From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <s.ivanov@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by lists.proxmox.com (Postfix) with ESMTPS id 1812A7DE05
 for <pmg-devel@lists.proxmox.com>; Tue,  9 Nov 2021 17:20:55 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
 by firstgate.proxmox.com (Proxmox) with ESMTP id 0ED21106F5
 for <pmg-devel@lists.proxmox.com>; Tue,  9 Nov 2021 17:20:25 +0100 (CET)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
 [94.136.29.106])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by firstgate.proxmox.com (Proxmox) with ESMTPS id 318E8106BB
 for <pmg-devel@lists.proxmox.com>; Tue,  9 Nov 2021 17:20:23 +0100 (CET)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
 by proxmox-new.maurer-it.com (Proxmox) with ESMTP id EB32F42478
 for <pmg-devel@lists.proxmox.com>; Tue,  9 Nov 2021 17:20:22 +0100 (CET)
From: Stoiko Ivanov <s.ivanov@proxmox.com>
To: pmg-devel@lists.proxmox.com
Date: Tue,  9 Nov 2021 17:20:03 +0100
Message-Id: <20211109162009.3186-3-s.ivanov@proxmox.com>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20211109162009.3186-1-s.ivanov@proxmox.com>
References: <20211109162009.3186-1-s.ivanov@proxmox.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results:  0
 AWL 0.362 Adjusted score from AWL reputation of From: address
 BAYES_00                 -1.9 Bayes spam probability is 0 to 1%
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
 URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
 http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
 information. [dnschallenge.pm]
Subject: [pmg-devel] [PATCH proxmox-acme 2/2] dns-challenge: add 'use-proxy'
 property
X-BeenThere: pmg-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Mail Gateway development discussion
 <pmg-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pmg-devel>, 
 <mailto:pmg-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pmg-devel/>
List-Post: <mailto:pmg-devel@lists.proxmox.com>
List-Help: <mailto:pmg-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel>, 
 <mailto:pmg-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 09 Nov 2021 16:20:55 -0000

this patch adds an optional 'use-proxy' property to the dns
challenges.

If set to 1 the caller is expected to add the proxy url in the plugin
config, which is then set as 'http_proxy' and 'https_proxy'
environment variable by the plugin caller (and then used by curl)

Tested with the pdns plugin, direct traffic to the pdns server being
dropped, and a configured squid proxy

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PVE/ACME/DNSChallenge.pm | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/PVE/ACME/DNSChallenge.pm b/src/PVE/ACME/DNSChallenge.pm
index 9b28970..c03b3db 100644
--- a/src/PVE/ACME/DNSChallenge.pm
+++ b/src/PVE/ACME/DNSChallenge.pm
@@ -50,7 +50,12 @@ sub properties {
 	    optional => 1,
 	    minimum => 0,
 	    maximum => 2 * 24 * 60 * 60,
-	}
+	},
+	'use-proxy' => {
+	    description => "Flag indicating whether a http proxy should be used.",
+	    type => 'boolean',
+	    optional => 1,
+	},
     };
 }
 
@@ -61,6 +66,7 @@ sub options {
 	nodes => { optional => 1 },
 	disable => { optional => 1 },
 	'validation-delay' => { optional => 1 },
+	'use-proxy' => { optional => 1 },
     };
 }
 
@@ -78,6 +84,7 @@ my $proxmox_acme_command = sub {
     my $txtvalue = PVE::ACME::encode(sha256($key_auth));
     my $dnsplugin = $data->{plugin}->{api};
     my $plugin_conf_string = $data->{plugin}->{data};
+    my $proxy = $data->{plugin}->{proxy};
 
     # for security reasons, we execute the command as nobody
     # we can't verify that the code of the DNSPlugins are harmless.
@@ -93,6 +100,7 @@ my $proxmox_acme_command = sub {
     }
     my $input = "$txtvalue\n";
     $input .= "$plugin_conf_string\n" if $plugin_conf_string;
+    $input .= "https_proxy=$proxy\nhttp_proxy=$proxy\n" if $proxy;
 
     PVE::Tools::run_command($cmd, input => $input);
 
-- 
2.30.2