Merge pull request #4769 from c-po/pki-acme-listen-address

pki: T7885: check_port_availability() can't be used during system boot

2 files changed, 26 insertions, 2 deletions

diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index fa6958130..98e5840a9 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -185,7 +185,7 @@ def get_config(config=None):
             pki.update({'changed':{}})
         pki['changed'].update({key.replace('-', '_') : tmp})
 
-    # We only merge on the defaults of there is a configuration at all
+    # We only merge on the defaults if there is a configuration at all
     if conf.exists(base):
         # We have gathered the dict representation of the CLI, but there are default
         # options which we need to update into the dictionary retrived.
@@ -265,11 +265,18 @@ def get_config(config=None):
                 continue
             if not dict_search('system.load_balancing.haproxy', pki):
                 continue
+            # Determine which service depends on ACME issued certificates
             used_by = []
+            # We start with HAProxy
             for cert_list, _ in dict_search_recursive(
                 pki['system']['load_balancing']['haproxy'], 'certificate'):
                 if name in cert_list:
                     used_by.append('haproxy')
+            # Check if OpenConnect consumes an ACME certificate
+            tmp = dict_search('system.vpn.openconnect.ssl.certificate', pki)
+            if tmp and tmp in cert_list:
+                used_by.append('openconnect')
+
             if used_by:
                 pki['certificate'][name]['acme'].update({'used_by': used_by})
 
@@ -369,7 +376,12 @@ def verify(pki):
                     listen_address = cert_conf['acme']['listen_address']
 
                 if 'used_by' not in cert_conf['acme']:
-                    if not check_port_availability(listen_address, 80):
+                    # A call to check_port_availability() will always fail during system
+                    # boot when listen_address is set and the address is not yet assigned
+                    # to an interface. This happens b/c PKI subsystem is called prior
+                    # to any inteface - e.g. ethernet - and thus the OS will always
+                    # be unable to bind() a socket() to a non existing IP address.
+                    if boot_configuration_complete() and not check_port_availability(listen_address, 80):
                         raise ConfigError('Port 80 is already in use and not available '\
                                           f'to provide ACME challenge for "{name}"!')
 
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 0f144443b..7ee51a1ae 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -26,6 +26,7 @@ from cryptography.x509.oid import ExtendedKeyUsageOID
 
 import vyos.opmode
 
+from vyos.base import Warning
 from vyos.config import Config
 from vyos.config import config_dict_mangle_acme
 from vyos.pki import encode_certificate
@@ -1379,6 +1380,17 @@ def renew_certbot(raw: bool, force: typing.Optional[bool] = False):
     certbot_config = directories['certbot']
     hook_dir = directories['base']
 
+    if force and not os.path.isdir(f'{certbot_config}'):
+        # Assume someone deleted the certbot_config folder, renew alone will not
+        # work as there are no configuration files left to know what to renew.
+        # Re-run CLI PKI helper to initially request certificates via ACME
+        # again. This should never be the case - but sometimes the universe has
+        # a bad time
+        Warning(f'Directory "{certbot_config}" missing. Reinitializing PKI ' \
+                'subsystem...\n\n')
+        vyos_conf_scripts_dir = directories['conf_mode']
+        cmd(f'sudo sg vyattacfg -c {vyos_conf_scripts_dir}/pki.py')
+
     tmp = f'/usr/bin/certbot renew --no-random-sleep-on-renew ' \
           f'--config-dir "{certbot_config}" ' \
           f'--post-hook "{hook_dir}/vyos-certbot-renew-pki.sh"'