maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

add optional dns validation for let's encrypt activated domains; fixes #817

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2020-04-14 10:28:33 +02:00
parent 9018404faa
commit 78fc4f84b2
10 changed files with 131 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php
View File

@@ -4,6 +4,8 @@ namespace Froxlor\Cron\Http\LetsEncrypt;
use Froxlor\FroxlorLogger;
use Froxlor\Settings;
use Froxlor\Database\Database;
use Froxlor\PhpHelper;
use Froxlor\Domain\Domain;
/**
* This file is part of the Froxlor project.
@@ -248,6 +250,9 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron
}
}
}
self::validateDns($domains, $certrow['domainid'], $cronlog);
self::runAcmeSh($certrow, $domains, $cronlog, $do_force);
} else {
$cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_WARNING, "Skipping Let's Encrypt generation for " . $certrow['domain'] . " due to an enabled ssl_redirect");
@@ -255,6 +260,32 @@ class AcmeSh extends \Froxlor\Cron\FroxlorCron
}
}
/**
* validate dns (A / AAAA record) of domain against known system ips
*
* @param array $domains
* @param int $domain_id
* @param FroxlorLogger $cronlog
*/
private static function validateDns(&$domains = array(), $domain_id, &$cronlog)
{
if (Settings::Get('system.le_domain_dnscheck') == '1' && ! empty($domains)) {
$loop_domains = $domains;
// ips according to our system
$our_ips = Domain::getIpsOfDomain($domain_id);
foreach ($loop_domains as $idx => $domain) {
$cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_INFO, "Validating DNS of " . $domain);
// ips accordint to NS
$domain_ips = PhpHelper::gethostbynamel6($domain);
if (count(array_intersect($our_ips, $domain_ips)) <= 0) {
// no common ips...
$cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_WARNING, "Skipping Let's Encrypt generation for " . $domain . " due to no system known IP address via DNS check");
unset($domains[$idx]);
}
}
}
}
private static function runAcmeSh($certrow = array(), $domains = array(), &$cronlog = null, $force = false)
{
if (! empty($domains)) {

35
lib/Froxlor/Domain/Domain.php
View File

@@ -6,6 +6,41 @@ use Froxlor\Database\Database;
class Domain
{
/**
* return all ip addresses associated with given domain,
* returns all ips if domain-id = 0 (froxlor.vhost)
*
* @param int $domain_id
* @return array
*/
public static function getIpsOfDomain($domain_id)
{
if ($domain_id > 0) {
$sel_stmt = Database::prepare("
SELECT i.ip FROM `" . TABLE_PANEL_IPSANDPORTS . "` `i`
LEFT JOIN `" . TABLE_DOMAINTOIP . "` `dip` ON dip.id_ipandports = i.id
AND dip.id_domain = :domainid
GROUP BY i.ip
");
$sel_param = array(
'domainid' => $domain_id
);
} else {
// assuming froxlor.vhost (id = 0)
$sel_stmt = Database::prepare("
SELECT ip FROM `" . TABLE_PANEL_IPSANDPORTS . "`
GROUP BY ip
");
$sel_param = array();
}
Database::pexecute($sel_stmt, $sel_param);
$result = array();
while ($ip = $sel_stmt->fetch(\PDO::FETCH_ASSOC)) {
$result[] = $ip['ip'];
}
return $result;
}
/**
* return an array of all enabled redirect-codes
*

2
lib/Froxlor/Froxlor.php
View File

@@ -10,7 +10,7 @@ final class Froxlor
const VERSION = '0.10.15';
// Database version (YYYYMMDDC where C is a daily counter)
const DBVERSION = '202002290';
const DBVERSION = '202004140';
// Distribution branding-tag (used for Debian etc.)
const BRANDING = '';