maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

LE: PSR-2 formatting

Browse Source
This commit is contained in:
Daniel Reichelt
2016-05-16 16:23:31 +02:00
parent 1d4211a5ce
commit 0ae0178b4c
2 changed files with 66 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
lib/classes/ssl/class.lescript.php
View File

@@ -62,14 +62,15 @@ class lescript
$keys = $this->generateKey(); $keys = $this->generateKey();
// Only store the accountkey in production, in staging always generate a new key // Only store the accountkey in production, in staging always generate a new key
if (Settings::Get('system.letsencryptca') == 'production') { if (Settings::Get('system.letsencryptca') == 'production') {
$upd_stmt = Database::prepare(" $upd_stmt = Database::prepare(
UPDATE `" . TABLE_PANEL_CUSTOMERS . "` SET `lepublickey` = :public, `leprivatekey` = :private WHERE `customerid` = :customerid; "UPDATE `" . TABLE_PANEL_CUSTOMERS . "` SET `lepublickey` = :public, `leprivatekey` = :private " .
"); "WHERE `customerid` = :customerid;");
Database::pexecute($upd_stmt, array( Database::pexecute($upd_stmt,
'public' => $keys['public'], array(
'private' => $keys['private'], 'public' => $keys['public'],
'customerid' => $certrow['customerid'] 'private' => $keys['private'],
)); 'customerid' => $certrow['customerid']
));
} }
$this->accountKey = $keys['private']; $this->accountKey = $keys['private'];
$this->postNewReg(); $this->postNewReg();
@@ -101,13 +102,14 @@ class lescript
$this->log("Requesting challenge for $domain"); $this->log("Requesting challenge for $domain");
$response = $this->signedRequest("/acme/new-authz", array( $response = $this->signedRequest("/acme/new-authz",
"resource" => "new-authz", array(
"identifier" => array( "resource" => "new-authz",
"type" => "dns", "identifier" => array(
"value" => $domain "type" => "dns",
) "value" => $domain
)); )
));
// if response is not an array but a string, it's most likely a server-error, e.g. // if response is not an array but a string, it's most likely a server-error, e.g.
// <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request. // <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.
@@ -121,9 +123,10 @@ class lescript
} }
// choose http-01 challenge only // choose http-01 challenge only
$challenge = array_reduce($response['challenges'], function ($v, $w) { $challenge = array_reduce($response['challenges'],
return $v ? $v : ($w['type'] == 'http-01' ? $w : false); function ($v, $w) {
}); return $v ? $v : ($w['type'] == 'http-01' ? $w : false);
});
if (! $challenge) if (! $challenge)
throw new RuntimeException("HTTP Challenge for $domain is not available. Whole response: " . json_encode($response)); throw new RuntimeException("HTTP Challenge for $domain is not available. Whole response: " . json_encode($response));
@@ -145,8 +148,7 @@ class lescript
"e" => Base64UrlSafeEncoder::encode($accountKeyDetails["rsa"]["e"]), "e" => Base64UrlSafeEncoder::encode($accountKeyDetails["rsa"]["e"]),
"kty" => "RSA", "kty" => "RSA",
"n" => Base64UrlSafeEncoder::encode($accountKeyDetails["rsa"]["n"]) "n" => Base64UrlSafeEncoder::encode($accountKeyDetails["rsa"]["n"])
) );
;
$payload = $challenge['token'] . '.' . Base64UrlSafeEncoder::encode(hash('sha256', json_encode($header), true)); $payload = $challenge['token'] . '.' . Base64UrlSafeEncoder::encode(hash('sha256', json_encode($header), true));
file_put_contents($tokenPath, $payload); file_put_contents($tokenPath, $payload);
@@ -174,12 +176,13 @@ class lescript
$this->log("Sending request to challenge"); $this->log("Sending request to challenge");
// send request to challenge // send request to challenge
$result = $this->signedRequest($challenge['uri'], array( $result = $this->signedRequest($challenge['uri'],
"resource" => "challenge", array(
"type" => "http-01", "resource" => "challenge",
"keyAuthorization" => $payload, "type" => "http-01",
"token" => $challenge['token'] "keyAuthorization" => $payload,
)); "token" => $challenge['token']
));
// waiting loop // waiting loop
// we wait for a maximum of 30 seconds to avoid endless loops // we wait for a maximum of 30 seconds to avoid endless loops
@@ -306,7 +309,8 @@ class lescript
$tmpConfPath = $tmpConfMeta["uri"]; $tmpConfPath = $tmpConfMeta["uri"];
// workaround to get SAN working // workaround to get SAN working
fwrite($tmpConf, 'HOME = . fwrite($tmpConf,
'HOME = .
RANDFILE = $ENV::HOME/.rnd RANDFILE = $ENV::HOME/.rnd
[ req ] [ req ]
default_bits = ' . Settings::Get('system.letsencryptkeysize') . ' default_bits = ' . Settings::Get('system.letsencryptkeysize') . '
@@ -320,15 +324,16 @@ basicConstraints = CA:FALSE
subjectAltName = ' . $san . ' subjectAltName = ' . $san . '
keyUsage = nonRepudiation, digitalSignature, keyEncipherment'); keyUsage = nonRepudiation, digitalSignature, keyEncipherment');
$csr = openssl_csr_new(array( $csr = openssl_csr_new(
"CN" => $domain, array(
"ST" => Settings::Get('system.letsencryptstate'), "CN" => $domain,
"C" => Settings::Get('system.letsencryptcountrycode'), "ST" => Settings::Get('system.letsencryptstate'),
"O" => "Unknown" "C" => Settings::Get('system.letsencryptcountrycode'),
), $privateKey, array( "O" => "Unknown"
"config" => $tmpConfPath, ), $privateKey, array(
"digest_alg" => "sha256" "config" => $tmpConfPath,
)); "digest_alg" => "sha256"
));
if (! $csr) if (! $csr)
throw new \RuntimeException("CSR couldn't be generated! " . openssl_error_string()); throw new \RuntimeException("CSR couldn't be generated! " . openssl_error_string());
@@ -343,10 +348,11 @@ keyUsage = nonRepudiation, digitalSignature, keyEncipherment');
private function generateKey() private function generateKey()
{ {
$res = openssl_pkey_new(array( $res = openssl_pkey_new(
"private_key_type" => OPENSSL_KEYTYPE_RSA, array(
"private_key_bits" => (int) Settings::Get('system.letsencryptkeysize') "private_key_type" => OPENSSL_KEYTYPE_RSA,
)); "private_key_bits" => (int) Settings::Get('system.letsencryptkeysize')
));
if (! openssl_pkey_export($res, $privateKey)) { if (! openssl_pkey_export($res, $privateKey)) {
throw new \RuntimeException("Key export failed!"); throw new \RuntimeException("Key export failed!");

36
scripts/jobs/cron_letsencrypt.php
View File

@@ -1,5 +1,4 @@
<?php <?php
if (! defined('MASTER_CRONJOB')) if (! defined('MASTER_CRONJOB'))
die('You cannot access this file directly!'); die('You cannot access this file directly!');
@@ -25,17 +24,19 @@ $cronlog->logAction(CRON_ACTION, LOG_INFO, "Updating Let's Encrypt certificates"
if (! extension_loaded('curl')) { if (! extension_loaded('curl')) {
$cronlog->logAction(CRON_ACTION, LOG_ERR, "Let's Encrypt requires the php cURL extension to be installed."); $cronlog->logAction(CRON_ACTION, LOG_ERR, "Let's Encrypt requires the php cURL extension to be installed.");
exit; exit();
} }
$certificates_stmt = Database::query(" $certificates_stmt = Database::query(
"
SELECT domssl.`id`, domssl.`domainid`, domssl.expirationdate, domssl.`ssl_cert_file`, domssl.`ssl_key_file`, domssl.`ssl_ca_file`, domssl.`ssl_csr_file`, dom.`domain`, dom.`iswildcarddomain`, dom.`wwwserveralias`, SELECT domssl.`id`, domssl.`domainid`, domssl.expirationdate, domssl.`ssl_cert_file`, domssl.`ssl_key_file`, domssl.`ssl_ca_file`, domssl.`ssl_csr_file`, dom.`domain`, dom.`iswildcarddomain`, dom.`wwwserveralias`,
dom.`documentroot`, dom.`id` as 'domainid', dom.`ssl_redirect`, cust.`leprivatekey`, cust.`lepublickey`, cust.customerid, cust.loginname dom.`documentroot`, dom.`id` as 'domainid', dom.`ssl_redirect`, cust.`leprivatekey`, cust.`lepublickey`, cust.customerid, cust.loginname
FROM `" . TABLE_PANEL_CUSTOMERS . "` as cust, `" . TABLE_PANEL_DOMAINS . "` dom LEFT JOIN `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` domssl ON (dom.id = domssl.domainid) FROM `" . TABLE_PANEL_CUSTOMERS . "` as cust, `" . TABLE_PANEL_DOMAINS . "` dom LEFT JOIN `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` domssl ON (dom.id = domssl.domainid)
WHERE dom.customerid = cust.customerid AND dom.letsencrypt = 1 AND (domssl.expirationdate < DATE_ADD(NOW(), INTERVAL 30 DAY) OR domssl.expirationdate IS NULL) WHERE dom.customerid = cust.customerid AND dom.letsencrypt = 1 AND (domssl.expirationdate < DATE_ADD(NOW(), INTERVAL 30 DAY) OR domssl.expirationdate IS NULL)
"); ");
$updcert_stmt = Database::prepare(" $updcert_stmt = Database::prepare(
"
REPLACE INTO `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` SET `id` = :id, `domainid` = :domainid, `ssl_cert_file` = :crt, `ssl_key_file` = :key, `ssl_ca_file` = :ca, `ssl_cert_chainfile` = :chain, `ssl_csr_file` = :csr, expirationdate = :expirationdate REPLACE INTO `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` SET `id` = :id, `domainid` = :domainid, `ssl_cert_file` = :crt, `ssl_key_file` = :key, `ssl_ca_file` = :ca, `ssl_cert_chainfile` = :chain, `ssl_csr_file` = :csr, expirationdate = :expirationdate
"); ");
@@ -92,16 +93,17 @@ foreach ($certrows as $certrow) {
$newcert = openssl_x509_parse($return['crt']); $newcert = openssl_x509_parse($return['crt']);
// Store the new data // Store the new data
Database::pexecute($updcert_stmt, array( Database::pexecute($updcert_stmt,
'id' => $certrow['id'], array(
'domainid' => $certrow['domainid'], 'id' => $certrow['id'],
'crt' => $return['crt'], 'domainid' => $certrow['domainid'],
'key' => $return['key'], 'crt' => $return['crt'],
'ca' => $return['chain'], 'key' => $return['key'],
'chain' => $return['chain'], 'ca' => $return['chain'],
'csr' => $return['csr'], 'chain' => $return['chain'],
'expirationdate' => date('Y-m-d H:i:s', $newcert['validTo_time_t']) 'csr' => $return['csr'],
)); 'expirationdate' => date('Y-m-d H:i:s', $newcert['validTo_time_t'])
));
if ($certrow['ssl_redirect'] == 3) { if ($certrow['ssl_redirect'] == 3) {
Database::pexecute($upddom_stmt, array( Database::pexecute($upddom_stmt, array(
@@ -113,10 +115,12 @@ foreach ($certrows as $certrow) {
$changedetected = 1; $changedetected = 1;
} catch (Exception $e) { } catch (Exception $e) {
$cronlog->logAction(CRON_ACTION, LOG_ERR, "Could not get Let's Encrypt certificate for " . $certrow['domain'] . ": " . $e->getMessage()); $cronlog->logAction(CRON_ACTION, LOG_ERR,
"Could not get Let's Encrypt certificate for " . $certrow['domain'] . ": " . $e->getMessage());
} }
} else { } else {
$cronlog->logAction(CRON_ACTION, LOG_WARNING, "Skipping Let's Encrypt generation for " . $certrow['domain'] . " due to an enabled ssl_redirect"); $cronlog->logAction(CRON_ACTION, LOG_WARNING,
"Skipping Let's Encrypt generation for " . $certrow['domain'] . " due to an enabled ssl_redirect");
} }
} }