[pbs-devel] [PATCH proxmox-backup 6/6] acme: add support for wildcard certificates

[Stoiko Ivanov]

following the implementation in PMG in:
* verifying that a acmedomain with wildcard is not using the standalone
  validation
* the initial '*.' is stripped when searching for the proper domain
  config and when running the validation plugin

Signed-off-by: Stoiko Ivanov <s.ivanov at proxmox.com>
---
 pbs-api-types/src/lib.rs      | 5 +++++
 src/acme/plugin.rs            | 2 +-
 src/api2/node/certificates.rs | 2 +-
 src/api2/types/acme.rs        | 4 ++--
 src/config/node.rs            | 9 +++++++++
 5 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
index 96ac657b..73a84ca6 100644
--- a/pbs-api-types/src/lib.rs
+++ b/pbs-api-types/src/lib.rs
@@ -82,6 +82,7 @@ pub use zfs::*;
 mod local_macros {
     macro_rules! DNS_LABEL { () => (r"(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)") }
     macro_rules! DNS_NAME { () => (concat!(r"(?:(?:", DNS_LABEL!() , r"\.)*", DNS_LABEL!(), ")")) }
+    macro_rules! DNS_NAME_OR_WILDCARD { () => (concat!(r"(?:\*\.)?(?:(?:", DNS_LABEL!() , r"\.)*", DNS_LABEL!(), ")")) }
     macro_rules! CIDR_V4_REGEX_STR { () => (concat!(r"(?:", IPV4RE!(), r"/\d{1,2})$")) }
     macro_rules! CIDR_V6_REGEX_STR { () => (concat!(r"(?:", IPV6RE!(), r"/\d{1,3})$")) }
     macro_rules! DNS_ALIAS_LABEL { () => (r"(?:[a-zA-Z0-9_](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)") }
@@ -99,6 +100,7 @@ const_regex! {
     pub CIDR_REGEX =  concat!(r"^(?:", CIDR_V4_REGEX_STR!(), "|",  CIDR_V6_REGEX_STR!(), r")$");
     pub HOSTNAME_REGEX = r"^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)$";
     pub DNS_NAME_REGEX =  concat!(r"^", DNS_NAME!(), r"$");
+    pub DNS_NAME_OR_WILDCARD_REGEX =  concat!(r"^", DNS_NAME_OR_WILDCARD!(), r"$");
     pub DNS_ALIAS_REGEX =  concat!(r"^", DNS_ALIAS_NAME!(), r"$");
     pub DNS_NAME_OR_IP_REGEX = concat!(r"^(?:", DNS_NAME!(), "|",  IPRE!(), r")$");
 
@@ -177,6 +179,9 @@ pub const HOSTNAME_SCHEMA: Schema = StringSchema::new("Hostname (as defined in R
 pub const DNS_NAME_FORMAT: ApiStringFormat =
     ApiStringFormat::Pattern(&DNS_NAME_REGEX);
 
+pub const DNS_NAME_OR_WILDCARD_FORMAT: ApiStringFormat =
+    ApiStringFormat::Pattern(&DNS_NAME_OR_WILDCARD_REGEX);
+
 pub const DNS_NAME_OR_IP_FORMAT: ApiStringFormat =
     ApiStringFormat::Pattern(&DNS_NAME_OR_IP_REGEX);
 
diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
index d31c2b8f..4dedb69b 100644
--- a/src/acme/plugin.rs
+++ b/src/acme/plugin.rs
@@ -145,7 +145,7 @@ impl DnsPlugin {
                 PROXMOX_ACME_SH_PATH,
                 action,
                 &self.core.api,
-                domain.alias.as_deref().unwrap_or(&domain.domain),
+                domain.alias.as_deref().unwrap_or(&domain.domain.trim_start_matches("*.")),
         ]);
 
         // We could use 1 socketpair, but tokio wraps them all in `File` internally causing `close`
diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
index 4d26b29f..f6a7c2d3 100644
--- a/src/api2/node/certificates.rs
+++ b/src/api2/node/certificates.rs
@@ -299,7 +299,7 @@ async fn order_certificate(
     let get_domain_config = |domain: &str| {
         domains
             .iter()
-            .find(|d| d.domain == domain)
+            .find(|d| d.domain.trim_start_matches("*.") == domain)
             .ok_or_else(|| format_err!("no config for domain '{}'", domain))
     };
 
diff --git a/src/api2/types/acme.rs b/src/api2/types/acme.rs
index 21e953bb..7b9de74a 100644
--- a/src/api2/types/acme.rs
+++ b/src/api2/types/acme.rs
@@ -4,12 +4,12 @@ use serde_json::Value;
 use proxmox_schema::{api, ApiType, Schema, StringSchema, ApiStringFormat};
 
 use pbs_api_types::{
-    DNS_ALIAS_FORMAT, DNS_NAME_FORMAT, PROXMOX_SAFE_ID_FORMAT,
+    DNS_ALIAS_FORMAT, DNS_NAME_OR_WILDCARD_FORMAT, PROXMOX_SAFE_ID_FORMAT,
 };
 
 #[api(
     properties: {
-        "domain": { format: &DNS_NAME_FORMAT },
+        "domain": { format: &DNS_NAME_OR_WILDCARD_FORMAT },
         "alias": {
             optional: true,
             format: &DNS_ALIAS_FORMAT,
diff --git a/src/config/node.rs b/src/config/node.rs
index 93444216..fb9b1105 100644
--- a/src/config/node.rs
+++ b/src/config/node.rs
@@ -163,6 +163,15 @@ impl NodeConfig {
             if !domains.insert(domain.domain.to_lowercase()) {
                 bail!("duplicate domain '{}' in ACME config", domain.domain);
             }
+            if domain.domain.starts_with("*.") {
+                let plugin = domain.plugin.as_deref().unwrap_or("standalone");
+                if plugin == "standalone" {
+                    bail!(
+                        "wildcard domain '{}' needs a dns-01 plugin for validation!",
+                        domain.domain
+                    );
+                }
+            }
         }
 
         Ok(())
-- 
2.30.2