Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
52a168b9
Unverified
Commit
52a168b9
authored
Feb 08, 2020
by
Brian Hartvigsen
Browse files
Stop using jq/curl directly
This is a lot more fragile then the previous code due to treating JSON as just a string
parent
b3b00b67
Changes
1
Hide whitespace changes
Inline
Side-by-side
deploy/synology_dsm.sh
View file @
52a168b9
...
...
@@ -20,6 +20,12 @@
######## Public functions #####################
_syno_get_cookie_data
()
{
_debug2 Cookie
"
$1
"
_debug3
grep
"
$(
grep
"
\W
$1
="
"
$HTTP_HEADER
"
|
grep
"^Set-Cookie:"
| _tail_n 1 | _egrep_o
"
$1
=[^;]*;"
|
tr
-d
';'
)
"
grep
"
\W
$1
="
"
$HTTP_HEADER
"
|
grep
"^Set-Cookie:"
| _tail_n 1 | _egrep_o
"
$1
=[^;]*;"
|
tr
-d
';'
}
#domain keyfile certfile cafile fullchain
synology_dsm_deploy
()
{
...
...
@@ -31,8 +37,8 @@ synology_dsm_deploy() {
_debug _cdomain
"
$_cdomain
"
# Get Username and Password, but don't save until we successfully authenticate
SYNO_Username
=
"
${
SYNO_Username
:-
$(
_
readdomain
conf SYNO_Username
)
}
"
SYNO_Password
=
"
${
SYNO_Password
:-
$(
_
readdomain
conf SYNO_Password
)
}
"
SYNO_Username
=
"
${
SYNO_Username
:-
$(
_
getdeploy
conf SYNO_Username
)
}
"
SYNO_Password
=
"
${
SYNO_Password
:-
$(
_
getdeploy
conf SYNO_Password
)
}
"
if
[
-z
"
$SYNO_Username
"
]
||
[
-z
"
$SYNO_Password
"
]
;
then
SYNO_Username
=
""
SYNO_Password
=
""
...
...
@@ -43,12 +49,12 @@ synology_dsm_deploy() {
_secure_debug2 SYNO_Password
"
$SYNO_Password
"
# Optional scheme, hostname, and port for Synology DSM
SYNO_Scheme
=
"
${
SYNO_Scheme
:-
$(
_
readdomain
conf SYNO_Scheme
)
}
"
SYNO_Hostname
=
"
${
SYNO_Hostname
:-
$(
_
readdomain
conf SYNO_Hostname
)
}
"
SYNO_Port
=
"
${
SYNO_Port
:-
$(
_
readdomain
conf SYNO_Port
)
}
"
_saved
omain
conf SYNO_Scheme
"
$SYNO_Scheme
"
_saved
omain
conf SYNO_Hostname
"
$SYNO_Hostname
"
_saved
omain
conf SYNO_Port
"
$SYNO_Port
"
SYNO_Scheme
=
"
${
SYNO_Scheme
:-
$(
_
getdeploy
conf SYNO_Scheme
)
}
"
SYNO_Hostname
=
"
${
SYNO_Hostname
:-
$(
_
getdeploy
conf SYNO_Hostname
)
}
"
SYNO_Port
=
"
${
SYNO_Port
:-
$(
_
getdeploy
conf SYNO_Port
)
}
"
_saved
eploy
conf SYNO_Scheme
"
$SYNO_Scheme
"
_saved
eploy
conf SYNO_Hostname
"
$SYNO_Hostname
"
_saved
eploy
conf SYNO_Port
"
$SYNO_Port
"
# default vaules for scheme, hostname, and port
# defaulting to localhost and http because it's localhost...
...
...
@@ -69,77 +75,78 @@ synology_dsm_deploy() {
fi
_debug SYNO_Certificate
"
$SYNO_Certificate
"
# We can't use _get or _post because they lack support for cookies
# use jq because I'm too lazy to figure out what is required to parse json
# by hand. Also it seems to be in place for Synology DSM (6.2.1 at least)
for
x
in
curl jq
;
do
if
!
_exists
"
$x
"
;
then
_err
"Please install
$x
first."
_err
"We need
$x
to work."
return
1
fi
done
_base_url
=
"
$SYNO_Scheme
://
$SYNO_Hostname
:
$SYNO_Port
"
_debug _base_url
"
$_base_url
"
_cookie_jar
=
"
$(
_mktemp
)
"
_debug _cookie_jar
"
$_cookie_jar
"
# Login, get the token from JSON and session id from cookie
_debug
"Logging into
$SYNO_Hostname
:
$SYNO_Port
"
token
=
$(
curl
-sk
-c
"
$_cookie_jar
"
"
$_base_url
/webman/login.cgi?username=
$SYNO_Username
&passwd=
$SYNO_Password
&enable_syno_token=yes"
| jq
-r
.SynoToken
)
if
[
"
$token
"
=
"null"
]
;
then
_info
"Logging into
$SYNO_Hostname
:
$SYNO_Port
"
response
=
$(
_get
"
$_base_url
/webman/login.cgi?username=
$SYNO_Username
&passwd=
$SYNO_Password
&enable_syno_token=yes"
)
token
=
$(
echo
"
$response
"
|
grep
"SynoToken"
|
sed
-n
's/.*"SynoToken" *: *"\([^"]*\).*/\1/p'
)
_debug3 response
"
$response
"
if
[
-z
"
$token
"
]
;
then
_err
"Unable to authenticate to
$SYNO_Hostname
:
$SYNO_Port
using
$SYNO_Scheme
."
_err
"Check your username and password."
rm
"
$_cookie_jar
"
return
1
fi
_H1
=
"Cookie:
$(
_syno_get_cookie_data
"id"
)
;
$(
_syno_get_cookie_data
"smid"
)
"
_H2
=
"X-SYNO-TOKEN:
$token
"
export
_H1
export
_H2
_debug3 H1
"
${
_H1
}
"
_debug3 H2
"
${
_H2
}
"
# Now that we know the username and password are good, save them
_saved
omain
conf SYNO_Username
"
$SYNO_Username
"
_saved
omain
conf SYNO_Password
"
$SYNO_Password
"
_saved
eploy
conf SYNO_Username
"
$SYNO_Username
"
_saved
eploy
conf SYNO_Password
"
$SYNO_Password
"
_secure_debug2 token
"
$token
"
# Use token and session id to get the list of certificates
response
=
$(
curl
-sk
-b
"
$_cookie_jar
"
"
$_base_url
/webapi/entry.cgi"
-H
"X-SYNO-TOKEN:
$token
"
-d
api
=
SYNO.Core.Certificate.CRT
-d
method
=
list
-d
version
=
1
)
_info
"Getting certificates in Synology DSM"
response
=
$(
_post
"
api=SYNO.Core.Certificate.CRT
&
method=list
&
version=1
"
"
$_base_url
/webapi/entry.cgi"
)
_debug3 response
"
$response
"
# select the first certificate matching our description
cert
=
$(
echo
"
$response
"
| jq
-r
".data.certificates | map(select(.desc ==
\"
$SYNO_Certificate
\"
))[0]"
)
_debug3 cert
"
$cert
"
id
=
$(
printf
"
$response
"
|
sed
-n
"s/.*
\"
desc
\"
:
\"
$SYNO_Certificate
\"
,
\"
id
\"
:
\"\(
[^
\"
]*
\)
.*/
\1
/p"
)
_debug2
id
"
$id
"
if
[
"
$cert
"
=
"null
"
]
;
then
if
[
-z
"
$id
"
]
;
then
_err
"Unable to find certificate:
$SYNO_Certificate
"
rm
"
$_cookie_jar
"
return
1
fi
# we've verified this certificate description is a thing, so save it
_savedeployconf SYNO_Certificate
"
$SYNO_Certificate
"
id
=
$(
echo
"
$cert
"
| jq
-r
".id"
)
default
=
$(
echo
"
$cert
"
| jq
-r
".is_default"
)
_debug2
id
"
$id
"
default
=
false
if
printf
"
$response
"
|
sed
-n
"s/.*
\"
desc
\"
:
\"
$SYNO_Certificate
\"
,
\(
[^{]*
\)
.*/
\1
/p"
|
grep
-q
--
'is_default":true'
;
then
default
=
true
fi
_debug2 default
"
$default
"
# This is the heavy lifting, make the API call to update a certificate in place
response
=
$(
curl
-sk
-b
"
$_cookie_jar
"
"
$_base_url
/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=
$token
"
-F
"key=@
$_ckey
"
-F
"cert=@
$_ccert
"
-F
"inter_cert=@
$_cca
"
-F
"id=
$id
"
-F
"desc=
$SYNO_Certificate
"
-F
"as_default=
$default
"
)
_info
"Generate form POST request"
nl
=
"
\0
15
\0
12"
delim
=
"--------------------------
$(
date
+%Y%m%d%H%M%S
)
"
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
cert
\"
; filename=
\"
$(
basename
"
$_ccert
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ccert
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
inter_cert
\"
; filename=
\"
$(
basename
"
$_cca
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cca
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
id
\"
${
nl
}${
nl
}
$id
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
desc
\"
${
nl
}${
nl
}${
SYNO_Certificate
}
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
as_default
\"
${
nl
}${
nl
}${
default
}
"
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
content
=
"
$(
printf
"%b_"
"
$content
"
)
"
;
content
=
"
${
content
%_
}
"
# protect trailing \n
_info
"Upload certificate to the Synology DSM"
response
=
$(
_post
"
$content
"
"
$_base_url
/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=
$token
"
""
"POST"
"multipart/form-data; boundary=
${
delim
}
"
)
_debug3 response
"
$response
"
success
=
$(
echo
"
$response
"
| jq
-r
".success"
)
_debug2 success
"
$success
"
rm
"
$_cookie_jar
"
if
[
"
$success
"
=
"true"
]
;
then
restarted
=
$(
echo
"
$response
"
| jq
-r
".data.restart_httpd"
)
if
[
"
$restarted
"
=
"true"
]
;
then
if
!
printf
"
$response
"
|
grep
-q
'"error":'
;
then
if
printf
"
$response
"
|
grep
-q
'"restart_httpd":true'
;
then
_info
"http services were restarted"
else
_info
"http services were NOT restarted"
fi
return
0
else
code
=
$(
echo
"
$response
"
| jq
-r
".error.code"
)
_err
"Unable to update certificate, error code
$code
"
_err
"Unable to update certificate, error code
$response
"
return
1
fi
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment