NAS-132257 / 25.04 / Add TNC service

src/middlewared/middlewared/alembic/versions/25.04/2024-12-19_12-30_tnc_support.py

@@ -0,0 +1,40 @@
+"""
+TNC Support
+
+Revision ID: 83d9689fcbc8
+Revises: 19cdc9f2d2df
+Create Date: 2024-12-19 12:30:41.855489+00:00
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '83d9689fcbc8'
+down_revision = '19cdc9f2d2df'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'truenas_connect',
+        sa.Column('id', sa.Integer(), nullable=False),
+        sa.Column('enabled', sa.BOOLEAN(), nullable=False),
+        sa.Column('jwt_token', sa.TEXT(), nullable=True),
+        sa.Column('ips', sa.TEXT(), nullable=False, server_default='[]'),
+        sa.Column('registration_details', sa.TEXT(), nullable=False, server_default='{}'),
+        sa.Column('status', sa.String(length=255), nullable=False),
+        sa.Column('certificate_id', sa.Integer(), nullable=True),
+        sa.PrimaryKeyConstraint('id', name=op.f('pk_truenas_connect')),
+        sa.ForeignKeyConstraint(
+            ['certificate_id'], ['system_certificate.id'],
+            name=op.f('fk_truenas_connect_certificate_id_system_certificate')
+        ),
+        sqlite_autoincrement=True,
+    )
+    with op.batch_alter_table('truenas_connect', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_truenas_connect_certificate_id'), ['certificate_id'], unique=False)
+
+
+def downgrade():
+    pass

src/middlewared/middlewared/api/v25_04_0/__init__.py

@@ -46,6 +46,7 @@
 from .system_ntpserver import *  # noqa
 from .system_reboot import *  # noqa
 from .system_security import *  # noqa
+from .tn_connect import *  # noqa
 from .truenas import *  # noqa
 from .user import *  # noqa
 from .vendor import *  # noqa

src/middlewared/middlewared/api/v25_04_0/acme_dns_authenticator.py

@@ -15,6 +15,7 @@
     'ACMEDNSAuthenticatorDeleteResult', 'ACMEDNSAuthenticatorSchemasArgs', 'ACMEDNSAuthenticatorSchemasResult',
     'ACMEDNSAuthenticatorPerformChallengeArgs', 'ACMEDNSAuthenticatorPerformChallengeResult', 'Route53SchemaArgs',
     'ACMECustomDNSAuthenticatorReturns', 'CloudFlareSchemaArgs', 'OVHSchemaArgs', 'ShellSchemaArgs',
+    'TrueNASConnectSchemaArgs',
 ]
 
 
@@ -32,6 +33,15 @@ class ACMECustomDNSAuthenticatorReturns(BaseModel):
     result: dict
 
 
+class TrueNASConnectSchema(BaseModel):
+    pass
+
+
+@single_argument_args('attributes')
+class TrueNASConnectSchemaArgs(TrueNASConnectSchema):
+    pass
+
+
 class CloudFlareSchema(BaseModel):
     authenticator: Literal['cloudflare']
     cloudflare_email: NonEmptyString | None = Field(default=None, description='Cloudflare Email')
@@ -133,7 +143,7 @@ class ACMEDNSAuthenticatorDeleteResult(BaseModel):
 
 @single_argument_args('acme_dns_authenticator_performance_challenge')
 class ACMEDNSAuthenticatorPerformChallengeArgs(BaseModel):
-    authenticator: int
+    authenticator: int | None
     key: LongString
     domain: str
     challenge: LongString

src/middlewared/middlewared/api/v25_04_0/tn_connect.py

@@ -0,0 +1,53 @@
+from pydantic import IPvAnyAddress
+
+from middlewared.api.base import BaseModel, ForUpdateMetaclass, NonEmptyString, single_argument_args
+
+
+__all__ = [
+    'TNCEntry', 'TNCGetRegistrationURIArgs', 'TNCGetRegistrationURIResult', 'TNCUpdateArgs', 'TNCUpdateResult',
+    'TNCGenerateClaimTokenArgs', 'TNCGenerateClaimTokenResult', 'TNCIPChoicesArgs', 'TNCIPChoicesResult',
+]
+
+
+class TNCEntry(BaseModel):
+    id: int
+    enabled: bool
+    registration_details: dict
+    ips: list[NonEmptyString]
+    status: NonEmptyString
+    status_reason: NonEmptyString
+    certificate: int | None
+
+
+@single_argument_args('tn_connect_update')
+class TNCUpdateArgs(BaseModel, metaclass=ForUpdateMetaclass):
+    enabled: bool
+    ips: list[IPvAnyAddress]
+
+
+class TNCUpdateResult(BaseModel):
+    result: TNCEntry
+
+
+class TNCGetRegistrationURIArgs(BaseModel):
+    pass
+
+
+class TNCGetRegistrationURIResult(BaseModel):
+    result: NonEmptyString
+
+
+class TNCGenerateClaimTokenArgs(BaseModel):
+    pass
+
+
+class TNCGenerateClaimTokenResult(BaseModel):
+    result: NonEmptyString
+
+
+class TNCIPChoicesArgs(BaseModel):
+    pass
+
+
+class TNCIPChoicesResult(BaseModel):
+    result: dict[str, str]

src/middlewared/middlewared/logger.py

@@ -57,6 +57,7 @@
 FAILOVER_LOGFILE = '/var/log/failover.log'
 LOGFILE = '/var/log/middlewared.log'
 NETDATA_API_LOGFILE = '/var/log/netdata_api.log'
+TRUENAS_CONNECT_LOGFILE = '/var/log/truenas_connect.log'
 ZETTAREPL_LOGFILE = '/var/log/zettarepl.log'
 
 
@@ -101,6 +102,7 @@ def configure_logging(self, output_option: str):
                 ('docker_image', DOCKER_IMAGE_LOGFILE, self.log_format),
                 ('failover', FAILOVER_LOGFILE, self.log_format),
                 ('netdata_api', NETDATA_API_LOGFILE, self.log_format),
+                ('truenas_connect', TRUENAS_CONNECT_LOGFILE, self.log_format),
                 ('zettarepl', ZETTAREPL_LOGFILE,
                  '[%(asctime)s] %(levelname)-8s [%(threadName)s] [%(name)s] %(message)s'),
             ]:

src/middlewared/middlewared/plugins/acme_protocol_/authenticators/base.py

@@ -8,6 +8,7 @@ class Authenticator:
     NAME = NotImplementedError
     PROPAGATION_DELAY = NotImplementedError
     SCHEMA_MODEL = NotImplementedError
+    INTERNAL = False
 
     def __init__(self, middleware, attributes):
         self.middleware = middleware

src/middlewared/middlewared/plugins/acme_protocol_/authenticators/factory.py

@@ -6,6 +6,7 @@
 from .ovh import OVHAuthenticator
 from .route53 import Route53Authenticator
 from .shell import ShellAuthenticator
+from .truenas_connect import TrueNASConnectAuthenticator
 
 
 class AuthenticatorFactory:
@@ -21,8 +22,8 @@ def authenticator(self, name):
             raise CallError(f'Unable to locate {name!r} authenticator.', errno=errno.ENOENT)
         return self._creators[name]
 
-    def get_authenticators(self):
-        return self._creators
+    def get_authenticators(self, include_internal=False):
+        return {k: v for k, v in self._creators.items() if v.INTERNAL is False or include_internal}
 
 
 auth_factory = AuthenticatorFactory()
@@ -31,5 +32,6 @@ def get_authenticators(self):
     Route53Authenticator,
     OVHAuthenticator,
     ShellAuthenticator,
+    TrueNASConnectAuthenticator,
 ]:
     auth_factory.register(authenticator)

src/middlewared/middlewared/plugins/acme_protocol_/authenticators/truenas_connect.py

@@ -0,0 +1,62 @@
+import json
+import logging
+import requests
+
+from middlewared.api.current import TrueNASConnectSchemaArgs
+from middlewared.plugins.truenas_connect.mixin import auth_headers
+from middlewared.plugins.truenas_connect.urls import LECA_DNS_URL, LECA_CLEANUP_URL
+from middlewared.service import CallError
+
+from .base import Authenticator
+
+
+logger = logging.getLogger('truenas_connect')
+
+
+class TrueNASConnectAuthenticator(Authenticator):
+
+    NAME = 'tn_connect'
+    PROPAGATION_DELAY = 20
+    SCHEMA_MODEL = TrueNASConnectSchemaArgs
+    INTERNAL = True
+
+    @staticmethod
+    async def validate_credentials(middleware, data):
+        pass
+
+    def _perform(self, domain, validation_name, validation_content):
+        try:
+            self._perform_internal(domain, validation_name, validation_content)
+        except CallError:
+            raise
+        except Exception as e:
+            raise CallError(f'Failed to perform {self.NAME} challenge for {domain!r} domain: {e}')
+
+    def _perform_internal(self, domain, validation_name, validation_content):
+        logger.debug(
+            'Performing %r challenge for %r domain with %r validation name and %r validation content',
+            self.NAME, domain, validation_name, validation_content,
+        )
+        response = requests.post(LECA_DNS_URL, data=json.dumps({
+            'token': validation_content,
+            'hostnames': [domain],  # We should be using validation name here
+        }), headers=auth_headers(self.attributes), timeout=30)
+        if response.status_code != 201:
+            raise CallError(
+                f'Failed to perform {self.NAME} challenge for {domain!r} domain with '
+                f'{response.status_code!r} status code: {response.text}'
+            )
+
+        logger.debug('Successfully performed %r challenge for %r domain', self.NAME, domain)
+
+    def _cleanup(self, domain, validation_name, validation_content):
+        logger.debug('Cleaning up %r challenge for %r domain', self.NAME, domain)
+        try:
+            requests.delete(
+                LECA_CLEANUP_URL, headers=auth_headers(self.attributes), timeout=30, data=json.dumps({
+                    'hostnames': [validation_name],  # We use validation name here instead of domain as Zack advised
+                })
+            )
+        except Exception:
+            # We do not make this fatal as it does not matter if we fail to clean-up
+            logger.debug('Failed to cleanup %r challenge for %r domain', self.NAME, domain, exc_info=True)

src/middlewared/middlewared/plugins/acme_protocol_/challenge.py

@@ -27,7 +27,13 @@ def cleanup_challenge(self, data):
 
     @private
     def get_authenticator(self, authenticator):
-        auth_details = self.middleware.call_sync('acme.dns.authenticator.get_instance', authenticator)
+        if authenticator is None:
+            auth_details = {
+                'attributes': {'authenticator': 'tn_connect', **self.middleware.call_sync('tn_connect.config_internal')}
+            }
+        else:
+            auth_details = self.middleware.call_sync('acme.dns.authenticator.get_instance', authenticator)
+
         return self.get_authenticator_internal(
             auth_details['attributes']['authenticator']
         )(self.middleware, auth_details['attributes'])

src/middlewared/middlewared/plugins/acme_protocol_/client_utils.py

@@ -13,7 +13,7 @@ class BodyDict(typing.TypedDict):
 
 class ACMEClientAndKeyData(typing.TypedDict):
     uri: str
-    tos: bool
+    tos: bool | str
     new_account_uri: str
     new_nonce_uri: str
     new_order_uri: str
@@ -25,7 +25,7 @@ def get_acme_client_and_key(data: ACMEClientAndKeyData) -> tuple[client.ClientV2
     """
     Expected data dict should contain the following
     - uri: str
-    - tos: bool
+    - tos: bool | str
     - new_account_uri: str
     - new_nonce_uri: str
     - new_order_uri: str

src/middlewared/middlewared/plugins/acme_protocol_/revoke_cert.py

@@ -0,0 +1,24 @@
+from OpenSSL import crypto
+
+import josepy as jose
+from acme import errors, messages
+
+from middlewared.service import CallError, Service
+
+from .client_utils import get_acme_client_and_key
+
+
+class ACMEService(Service):
+
+    class Config:
+        namespace = 'acme'
+        private = True
+
+    def revoke_certificate(self, acme_client_key_payload, certificate):
+        acme_client, key = get_acme_client_and_key(acme_client_key_payload)
+        try:
+            acme_client.revoke(
+                jose.ComparableX509(crypto.load_certificate(crypto.FILETYPE_PEM, certificate)), 0
+            )
+        except (errors.ClientError, messages.Error) as e:
+            raise CallError(f'Failed to revoke certificate: {e}')

src/middlewared/middlewared/plugins/crypto_/certificates.py

@@ -1,8 +1,4 @@
 import datetime
-import josepy as jose
-
-from acme import errors, messages
-from OpenSSL import crypto
 
 import middlewared.sqlalchemy as sa
 
@@ -605,6 +601,13 @@ async def do_update(self, job, id_, data):
         if any(new.get(k) != old.get(k) for k in ('name', 'revoked', 'renew_days', 'add_to_trusted_store')):
 
             verrors = ValidationErrors()
+            tnc_config = await self.middleware.call('tn_connect.config')
+            if tnc_config['certificate'] == id_:
+                verrors.add(
+                    'certificate_update.name',
+                    'This certificate is being used by TrueNAS Connect service and cannot be modified'
+                )
+                verrors.check()
 
             if new['name'] != old['name']:
                 await validate_cert_name(
@@ -717,17 +720,15 @@ def do_delete(self, job, id_, force):
 
         if certificate.get('acme') and not certificate['expired']:
             # We won't try revoking a certificate which has expired already
-            client, key = self.middleware.call_sync(
-                'acme.get_acme_client_and_key', certificate['acme']['directory'], True
-            )
-
             try:
-                client.revoke(
-                    jose.ComparableX509(crypto.load_certificate(crypto.FILETYPE_PEM, certificate['certificate'])), 0
+                self.middleware.call_sync(
+                    'acme.revoke_certificate', self.middleware.call_sync(
+                        'acme.get_acme_client_and_key_payload', certificate['acme']['directory'], True
+                    ), certificate['certificate'],
                 )
-            except (errors.ClientError, messages.Error) as e:
+            except CallError:
                 if not force:
-                    raise CallError(f'Failed to revoke certificate: {e}')
+                    raise
 
         response = self.middleware.call_sync(
             'datastore.delete',

src/middlewared/middlewared/plugins/system_general/update.py

@@ -169,6 +169,7 @@ async def validate_general_settings(self, data, old_config, schema):
                     f'When "{wildcard}" has been selected, selection of other addresses is not allowed'
                 )
 
+        tnc_config = await self.middleware.call('tn_connect.config')
         certificate_id = data.get('ui_certificate')
         cert = await self.middleware.call(
             'certificate.query',
@@ -179,6 +180,11 @@ async def validate_general_settings(self, data, old_config, schema):
                 f'{schema}.ui_certificate',
                 'Please specify a valid certificate which exists in the system'
             )
+        elif tnc_config['certificate'] and tnc_config['certificate'] != certificate_id:
+            verrors.add(
+                f'{schema}.ui_certificate',
+                'Certificate cannot be changed when TrueNAS Connect has been configured'
+            )
         else:
             verrors.extend(
                 await self.middleware.call(