bump version to 1.0.3

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns challenge: provide schema for more providers
Thomas Lamprecht [Thu, 7 May 2020 18:39:56 +0000 (20:39 +0200)]
dns challenge: provide schema for more providers

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agotrigger activate-noawait pve-api-updates
Thomas Lamprecht [Thu, 7 May 2020 15:29:35 +0000 (17:29 +0200)]
trigger activate-noawait pve-api-updates

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.2
Thomas Lamprecht [Tue, 5 May 2020 17:19:49 +0000 (19:19 +0200)]
bump version to 1.0.2

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns schema: move fields one level deeper
Thomas Lamprecht [Tue, 5 May 2020 17:18:58 +0000 (19:18 +0200)]
dns schema: move fields one level deeper

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agodns: complete OVH schema
Thomas Lamprecht [Tue, 5 May 2020 16:34:33 +0000 (18:34 +0200)]
dns: complete OVH schema

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agoadd note that the data has to be base64 encoded
Dominik Csapak [Tue, 5 May 2020 12:38:12 +0000 (14:38 +0200)]
add note that the data has to be base64 encoded

but only via api, on the cli it is a file which contains
the data in plaintext

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2 years agoDNSChallenge: make plugins a hash with an optional schema
Dominik Csapak [Tue, 5 May 2020 12:38:11 +0000 (14:38 +0200)]
DNSChallenge: make plugins a hash with an optional schema

so that we can use that schema to generate form fields in the gui

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2 years agoplugin id: limit to 'pve-configid' format
Thomas Lamprecht [Mon, 4 May 2020 12:54:24 +0000 (14:54 +0200)]
plugin id: limit to 'pve-configid' format

Else one can pass almost arbitrary data as ID and break editing or
deletion of a plugin.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.1
Thomas Lamprecht [Sun, 3 May 2020 16:06:01 +0000 (18:06 +0200)]
bump version to 1.0.1

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agoDNS Challenge: add validation-delay plugin option
Thomas Lamprecht [Sun, 3 May 2020 16:05:29 +0000 (18:05 +0200)]
DNS Challenge: add validation-delay plugin option

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agouse smart-relative gitmodule path
Thomas Lamprecht [Sun, 3 May 2020 15:17:39 +0000 (17:17 +0200)]
use smart-relative gitmodule path

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.0
Thomas Lamprecht [Sun, 3 May 2020 15:07:44 +0000 (17:07 +0200)]
bump version to 1.0.0

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agouse native source format, fix lintian complaints
Thomas Lamprecht [Sun, 3 May 2020 15:05:29 +0000 (17:05 +0200)]
use native source format, fix lintian complaints

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobuildsys: move submodule to src, cleanups
Thomas Lamprecht [Sun, 3 May 2020 15:00:46 +0000 (17:00 +0200)]
buildsys: move submodule to src, cleanups

it's nicer as the build system is more coherent, i.e., I can do `make
install` from inside src and it actually works ;)

Use an atomic target for the build directory, else we can easily get
bogus builds.

Further use only one type of GNU make variable flavors, not both $()
and ${} mixed..

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobuildsys: sort and cleanup
Thomas Lamprecht [Sun, 3 May 2020 14:49:26 +0000 (16:49 +0200)]
buildsys: sort and cleanup

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agoallow to get full DNS plugins list
Thomas Lamprecht [Sun, 3 May 2020 14:47:41 +0000 (16:47 +0200)]
allow to get full DNS plugins list

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agoacme: variable name cleanup
Thomas Lamprecht [Sat, 2 May 2020 16:48:07 +0000 (18:48 +0200)]
acme: variable name cleanup

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agod/control: add ${perl:Depends} and require pve-common > 6~
Thomas Lamprecht [Thu, 30 Apr 2020 10:14:41 +0000 (12:14 +0200)]
d/control: add ${perl:Depends} and require pve-common > 6~

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 years agobump version to 1.0.0-1
Fabian Grünbichler [Mon, 20 Apr 2020 08:34:23 +0000 (10:34 +0200)]
bump version to 1.0.0-1

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agod/control: add B+R libpve-common-perl
Fabian Grünbichler [Mon, 20 Apr 2020 08:05:01 +0000 (10:05 +0200)]
d/control: add B+R libpve-common-perl

since we takeover the perl modules

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agod/control: wrap-and-sort
Fabian Grünbichler [Mon, 20 Apr 2020 08:00:38 +0000 (10:00 +0200)]
d/control: wrap-and-sort

2 years agoproxmox-acme: fix readaccountconf
Fabian Grünbichler [Fri, 17 Apr 2020 13:11:05 +0000 (15:11 +0200)]
proxmox-acme: fix readaccountconf

by switching to bash and echoing the values passed in from the plugin
config.

plugins like the OVH config attempt to detect and handle changed config
by comparing set env variables and values stored in the config, leading
to confusing output otherwise.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodns plugin: improve 'data' string encoding/passing
Fabian Grünbichler [Fri, 17 Apr 2020 13:09:34 +0000 (15:09 +0200)]
dns plugin: improve 'data' string encoding/passing

encode the full multi-line string as base64 single-line string on
each config write, and decode at config parse time. pass both the data
key/value pairs and the secret txtvalue via STDIN instead of as command
line arguments.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodns plugin: reset environment
Fabian Grünbichler [Fri, 17 Apr 2020 12:42:24 +0000 (14:42 +0200)]
dns plugin: reset environment

in addition to switching to nobody:nogroup, to reduce things exposed to
the dnsapi plugins

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoplugins: remove get_subplugins
Fabian Grünbichler [Fri, 17 Apr 2020 12:31:49 +0000 (14:31 +0200)]
plugins: remove get_subplugins

it's unused, and the only plugin that has such functionality already
encodes the possible values as enum in the schema anyway..

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoplugins: unify extract_challenge
Fabian Grünbichler [Fri, 17 Apr 2020 12:27:42 +0000 (14:27 +0200)]
plugins: unify extract_challenge

we have a list of supported challenge types per plugin, so we only need
one generic implementation.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoplugins: refactor setup/teardown signatures
Fabian Grünbichler [Fri, 17 Apr 2020 07:39:50 +0000 (09:39 +0200)]
plugins: refactor setup/teardown signatures

and move handling of tokens/key_auths to plugins, since it's not bound
to be identical for all challenge types forever.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodns plugin: use non-usrmerged path for bash
Fabian Grünbichler [Thu, 16 Apr 2020 18:47:55 +0000 (20:47 +0200)]
dns plugin: use non-usrmerged path for bash

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agodns plugin: make data optional
Fabian Grünbichler [Thu, 16 Apr 2020 18:45:04 +0000 (20:45 +0200)]
dns plugin: make data optional

it might be hard-coded in a (modified) plugin, or not needed

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoprotocol: request validation with empty body
Fabian Grünbichler [Thu, 16 Apr 2020 18:10:32 +0000 (20:10 +0200)]
protocol: request validation with empty body

including the key authorization is deprecated and will be removed at
some point, might as well clean that up now to be prepared.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoconfig: always define a 'standalone' plugin instance
Fabian Grünbichler [Thu, 16 Apr 2020 18:07:33 +0000 (20:07 +0200)]
config: always define a 'standalone' plugin instance

so that consumers can fallback to it

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2 years agoImplement function to resolve all subplugins
Wolfgang Link [Wed, 8 Apr 2020 09:06:10 +0000 (11:06 +0200)]
Implement function to resolve all subplugins

This function helps to retrieve all subplugins
that are supported by the plugins.
This will later be used as an enumeration for entering parameters.

2 years agoAdd debug mode
Wolfgang Link [Tue, 31 Mar 2020 06:53:45 +0000 (08:53 +0200)]
Add debug mode

This can be used at setup time to get feedback on the DNS plugin parameters.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoAdd DNSChallenge Plugin
Wolfgang Link [Tue, 31 Mar 2020 07:01:06 +0000 (09:01 +0200)]
Add DNSChallenge Plugin

This plugin calls the custom script acme.sh and uses the implementation of the DNS API.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoUse the caller's data instead of extracting it yourself.
Wolfgang Link [Mon, 6 Apr 2020 06:35:06 +0000 (08:35 +0200)]
Use the caller's data instead of extracting it yourself.

Add the server in the data structure to return it.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoCreate the plugin config.
Wolfgang Link [Tue, 7 Apr 2020 08:40:02 +0000 (10:40 +0200)]
Create the plugin config.

At the moment, Proxmox has two different configurations that require different properties.
DNSChallange requires credentials for the DNSAPI.
Standalone has no settings because Letsencrypt only supports port 80 with the http-01 challenge.
This configuration is registered in the pve-manager.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoRefactor extract_callenge for code reuse.
Wolfgang Link [Mon, 6 Apr 2020 11:30:23 +0000 (13:30 +0200)]
Refactor extract_callenge for code reuse.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoMove code from pve-common
Wolfgang Link [Tue, 31 Mar 2020 06:39:28 +0000 (08:39 +0200)]
Move code from pve-common

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoAdd submodule acme.sh for DNS plugins
Wolfgang Link [Fri, 3 Apr 2020 11:16:19 +0000 (13:16 +0200)]
Add submodule acme.sh for DNS plugins

Copy the DNS plugins form acme.sh

The project acme.sh can be found here.
https://github.com/Neilpang/acme.sh

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoImplement feature setup and teardown functionality.
Wolfgang Link [Thu, 2 Apr 2020 12:32:11 +0000 (14:32 +0200)]
Implement feature setup and teardown functionality.

We use these functions to add and remove a txt record via the dnsapi.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoAdd funtion to set DNSAPI variable
Wolfgang Link [Mon, 6 Apr 2020 04:48:38 +0000 (06:48 +0200)]
Add funtion to set DNSAPI variable

acme.sh DNS plugins expect a configuration in which the login information
is stored.
We pass the credentials with the command.
This function supports the expected behavior of the plugins.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoRemove unnecessary Code and fixes.
Wolfgang Link [Tue, 31 Mar 2020 06:38:50 +0000 (08:38 +0200)]
Remove unnecessary Code and fixes.

This Code is not required in the Proxmox environment.
We know in our environment what we have as a tool-change.

Fix Code what does not work because variable or functions are missing.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoCopy the needed function form acme.sh
Wolfgang Link [Tue, 31 Mar 2020 06:38:22 +0000 (08:38 +0200)]
Copy the needed function form acme.sh

For the thin wrapper around acme.sh DNS plugins, the required functions are copied.
The project acme.sh can be found here.
https://github.com/Neilpang/acme.sh

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
2 years agoAdd Debian Buildsystem config
Wolfgang Link [Thu, 2 Apr 2020 12:29:16 +0000 (14:29 +0200)]
Add Debian Buildsystem config

Signed-off-by: Wolfgang Link <w.link@proxmox.com>