Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
52a168b9
Unverified
Commit
52a168b9
authored
Feb 08, 2020
by
Brian Hartvigsen
Browse files
Stop using jq/curl directly
This is a lot more fragile then the previous code due to treating JSON as just a string
parent
b3b00b67
Changes
1
Hide whitespace changes
Inline
Side-by-side
deploy/synology_dsm.sh
View file @
52a168b9
...
@@ -20,6 +20,12 @@
...
@@ -20,6 +20,12 @@
######## Public functions #####################
######## Public functions #####################
_syno_get_cookie_data
()
{
_debug2 Cookie
"
$1
"
_debug3
grep
"
$(
grep
"
\W
$1
="
"
$HTTP_HEADER
"
|
grep
"^Set-Cookie:"
| _tail_n 1 | _egrep_o
"
$1
=[^;]*;"
|
tr
-d
';'
)
"
grep
"
\W
$1
="
"
$HTTP_HEADER
"
|
grep
"^Set-Cookie:"
| _tail_n 1 | _egrep_o
"
$1
=[^;]*;"
|
tr
-d
';'
}
#domain keyfile certfile cafile fullchain
#domain keyfile certfile cafile fullchain
synology_dsm_deploy
()
{
synology_dsm_deploy
()
{
...
@@ -31,8 +37,8 @@ synology_dsm_deploy() {
...
@@ -31,8 +37,8 @@ synology_dsm_deploy() {
_debug _cdomain
"
$_cdomain
"
_debug _cdomain
"
$_cdomain
"
# Get Username and Password, but don't save until we successfully authenticate
# Get Username and Password, but don't save until we successfully authenticate
SYNO_Username
=
"
${
SYNO_Username
:-
$(
_
readdomain
conf SYNO_Username
)
}
"
SYNO_Username
=
"
${
SYNO_Username
:-
$(
_
getdeploy
conf SYNO_Username
)
}
"
SYNO_Password
=
"
${
SYNO_Password
:-
$(
_
readdomain
conf SYNO_Password
)
}
"
SYNO_Password
=
"
${
SYNO_Password
:-
$(
_
getdeploy
conf SYNO_Password
)
}
"
if
[
-z
"
$SYNO_Username
"
]
||
[
-z
"
$SYNO_Password
"
]
;
then
if
[
-z
"
$SYNO_Username
"
]
||
[
-z
"
$SYNO_Password
"
]
;
then
SYNO_Username
=
""
SYNO_Username
=
""
SYNO_Password
=
""
SYNO_Password
=
""
...
@@ -43,12 +49,12 @@ synology_dsm_deploy() {
...
@@ -43,12 +49,12 @@ synology_dsm_deploy() {
_secure_debug2 SYNO_Password
"
$SYNO_Password
"
_secure_debug2 SYNO_Password
"
$SYNO_Password
"
# Optional scheme, hostname, and port for Synology DSM
# Optional scheme, hostname, and port for Synology DSM
SYNO_Scheme
=
"
${
SYNO_Scheme
:-
$(
_
readdomain
conf SYNO_Scheme
)
}
"
SYNO_Scheme
=
"
${
SYNO_Scheme
:-
$(
_
getdeploy
conf SYNO_Scheme
)
}
"
SYNO_Hostname
=
"
${
SYNO_Hostname
:-
$(
_
readdomain
conf SYNO_Hostname
)
}
"
SYNO_Hostname
=
"
${
SYNO_Hostname
:-
$(
_
getdeploy
conf SYNO_Hostname
)
}
"
SYNO_Port
=
"
${
SYNO_Port
:-
$(
_
readdomain
conf SYNO_Port
)
}
"
SYNO_Port
=
"
${
SYNO_Port
:-
$(
_
getdeploy
conf SYNO_Port
)
}
"
_saved
omain
conf SYNO_Scheme
"
$SYNO_Scheme
"
_saved
eploy
conf SYNO_Scheme
"
$SYNO_Scheme
"
_saved
omain
conf SYNO_Hostname
"
$SYNO_Hostname
"
_saved
eploy
conf SYNO_Hostname
"
$SYNO_Hostname
"
_saved
omain
conf SYNO_Port
"
$SYNO_Port
"
_saved
eploy
conf SYNO_Port
"
$SYNO_Port
"
# default vaules for scheme, hostname, and port
# default vaules for scheme, hostname, and port
# defaulting to localhost and http because it's localhost...
# defaulting to localhost and http because it's localhost...
...
@@ -69,77 +75,78 @@ synology_dsm_deploy() {
...
@@ -69,77 +75,78 @@ synology_dsm_deploy() {
fi
fi
_debug SYNO_Certificate
"
$SYNO_Certificate
"
_debug SYNO_Certificate
"
$SYNO_Certificate
"
# We can't use _get or _post because they lack support for cookies
# use jq because I'm too lazy to figure out what is required to parse json
# by hand. Also it seems to be in place for Synology DSM (6.2.1 at least)
for
x
in
curl jq
;
do
if
!
_exists
"
$x
"
;
then
_err
"Please install
$x
first."
_err
"We need
$x
to work."
return
1
fi
done
_base_url
=
"
$SYNO_Scheme
://
$SYNO_Hostname
:
$SYNO_Port
"
_base_url
=
"
$SYNO_Scheme
://
$SYNO_Hostname
:
$SYNO_Port
"
_debug _base_url
"
$_base_url
"
_debug _base_url
"
$_base_url
"
_cookie_jar
=
"
$(
_mktemp
)
"
_debug _cookie_jar
"
$_cookie_jar
"
# Login, get the token from JSON and session id from cookie
# Login, get the token from JSON and session id from cookie
_debug
"Logging into
$SYNO_Hostname
:
$SYNO_Port
"
_info
"Logging into
$SYNO_Hostname
:
$SYNO_Port
"
token
=
$(
curl
-sk
-c
"
$_cookie_jar
"
"
$_base_url
/webman/login.cgi?username=
$SYNO_Username
&passwd=
$SYNO_Password
&enable_syno_token=yes"
| jq
-r
.SynoToken
)
response
=
$(
_get
"
$_base_url
/webman/login.cgi?username=
$SYNO_Username
&passwd=
$SYNO_Password
&enable_syno_token=yes"
)
if
[
"
$token
"
=
"null"
]
;
then
token
=
$(
echo
"
$response
"
|
grep
"SynoToken"
|
sed
-n
's/.*"SynoToken" *: *"\([^"]*\).*/\1/p'
)
_debug3 response
"
$response
"
if
[
-z
"
$token
"
]
;
then
_err
"Unable to authenticate to
$SYNO_Hostname
:
$SYNO_Port
using
$SYNO_Scheme
."
_err
"Unable to authenticate to
$SYNO_Hostname
:
$SYNO_Port
using
$SYNO_Scheme
."
_err
"Check your username and password."
_err
"Check your username and password."
rm
"
$_cookie_jar
"
return
1
return
1
fi
fi
_H1
=
"Cookie:
$(
_syno_get_cookie_data
"id"
)
;
$(
_syno_get_cookie_data
"smid"
)
"
_H2
=
"X-SYNO-TOKEN:
$token
"
export
_H1
export
_H2
_debug3 H1
"
${
_H1
}
"
_debug3 H2
"
${
_H2
}
"
# Now that we know the username and password are good, save them
# Now that we know the username and password are good, save them
_saved
omain
conf SYNO_Username
"
$SYNO_Username
"
_saved
eploy
conf SYNO_Username
"
$SYNO_Username
"
_saved
omain
conf SYNO_Password
"
$SYNO_Password
"
_saved
eploy
conf SYNO_Password
"
$SYNO_Password
"
_secure_debug2 token
"
$token
"
_secure_debug2 token
"
$token
"
# Use token and session id to get the list of certificates
_info
"Getting certificates in Synology DSM"
response
=
$(
curl
-sk
-b
"
$_cookie_jar
"
"
$_base_url
/webapi/entry.cgi"
-H
"X-SYNO-TOKEN:
$token
"
-d
api
=
SYNO.Core.Certificate.CRT
-d
method
=
list
-d
version
=
1
)
response
=
$(
_post
"
api=SYNO.Core.Certificate.CRT
&
method=list
&
version=1
"
"
$_base_url
/webapi/entry.cgi"
)
_debug3 response
"
$response
"
_debug3 response
"
$response
"
# select the first certificate matching our description
id
=
$(
printf
"
$response
"
|
sed
-n
"s/.*
\"
desc
\"
:
\"
$SYNO_Certificate
\"
,
\"
id
\"
:
\"\(
[^
\"
]*
\)
.*/
\1
/p"
)
cert
=
$(
echo
"
$response
"
| jq
-r
".data.certificates | map(select(.desc ==
\"
$SYNO_Certificate
\"
))[0]"
)
_debug2
id
"
$id
"
_debug3 cert
"
$cert
"
if
[
"
$cert
"
=
"null
"
]
;
then
if
[
-z
"
$id
"
]
;
then
_err
"Unable to find certificate:
$SYNO_Certificate
"
_err
"Unable to find certificate:
$SYNO_Certificate
"
rm
"
$_cookie_jar
"
return
1
return
1
fi
fi
# we've verified this certificate description is a thing, so save it
# we've verified this certificate description is a thing, so save it
_savedeployconf SYNO_Certificate
"
$SYNO_Certificate
"
_savedeployconf SYNO_Certificate
"
$SYNO_Certificate
"
id
=
$(
echo
"
$cert
"
| jq
-r
".id"
)
default
=
false
default
=
$(
echo
"
$cert
"
| jq
-r
".is_default"
)
if
printf
"
$response
"
|
sed
-n
"s/.*
\"
desc
\"
:
\"
$SYNO_Certificate
\"
,
\(
[^{]*
\)
.*/
\1
/p"
|
grep
-q
--
'is_default":true'
;
then
_debug2
id
"
$id
"
default
=
true
fi
_debug2 default
"
$default
"
_debug2 default
"
$default
"
# This is the heavy lifting, make the API call to update a certificate in place
_info
"Generate form POST request"
response
=
$(
curl
-sk
-b
"
$_cookie_jar
"
"
$_base_url
/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=
$token
"
-F
"key=@
$_ckey
"
-F
"cert=@
$_ccert
"
-F
"inter_cert=@
$_cca
"
-F
"id=
$id
"
-F
"desc=
$SYNO_Certificate
"
-F
"as_default=
$default
"
)
nl
=
"
\0
15
\0
12"
delim
=
"--------------------------
$(
date
+%Y%m%d%H%M%S
)
"
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
cert
\"
; filename=
\"
$(
basename
"
$_ccert
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ccert
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
inter_cert
\"
; filename=
\"
$(
basename
"
$_cca
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cca
"
)
\0
12"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
id
\"
${
nl
}${
nl
}
$id
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
desc
\"
${
nl
}${
nl
}${
SYNO_Certificate
}
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
as_default
\"
${
nl
}${
nl
}${
default
}
"
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
content
=
"
$(
printf
"%b_"
"
$content
"
)
"
;
content
=
"
${
content
%_
}
"
# protect trailing \n
_info
"Upload certificate to the Synology DSM"
response
=
$(
_post
"
$content
"
"
$_base_url
/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=
$token
"
""
"POST"
"multipart/form-data; boundary=
${
delim
}
"
)
_debug3 response
"
$response
"
_debug3 response
"
$response
"
success
=
$(
echo
"
$response
"
| jq
-r
".success"
)
_debug2 success
"
$success
"
rm
"
$_cookie_jar
"
if
[
"
$success
"
=
"true"
]
;
then
if
!
printf
"
$response
"
|
grep
-q
'"error":'
;
then
restarted
=
$(
echo
"
$response
"
| jq
-r
".data.restart_httpd"
)
if
printf
"
$response
"
|
grep
-q
'"restart_httpd":true'
;
then
if
[
"
$restarted
"
=
"true"
]
;
then
_info
"http services were restarted"
_info
"http services were restarted"
else
else
_info
"http services were NOT restarted"
_info
"http services were NOT restarted"
fi
fi
return
0
return
0
else
else
code
=
$(
echo
"
$response
"
| jq
-r
".error.code"
)
_err
"Unable to update certificate, error code
$response
"
_err
"Unable to update certificate, error code
$code
"
return
1
return
1
fi
fi
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment