Skip to content

Commit e4f5d75

Browse files
pgerberpgerber
committed
security/acme-client: fix IPv6 support HTTP-01 and TLS-ALPN-01 challenges
Underlying issue: IPv6 features multiple scopes restricting where the IP address is valid [1]. ::1 belongs to link-local scope which is not allowed to be routed. As result FreeBSD will reject the connection after rewriting, as it will come from global scope (the internet) and going to ::1 [2]. This isn't allowed. The fix / workaround: Instead of redirecting to ::1, the following is tried: * If there is a WAN interface with an IPv6 address defined, redirect to this address. I expect most setup with IPv6 to have a WAN interface with a suitable (=allowed scope) IPv6 address. * Else, only redirect the port and leave the address unchanged. This will only work if we are issuing a certificate for ourselves (rather than a host behind the firewall). A better solution would be to pick an arbitrary IPv6 address of the host with a suitable scope. However, I believe this would be considerably more complex to implement and test. I propose we use this simplified approach, at least for now, which should already work for the vast majority of users. [1]: https://en.wikipedia.org/wiki/IPv6_address#Address_scopes [2]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193568
1 parent 926169c commit e4f5d75

3 files changed

Lines changed: 60 additions & 9 deletions

File tree

‎security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,33 @@ public function prepare()
8686
}
8787
}
8888

89+
// Find redirect target for IPv6
90+
//
91+
// Needed because redirecting to ::1 isn't allowed [1].
92+
//
93+
// [1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193568
94+
$ipv6_redirect_addr = null;
95+
if (is_ipv6_allowed()) {
96+
$backend = new \OPNsense\Core\Backend();
97+
$interface = "wan";
98+
$response = json_decode($backend->configdpRun('interface address', [$interface]));
99+
100+
if (isset($response->$interface)) {
101+
foreach ($response->$interface as $if) {
102+
if (!empty($if->address) && $if->family == "inet6") {
103+
$ipv6_redirect_addr = $if->address;
104+
break;
105+
}
106+
}
107+
}
108+
109+
if ($ipv6_redirect_addr != null) {
110+
LeUtils::log("found IPv6 on WAN interface, will redirect traffic there ({$ipv6_redirect_addr})");
111+
} else {
112+
LeUtils::log("failed to find IPv6 on WAN interface ($interface), will not rewrite target address");
113+
}
114+
}
115+
89116
// Generate rules for all IP addresses
90117
$anchor_rules = "";
91118
if (!empty($iplist)) {
@@ -99,7 +126,7 @@ public function prepare()
99126
LeUtils::log("using IPv4 address: {$ip}");
100127
} elseif (is_ipv6_allowed() && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
101128
// IPv6
102-
$_dst = '::1';
129+
$_dst = $ipv6_redirect_addr != null ? $ipv6_redirect_addr : $ip;
103130
$_family = 'inet6';
104131
LeUtils::log("using IPv6 address: {$ip}");
105132
} else {

‎security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,33 @@ public function prepare()
8787
}
8888
}
8989

90+
// Find redirect target for IPv6
91+
//
92+
// Needed because redirecting to ::1 isn't allowed [1].
93+
//
94+
// [1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193568
95+
$ipv6_redirect_addr = null;
96+
if (is_ipv6_allowed()) {
97+
$backend = new \OPNsense\Core\Backend();
98+
$interface = "wan";
99+
$response = json_decode($backend->configdpRun('interface address', [$interface]));
100+
101+
if (isset($response->$interface)) {
102+
foreach ($response->$interface as $if) {
103+
if (!empty($if->address) && $if->family == "inet6") {
104+
$ipv6_redirect_addr = $if->address;
105+
break;
106+
}
107+
}
108+
}
109+
110+
if ($ipv6_redirect_addr != null) {
111+
LeUtils::log("found IPv6 on WAN interface, will redirect traffic there ({$ipv6_redirect_addr})");
112+
} else {
113+
LeUtils::log("failed to find IPv6 on WAN interface ($interface), will not rewrite target address");
114+
}
115+
}
116+
90117
// Generate rules for all IP addresses
91118
$anchor_rules = "";
92119
if (!empty($iplist)) {
@@ -100,7 +127,7 @@ public function prepare()
100127
LeUtils::log("using IPv4 address: {$ip}");
101128
} elseif (is_ipv6_allowed() && (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
102129
// IPv6
103-
$_dst = '::1';
130+
$_dst = $ipv6_redirect_addr != null ? $ipv6_redirect_addr : $ip;
104131
$_family = 'inet6';
105132
LeUtils::log("using IPv6 address: {$ip}");
106133
} else {

‎security/acme-client/src/opnsense/service/templates/OPNsense/AcmeClient/lighttpd-acme-challenge.conf‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
# FreeBSD!
88
server.event-handler = "freebsd-kqueue"
99
server.network-backend = "writev"
10-
#server.use-ipv6 = "enable"
10+
server.use-ipv6 = "{{ 'enable' if OPNsense.Interfaces.settings.disableipv6 == "0" else 'disable' }}"
1111

1212
# modules to load
1313
server.modules = ( "mod_access", "mod_expire", "mod_deflate", "mod_redirect",
@@ -60,13 +60,10 @@ mimetype.assign = (
6060
url.access-deny = ( "~", ".inc" )
6161

6262
# bind to port
63-
server.bind = "127.0.0.1"
6463
server.port = {{OPNsense.AcmeClient.settings.challengePort}}
65-
$SERVER["socket"] == "127.0.0.1:{{OPNsense.AcmeClient.settings.challengePort}}" { }
66-
67-
{% if OPNsense.Interfaces.settings.disableipv6 == "0" %}
68-
# IPv6
69-
$SERVER["socket"] == "[::1]:{{OPNsense.AcmeClient.settings.challengePort}}" { }
64+
$SERVER["socket"] == "0.0.0.0:{{OPNsense.AcmeClient.settings.challengePort}}" { }
65+
{% if OPNsense.Interfaces.settings.disableipv6 == "1" %}
66+
$SERVER["socket"] == "[::]:{{OPNsense.AcmeClient.settings.challengePort}}" { }
7067
{% endif %}
7168

7269
# to help the rc.scripts

0 commit comments

Comments
 (0)