[PATCH proxmox 3/3] fix #7166: acme-api: time out validation and finalization

[Samuel Rufinatscha <s.rufinatscha@proxmox.com>]

Limit each domain's validation and order finalization to five minutes.
Start the validation timeout after plugin setup so DNS propagation waits
are unaffected, and clean up the plugin on timeout.

Signed-off-by: Samuel Rufinatscha <s.rufinatscha@proxmox.com>
---
 proxmox-acme-api/src/certificate_helpers.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/proxmox-acme-api/src/certificate_helpers.rs b/proxmox-acme-api/src/certificate_helpers.rs
index 771111fb..323f4b4a 100644
--- a/proxmox-acme-api/src/certificate_helpers.rs
+++ b/proxmox-acme-api/src/certificate_helpers.rs
@@ -16,6 +16,8 @@ use proxmox_rest_server::WorkerTask;
 use crate::CertificateInfo;
 use crate::types::{AcmeConfig, AcmeDomain};
 
+const ACME_POLL_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+
 pub async fn revoke_certificate(acme_config: &AcmeConfig, certificate: &[u8]) -> Result<(), Error> {
     let mut acme = super::account_config::load_account_config(&acme_config.account)
         .await?
@@ -103,6 +105,9 @@ pub async fn order_certificate(
         let result = tokio::select! {
             biased;
             _ = worker.abort_future() => Err(format_err!("abort requested - aborting task")),
+            _ = tokio::time::sleep(ACME_POLL_TIMEOUT) => {
+                Err(format_err!("ACME validation for '{domain}' timed out"))
+            }
             result = request_validation(&mut acme, auth_url, validation_url) => result,
         };
 
@@ -126,6 +131,7 @@ pub async fn order_certificate(
     let certificate = tokio::select! {
         biased;
         _ = worker.abort_future() => bail!("abort requested - aborting task"),
+        _ = tokio::time::sleep(ACME_POLL_TIMEOUT) => bail!("ACME order finalization timed out"),
         result = finalize_order(&mut acme, &order.location, &csr.data) => result?,
     };
 
-- 
2.47.3