Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
75660e6f
Unverified
Commit
75660e6f
authored
Nov 19, 2020
by
neil
Committed by
GitHub
Nov 19, 2020
Browse files
Merge pull request #3258 from acmesh-official/dev
sync
parents
02baa778
199ca77c
Changes
9
Show whitespace changes
Inline
Side-by-side
.github/workflows/DNS.yml
View file @
75660e6f
...
...
@@ -143,8 +143,9 @@ jobs:
C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
shell
:
cmd
-
name
:
Set ENV
shell
:
cmd
run
:
|
echo
'::set-env name=
PATH
::
C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin
'
echo PATH
=
C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin
>> %GITHUB_ENV%
-
name
:
Clone acmetest
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
-
name
:
Run acmetest
...
...
.github/workflows/LetsEncrypt.yml
View file @
75660e6f
...
...
@@ -87,8 +87,13 @@ jobs:
C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
shell
:
cmd
-
name
:
Set ENV
shell
:
cmd
run
:
|
echo PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin >> %GITHUB_ENV%
-
name
:
Check ENV
shell
:
cmd
run
:
|
echo
'::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
echo
"PATH=%PATH%"
-
name
:
Clone acmetest
shell
:
cmd
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
...
...
.github/workflows/dockerhub.yml
View file @
75660e6f
...
...
@@ -63,4 +63,4 @@ jobs:
--tag ${DOCKER_IMAGE}:${DOCKER_IMAGE_TAG} \
--output "type=image,push=true" \
--build-arg AUTO_UPGRADE=${AUTO_UPGRADE} \
--platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386 .
--platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386
,linux/ppc64le,linux/s390x
.
Dockerfile
View file @
75660e6f
...
...
@@ -7,6 +7,7 @@ RUN apk update -f \
coreutils
\
bind-tools
\
curl
\
sed
\
socat
\
tzdata
\
oath-toolkit-oathtool
\
...
...
acme.sh
View file @
75660e6f
...
...
@@ -3993,7 +3993,7 @@ _check_dns_entries() {
#file
_get_cert_issuers
()
{
_cfile
=
"
$1
"
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
;
then
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
help
2>&1
)
"
"unknown option help"
;
then
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-nocrl
-certfile
$_cfile
|
${
ACME_OPENSSL_BIN
:-
openssl
}
pkcs7
-print_certs
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
else
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
$_cfile
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
...
...
@@ -5823,7 +5823,7 @@ _deactivate() {
_URL_NAME
=
"uri"
fi
entries
=
"
$(
echo
"
$response
"
|
_egrep_o
"[^{]*
\"
type
\"
:
\"
[^
\"
]*
\"
, *
\"
status
\"
: *
\"
valid
\"
, *
\"
$_URL_NAME
\"
[^}]*
"
)
"
entries
=
"
$(
echo
"
$response
"
|
tr
']['
'='
| _egrep_o
"challenges
\"
: *=[^=]*="
|
tr
'}{'
'\n'
|
grep
"
\"
status
\"
: *
\"
valid
\"
"
)
"
if
[
-z
"
$entries
"
]
;
then
_info
"No valid entries found."
if
[
-z
"
$thumbprint
"
]
;
then
...
...
@@ -5866,7 +5866,7 @@ _deactivate() {
_debug _vtype
"
$_vtype
"
_info
"Found
$_vtype
"
uri
=
"
$(
echo
"
$entry
"
| _egrep_o
"
\"
$_URL_NAME
\"
:
\"
[^
\"
]*"
|
cu
t
-d
:
-f
2,3 |
tr
-d
'"'
)
"
uri
=
"
$(
echo
"
$entry
"
| _egrep_o
"
\"
$_URL_NAME
\"
:
\"
[^
\"
]*
\"
"
|
t
r
-d
'" '
|
cut
-d
:
-f
2-
)
"
_debug uri
"
$uri
"
if
[
"
$_d_type
"
]
&&
[
"
$_d_type
"
!=
"
$_vtype
"
]
;
then
...
...
deploy/fritzbox.sh
View file @
75660e6f
...
...
@@ -64,9 +64,9 @@ fritzbox_deploy() {
_info
"Log in to the FRITZ!Box"
_fritzbox_challenge
=
"
$(
_get
"
${
_fritzbox_url
}
/login_sid.lua"
|
sed
-e
's/^.*<Challenge>//'
-e
's/<\/Challenge>.*$//'
)
"
if
_exists iconv
;
then
_fritzbox_hash
=
"
$(
printf
"%s-%s"
"
${
_fritzbox_challenge
}
"
"
${
_fritzbox_password
}
"
| iconv
-f
ASCII
-t
UTF16LE |
md5sum
|
awk
'{print $1}'
)
"
_fritzbox_hash
=
"
$(
printf
"%s-%s"
"
${
_fritzbox_challenge
}
"
"
${
_fritzbox_password
}
"
| iconv
-f
ASCII
-t
UTF16LE |
_digest md5 hex
)
"
else
_fritzbox_hash
=
"
$(
printf
"%s-%s"
"
${
_fritzbox_challenge
}
"
"
${
_fritzbox_password
}
"
| perl
-p
-e
'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";'
|
md5sum
|
awk
'{print $1}'
)
"
_fritzbox_hash
=
"
$(
printf
"%s-%s"
"
${
_fritzbox_challenge
}
"
"
${
_fritzbox_password
}
"
| perl
-p
-e
'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";'
|
_digest md5 hex
)
"
fi
_fritzbox_sid
=
"
$(
_get
"
${
_fritzbox_url
}
/login_sid.lua?sid=0000000000000000&username=
${
_fritzbox_username
}
&response=
${
_fritzbox_challenge
}
-
${
_fritzbox_hash
}
"
|
sed
-e
's/^.*<SID>//'
-e
's/<\/SID>.*$//'
)
"
...
...
deploy/vault.sh
0 → 100644
View file @
75660e6f
#!/usr/bin/env sh
# Here is a script to deploy cert to hashicorp vault using curl
# (https://www.vaultproject.io/)
#
# it requires following environment variables:
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
#
# additionally, you need to ensure that VAULT_TOKEN is avialable
# to access the vault server
#returns 0 means success, otherwise error.
######## Public functions #####################
#domain keyfile certfile cafile fullchain
vault_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
# validate required env vars
_getdeployconf VAULT_PREFIX
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
return
1
fi
_savedeployconf VAULT_PREFIX
"
$VAULT_PREFIX
"
_getdeployconf VAULT_ADDR
if
[
-z
"
$VAULT_ADDR
"
]
;
then
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
return
1
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
# JSON does not allow multiline strings.
# So replacing new-lines with "\n" here
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
_ccert
=
$(
sed
-z
's/\n/\\n/g'
<
"
$3
"
)
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
if
[
-n
"
$FABIO
"
]
;
then
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
else
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
fi
}
dnsapi/dns_anx.sh
0 → 100644
View file @
75660e6f
#!/usr/bin/env sh
# Anexia CloudDNS acme.sh hook
# Author: MA
#ANX_Token="xxxx"
ANX_API
=
'https://engine.anexia-it.com/api/clouddns/v1'
######## Public functions #####################
dns_anx_add
()
{
fulldomain
=
$1
txtvalue
=
$2
_info
"Using ANX CDNS API"
ANX_Token
=
"
${
ANX_Token
:-
$(
_readaccountconf_mutable ANX_Token
)
}
"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
if
[
"
$ANX_Token
"
]
;
then
_saveaccountconf_mutable ANX_Token
"
$ANX_Token
"
else
_err
"You didn't specify a ANEXIA Engine API token."
return
1
fi
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
# Always add records, wildcard need two records with the same name
_anx_rest POST
"zone.json/
${
_domain
}
/records"
"{
\"
name
\"
:
\"
$_sub_domain
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
rdata
\"
:
\"
$txtvalue
\"
}"
if
_contains
"
$response
"
"
$txtvalue
"
;
then
return
0
else
return
1
fi
}
dns_anx_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
_info
"Using ANX CDNS API"
ANX_Token
=
"
${
ANX_Token
:-
$(
_readaccountconf_mutable ANX_Token
)
}
"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_get_record_id
if
_is_uuid
"
$_record_id
"
;
then
if
!
_anx_rest DELETE
"zone.json/
${
_domain
}
/records/
$_record_id
"
;
then
_err
"Delete record"
return
1
fi
else
_info
"No record found."
fi
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
status
\"
:
\"
OK
\"
>
/dev/null
}
#################### Private functions below ##################################
_is_uuid
()
{
pattern
=
'^\{?[A-Z0-9a-z]{8}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{12}\}?$'
if
echo
"
$1
"
| _egrep_o
"
$pattern
"
>
/dev/null
;
then
return
0
fi
return
1
}
_get_record_id
()
{
_debug subdomain
"
$_sub_domain
"
_debug domain
"
$_domain
"
if
_anx_rest GET
"zone.json/
${
_domain
}
/records?name=
$_sub_domain
&type=TXT"
;
then
_debug response
"
$response
"
if
_contains
"
$response
"
"
\"
name
\"
:
\"
$_sub_domain
\"
"
>
/dev/null
;
then
_record_id
=
$(
printf
"%s
\n
"
"
$response
"
| _egrep_o
"
\[
.
\"
identifier
\"
:
\"
[^
\"
]*
\"
"
|
head
-n
1 |
cut
-d
:
-f
2 |
tr
-d
\"
)
else
_record_id
=
''
fi
else
_err
"Search existing record"
fi
}
_anx_rest
()
{
m
=
$1
ep
=
"
$2
"
data
=
"
$3
"
_debug
"
$ep
"
export
_H1
=
"Content-Type: application/json"
export
_H2
=
"Authorization: Token
$ANX_Token
"
if
[
"
$m
"
!=
"GET"
]
;
then
_debug data
"
$data
"
response
=
"
$(
_post
"
$data
"
"
${
ANX_API
}
/
$ep
"
""
"
$m
"
)
"
else
response
=
"
$(
_get
"
${
ANX_API
}
/
$ep
"
)
"
fi
# shellcheck disable=SC2181
if
[
"
$?
"
!=
"0"
]
;
then
_err
"error
$ep
"
return
1
fi
_debug response
"
$response
"
return
0
}
_get_root
()
{
domain
=
$1
i
=
1
p
=
1
_anx_rest GET
"zone.json"
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
if
[
-z
"
$h
"
]
;
then
#not valid
return
1
fi
if
_contains
"
$response
"
"
\"
name
\"
:
\"
$h
\"
"
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
return
0
fi
p
=
$i
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
}
dnsapi/dns_edgedns.sh
0 → 100755
View file @
75660e6f
#!/usr/bin/env sh
# Akamai Edge DNS v2 API
# User must provide Open Edgegrid API credentials to the EdgeDNS installation. The remote user in EdgeDNS must have CRUD access to
# Edge DNS Zones and Recordsets, e.g. DNS—Zone Record Management authorization
# Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
# Values to export:
# --EITHER--
# *** TBD. NOT IMPLEMENTED YET ***
# specify Edgegrid credentials file and section
# AKAMAI_EDGERC=<full file path>
# AKAMAI_EDGERC_SECTION="default"
## --OR--
# specify indiviual credentials
# export AKAMAI_HOST = <host>
# export AKAMAI_ACCESS_TOKEN = <access token>
# export AKAMAI_CLIENT_TOKEN = <client token>
# export AKAMAI_CLIENT_SECRET = <client secret>
ACME_EDGEDNS_VERSION
=
"0.1.0"
######## Public functions #####################
# Usage: dns_edgedns_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
# Used to add txt record
#
dns_edgedns_add
()
{
fulldomain
=
$1
txtvalue
=
$2
_debug
"ENTERING DNS_EDGEDNS_ADD"
_debug2
"fulldomain"
"
$fulldomain
"
_debug2
"txtvalue"
"
$txtvalue
"
if
!
_EDGEDNS_credentials
;
then
_err
"
$@
"
return
1
fi
if
!
_EDGEDNS_getZoneInfo
"
$fulldomain
"
;
then
_err
"Invalid domain"
return
1
fi
_debug2
"Add: zone"
"
$zone
"
acmeRecordURI
=
$(
printf
"%s/%s/names/%s/types/TXT"
"
$edge_endpoint
"
"
$zone
"
"
$fulldomain
"
)
_debug3
"Add URL"
"
$acmeRecordURI
"
# Get existing TXT record
_edge_result
=
$(
_edgedns_rest GET
"
$acmeRecordURI
"
)
_api_status
=
"
$?
"
_debug3
"_edge_result"
"
$_edge_result
"
if
[
"
$_api_status
"
-ne
0
]
;
then
if
[
"
$curResult
"
=
"FATAL"
]
;
then
_err
"
$(
printf
"Fatal error: acme API function call : %s"
"
$retVal
"
)
"
fi
if
[
"
$_edge_result
"
!=
"404"
]
;
then
_err
"
$(
printf
"Failure accessing Akamai Edge DNS API Server. Error: %s"
"
$_edge_result
"
)
"
return
1
fi
fi
rdata
=
"
\"
${
txtvalue
}
\"
"
record_op
=
"POST"
if
[
"
$_api_status
"
-eq
0
]
;
then
# record already exists. Get existing record data and update
record_op
=
"PUT"
rdlist
=
"
${
_edge_result
#*\
"rdata
\"
:[}"
rdlist=
"
${
rdlist
%%]*
}
"
rdlist=
$(
echo
"
$rdlist
"
|
tr
-d
'"'
|
tr
-d
"
\\\\
"
)
_debug3
"existing TXT found"
_debug3
"record data"
"
$rdlist
"
# value already there?
if _contains
"
$rdlist
"
"
$txtvalue
"
; then
return 0
fi
_txt_val=
""
while [
"
$_txt_val
"
!=
"
$rdlist
"
] && [
"
${
rdlist
}
"
]; do
_txt_val=
"
${
rdlist
%%,*
}
"
rdlist=
"
${
rdlist
#*,
}
"
rdata=
"
${
rdata
}
,
\"
${
_txt_val
}
\"
"
done
fi
# Add the txtvalue TXT Record
body=
"{
\"
name
\"
:
\"
$fulldomain
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
ttl
\"
:600,
\"
rdata
\"
:"
[
${
rdata
}
]
"}"
_debug3
"Add body '
${
body
}
'"
_edge_result=
$(
_edgedns_rest
"
$record_op
"
"
$acmeRecordURI
"
"
$body
"
)
_api_status=
"
$?
"
if [
"
$_api_status
"
-eq 0 ]; then
_log
"
$(
printf
"Text value %s added to recordset %s"
"
$txtvalue
"
"
$fulldomain
"
)
"
return 0
else
_err
"
$(
printf
"error adding TXT record for validation. Error: %s"
"
$_edge_result
"
)
"
return 1
fi
}
# Usage: dns_edgedns_rm _acme-challenge.www.domain.com "
XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs
"
# Used to delete txt record
#
dns_edgedns_rm() {
fulldomain=
$1
txtvalue=
$2
_debug "
ENTERING DNS_EDGEDNS_RM
"
_debug2 "
fulldomain
" "
$fulldomain
"
_debug2 "
txtvalue
" "
$txtvalue
"
if ! _EDGEDNS_credentials; then
_err "
$@
"
return 1
fi
if ! _EDGEDNS_getZoneInfo "
$fulldomain
"; then
_err "
Invalid domain
"
return 1
fi
_debug2 "
RM: zone
" "
${
zone
}
"
acmeRecordURI=
$(
printf
"%s/%s/names/%s/types/TXT"
"
${
edge_endpoint
}
"
"
$zone
"
"
$fulldomain
"
)
_debug3 "
RM URL
" "
$acmeRecordURI
"
# Get existing TXT record
_edge_result=
$(
_edgedns_rest GET
"
$acmeRecordURI
"
)
_api_status="
$?
"
if [ "
$_api_status
" -ne 0 ]; then
if [ "
$curResult
" = "
FATAL
" ]; then
_err "
$(
printf
"Fatal error: acme API function call : %s"
"
$retVal
"
)
"
fi
if [ "
$_edge_result
" != "
404
" ]; then
_err "
$(
printf
"Failure accessing Akamai Edge DNS API Server. Error: %s"
"
$_edge_result
"
)
"
return 1
fi
fi
_debug3 "
_edge_result
" "
$_edge_result
"
record_op="
DELETE
"
body=""
if [ "
$_api_status
" -eq 0 ]; then
# record already exists. Get existing record data and update
rdlist="
${
_edge_result
#*\
"rdata
\"
:[}"
rdlist=
"
${
rdlist
%%]*
}
"
rdlist=
$(
echo
"
$rdlist
"
|
tr
-d
'"'
|
tr
-d
"
\\\\
"
)
_debug3
"rdlist"
"
$rdlist
"
if [ -n
"
$rdlist
"
]; then
record_op=
"PUT"
comma=
""
rdata=
""
_txt_val=
""
while [
"
$_txt_val
"
!=
"
$rdlist
"
] && [
"
$rdlist
"
]; do
_txt_val=
"
${
rdlist
%%,*
}
"
rdlist=
"
${
rdlist
#*,
}
"
_debug3
"_txt_val"
"
$_txt_val
"
_debug3
"txtvalue"
"
$txtvalue
"
if ! _contains
"
$_txt_val
"
"
$txtvalue
"
; then
rdata=
"
${
rdata
}${
comma
}
\"
${
_txt_val
}
\"
"
comma=
","
fi
done
if [ -z
"
$rdata
"
]; then
record_op=
"DELETE"
else
# Recreate the txtvalue TXT Record
body=
"{
\"
name
\"
:
\"
$fulldomain
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
ttl
\"
:600,
\"
rdata
\"
:"
[
${
rdata
}
]
"}"
_debug3
"body"
"
$body
"
fi
fi
fi
_edge_result=
$(
_edgedns_rest
"
$record_op
"
"
$acmeRecordURI
"
"
$body
"
)
_api_status=
"
$?
"
if [
"
$_api_status
"
-eq 0 ]; then
_log
"
$(
printf
"Text value %s removed from recordset %s"
"
$txtvalue
"
"
$fulldomain
"
)
"
return 0
else
_err
"
$(
printf
"error removing TXT record for validation. Error: %s"
"
$_edge_result
"
)
"
return 1
fi
}
#################### Private functions below ##################################
_EDGEDNS_credentials
()
{
_debug
"GettingEdge DNS credentials"
_log
"
$(
printf
"ACME DNSAPI Edge DNS version %s"
${
ACME_EDGEDNS_VERSION
}
)
"
args_missing
=
0
if
[
-z
"
$AKAMAI_ACCESS_TOKEN
"
]
;
then
AKAMAI_ACCESS_TOKEN
=
""
AKAMAI_CLIENT_TOKEN
=
""
AKAMAI_HOST
=
""
AKAMAI_CLIENT_SECRET
=
""
_err
"AKAMAI_ACCESS_TOKEN is missing"
args_missing
=
1
fi
if
[
-z
"
$AKAMAI_CLIENT_TOKEN
"
]
;
then
AKAMAI_ACCESS_TOKEN
=
""
AKAMAI_CLIENT_TOKEN
=
""
AKAMAI_HOST
=
""
AKAMAI_CLIENT_SECRET
=
""
_err
"AKAMAI_CLIENT_TOKEN is missing"
args_missing
=
1
fi
if
[
-z
"
$AKAMAI_HOST
"
]
;
then
AKAMAI_ACCESS_TOKEN
=
""
AKAMAI_CLIENT_TOKEN
=
""
AKAMAI_HOST
=
""
AKAMAI_CLIENT_SECRET
=
""
_err
"AKAMAI_HOST is missing"
args_missing
=
1
fi
if
[
-z
"
$AKAMAI_CLIENT_SECRET
"
]
;
then
AKAMAI_ACCESS_TOKEN
=
""
AKAMAI_CLIENT_TOKEN
=
""
AKAMAI_HOST
=
""
AKAMAI_CLIENT_SECRET
=
""
_err
"AKAMAI_CLIENT_SECRET is missing"
args_missing
=
1
fi
if
[
"
$args_missing
"
=
1
]
;
then
_err
"You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
return
1
else
_saveaccountconf_mutable AKAMAI_ACCESS_TOKEN
"
$AKAMAI_ACCESS_TOKEN
"
_saveaccountconf_mutable AKAMAI_CLIENT_TOKEN
"
$AKAMAI_CLIENT_TOKEN
"
_saveaccountconf_mutable AKAMAI_HOST
"
$AKAMAI_HOST
"
_saveaccountconf_mutable AKAMAI_CLIENT_SECRET
"
$AKAMAI_CLIENT_SECRET
"
# Set whether curl should use secure or insecure mode
fi
export
HTTPS_INSECURE
=
0
# All Edgegrid API calls are secure
edge_endpoint
=
$(
printf
"https://%s/config-dns/v2/zones"
"
$AKAMAI_HOST
"
)
_debug3
"Edge API Endpoint:"
"
$edge_endpoint
"
}
_EDGEDNS_getZoneInfo
()
{
_debug
"Getting Zoneinfo"
zoneEnd
=
false
curZone
=
$1
while
[
-n
"
$zoneEnd
"
]
;
do
# we can strip the first part of the fulldomain, since its just the _acme-challenge string
curZone
=
"
${
curZone
#*.
}
"
# suffix . needed for zone -> domain.tld.
# create zone get url
get_zone_url
=
$(
printf
"%s/%s"
"
$edge_endpoint
"
"
$curZone
"
)
_debug3
"Zone Get: "
"
${
get_zone_url
}
"
curResult
=
$(
_edgedns_rest GET
"
$get_zone_url
"
)
retVal
=
$?
if
[
"
$retVal
"
-ne
0
]
;
then
if
[
"
$curResult
"
=
"FATAL"
]
;
then
_err
"
$(
printf
"Fatal error: acme API function call : %s"
"
$retVal
"
)
"
fi
if
[
"
$curResult
"
!=
"404"
]
;
then
_err
"
$(
printf
"Managed zone validation failed. Error response: %s"
"
$retVal
"
)
"
return
1
fi
fi
if
_contains
"
$curResult
"
"
\"
zone
\"
:"
;
then
_debug2
"Zone data"
"
${
curResult
}
"
zone
=
$(
echo
"
${
curResult
}
"
| _egrep_o
"
\"
zone
\"\\
s*:
\\
s*
\"
[^
\"
]*
\"
"
| _head_n 1 |
cut
-d
:
-f
2 |
tr
-d
"
\"
"
)
_debug3
"Zone"
"
${
zone
}
"
zoneEnd
=
""
return
0
fi
if
[
"
${
curZone
#*.
}
"
!=
"
$curZone
"
]
;
then
_debug3
"
$(
printf
"%s still contains a '.' - so we can check next higher level"
"
$curZone
"
)
"
else
zoneEnd
=
true
_err
"Couldn't retrieve zone data."
return
1
fi
done
_err
"Failed to retrieve zone data."
return
2
}
_edgedns_headers
=
""
_edgedns_rest
()
{
_debug
"Handling API Request"
m
=
$1
# Assume endpoint is complete path, including query args if applicable
ep
=
$2
body_data
=
$3
_edgedns_content_type
=
""
_request_url_path
=
"
$ep
"
_request_body
=
"
$body_data
"
_request_method
=
"
$m
"
_edgedns_headers
=
""
tab
=
""
_edgedns_headers
=
"
${
_edgedns_headers
}${
tab
}
Host:
${
AKAMAI_HOST
}
"
tab
=
"
\t
"
# Set in acme.sh _post/_get
#_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
_edgedns_headers
=
"
${
_edgedns_headers
}${
tab
}
Accept: application/json,*/*"
if
[
"
$m
"
!=
"GET"
]
&&
[
"
$m
"
!=
"DELETE"
]
;
then
_edgedns_content_type
=
"application/json"
_debug3
"_request_body"
"
$_request_body
"
_body_len
=
$(
echo
"
$_request_body
"
|
tr
-d
"
\n\r
"
|
awk
'{print length}'
)
_edgedns_headers
=
"
${
_edgedns_headers
}${
tab
}
Content-Length:
${
_body_len
}
"
fi
_edgedns_make_auth_header
_edgedns_headers
=
"
${
_edgedns_headers
}${
tab
}
Authorization:
${
_signed_auth_header
}
"
_secure_debug2
"Made Auth Header"
"
$_signed_auth_header
"
hdr_indx
=
1
work_header
=
"
${
_edgedns_headers
}${
tab
}
"
_debug3
"work_header"
"
$work_header
"
while
[
"
$work_header
"
]
;
do
entry
=
"
${
work_header
%%\\t*
}
"
work_header
=
"
${
work_header
#*\\t
}
"
export
"
$(
printf
"_H%s=%s"
"
$hdr_indx
"
"
$entry
"
)
"
_debug2
"Request Header "
"
$entry
"
hdr_indx
=
$((
hdr_indx
+
1
))
done
# clear headers from previous request to avoid getting wrong http code on timeouts
:
>
"
$HTTP_HEADER
"
_debug2
"
$ep
"
if
[
"
$m
"
!=
"GET"
]
;
then
_debug3
"Method data"
"
$data
"
# body url [needbase64] [POST|PUT|DELETE] [ContentType]
response
=
$(
_post
"
$_request_body
"
"
$ep
"
false
"
$m
"
"
$_edgedns_content_type
"
)
else
response
=
$(
_get
"
$ep
"
)
fi
_ret
=
"
$?
"
if
[
"
$_ret
"
-ne
0
]
;
then
_err
"
$(
printf
"acme.sh API function call failed. Error: %s"
"
$_ret
"
)
"
echo
"FATAL"
return
"
$_ret
"
fi
_debug2
"response"
"
${
response
}
"
_code
=
"
$(
grep
"^HTTP"
"
$HTTP_HEADER
"
| _tail_n 1 |
cut
-d
" "
-f
2 |
tr
-d
"
\\
r
\\
n"
)
"
_debug2
"http response code"
"
$_code
"
if
[
"
$_code
"
=
"200"
]
||
[
"
$_code
"
=
"201"
]
;
then
# All good
response
=
"
$(
echo
"
${
response
}
"
| _normalizeJson
)
"
echo
"
$response
"
return
0
fi
if
[
"
$_code
"
=
"204"
]
;
then
# Success, no body
echo
"
$_code
"
return
0
fi
if
[
"
$_code
"
=
"400"
]
;
then
_err
"Bad request presented"
_log
"
$(
printf
"Headers: %s"
"
$_edgedns_headers
"
)
"
_log
"
$(
printf
"Method: %s"
"
$_request_method
"
)
"
_log
"
$(
printf
"URL: %s"
"
$ep
"
)
"
_log
"
$(
printf
"Data: %s"
"
$data
"
)
"
fi
if
[
"
$_code
"
=
"403"
]
;
then
_err
"access denied make sure your Edgegrid cedentials are correct."
fi
echo
"
$_code
"
return
1
}
_edgedns_eg_timestamp
()
{
_debug
"Generating signature Timestamp"
_debug3
"Retriving ntp time"
_timeheaders
=
"
$(
_get
"https://www.ntp.org"
"onlyheader"
)
"
_debug3
"_timeheaders"
"
$_timeheaders
"
_ntpdate
=
"
$(
echo
"
$_timeheaders
"
|
grep
-i
"Date:"
| _head_n 1 |
cut
-d
':'
-f
2- |
tr
-d
"
\r\n
"
)
"
_debug3
"_ntpdate"
"
$_ntpdate
"
_ntpdate
=
"
$(
echo
"
${
_ntpdate
}
"
|
sed
-e
's/^[[:space:]]*//'
)
"
_debug3
"_NTPDATE"
"
$_ntpdate
"
_ntptime
=
"
$(
echo
"
${
_ntpdate
}
"
| _head_n 1 |
cut
-d
" "
-f
5 |
tr
-d
"
\r\n
"
)
"
_debug3
"_ntptime"
"
$_ntptime
"
_eg_timestamp
=
$(
date
-u
"+%Y%m%dT"
)
_eg_timestamp
=
"
$(
printf
"%s%s+0000"
"
$_eg_timestamp
"
"
$_ntptime
"
)
"
_debug
"_eg_timestamp"
"
$_eg_timestamp
"
}
_edgedns_new_nonce
()
{
_debug
"Generating Nonce"
_nonce
=
$(
echo
"EDGEDNS
$(
_time
)
"
| _digest sha1 hex |
cut
-c
1-32
)
_debug3
"_nonce"
"
$_nonce
"
}
_edgedns_make_auth_header
()
{
_debug
"Constructing Auth Header"
_edgedns_new_nonce
_edgedns_eg_timestamp
# "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
_auth_header
=
"
$(
printf
"EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;"
"
$AKAMAI_CLIENT_TOKEN
"
"
$AKAMAI_ACCESS_TOKEN
"
"
$_eg_timestamp
"
"
$_nonce
"
)
"
_secure_debug2
"Unsigned Auth Header: "
"
$_auth_header
"
_edgedns_sign_request
_signed_auth_header
=
"
$(
printf
"%ssignature=%s"
"
$_auth_header
"
"
$_signed_req
"
)
"
_secure_debug2
"Signed Auth Header: "
"
${
_signed_auth_header
}
"
}
_edgedns_sign_request
()
{
_debug2
"Signing http request"
_edgedns_make_data_to_sign
"
$_auth_header
"
_secure_debug2
"Returned signed data"
"
$_mdata
"
_edgedns_make_signing_key
"
$_eg_timestamp
"
_edgedns_base64_hmac_sha256
"
$_mdata
"
"
$_signing_key
"
_signed_req
=
"
$_hmac_out
"
_secure_debug2
"Signed Request"
"
$_signed_req
"
}
_edgedns_make_signing_key
()
{
_debug2
"Creating sigining key"
ts
=
$1
_edgedns_base64_hmac_sha256
"
$ts
"
"
$AKAMAI_CLIENT_SECRET
"
_signing_key
=
"
$_hmac_out
"
_secure_debug2
"Signing Key"
"
$_signing_key
"
}
_edgedns_make_data_to_sign
()
{
_debug2
"Processing data to sign"
hdr
=
$1
_secure_debug2
"hdr"
"
$hdr
"
_edgedns_make_content_hash
path
=
"
$(
echo
"
$_request_url_path
"
|
tr
-d
"
\n\r
"
|
sed
's/https\?:\/\///'
)
"
path
=
"
${
path
#*
$AKAMAI_HOST
}
"
_debug
"hier path"
"
$path
"
# dont expose headers to sign so use MT string
_mdata
=
"
$(
printf
"%s
\t
https
\t
%s
\t
%s
\t
%s
\t
%s
\t
%s"
"
$_request_method
"
"
$AKAMAI_HOST
"
"
$path
"
""
"
$_hash
"
"
$hdr
"
)
"
_secure_debug2
"Data to Sign"
"
$_mdata
"
}
_edgedns_make_content_hash
()
{
_debug2
"Generating content hash"
_hash
=
""
_debug2
"Request method"
"
${
_request_method
}
"
if
[
"
$_request_method
"
!=
"POST"
]
||
[
-z
"
$_request_body
"
]
;
then
return
0
fi
_debug2
"Req body"
"
$_request_body
"
_edgedns_base64_sha256
"
$_request_body
"
_hash
=
"
$_sha256_out
"
_debug2
"Content hash"
"
$_hash
"
}
_edgedns_base64_hmac_sha256
()
{
_debug2
"Generating hmac"
data
=
$1
key
=
$2
encoded_data
=
"
$(
echo
"
$data
"
| iconv
-t
utf-8
)
"
encoded_key
=
"
$(
echo
"
$key
"
| iconv
-t
utf-8
)
"
_secure_debug2
"encoded data"
"
$encoded_data
"
_secure_debug2
"encoded key"
"
$encoded_key
"
encoded_key_hex
=
$(
printf
"%s"
"
$encoded_key
"
| _hex_dump |
tr
-d
' '
)
data_sig
=
"
$(
echo
"
$encoded_data
"
|
tr
-d
"
\n\r
"
| _hmac sha256
"
$encoded_key_hex
"
| _base64
)
"
_secure_debug2
"data_sig:"
"
$data_sig
"
_hmac_out
=
"
$(
echo
"
$data_sig
"
|
tr
-d
"
\n\r
"
| iconv
-f
utf-8
)
"
_secure_debug2
"hmac"
"
$_hmac_out
"
}
_edgedns_base64_sha256
()
{
_debug2
"Creating sha256 digest"
trg
=
$1
_secure_debug2
"digest data"
"
$trg
"
digest
=
"
$(
echo
"
$trg
"
|
tr
-d
"
\n\r
"
| _digest
"sha256"
)
"
_sha256_out
=
"
$(
echo
"
$digest
"
|
tr
-d
"
\n\r
"
| iconv
-f
utf-8
)
"
_secure_debug2
"digest decode"
"
$_sha256_out
"
}
#_edgedns_parse_edgerc() {
# filepath=$1
# section=$2
#}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment