proxmox-mirrors/proxmox
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox synced 2025-08-08 05:35:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

acme-api: use product-config instead of custom acme api configuration

Browse Source 
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
This commit is contained in:
Dietmar Maurer 2024-05-17 11:52:57 +02:00
parent 0ffe40fcfa
commit 7c899090e4
8 changed files with 608 additions and 649 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
proxmox-acme-api/Cargo.toml
View File

@ -32,12 +32,15 @@ proxmox-router = { workspace = true, optional = true }
proxmox-sys = { workspace = true, optional = true }
proxmox-schema = { workspace = true, features = ["api-macro", "api-types"] }
proxmox-acme = { workspace = true, optional = true, features = ["api-types"] }
proxmox-product-config = { workspace = true, optional = true }
[features]
default = ["api-types"]
api-types = ["dep:proxmox-acme", "dep:proxmox-serde"]
impl = [
"api-types",
"dep:proxmox-product-config",
"proxmox-product-config?/impl",
"dep:proxmox-acme",
"proxmox-acme?/impl",
"proxmox-acme?/async-client",

34
proxmox-acme-api/src/account_api_impl.rs
View File

@ -11,9 +11,9 @@ use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_rest_server::WorkerTask;
use proxmox_sys::task_warn;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
use crate::config::{AcmeApiConfig, DEFAULT_ACME_DIRECTORY_ENTRY};
use crate::account_config::AccountData;
use crate::config::DEFAULT_ACME_DIRECTORY_ENTRY;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
fn account_contact_from_string(s: &str) -> Vec<String> {
s.split(&[' ', ';', ',', '\0'][..])
@ -21,21 +21,17 @@ fn account_contact_from_string(s: &str) -> Vec<String> {
.collect()
}
impl AcmeApiConfig {
pub fn list_accounts(&self) -> Result<Vec<AccountEntry>, Error> {
pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
let mut entries = Vec::new();
self.foreach_acme_account(|name| {
super::account_config::foreach_acme_account(|name| {
entries.push(AccountEntry { name });
ControlFlow::Continue(())
})?;
Ok(entries)
}
pub async fn get_account(
&self,
account_name: AcmeAccountName,
) -> Result<AccountInfo, Error> {
let account_data = self.load_account_config(&account_name).await?;
pub async fn get_account(account_name: AcmeAccountName) -> Result<AccountInfo, Error> {
let account_data = super::account_config::load_account_config(&account_name).await?;
Ok(AccountInfo {
location: account_data.location.clone(),
tos: account_data.tos.clone(),
@ -47,7 +43,7 @@ impl AcmeApiConfig {
})
}
pub async fn get_tos(&self, directory: Option<String>) -> Result<Option<String>, Error> {
pub async fn get_tos(directory: Option<String>) -> Result<Option<String>, Error> {
let directory = directory.unwrap_or_else(|| DEFAULT_ACME_DIRECTORY_ENTRY.url.to_string());
Ok(AcmeClient::new(directory)
.terms_of_service_url()
@ -56,7 +52,6 @@ impl AcmeApiConfig {
}
pub async fn register_account(
&self,
name: &AcmeAccountName,
contact: String,
tos_url: Option<String>,
@ -72,18 +67,17 @@ impl AcmeApiConfig {
let account = AccountData::from_account_dir_tos(account, directory_url, tos_url);
self.create_account_config(&name, &account)?;
super::account_config::create_account_config(&name, &account)?;
Ok(account.location)
}
pub async fn deactivate_account(
&self,
worker: &WorkerTask,
name: &AcmeAccountName,
force: bool,
) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?;
let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client();
match client
@ -92,7 +86,7 @@ impl AcmeApiConfig {
{
Ok(account) => {
account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?;
super::account_config::save_account_config(&name, &account_data)?;
}
Err(err) if !force => return Err(err),
Err(err) => {
@ -105,17 +99,16 @@ impl AcmeApiConfig {
}
}
self.mark_account_deactivated(&name)?;
super::account_config::mark_account_deactivated(&name)?;
Ok(())
}
pub async fn update_account(
&self,
name: &AcmeAccountName,
contact: Option<String>,
) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?;
let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client();
let data = match contact {
@ -127,8 +120,7 @@ impl AcmeApiConfig {
let account = client.update_account(&data).await?;
account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?;
super::account_config::save_account_config(&name, &account_data)?;
Ok(())
}
}

60
proxmox-acme-api/src/account_config.rs
View File

@ -1,9 +1,9 @@
//! ACME account configuration helpers (load/save config)
use std::ops::ControlFlow;
use std::fs::OpenOptions;
use std::path::Path;
use std::ops::ControlFlow;
use std::os::unix::fs::OpenOptionsExt;
use std::path::{Path, PathBuf};
use anyhow::{bail, format_err, Error};
use serde::{Deserialize, Serialize};
@ -17,7 +17,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_acme::Account;
use crate::config::AcmeApiConfig;
use crate::types::AcmeAccountName;
#[inline]
@ -79,26 +78,25 @@ impl AccountData {
}
}
impl AcmeApiConfig {
fn acme_account_dir(&self) -> String {
format!("{}/{}", self.config_dir, "accounts")
fn acme_account_dir() -> PathBuf {
super::config::acme_config_dir().join("accounts")
}
/// Returns the path to the account configuration file (`$config_dir/accounts/$name`).
pub fn account_cfg_filename(&self, name: &str) -> String {
format!("{}/{}", self.acme_account_dir(), name)
pub fn account_cfg_filename(name: &str) -> PathBuf {
acme_account_dir().join(name)
}
fn make_acme_account_dir(&self) -> nix::Result<()> {
self.make_acme_dir()?;
Self::create_acme_subdir(&self.acme_account_dir())
fn make_acme_account_dir() -> nix::Result<()> {
super::config::make_acme_dir()?;
super::config::create_secret_subdir(acme_account_dir())
}
pub(crate) fn foreach_acme_account<F>(&self, mut func: F) -> Result<(), Error>
pub(crate) fn foreach_acme_account<F>(mut func: F) -> Result<(), Error>
where
F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>,
{
match proxmox_sys::fs::scan_subdir(-1, self.acme_account_dir().as_str(), &SAFE_ID_REGEX) {
match proxmox_sys::fs::scan_subdir(-1, acme_account_dir().as_path(), &SAFE_ID_REGEX) {
Ok(files) => {
for file in files {
let file = file?;
@ -125,10 +123,10 @@ impl AcmeApiConfig {
}
// Mark account as deactivated
pub(crate) fn mark_account_deactivated(&self, account_name: &str) -> Result<(), Error> {
let from = self.account_cfg_filename(account_name);
pub(crate) fn mark_account_deactivated(account_name: &str) -> Result<(), Error> {
let from = account_cfg_filename(account_name);
for i in 0..100 {
let to = self.account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i));
let to = account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i));
if !Path::new(&to).exists() {
return std::fs::rename(&from, &to).map_err(|err| {
format_err!(
@ -143,27 +141,27 @@ impl AcmeApiConfig {
bail!(
"No free slot to rename deactivated account {:?}, please cleanup {:?}",
from,
self.acme_account_dir()
acme_account_dir()
);
}
// Load an existing ACME account by name.
pub(crate) async fn load_account_config(&self, account_name: &str) -> Result<AccountData, Error> {
let account_cfg_filename = self.account_cfg_filename(account_name);
pub(crate) async fn load_account_config(account_name: &str) -> Result<AccountData, Error> {
let account_cfg_filename = account_cfg_filename(account_name);
let data = match tokio::fs::read(&account_cfg_filename).await {
Ok(data) => data,
Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
bail!("acme account '{}' does not exist", account_name)
}
Err(err) => bail!(
"failed to load acme account from '{}' - {}",
"failed to load acme account from {:?} - {}",
account_cfg_filename,
err
),
};
let data: AccountData = serde_json::from_slice(&data).map_err(|err| {
format_err!(
"failed to parse acme account from '{}' - {}",
"failed to parse acme account from {:?} - {}",
account_cfg_filename,
err
)
@ -174,19 +172,24 @@ impl AcmeApiConfig {
// Save an new ACME account (fails if the file already exists).
pub(crate) fn create_account_config(
&self,
account_name: &AcmeAccountName,
account: &AccountData,
) -> Result<(), Error> {
self.make_acme_account_dir()?;
make_acme_account_dir()?;
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref());
let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let file = OpenOptions::new()
.write(true)
.create_new(true)
.mode(0o600)
.open(&account_cfg_filename)
.map_err(|err| format_err!("failed to open {:?} for writing: {}", account_cfg_filename, err))?;
.map_err(|err| {
format_err!(
"failed to open {:?} for writing: {}",
account_cfg_filename,
err
)
})?;
serde_json::to_writer_pretty(file, account).map_err(|err| {
format_err!(
@ -201,11 +204,10 @@ impl AcmeApiConfig {
// Save ACME account data (overtwrite existing data).
pub(crate) fn save_account_config(
&self,
account_name: &AcmeAccountName,
account: &AccountData,
) -> Result<(), Error> {
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref());
let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let mut data = Vec::<u8>::new();
serde_json::to_writer_pretty(&mut data, account).map_err(|err| {
@ -216,7 +218,8 @@ impl AcmeApiConfig {
)
})?;
self.make_acme_account_dir()?;
make_acme_account_dir()?;
replace_file(
account_cfg_filename,
&data,
@ -227,4 +230,3 @@ impl AcmeApiConfig {
true,
)
}
}

16
proxmox-acme-api/src/certificate_helpers.rs
View File

@ -7,7 +7,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_rest_server::WorkerTask;
use proxmox_sys::{task_log, task_warn};
use crate::config::AcmeApiConfig;
use crate::types::{AcmeConfig, AcmeDomain};
pub struct OrderedCertificate {
@ -15,9 +14,7 @@ pub struct OrderedCertificate {
pub private_key_pem: Vec<u8>,
}
impl AcmeApiConfig {
pub async fn order_certificate(
&self,
worker: Arc<WorkerTask>,
acme_config: AcmeConfig,
domains: Vec<AcmeDomain>,
@ -40,9 +37,11 @@ impl AcmeApiConfig {
return Ok(None);
}
let mut acme = self.load_account_config(&acme_config.account).await?.client();
let mut acme = super::account_config::load_account_config(&acme_config.account)
.await?
.client();
let (plugins, _) = self.plugin_config()?;
let (plugins, _) = super::plugin_config::plugin_config()?;
task_log!(worker, "Placing ACME order");
@ -77,8 +76,8 @@ impl AcmeApiConfig {
task_log!(worker, "The validation for {} is pending", domain);
let domain_config: &AcmeDomain = get_domain_config(&domain)?;
let plugin_id = domain_config.plugin.as_deref().unwrap_or("standalone");
let mut plugin_cfg = crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)?
.ok_or_else(|| {
let mut plugin_cfg =
crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)?.ok_or_else(|| {
format_err!("plugin '{}' for domain '{}' not found!", plugin_id, domain)
})?;
@ -87,7 +86,7 @@ impl AcmeApiConfig {
.setup(&mut acme, &auth, domain_config, Arc::clone(&worker))
.await?;
let result = Self::request_validation(&worker, &mut acme, auth_url, validation_url).await;
let result = request_validation(&worker, &mut acme, auth_url, validation_url).await;
if let Err(err) = plugin_cfg
.teardown(&mut acme, &auth, domain_config, Arc::clone(&worker))
@ -203,4 +202,3 @@ impl AcmeApiConfig {
}
}
}
}

41
proxmox-acme-api/src/config.rs
View File

@ -1,26 +1,15 @@
//! ACME API Configuration.
use std::borrow::Cow;
use std::path::{Path, PathBuf};
use proxmox_sys::error::SysError;
use proxmox_sys::fs::CreateOptions;
use proxmox_product_config::product_config;
use crate::types::KnownAcmeDirectory;
/// ACME API Configuration.
///
/// This struct provides access to the server side configuration, like the
/// configuration directory. All ACME API functions are implemented as member
/// fuction, so they all have access to this configuration.
///
pub struct AcmeApiConfig {
/// Path to the ACME configuration directory.
pub config_dir: &'static str,
/// Configuration file owner.
pub file_owner: fn() -> nix::unistd::User,
}
/// List of known ACME directorties.
pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
KnownAcmeDirectory {
@ -36,20 +25,19 @@ pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
/// Default ACME directorties.
pub const DEFAULT_ACME_DIRECTORY_ENTRY: &KnownAcmeDirectory = &KNOWN_ACME_DIRECTORIES[0];
// local helpers to read/write acme configuration
impl AcmeApiConfig {
pub(crate) fn acme_config_dir(&self) -> &'static str {
self.config_dir
pub(crate) fn acme_config_dir() -> PathBuf {
product_config().absolute_path("acme")
}
pub(crate) fn plugin_cfg_filename(&self) -> String {
format!("{}/plugins.cfg", self.acme_config_dir())
}
pub(crate) fn plugin_cfg_lockfile(&self) -> String {
format!("{}/.plugins.lck", self.acme_config_dir())
pub(crate) fn plugin_cfg_filename() -> PathBuf {
acme_config_dir().join("plugins.cfg")
}
pub(crate) fn create_acme_subdir(dir: &str) -> nix::Result<()> {
pub(crate) fn plugin_cfg_lockfile() -> PathBuf {
acme_config_dir().join("plugins.lck")
}
pub(crate) fn create_secret_subdir<P: AsRef<Path>>(dir: P) -> nix::Result<()> {
let root_only = CreateOptions::new()
.owner(nix::unistd::ROOT)
.group(nix::unistd::Gid::from_raw(0))
@ -62,7 +50,6 @@ impl AcmeApiConfig {
}
}
pub(crate) fn make_acme_dir(&self) -> nix::Result<()> {
Self::create_acme_subdir(&self.acme_config_dir())
}
pub(crate) fn make_acme_dir() -> nix::Result<()> {
create_secret_subdir(acme_config_dir())
}

26
proxmox-acme-api/src/lib.rs
View File

@ -4,25 +4,37 @@
pub mod types;
#[cfg(feature = "impl")]
pub mod challenge_schemas;
mod config;
#[cfg(feature = "impl")]
pub mod config;
mod challenge_schemas;
#[cfg(feature = "impl")]
pub use challenge_schemas::get_cached_challenge_schemas;
#[cfg(feature = "impl")]
pub(crate) mod account_config;
mod account_config;
#[cfg(feature = "impl")]
pub(crate) mod plugin_config;
mod plugin_config;
#[cfg(feature = "impl")]
pub(crate) mod account_api_impl;
mod account_api_impl;
#[cfg(feature = "impl")]
pub use account_api_impl::{
deactivate_account, get_account, get_tos, list_accounts, register_account, update_account,
};
#[cfg(feature = "impl")]
pub(crate) mod plugin_api_impl;
mod plugin_api_impl;
#[cfg(feature = "impl")]
pub use plugin_api_impl::{add_plugin, delete_plugin, get_plugin, list_plugins, update_plugin};
#[cfg(feature = "impl")]
pub(crate) mod acme_plugin;
#[cfg(feature = "impl")]
pub(crate) mod certificate_helpers;
mod certificate_helpers;
#[cfg(feature = "impl")]
pub use certificate_helpers::order_certificate;

45
proxmox-acme-api/src/plugin_api_impl.rs
View File

@ -8,17 +8,14 @@ use serde_json::Value;
use proxmox_schema::param_bail;
use crate::config::AcmeApiConfig;
use crate::types::{DeletablePluginProperty, PluginConfig, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater};
use crate::types::{
DeletablePluginProperty, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater, PluginConfig,
};
use proxmox_router::{http_bail, RpcEnvironment};
impl AcmeApiConfig {
pub fn list_plugins(
&self,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<PluginConfig>, Error> {
let (plugins, digest) = self.plugin_config()?;
pub fn list_plugins(rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<PluginConfig>, Error> {
let (plugins, digest) = super::plugin_config::plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into();
Ok(plugins
@ -28,11 +25,10 @@ impl AcmeApiConfig {
}
pub fn get_plugin(
&self,
id: String,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<PluginConfig, Error> {
let (plugins, digest) = self.plugin_config()?;
let (plugins, digest) = super::plugin_config::plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into();
match plugins.get(&id) {
@ -41,12 +37,7 @@ impl AcmeApiConfig {
}
}
pub fn add_plugin(
&self,
r#type: String,
core: DnsPluginCore,
data: String,
) -> Result<(), Error> {
pub fn add_plugin(r#type: String, core: DnsPluginCore, data: String) -> Result<(), Error> {
// Currently we only support DNS plugins and the standalone plugin is "fixed":
if r#type != "dns" {
param_bail!("type", "invalid ACME plugin type: {:?}", r#type);
@ -57,9 +48,9 @@ impl AcmeApiConfig {
let id = core.id.clone();
let _lock = self.lock_plugin_config()?;
let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?;
let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.contains_key(&id) {
param_bail!("id", "ACME plugin ID {:?} already exists", id);
}
@ -68,13 +59,12 @@ impl AcmeApiConfig {
plugins.insert(id, r#type, plugin);
self.save_plugin_config(&plugins)?;
super::plugin_config::save_plugin_config(&plugins)?;
Ok(())
}
pub fn update_plugin(
&self,
id: String,
update: DnsPluginCoreUpdater,
data: Option<String>,
@ -89,9 +79,9 @@ impl AcmeApiConfig {
.transpose()
.map_err(|_| format_err!("data must be valid UTF-8"))?;
let _lock = self.lock_plugin_config()?;
let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, expected_digest) = self.plugin_config()?;
let (mut plugins, expected_digest) = super::plugin_config::plugin_config()?;
if let Some(digest) = digest {
let digest = <[u8; 32]>::from_hex(digest)?;
@ -138,23 +128,22 @@ impl AcmeApiConfig {
None => http_bail!(NOT_FOUND, "no such plugin"),
}
self.save_plugin_config(&plugins)?;
super::plugin_config::save_plugin_config(&plugins)?;
Ok(())
}
pub fn delete_plugin(&self, id: String) -> Result<(), Error> {
let _lock = self.lock_plugin_config()?;
pub fn delete_plugin(id: String) -> Result<(), Error> {
let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?;
let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.remove(&id).is_none() {
http_bail!(NOT_FOUND, "no such plugin");
}
self.save_plugin_config(&plugins)?;
super::plugin_config::save_plugin_config(&plugins)?;
Ok(())
}
}
// See PMG/PVE's $modify_cfg_for_api sub
fn modify_cfg_for_api(id: &str, ty: &str, data: &Value) -> PluginConfig {

52
proxmox-acme-api/src/plugin_config.rs
View File

@ -6,9 +6,9 @@ use serde_json::Value;
use proxmox_schema::{ApiType, Schema};
use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin};
use proxmox_product_config::{ApiLockGuard, open_api_lockfile, replace_config};
use crate::config::AcmeApiConfig;
use crate::types::{PLUGIN_ID_SCHEMA, DnsPlugin, StandalonePlugin};
use crate::types::{DnsPlugin, StandalonePlugin, PLUGIN_ID_SCHEMA};
lazy_static! {
static ref CONFIG: SectionConfig = init();
@ -52,31 +52,16 @@ fn init() -> SectionConfig {
config
}
// LockGuard for the plugin configuration
pub(crate) struct AcmePluginConfigLockGuard {
_file: Option<std::fs::File>,
pub(crate) fn lock_plugin_config() -> Result<ApiLockGuard, Error> {
super::config::make_acme_dir()?;
let plugin_cfg_lockfile = super::config::plugin_cfg_lockfile();
open_api_lockfile(plugin_cfg_lockfile, None, true)
}
impl AcmeApiConfig {
pub(crate) fn lock_plugin_config(&self) -> Result<AcmePluginConfigLockGuard, Error> {
self.make_acme_dir()?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0660);
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
let timeout = std::time::Duration::new(10, 0);
let plugin_cfg_lockfile = self.plugin_cfg_lockfile();
let file = proxmox_sys::fs::open_file_locked(&plugin_cfg_lockfile, timeout, true, options)?;
Ok(AcmePluginConfigLockGuard { _file: Some(file) })
}
pub(crate) fn plugin_config(&self) -> Result<(PluginData, [u8; 32]), Error> {
let plugin_cfg_filename = self.plugin_cfg_filename();
pub(crate) fn plugin_config() -> Result<(PluginData, [u8; 32]), Error> {
let plugin_cfg_filename = super::config::plugin_cfg_filename();
let content =
proxmox_sys::fs::file_read_optional_string(&plugin_cfg_filename)?.unwrap_or_default();
@ -93,21 +78,12 @@ impl AcmeApiConfig {
Ok((PluginData { data }, digest))
}
pub(crate) fn save_plugin_config(&self, config: &PluginData) -> Result<(), Error> {
self.make_acme_dir()?;
let plugin_cfg_filename = self.plugin_cfg_filename();
pub(crate) fn save_plugin_config(config: &PluginData) -> Result<(), Error> {
super::config::make_acme_dir()?;
let plugin_cfg_filename = super::config::plugin_cfg_filename();
let raw = CONFIG.write(&plugin_cfg_filename, &config.data)?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640);
// set the correct owner/group/permissions while saving file
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
proxmox_sys::fs::replace_file(plugin_cfg_filename, raw.as_bytes(), options, true)
}
replace_config(plugin_cfg_filename, raw.as_bytes())
}
pub(crate) struct PluginData {