Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
4742e095
Commit
4742e095
authored
Jan 30, 2017
by
neil
Committed by
GitHub
Jan 30, 2017
Browse files
Merge pull request #563 from Neilpang/dev
Dev
parents
911a2084
c3b1eb08
Changes
5
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
4742e095
...
...
@@ -336,15 +336,245 @@ _h2b() {
done
}
#hex string
_hex
()
{
_str
=
"
$1
"
_str_len
=
${#
_str
}
_h_i
=
1
while
[
"
$_h_i
"
-le
"
$_str_len
"
]
;
do
_str_c
=
"
$(
printf
"%s"
"
$_str
"
|
cut
-c
"
$_h_i
"
)
"
printf
"%02x"
"'
$_str_c
"
_h_i
=
"
$(
_math
"
$_h_i
"
+ 1
)
"
_is_solaris() {
_contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
}
#stdin output hexstr splited by one space
#input:"abc"
#output: " 61 62 63"
_hex_dump() {
if _is_solaris; then
od -A n -v -t x1 | tr -d "\r\n\t" | tr -s " " | tr -d "\n"
else
od -A n -v -t x1 | tr -d "\r\n\t" | tr -s " " | sed "s/ $//" | tr -d "\n"
fi
}
#url encode, no-preserved chars
#A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
#41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
#a b c d e f g h i j k l m n o p q r s t u v w x y z
#61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
#0 1 2 3 4 5 6 7 8 9 - _ . ~
#30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
#stdin stdout
_url_encode() {
_hex_str=$(_hex_dump)
_debug3 "_url_encode"
_debug3 "_hex_str" "$_hex_str"
for _hex_code in $_hex_str; do
#upper case
case "${_hex_code}" in
"41")
printf "%s" "A"
;;
"42")
printf "%s" "B"
;;
"43")
printf "%s" "C"
;;
"44")
printf "%s" "D"
;;
"45")
printf "%s" "E"
;;
"46")
printf "%s" "F"
;;
"47")
printf "%s" "G"
;;
"48")
printf "%s" "H"
;;
"49")
printf "%s" "I"
;;
"4a")
printf "%s" "J"
;;
"4b")
printf "%s" "K"
;;
"4c")
printf "%s" "L"
;;
"4d")
printf "%s" "M"
;;
"4e")
printf "%s" "N"
;;
"4f")
printf "%s" "O"
;;
"50")
printf "%s" "P"
;;
"51")
printf "%s" "Q"
;;
"52")
printf "%s" "R"
;;
"53")
printf "%s" "S"
;;
"54")
printf "%s" "T"
;;
"55")
printf "%s" "U"
;;
"56")
printf "%s" "V"
;;
"57")
printf "%s" "W"
;;
"58")
printf "%s" "X"
;;
"59")
printf "%s" "Y"
;;
"5a")
printf "%s" "Z"
;;
#lower case
"61")
printf "%s" "a"
;;
"62")
printf "%s" "b"
;;
"63")
printf "%s" "c"
;;
"64")
printf "%s" "d"
;;
"65")
printf "%s" "e"
;;
"66")
printf "%s" "f"
;;
"67")
printf "%s" "g"
;;
"68")
printf "%s" "h"
;;
"69")
printf "%s" "i"
;;
"6a")
printf "%s" "j"
;;
"6b")
printf "%s" "k"
;;
"6c")
printf "%s" "l"
;;
"6d")
printf "%s" "m"
;;
"6e")
printf "%s" "n"
;;
"6f")
printf "%s" "o"
;;
"70")
printf "%s" "p"
;;
"71")
printf "%s" "q"
;;
"72")
printf "%s" "r"
;;
"73")
printf "%s" "s"
;;
"74")
printf "%s" "t"
;;
"75")
printf "%s" "u"
;;
"76")
printf "%s" "v"
;;
"77")
printf "%s" "w"
;;
"78")
printf "%s" "x"
;;
"79")
printf "%s" "y"
;;
"7a")
printf "%s" "z"
;;
#numbers
"30")
printf "%s" "0"
;;
"31")
printf "%s" "1"
;;
"32")
printf "%s" "2"
;;
"33")
printf "%s" "3"
;;
"34")
printf "%s" "4"
;;
"35")
printf "%s" "5"
;;
"36")
printf "%s" "6"
;;
"37")
printf "%s" "7"
;;
"38")
printf "%s" "8"
;;
"39")
printf "%s" "9"
;;
"2d")
printf "%s" "-"
;;
"5f")
printf "%s" "_"
;;
"2e")
printf "%s" "."
;;
"7e")
printf "%s" "~"
;;
#other hex
*)
printf '%%%s' "$_hex_code"
;;
esac
done
}
...
...
@@ -868,7 +1098,7 @@ createCSR() {
}
_url
encod
e
()
{
_url
_replac
e() {
tr '/+' '_-' | tr -d '= '
}
...
...
@@ -935,7 +1165,7 @@ _calcjwk() {
modulus=$($OPENSSL_BIN rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
_debug3 modulus "$modulus"
n
=
"
$(
printf
"%s"
"
$modulus
"
| _h2b | _base64 | _url
encod
e
)
"
n="$(printf "%s" "$modulus" | _h2b | _base64 | _url
_replac
e)"
_debug3 n "$n"
jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
...
...
@@ -990,14 +1220,14 @@ _calcjwk() {
x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
_debug3 x "$x"
x64
=
"
$(
printf
"%s"
"
$x
"
|
tr
-d
: | _h2b | _base64 | _url
encod
e
)
"
x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url
_replac
e)"
_debug3 x64 "$x64"
xend=$(_math "$xend" + 1)
y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
_debug3 y "$y"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url
encod
e
)
"
y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url
_replac
e)"
_debug3 y64 "$y64"
jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
...
...
@@ -1241,7 +1471,7 @@ _send_signed_request() {
return 1
fi
payload64
=
$(
printf
"%s"
"
$payload
"
| _base64 | _url
encod
e
)
payload64=$(printf "%s" "$payload" | _base64 | _url
_replac
e)
_debug3 payload64 "$payload64"
if [ -z "$_CACHED_NONCE" ]; then
...
...
@@ -1267,7 +1497,7 @@ _send_signed_request() {
protected="$JWK_HEADERPLACE_PART1$nonce$JWK_HEADERPLACE_PART2"
_debug3 protected "$protected"
protected64
=
"
$(
printf
"%s"
"
$protected
"
| _base64 | _url
encod
e
)
"
protected64="$(printf "%s" "$protected" | _base64 | _url
_replac
e)"
_debug3 protected64 "$protected64"
if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
...
...
@@ -1276,7 +1506,7 @@ _send_signed_request() {
fi
_debug3 _sig_t "$_sig_t"
sig
=
"
$(
printf
"%s"
"
$_sig_t
"
| _url
encod
e
)
"
sig="$(printf "%s" "$_sig_t" | _url
_replac
e)"
_debug3 sig "$sig"
body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
...
...
@@ -2005,7 +2235,7 @@ _clearupdns() {
keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
_currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
txt
=
"
$(
printf
"%s"
"
$keyauthorization
"
| _digest
"sha256"
| _url
encod
e
)
"
txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url
_replac
e)"
_debug txt "$txt"
if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
_info "$d is already verified, skip $vtype."
...
...
@@ -2549,7 +2779,7 @@ issue() {
if [ -z "$thumbprint" ]; then
accountkey_json=$(printf "%s" "$jwk" | tr -d ' ')
thumbprint
=
$(
printf
"%s"
"
$accountkey_json
"
| _digest
"sha256"
| _url
encod
e
)
thumbprint=$(printf "%s" "$accountkey_json" | _digest "sha256" | _url
_replac
e)
fi
entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
...
...
@@ -2600,7 +2830,7 @@ issue() {
dnsadded='0'
txtdomain="_acme-challenge.$d"
_debug txtdomain "$txtdomain"
txt
=
"
$(
printf
"%s"
"
$keyauthorization
"
| _digest
"sha256"
| _url
encod
e
)
"
txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url
_replac
e)"
_debug txt "$txt"
d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
...
...
@@ -2875,7 +3105,7 @@ issue() {
_clearup
_info "Verify finished, start to sign."
der
=
"
$(
_getfile
"
${
CSR_PATH
}
"
"
${
BEGIN_CSR
}
"
"
${
END_CSR
}
"
|
tr
-d
"
\r\n
"
| _url
encod
e
)
"
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url
_replac
e)"
if ! _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"; then
_err "Sign failed."
...
...
@@ -3453,7 +3683,7 @@ revoke() {
return 1
fi
cert
=
"
$(
_getfile
"
${
CERT_PATH
}
"
"
${
BEGIN_CERT
}
"
"
${
END_CERT
}
"
|
tr
-d
"
\r\n
"
| _url
encod
e
)
"
cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url
_replac
e)"
if [ -z "$cert" ]; then
_err "Cert for $Le_Domain is empty found, skip."
...
...
deploy/kong.sh
0 → 100644
View file @
4742e095
#!/usr/bin/env sh
# This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter.
# Note that ssl plugin should be available on Kong instance
# The hook will match cdomain to request_host, in case of multiple domain it will always take the first
# one (acme.sh behaviour).
# If ssl config already exist it will update only cert and key not touching other parameter
# If ssl config doesn't exist it will only upload cert and key and not set other parameter
# Not that we deploy full chain
# See https://getkong.org/plugins/dynamic-ssl/ for other options
# Written by Geoffroi Genot <ggenot@voxbone.com>
######## Public functions #####################
#domain keyfile certfile cafile fullchain
kong_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_info
"Deploying certificate on Kong instance"
if
[
-z
"
$KONG_URL
"
]
;
then
_debug
"KONG_URL Not set, using default http://localhost:8001"
KONG_URL
=
"http://localhost:8001"
fi
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
#Get uuid linked to the domain
uuid
=
$(
_get
"
$KONG_URL
/apis?request_host=
$_cdomain
"
| _normalizeJson | _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
if
[
-z
"
$uuid
"
]
;
then
_err
"Unable to get Kong uuid for domain
$_cdomain
"
_err
"Make sure that KONG_URL is correctly configured"
_err
"Make sure that a Kong api request_host match the domain"
_err
"Kong url:
$KONG_URL
"
return
1
fi
#Save kong url if it's succesful (First run case)
_saveaccountconf KONG_URL
"
$KONG_URL
"
#Generate DEIM
delim
=
"-----MultipartDelimeter
$(
date
"+%s%N"
)
"
nl
=
"
\0
15
\0
12"
#Set Header
_H1
=
"Content-Type: multipart/form-data; boundary=
$delim
"
#Generate data for request (Multipart/form-data with mixed content)
#set name to ssl
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
name
\"
${
nl
}${
nl
}
ssl"
#add key
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
#Add cert
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.cert
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
#Close multipart
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
#Convert CRLF
content
=
$(
printf
%b
"
$content
"
)
#DEBUG
_debug header
"
$_H1
"
_debug content
"
$content
"
#Check if ssl plugins is aready enabled (if not => POST else => PATCH)
ssl_uuid
=
$(
_get
"
$KONG_URL
/apis/
$uuid
/plugins"
| _egrep_o
'"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"'
| _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
_debug ssl_uuid
"
$ssl_uuid
"
if
[
-z
"
$ssl_uuid
"
]
;
then
#Post certificate to Kong
response
=
$(
_post
"
$content
"
"
$KONG_URL
/apis/
$uuid
/plugins"
""
"POST"
)
else
#patch
response
=
$(
_post
"
$content
"
"
$KONG_URL
/apis/
$uuid
/plugins/
$ssl_uuid
"
""
"PATCH"
)
fi
if
!
[
"
$(
echo
"
$response
"
| _egrep_o
"ssl"
)
"
=
"ssl"
]
;
then
_err
"An error occured with cert upload. Check response:"
_err
"
$response
"
return
1
fi
_debug response
"
$response
"
_info
"Certificate successfully deployed"
}
dnsapi/dns_ali.sh
View file @
4742e095
...
...
@@ -67,7 +67,7 @@ _get_root() {
}
_ali_rest
()
{
signature
=
$(
printf
"%s"
"GET&%2F&
$(
_ali_urlencode
"
$query
"
)
"
| _hmac
"sha1"
"
$(
_hex
"
$Ali_Secret
&"
)
"
| _base64
)
signature
=
$(
printf
"%s"
"GET&%2F&
$(
_ali_urlencode
"
$query
"
)
"
| _hmac
"sha1"
"
$(
printf
"%s"
"
$Ali_Secret
&"
| _hex_dump |
sed
"s/ //g"
)
"
| _base64
)
signature
=
$(
_ali_urlencode
"
$signature
"
)
url
=
"
$Ali_API
?
$query
&Signature=
$signature
"
...
...
dnsapi/dns_aws.sh
View file @
4742e095
...
...
@@ -183,7 +183,7 @@ aws_rest() {
_debug2 kSecret
"
$kSecret
"
kSecretH
=
"
$(
_hex
"
$kSecret
"
)
"
kSecretH
=
"
$(
printf
"%s"
"
$kSecret
"
| _hex_dump |
sed
"s/ //g
"
)
"
_debug2 kSecretH
"
$kSecretH
"
kDateH
=
"
$(
printf
"
$RequestDateOnly
%s"
| _hmac
"
$Hash
"
"
$kSecretH
"
hex
)
"
...
...
dnsapi/dns_me.sh
View file @
4742e095
...
...
@@ -124,7 +124,7 @@ _me_rest() {
_debug
"
$ep
"
cdate
=
$(
date
-u
+
"%a, %d %b %Y %T %Z"
)
hmac
=
$(
printf
"%s"
"
$cdate
"
| _hmac sha1
"
$(
_hex
"
$ME_Secret
"
)
"
hex
)
hmac
=
$(
printf
"%s"
"
$cdate
"
| _hmac sha1
"
$(
printf
"%s"
"
$ME_Secret
"
| _hex_dump |
sed
"s/ //g"
)
"
hex
)
export
_H1
=
"x-dnsme-apiKey:
$ME_Key
"
export
_H2
=
"x-dnsme-requestDate:
$cdate
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment