Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
068076c0
Unverified
Commit
068076c0
authored
Jun 21, 2021
by
neil
Committed by
GitHub
Jun 21, 2021
Browse files
Merge pull request #3565 from acmesh-official/dev
Dev
parents
8a08de56
c0ae44a4
Changes
9
Hide whitespace changes
Inline
Side-by-side
.github/workflows/DNS.yml
View file @
068076c0
...
...
@@ -59,7 +59,7 @@ jobs:
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
-
name
:
Set env file
run
:
|
cd ../acmetest
cd ../acmetest
if [ "${{ secrets.TokenName1}}" ] ; then
echo "${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}" >> env.list
fi
...
...
@@ -75,7 +75,7 @@ jobs:
if [ "${{ secrets.TokenName5}}" ] ; then
echo "${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}" >> env.list
fi
echo "TEST_DNS_NO_WILDCARD" >> env.list
echo "TEST_DNS_NO_WILDCARD" >> env.list
echo "TEST_DNS_SLEEP" >> env.list
-
name
:
Run acmetest
run
:
cd ../acmetest && ./rundocker.sh testall
...
...
@@ -226,8 +226,10 @@ jobs:
-
uses
:
vmactions/solaris-vm@v0.0.3
with
:
envs
:
'
TEST_DNS
TestingDomain
TEST_DNS_NO_WILDCARD
TEST_DNS_SLEEP
CASE
TEST_LOCAL
DEBUG
${{
secrets.TokenName1}}
${{
secrets.TokenName2}}
${{
secrets.TokenName3}}
${{
secrets.TokenName4}}
${{
secrets.TokenName5}}'
prepare
:
pkgutil -y -i socat
curl
prepare
:
pkgutil -y -i socat
run
:
|
pkg set-mediator -v -I default@1.1 openssl
export PATH=/usr/gnu/bin:$PATH
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
fi
...
...
@@ -245,5 +247,3 @@ jobs:
fi
cd ../acmetest
./letest.sh
.github/workflows/LetsEncrypt.yml
View file @
068076c0
...
...
@@ -4,13 +4,14 @@ on:
branches
:
-
'
*'
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
pull_request
:
branches
:
-
dev
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
...
...
.github/workflows/Linux.yml
View file @
068076c0
...
...
@@ -4,16 +4,18 @@ on:
branches
:
-
'
*'
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
pull_request
:
branches
:
-
dev
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
jobs
:
Linux
:
strategy
:
...
...
.github/workflows/PebbleStrict.yml
View file @
068076c0
...
...
@@ -4,13 +4,13 @@ on:
branches
:
-
'
*'
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
pull_request
:
branches
:
-
dev
paths
:
-
'
*
*
.sh'
-
'
*.sh'
-
'
**.yml'
jobs
:
...
...
Dockerfile
View file @
068076c0
FROM
alpine:3.12
RUN
apk update
-f
\
&&
apk
--no-cache
add
-f
\
RUN
apk
--no-cache
add
-f
\
openssl
\
openssh-client
\
coreutils
\
...
...
@@ -12,8 +11,7 @@ RUN apk update -f \
tzdata
\
oath-toolkit-oathtool
\
tar
\
libidn
\
&&
rm
-rf
/var/cache/apk/
*
libidn
ENV
LE_CONFIG_HOME /acme.sh
...
...
@@ -22,7 +20,7 @@ ARG AUTO_UPGRADE=1
ENV
AUTO_UPGRADE $AUTO_UPGRADE
#Install
ADD
./ /install_acme.sh/
COPY
./ /install_acme.sh/
RUN
cd
/install_acme.sh
&&
([
-f
/install_acme.sh/acme.sh
]
&&
/install_acme.sh/acme.sh
--install
||
curl https://get.acme.sh | sh
)
&&
rm
-rf
/install_acme.sh/
...
...
README.md
View file @
068076c0
...
...
@@ -88,6 +88,7 @@ https://github.com/acmesh-official/acmetest
-
[
ZeroSSL.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA
)(
default
)
-
Letsencrypt.org CA
-
[
BuyPass.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/BuyPass.com-CA
)
-
[
SSL.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA
)
-
[
Pebble strict Mode
](
https://github.com/letsencrypt/pebble
)
-
Any other
[
RFC8555
](
https://tools.ietf.org/html/rfc8555
)
-compliant CA
...
...
@@ -469,7 +470,7 @@ TODO:
### Code Contributors
This project exists thanks to all the people who contribute.
[
[Contribute
](
CONTRIBUTING.md
)
].
This project exists thanks to all the people who contribute.
<a
href=
"https://github.com/acmesh-official/acme.sh/graphs/contributors"
><img
src=
"https://opencollective.com/acmesh/contributors.svg?width=890&button=false"
/></a>
### Financial Contributors
...
...
acme.sh
View file @
068076c0
...
...
@@ -29,18 +29,22 @@ CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory"
CA_ZEROSSL
=
"https://acme.zerossl.com/v2/DV90"
_ZERO_EAB_ENDPOINT
=
"http://api.zerossl.com/acme/eab-credentials-email"
CA_SSLCOM_RSA
=
"https://acme.ssl.com/sslcom-dv-rsa"
CA_SSLCOM_ECC
=
"https://acme.ssl.com/sslcom-dv-ecc"
DEFAULT_CA
=
$CA_ZEROSSL
DEFAULT_STAGING_CA
=
$CA_LETSENCRYPT_V2_TEST
CA_NAMES
=
"
ZeroSSL.com,zerossl
LetsEncrypt.org,letsencrypt
LetsEncrypt.org_test,letsencrypt_test,letsencrypttest
BuyPass.com,buypass
BuyPass.com_test,buypass_test,buypasstest
Zero
SSL.com,
zero
ssl
SSL.com,ssl
com
"
CA_SERVERS
=
"
$CA_LETSENCRYPT_V2
,
$CA_LETSENCRYPT_V2_TEST
,
$CA_BUYPASS
,
$CA_BUYPASS_TEST
,
$CA_
ZEROSSL
"
CA_SERVERS
=
"
$CA_
ZEROSSL
,
$CA_
LETSENCRYPT_V2
,
$CA_LETSENCRYPT_V2_TEST
,
$CA_BUYPASS
,
$CA_BUYPASS_TEST
,
$CA_
SSLCOM_RSA
"
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
...
...
@@ -155,6 +159,8 @@ _REVOKE_WIKI="https://github.com/acmesh-official/acme.sh/wiki/revokecert"
_ZEROSSL_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA"
_SSLCOM_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA"
_SERVER_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/Server"
_PREFERRED_CHAIN_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
...
...
@@ -1210,7 +1216,7 @@ _createcsr() {
_debug2 csr
"
$csr
"
_debug2 csrconf
"
$csrconf
"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
req_extensions = v3_req
\n
[ v3_req ]
\n\n
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
"
>
"
$csrconf
"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
req_extensions = v3_req
\n
[ v3_req ]
\n\n
"
>
"
$csrconf
"
if
[
"
$acmeValidationv1
"
]
;
then
domainlist
=
"
$(
_idn
"
$domainlist
"
)
"
...
...
@@ -2617,15 +2623,44 @@ _initpath() {
_ACME_SERVER_HOST
=
"
$(
echo
"
$ACME_DIRECTORY
"
|
cut
-d
:
-f
2 |
tr
-s
/ |
cut
-d
/
-f
2
)
"
_debug2
"_ACME_SERVER_HOST"
"
$_ACME_SERVER_HOST
"
CA_DIR
=
"
$CA_HOME
/
$_ACME_SERVER_HOST
"
_ACME_SERVER_PATH
=
"
$(
echo
"
$ACME_DIRECTORY
"
|
cut
-d
:
-f
2- |
tr
-s
/ |
cut
-d
/
-f
3-
)
"
_debug2
"_ACME_SERVER_PATH"
"
$_ACME_SERVER_PATH
"
CA_DIR
=
"
$CA_HOME
/
$_ACME_SERVER_HOST
/
$_ACME_SERVER_PATH
"
_DEFAULT_CA_CONF
=
"
$CA_DIR
/ca.conf"
if
[
-z
"
$CA_CONF
"
]
;
then
CA_CONF
=
"
$_DEFAULT_CA_CONF
"
fi
_debug3 CA_CONF
"
$CA_CONF
"
_OLD_CADIR
=
"
$CA_HOME
/
$_ACME_SERVER_HOST
"
_OLD_ACCOUNT_KEY
=
"
$_OLD_CADIR
/account.key"
_OLD_ACCOUNT_JSON
=
"
$_OLD_CADIR
/account.json"
_OLD_CA_CONF
=
"
$_OLD_CADIR
/ca.conf"
_DEFAULT_ACCOUNT_KEY_PATH
=
"
$CA_DIR
/account.key"
_DEFAULT_ACCOUNT_JSON_PATH
=
"
$CA_DIR
/account.json"
if
[
-z
"
$ACCOUNT_KEY_PATH
"
]
;
then
ACCOUNT_KEY_PATH
=
"
$_DEFAULT_ACCOUNT_KEY_PATH
"
if
[
-f
"
$_OLD_ACCOUNT_KEY
"
]
&&
!
[
-f
"
$ACCOUNT_KEY_PATH
"
]
;
then
mkdir
-p
"
$CA_DIR
"
mv
"
$_OLD_ACCOUNT_KEY
"
"
$ACCOUNT_KEY_PATH
"
fi
fi
if
[
-z
"
$ACCOUNT_JSON_PATH
"
]
;
then
ACCOUNT_JSON_PATH
=
"
$_DEFAULT_ACCOUNT_JSON_PATH
"
if
[
-f
"
$_OLD_ACCOUNT_JSON
"
]
&&
!
[
-f
"
$ACCOUNT_JSON_PATH
"
]
;
then
mkdir
-p
"
$CA_DIR
"
mv
"
$_OLD_ACCOUNT_JSON
"
"
$ACCOUNT_JSON_PATH
"
fi
fi
if
[
-f
"
$_OLD_CA_CONF
"
]
&&
!
[
-f
"
$CA_CONF
"
]
;
then
mkdir
-p
"
$CA_DIR
"
mv
"
$_OLD_CA_CONF
"
"
$CA_CONF
"
fi
if
[
-f
"
$CA_CONF
"
]
;
then
.
"
$CA_CONF
"
fi
...
...
@@ -2646,19 +2681,6 @@ _initpath() {
HTTP_HEADER
=
"
$LE_CONFIG_HOME
/http.header"
fi
_OLD_ACCOUNT_KEY
=
"
$LE_WORKING_DIR
/account.key"
_OLD_ACCOUNT_JSON
=
"
$LE_WORKING_DIR
/account.json"
_DEFAULT_ACCOUNT_KEY_PATH
=
"
$CA_DIR
/account.key"
_DEFAULT_ACCOUNT_JSON_PATH
=
"
$CA_DIR
/account.json"
if
[
-z
"
$ACCOUNT_KEY_PATH
"
]
;
then
ACCOUNT_KEY_PATH
=
"
$_DEFAULT_ACCOUNT_KEY_PATH
"
fi
if
[
-z
"
$ACCOUNT_JSON_PATH
"
]
;
then
ACCOUNT_JSON_PATH
=
"
$_DEFAULT_ACCOUNT_JSON_PATH
"
fi
_DEFAULT_CERT_HOME
=
"
$LE_CONFIG_HOME
"
if
[
-z
"
$CERT_HOME
"
]
;
then
CERT_HOME
=
"
$_DEFAULT_CERT_HOME
"
...
...
@@ -3489,15 +3511,6 @@ _regAccount() {
_initAPI
mkdir
-p
"
$CA_DIR
"
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_KEY
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_KEY
to
$ACCOUNT_KEY_PATH
"
mv
"
$_OLD_ACCOUNT_KEY
"
"
$ACCOUNT_KEY_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_JSON_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_JSON
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_JSON
to
$ACCOUNT_JSON_PATH
"
mv
"
$_OLD_ACCOUNT_JSON
"
"
$ACCOUNT_JSON_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
;
then
if
!
_create_account_key
"
$_reg_length
"
;
then
...
...
@@ -3635,16 +3648,6 @@ _regAccount() {
updateaccount
()
{
_initpath
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_KEY
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_KEY
to
$ACCOUNT_KEY_PATH
"
mv
"
$_OLD_ACCOUNT_KEY
"
"
$ACCOUNT_KEY_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_JSON_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_JSON
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_JSON
to
$ACCOUNT_JSON_PATH
"
mv
"
$_OLD_ACCOUNT_JSON
"
"
$ACCOUNT_JSON_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
;
then
_err
"Account key is not found at:
$ACCOUNT_KEY_PATH
"
return
1
...
...
@@ -3687,16 +3690,6 @@ updateaccount() {
deactivateaccount
()
{
_initpath
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_KEY
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_KEY
to
$ACCOUNT_KEY_PATH
"
mv
"
$_OLD_ACCOUNT_KEY
"
"
$ACCOUNT_KEY_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_JSON_PATH
"
]
&&
[
-f
"
$_OLD_ACCOUNT_JSON
"
]
;
then
_info
"mv
$_OLD_ACCOUNT_JSON
to
$ACCOUNT_JSON_PATH
"
mv
"
$_OLD_ACCOUNT_JSON
"
"
$ACCOUNT_JSON_PATH
"
fi
if
[
!
-f
"
$ACCOUNT_KEY_PATH
"
]
;
then
_err
"Account key is not found at:
$ACCOUNT_KEY_PATH
"
return
1
...
...
@@ -6638,9 +6631,10 @@ _checkSudo() {
return
0
}
#server
#server
#keylength
_selectServer
()
{
_server
=
"
$1
"
_skeylength
=
"
$2
"
_server_lower
=
"
$(
echo
"
$_server
"
| _lower_case
)
"
_sindex
=
0
for
snames
in
$CA_NAMES
;
do
...
...
@@ -6651,6 +6645,9 @@ _selectServer() {
if
[
"
$_server_lower
"
=
"
$sname
"
]
;
then
_debug2
"_selectServer match
$sname
"
_serverdir
=
"
$(
_getfield
"
$CA_SERVERS
"
$_sindex
)
"
if
[
"
$_serverdir
"
=
"
$CA_SSLCOM_RSA
"
]
&&
_isEccKey
"
$_skeylength
"
;
then
_serverdir
=
"
$CA_SSLCOM_ECC
"
fi
_debug
"Selected server:
$_serverdir
"
ACME_DIRECTORY
=
"
$_serverdir
"
export
ACME_DIRECTORY
...
...
@@ -6882,7 +6879,6 @@ _process() {
;;
--server
)
_server
=
"
$2
"
_selectServer
"
$_server
"
shift
;;
--debug
)
...
...
@@ -6981,7 +6977,6 @@ _process() {
Le_DNSSleep
=
"
$_dnssleep
"
shift
;;
--keylength
|
-k
)
_keylength
=
"
$2
"
shift
...
...
@@ -6990,7 +6985,6 @@ _process() {
_accountkeylength
=
"
$2
"
shift
;;
--cert-file
|
--certpath
)
_cert_file
=
"
$2
"
shift
...
...
@@ -7254,6 +7248,10 @@ _process() {
shift
1
done
if
[
"
$_server
"
]
;
then
_selectServer
"
$_server
"
"
${
_ecc
:-
$_keylength
}
"
fi
if
[
"
${
_CMD
}
"
!=
"install"
]
;
then
if
[
"
$__INTERACTIVE
"
]
&&
!
_checkSudo
;
then
if
[
-z
"
$FORCE
"
]
;
then
...
...
dnsapi/dns_nsd.sh
View file @
068076c0
...
...
@@ -51,7 +51,7 @@ dns_nsd_rm() {
Nsd_ZoneFile
=
"
${
Nsd_ZoneFile
:-
$(
_readdomainconf Nsd_ZoneFile
)
}
"
Nsd_Command
=
"
${
Nsd_Command
:-
$(
_readdomainconf Nsd_Command
)
}
"
sed
-
i
"/
$fulldomain
.
$ttlvalue
IN TXT
\"
$txtvalue
\"
/d"
"
$Nsd_ZoneFile
"
_
sed
_
i
"/
$fulldomain
.
$ttlvalue
IN TXT
\"
$txtvalue
\"
/d"
"
$Nsd_ZoneFile
"
_info
"Removed TXT record for
$fulldomain
"
_debug
"Running
$Nsd_Command
"
if
eval
"
$Nsd_Command
"
;
then
...
...
dnsapi/dns_oci.sh
0 → 100644
View file @
068076c0
#!/usr/bin/env sh
#
# Acme.sh DNS API plugin for Oracle Cloud Infrastructure
# Copyright (c) 2021, Oracle and/or its affiliates
#
# The plugin will automatically use the default profile from an OCI SDK and CLI
# configuration file, if it exists.
#
# Alternatively, set the following environment variables:
# - OCI_CLI_TENANCY : OCID of tenancy that contains the target DNS zone
# - OCI_CLI_USER : OCID of user with permission to add/remove records from zones
# - OCI_CLI_REGION : Should point to the tenancy home region
#
# One of the following two variables is required:
# - OCI_CLI_KEY_FILE: Path to private API signing key file in PEM format; or
# - OCI_CLI_KEY : The private API signing key in PEM format
#
# NOTE: using an encrypted private key that needs a passphrase is not supported.
#
dns_oci_add
()
{
_fqdn
=
"
$1
"
_rdata
=
"
$2
"
if
_get_oci_zone
;
then
_add_record_body
=
"{
\"
items
\"
:[{
\"
domain
\"
:
\"
${
_sub_domain
}
.
${
_domain
}
\"
,
\"
rdata
\"
:
\"
$_rdata
\"
,
\"
rtype
\"
:
\"
TXT
\"
,
\"
ttl
\"
: 30,
\"
operation
\"
:
\"
ADD
\"
}]}"
response
=
$(
_signed_request
"PATCH"
"/20180115/zones/
${
_domain
}
/records"
"
$_add_record_body
"
)
if
[
"
$response
"
]
;
then
_info
"Success: added TXT record for
${
_sub_domain
}
.
${
_domain
}
."
else
_err
"Error: failed to add TXT record for
${
_sub_domain
}
.
${
_domain
}
."
_err
"Check that the user has permission to add records to this zone."
return
1
fi
else
return
1
fi
}
dns_oci_rm
()
{
_fqdn
=
"
$1
"
_rdata
=
"
$2
"
if
_get_oci_zone
;
then
_remove_record_body
=
"{
\"
items
\"
:[{
\"
domain
\"
:
\"
${
_sub_domain
}
.
${
_domain
}
\"
,
\"
rdata
\"
:
\"
$_rdata
\"
,
\"
rtype
\"
:
\"
TXT
\"
,
\"
operation
\"
:
\"
REMOVE
\"
}]}"
response
=
$(
_signed_request
"PATCH"
"/20180115/zones/
${
_domain
}
/records"
"
$_remove_record_body
"
)
if
[
"
$response
"
]
;
then
_info
"Success: removed TXT record for
${
_sub_domain
}
.
${
_domain
}
."
else
_err
"Error: failed to remove TXT record for
${
_sub_domain
}
.
${
_domain
}
."
_err
"Check that the user has permission to remove records from this zone."
return
1
fi
else
return
1
fi
}
#################### Private functions below ##################################
_get_oci_zone
()
{
if
!
_oci_config
;
then
return
1
fi
if
!
_get_zone
"
$_fqdn
"
;
then
_err
"Error: DNS Zone not found for
$_fqdn
in
$OCI_CLI_TENANCY
"
return
1
fi
return
0
}
_oci_config
()
{
_DEFAULT_OCI_CLI_CONFIG_FILE
=
"
$HOME
/.oci/config"
OCI_CLI_CONFIG_FILE
=
"
${
OCI_CLI_CONFIG_FILE
:-
$(
_readaccountconf_mutable OCI_CLI_CONFIG_FILE
)
}
"
if
[
-z
"
$OCI_CLI_CONFIG_FILE
"
]
;
then
OCI_CLI_CONFIG_FILE
=
"
$_DEFAULT_OCI_CLI_CONFIG_FILE
"
fi
if
[
"
$_DEFAULT_OCI_CLI_CONFIG_FILE
"
!=
"
$OCI_CLI_CONFIG_FILE
"
]
;
then
_saveaccountconf_mutable OCI_CLI_CONFIG_FILE
"
$OCI_CLI_CONFIG_FILE
"
else
_clearaccountconf_mutable OCI_CLI_CONFIG_FILE
fi
_DEFAULT_OCI_CLI_PROFILE
=
"DEFAULT"
OCI_CLI_PROFILE
=
"
${
OCI_CLI_PROFILE
:-
$(
_readaccountconf_mutable OCI_CLI_PROFILE
)
}
"
if
[
"
$_DEFAULT_OCI_CLI_PROFILE
"
!=
"
$OCI_CLI_PROFILE
"
]
;
then
_saveaccountconf_mutable OCI_CLI_PROFILE
"
$OCI_CLI_PROFILE
"
else
OCI_CLI_PROFILE
=
"
$_DEFAULT_OCI_CLI_PROFILE
"
_clearaccountconf_mutable OCI_CLI_PROFILE
fi
OCI_CLI_TENANCY
=
"
${
OCI_CLI_TENANCY
:-
$(
_readaccountconf_mutable OCI_CLI_TENANCY
)
}
"
if
[
"
$OCI_CLI_TENANCY
"
]
;
then
_saveaccountconf_mutable OCI_CLI_TENANCY
"
$OCI_CLI_TENANCY
"
elif
[
-f
"
$OCI_CLI_CONFIG_FILE
"
]
;
then
_debug
"Reading OCI_CLI_TENANCY value from:
$OCI_CLI_CONFIG_FILE
"
OCI_CLI_TENANCY
=
"
${
OCI_CLI_TENANCY
:-
$(
_readini
"
$OCI_CLI_CONFIG_FILE
"
tenancy
"
$OCI_CLI_PROFILE
"
)
}
"
fi
if
[
-z
"
$OCI_CLI_TENANCY
"
]
;
then
_err
"Error: unable to read OCI_CLI_TENANCY from config file or environment variable."
return
1
fi
OCI_CLI_USER
=
"
${
OCI_CLI_USER
:-
$(
_readaccountconf_mutable OCI_CLI_USER
)
}
"
if
[
"
$OCI_CLI_USER
"
]
;
then
_saveaccountconf_mutable OCI_CLI_USER
"
$OCI_CLI_USER
"
elif
[
-f
"
$OCI_CLI_CONFIG_FILE
"
]
;
then
_debug
"Reading OCI_CLI_USER value from:
$OCI_CLI_CONFIG_FILE
"
OCI_CLI_USER
=
"
${
OCI_CLI_USER
:-
$(
_readini
"
$OCI_CLI_CONFIG_FILE
"
user
"
$OCI_CLI_PROFILE
"
)
}
"
fi
if
[
-z
"
$OCI_CLI_USER
"
]
;
then
_err
"Error: unable to read OCI_CLI_USER from config file or environment variable."
return
1
fi
OCI_CLI_REGION
=
"
${
OCI_CLI_REGION
:-
$(
_readaccountconf_mutable OCI_CLI_REGION
)
}
"
if
[
"
$OCI_CLI_REGION
"
]
;
then
_saveaccountconf_mutable OCI_CLI_REGION
"
$OCI_CLI_REGION
"
elif
[
-f
"
$OCI_CLI_CONFIG_FILE
"
]
;
then
_debug
"Reading OCI_CLI_REGION value from:
$OCI_CLI_CONFIG_FILE
"
OCI_CLI_REGION
=
"
${
OCI_CLI_REGION
:-
$(
_readini
"
$OCI_CLI_CONFIG_FILE
"
region
"
$OCI_CLI_PROFILE
"
)
}
"
fi
if
[
-z
"
$OCI_CLI_REGION
"
]
;
then
_err
"Error: unable to read OCI_CLI_REGION from config file or environment variable."
return
1
fi
OCI_CLI_KEY
=
"
${
OCI_CLI_KEY
:-
$(
_readaccountconf_mutable OCI_CLI_KEY
)
}
"
if
[
-z
"
$OCI_CLI_KEY
"
]
;
then
_clearaccountconf_mutable OCI_CLI_KEY
OCI_CLI_KEY_FILE
=
"
${
OCI_CLI_KEY_FILE
:-
$(
_readini
"
$OCI_CLI_CONFIG_FILE
"
key_file
"
$OCI_CLI_PROFILE
"
)
}
"
if
[
"
$OCI_CLI_KEY_FILE
"
]
&&
[
-f
"
$OCI_CLI_KEY_FILE
"
]
;
then
_debug
"Reading OCI_CLI_KEY value from:
$OCI_CLI_KEY_FILE
"
OCI_CLI_KEY
=
$(
_base64 <
"
$OCI_CLI_KEY_FILE
"
)
_saveaccountconf_mutable OCI_CLI_KEY
"
$OCI_CLI_KEY
"
fi
else
_saveaccountconf_mutable OCI_CLI_KEY
"
$OCI_CLI_KEY
"
fi
if
[
-z
"
$OCI_CLI_KEY_FILE
"
]
&&
[
-z
"
$OCI_CLI_KEY
"
]
;
then
_err
"Error: unable to find key file path in OCI config file or OCI_CLI_KEY_FILE."
_err
"Error: unable to load private API signing key from OCI_CLI_KEY."
return
1
fi
if
[
"
$(
printf
"%s
\n
"
"
$OCI_CLI_KEY
"
|
wc
-l
)
"
-eq
1
]
;
then
OCI_CLI_KEY
=
$(
printf
"%s"
"
$OCI_CLI_KEY
"
| _dbase64 multiline
)
fi
return
0
}
# _get_zone(): retrieves the Zone name and OCID
#
# _sub_domain=_acme-challenge.www
# _domain=domain.com
# _domain_ociid=ocid1.dns-zone.oc1..
_get_zone
()
{
domain
=
$1
i
=
1
p
=
1
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
if
[
-z
"
$h
"
]
;
then
# not valid
return
1
fi
_domain_id
=
$(
_signed_request
"GET"
"/20180115/zones/
$h
"
""
"id"
)
if
[
"
$_domain_id
"
]
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
_debug _domain_id
"
$_domain_id
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
return
0
fi
p
=
$i
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
}
#Usage: privatekey
#Output MD5 fingerprint
_fingerprint
()
{
pkey
=
"
$1
"
if
[
-z
"
$pkey
"
]
;
then
_usage
"Usage: _fingerprint privkey"
return
1
fi
printf
"%s"
"
$pkey
"
|
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-pubout
-outform
DER 2>/dev/null |
${
ACME_OPENSSL_BIN
:-
openssl
}
md5
-c
|
cut
-d
=
-f
2 |
tr
-d
' '
}
_signed_request
()
{
_sig_method
=
"
$1
"
_sig_target
=
"
$2
"
_sig_body
=
"
$3
"
_return_field
=
"
$4
"
_key_fingerprint
=
$(
_fingerprint
"
$OCI_CLI_KEY
"
)
_sig_host
=
"dns.
$OCI_CLI_REGION
.oraclecloud.com"
_sig_keyId
=
"
$OCI_CLI_TENANCY
/
$OCI_CLI_USER
/
$_key_fingerprint
"
_sig_alg
=
"rsa-sha256"
_sig_version
=
"1"
_sig_now
=
"
$(
LC_ALL
=
C
\d
ate
-u
"+%a, %d %h %Y %H:%M:%S GMT"
)
"
_request_method
=
$(
printf
%s
"
$_sig_method
"
| _lower_case
)
_curl_method
=
$(
printf
%s
"
$_sig_method
"
| _upper_case
)
_request_target
=
"(request-target):
$_request_method
$_sig_target
"
_date_header
=
"date:
$_sig_now
"
_host_header
=
"host:
$_sig_host
"
_string_to_sign
=
"
$_request_target
\n
$_date_header
\n
$_host_header
"
_sig_headers
=
"(request-target) date host"
if
[
"
$_sig_body
"
]
;
then
_secure_debug3 _sig_body
"
$_sig_body
"
_sig_body_sha256
=
"x-content-sha256:
$(
printf
%s
"
$_sig_body
"
| _digest sha256
)
"
_sig_body_type
=
"content-type: application/json"
_sig_body_length
=
"content-length:
${#
_sig_body
}
"
_string_to_sign
=
"
$_string_to_sign
\n
$_sig_body_sha256
\n
$_sig_body_type
\n
$_sig_body_length
"
_sig_headers
=
"
$_sig_headers
x-content-sha256 content-type content-length"
fi
_tmp_file
=
$(
_mktemp
)
if
[
-f
"
$_tmp_file
"
]
;
then
printf
'%s'
"
$OCI_CLI_KEY
"
>
"
$_tmp_file
"
_signature
=
$(
printf
'%b'
"
$_string_to_sign
"
| _sign
"
$_tmp_file
"
sha256 |
tr
-d
'\r\n'
)
rm
-f
"
$_tmp_file
"
fi
_signed_header
=
"Authorization: Signature version=
\"
$_sig_version
\"
,keyId=
\"
$_sig_keyId
\"
,algorithm=
\"
$_sig_alg
\"
,headers=
\"
$_sig_headers
\"
,signature=
\"
$_signature
\"
"
_secure_debug3 _signed_header
"
$_signed_header
"
if
[
"
$_curl_method
"
=
"GET"
]
;
then
export
_H1
=
"
$_date_header
"
export
_H2
=
"
$_signed_header
"
_response
=
"
$(
_get
"https://
${
_sig_host
}${
_sig_target
}
"
)
"
elif
[
"
$_curl_method
"
=
"PATCH"
]
;
then
export
_H1
=
"
$_date_header
"
export
_H2
=
"
$_sig_body_sha256
"
export
_H3
=
"
$_sig_body_type
"
export
_H4
=
"
$_sig_body_length
"
export
_H5
=
"
$_signed_header
"
_response
=
"
$(
_post
"
$_sig_body
"
"https://
${
_sig_host
}${
_sig_target
}
"
""
"PATCH"
)
"
else
_err
"Unable to process method:
$_curl_method
."
fi
_ret
=
"
$?
"
if
[
"
$_return_field
"
]
;
then
_response
=
"
$(
echo
"
$_response
"
|
sed
's/\\\"//g'
)
)"
_return
=
$(
echo
"
${
_response
}
"
| _egrep_o
"
\"
$_return_field
\"\\
s*:
\\
s*
\"
[^
\"
]*
\"
"
| _head_n 1 |
cut
-d
:
-f
2 |
tr
-d
"
\"
"
)
else
_return
=
"
$_response
"
fi
printf
"%s"
"
$_return
"
return
$_ret
}
# file key [section]
_readini
()
{
_file
=
"
$1
"
_key
=
"
$2
"
_section
=
"
${
3
:-
DEFAULT
}
"
_start_n
=
$(
grep
-n
'\['
"
$_section
"
']'
"
$_file
"
|
cut
-d
:
-f
1
)
_debug3 _start_n
"
$_start_n
"
if
[
-z
"
$_start_n
"
]
;
then
_err
"Can not find section:
$_section
"
return
1
fi
_start_nn
=
$(
_math
"
$_start_n
"
+ 1
)
_debug3
"_start_nn"
"
$_start_nn
"
_left
=
"
$(
sed
-n
"
${
_start_nn
}
,99999p"
"
$_file
"
)
"
_debug3 _left
"
$_left
"
_end
=
"
$(
echo
"
$_left
"
|
grep
-n
"^
\[
"
| _head_n 1
)
"
_debug3
"_end"
"
$_end
"
if
[
"
$_end
"
]
;
then
_end_n
=
$(
echo
"
$_end
"
|
cut
-d
:
-f
1
)
_debug3
"_end_n"
"
$_end_n
"
_seg_n
=
$(
echo
"
$_left
"
|
sed
-n
"1,
${
_end_n
}
p"
)
else
_seg_n
=
"
$_left
"
fi
_debug3
"_seg_n"
"
$_seg_n
"
_lineini
=
"
$(
echo
"
$_seg_n
"
|
grep
"^ *
$_key
*= *"
)
"
_inivalue
=
"
$(
printf
"%b"
"
$(
eval
"echo
$_lineini
| sed
\"
s/^ *
${
_key
}
*= *//g
\"
"
)
"
)
"
_debug2 _inivalue
"
$_inivalue
"
echo
"
$_inivalue
"
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment