]*>/,/Ig' \
+ | grep 'edit.php?' \
+ | grep "$top_domain")"
+ # The above beauty ends with striping out rows that do not have an
+ # href to edit.php and do not have the top domain we are looking for.
+ # So all we should be left with is CSV of table of subdomains we are
+ # interested in.
+
+ # Now we have to read through this table and extract the data we need
+ lines="$(echo "$subdomain_csv" | wc -l)"
+ nl='
+'
+ i=0
+ found=0
+ while [ "$i" -lt "$lines" ]; do
+ i="$(_math "$i" + 1)"
+ line="$(echo "$subdomain_csv" | cut -d "$nl" -f "$i")"
+ tmp="$(echo "$line" | cut -d ',' -f 1)"
+ if [ $found = 0 ] && _startswith "$tmp" "| $top_domain"; then
+ # this line will contain DNSdomainid for the top_domain
+ DNSdomainid="$(echo "$line" | cut -d ',' -f 2 | sed 's/^.*domain_id=//;s/>.*//')"
+ found=1
+ else
+ # lines contain DNS records for all subdomains
+ DNSname="$(echo "$line" | cut -d ',' -f 2 | sed 's/^[^>]*>//;s/<\/a>.*//')"
+ DNStype="$(echo "$line" | cut -d ',' -f 3)"
+ if [ "$DNSname" = "$fulldomain" ] && [ "$DNStype" = "TXT" ]; then
+ DNSdataid="$(echo "$line" | cut -d ',' -f 2 | sed 's/^.*data_id=//;s/>.*//')"
+ # Now get current value for the TXT record. This method may
+ # not produce accurate results as the value field is truncated
+ # on this webpage. To get full value we would need to load
+ # another page. However we don't really need this so long as
+ # there is only one TXT record for the acme chalenge subdomain.
+ DNSvalue="$(echo "$line" | cut -d ',' -f 4 | sed 's/^[^"]*"//;s/".*//;s/<\/td>.*//')"
+ if [ $found != 0 ]; then
+ break
+ # we are breaking out of the loop at the first match of DNS name
+ # and DNS type (if we are past finding the domainid). This assumes
+ # that there is only ever one TXT record for the LetsEncrypt/acme
+ # challenge subdomain. This seems to be a reasonable assumption
+ # as the acme client deletes the TXT record on successful validation.
+ fi
+ else
+ DNSname=""
+ DNStype=""
+ fi
+ fi
+ done
+
+ _debug "DNSname: $DNSname DNStype: $DNStype DNSdomainid: $DNSdomainid DNSdataid: $DNSdataid"
+ _debug "DNSvalue: $DNSvalue"
+
+ if [ -z "$DNSdomainid" ]; then
+ # If domain ID is empty then something went wrong (top level
+ # domain not found at FreeDNS).
+ if [ "$attempts" = "0" ]; then
+ # exhausted maximum retry attempts
+ _debug "$htmlpage"
+ _debug "$subdomain_csv"
+ _err "Domain $top_domain not found at FreeDNS"
+ return 1
+ fi
+ else
+ # break out of the 'retry' loop... we have found our domain ID
+ break
+ fi
+ _info "Domain $top_domain not found at FreeDNS"
+ _info "Retry loading subdomain page ($attempts attempts remaining)"
+ done
+
+ if [ -z "$DNSdataid" ]; then
+ # If data ID is empty then specific subdomain does not exist yet, need
+ # to create it this should always be the case as the acme client
+ # deletes the entry after domain is validated.
+ _freedns_add_txt_record "$FREEDNS_COOKIE" "$DNSdomainid" "$sub_domain" "$txtvalue"
+ return $?
+ else
+ if [ "$txtvalue" = "$DNSvalue" ]; then
+ # if value in TXT record matches value requested then DNS record
+ # does not need to be updated. But...
+ # Testing value match fails. Website is truncating the value field.
+ # So for now we will always go down the else path. Though in theory
+ # should never come here anyway as the acme client deletes
+ # the TXT record on successful validation, so we should not even
+ # have found a TXT record !!
+ _info "No update necessary for $fulldomain at FreeDNS"
+ return 0
+ else
+ # Delete the old TXT record (with the wrong value)
+ _freedns_delete_txt_record "$FREEDNS_COOKIE" "$DNSdataid"
+ if [ "$?" = "0" ]; then
+ # And add in new TXT record with the value provided
+ _freedns_add_txt_record "$FREEDNS_COOKIE" "$DNSdomainid" "$sub_domain" "$txtvalue"
+ fi
+ return $?
+ fi
+ fi
+ return 0
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_freedns_rm() {
+ fulldomain="$1"
+ txtvalue="$2"
+
+ _info "Delete TXT record using FreeDNS"
+ _debug "fulldomain: $fulldomain"
+ _debug "txtvalue: $txtvalue"
+
+ # Need to read cookie from conf file again in case new value set
+ # during login to FreeDNS when TXT record was created.
+ # acme.sh does not have a _readaccountconf() fuction
+ FREEDNS_COOKIE="$(_read_conf "$ACCOUNT_CONF_PATH" "FREEDNS_COOKIE")"
+ _debug "FreeDNS login cookies: $FREEDNS_COOKIE"
+
+ # Sometimes FreeDNS does not reurn the subdomain page but rather
+ # returns a page regarding becoming a premium member. This usually
+ # happens after a period of inactivity. Immediately trying again
+ # returns the correct subdomain page. So, we will try twice to
+ # load the page and obtain our TXT record.
+ attempts=2
+ while [ "$attempts" -gt "0" ]; do
+ attempts="$(_math "$attempts" - 1)"
+
+ htmlpage="$(_freedns_retrieve_subdomain_page "$FREEDNS_COOKIE")"
+ if [ "$?" != "0" ]; then
+ return 1
+ fi
+
+ # Now convert the tables in the HTML to CSV. This litte gem from
+ # http://stackoverflow.com/questions/1403087/how-can-i-convert-an-html-table-to-csv
+ subdomain_csv="$(echo "$htmlpage" \
+ | grep -i -e ']*>/\n/Ig' \
+ | sed 's/<\/\?\(TABLE\|TR\)[^>]*>//Ig' \
+ | sed 's/^]*>\|<\/\?T[DH][^>]*>$//Ig' \
+ | sed 's/<\/T[DH][^>]*>]*>/,/Ig' \
+ | grep 'edit.php?' \
+ | grep "$fulldomain")"
+ # The above beauty ends with striping out rows that do not have an
+ # href to edit.php and do not have the domain name we are looking for.
+ # So all we should be left with is CSV of table of subdomains we are
+ # interested in.
+
+ # Now we have to read through this table and extract the data we need
+ lines="$(echo "$subdomain_csv" | wc -l)"
+ nl='
+'
+ i=0
+ found=0
+ while [ "$i" -lt "$lines" ]; do
+ i="$(_math "$i" + 1)"
+ line="$(echo "$subdomain_csv" | cut -d "$nl" -f "$i")"
+ DNSname="$(echo "$line" | cut -d ',' -f 2 | sed 's/^[^>]*>//;s/<\/a>.*//')"
+ DNStype="$(echo "$line" | cut -d ',' -f 3)"
+ if [ "$DNSname" = "$fulldomain" ] && [ "$DNStype" = "TXT" ]; then
+ DNSdataid="$(echo "$line" | cut -d ',' -f 2 | sed 's/^.*data_id=//;s/>.*//')"
+ DNSvalue="$(echo "$line" | cut -d ',' -f 4 | sed 's/^[^"]*"//;s/".*//;s/<\/td>.*//')"
+ _debug "DNSvalue: $DNSvalue"
+ # if [ "$DNSvalue" = "$txtvalue" ]; then
+ # Testing value match fails. Website is truncating the value
+ # field. So for now we will assume that there is only one TXT
+ # field for the sub domain and just delete it. Currently this
+ # is a safe assumption.
+ _freedns_delete_txt_record "$FREEDNS_COOKIE" "$DNSdataid"
+ return $?
+ # fi
+ fi
+ done
+ done
+
+ # If we get this far we did not find a match (after two attempts)
+ # Not necessarily an error, but log anyway.
+ _debug2 "$subdomain_csv"
+ _info "Cannot delete TXT record for $fulldomain/$txtvalue. Does not exist at FreeDNS"
+ return 0
+}
+
+#################### Private functions below ##################################
+
+# usage: _freedns_login username password
+# print string "cookie=value" etc.
+# returns 0 success
+_freedns_login() {
+ export _H1="Accept-Language:en-US"
+ username="$1"
+ password="$2"
+ url="https://freedns.afraid.org/zc.php?step=2"
+
+ _debug "Login to FreeDNS as user $username"
+
+ htmlpage="$(_post "username=$(printf '%s' "$username" | _url_encode)&password=$(printf '%s' "$password" | _url_encode)&submit=Login&action=auth" "$url")"
+
+ if [ "$?" != "0" ]; then
+ _err "FreeDNS login failed for user $username bad RC from _post"
+ return 1
+ fi
+
+ cookies="$(grep -i '^Set-Cookie.*dns_cookie.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+
+ # if cookies is not empty then logon successful
+ if [ -z "$cookies" ]; then
+ _debug "$htmlpage"
+ _err "FreeDNS login failed for user $username. Check $HTTP_HEADER file"
+ return 1
+ fi
+
+ printf "%s" "$cookies"
+ return 0
+}
+
+# usage _freedns_retrieve_subdomain_page login_cookies
+# echo page retrieved (html)
+# returns 0 success
+_freedns_retrieve_subdomain_page() {
+ export _H1="Cookie:$1"
+ export _H2="Accept-Language:en-US"
+ url="https://freedns.afraid.org/subdomain/"
+
+ _debug "Retrieve subdmoain page from FreeDNS"
+
+ htmlpage="$(_get "$url")"
+
+ if [ "$?" != "0" ]; then
+ _err "FreeDNS retrieve subdomins failed bad RC from _get"
+ return 1
+ elif [ -z "$htmlpage" ]; then
+ _err "FreeDNS returned empty subdomain page"
+ return 1
+ fi
+
+ _debug2 "$htmlpage"
+
+ printf "%s" "$htmlpage"
+ return 0
+}
+
+# usage _freedns_add_txt_record login_cookies domain_id subdomain value
+# returns 0 success
+_freedns_add_txt_record() {
+ export _H1="Cookie:$1"
+ export _H2="Accept-Language:en-US"
+ domain_id="$2"
+ subdomain="$3"
+ value="$(printf '%s' "$4" | _url_encode)"
+ url="http://freedns.afraid.org/subdomain/save.php?step=2"
+
+ htmlpage="$(_post "type=TXT&domain_id=$domain_id&subdomain=$subdomain&address=%22$value%22&send=Save%21" "$url")"
+
+ if [ "$?" != "0" ]; then
+ _err "FreeDNS failed to add TXT record for $subdomain bad RC from _post"
+ return 1
+ elif ! grep "200 OK" "$HTTP_HEADER" >/dev/null; then
+ _debug "$htmlpage"
+ _err "FreeDNS failed to add TXT record for $subdomain. Check $HTTP_HEADER file"
+ return 1
+ elif _contains "$htmlpage" "security code was incorrect"; then
+ _debug "$htmlpage"
+ _err "FreeDNS failed to add TXT record for $subdomain as FreeDNS requested seurity code"
+ _err "Note that you cannot use automatic DNS validation for FreeDNS public domains"
+ return 1
+ fi
+
+ _debug2 "$htmlpage"
+ _info "Added acme challenge TXT record for $fulldomain at FreeDNS"
+ return 0
+}
+
+# usage _freedns_delete_txt_record login_cookies data_id
+# returns 0 success
+_freedns_delete_txt_record() {
+ export _H1="Cookie:$1"
+ export _H2="Accept-Language:en-US"
+ data_id="$2"
+ url="https://freedns.afraid.org/subdomain/delete2.php"
+
+ htmlheader="$(_get "$url?data_id%5B%5D=$data_id&submit=delete+selected" "onlyheader")"
+
+ if [ "$?" != "0" ]; then
+ _err "FreeDNS failed to delete TXT record for $data_id bad RC from _get"
+ return 1
+ elif ! _contains "$htmlheader" "200 OK"; then
+ _debug "$htmlheader"
+ _err "FreeDNS failed to delete TXT record $data_id"
+ return 1
+ fi
+
+ _info "Deleted acme challenge TXT record for $fulldomain at FreeDNS"
+ return 0
+}
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gandi_livedns.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gandi_livedns.sh
new file mode 100755
index 000000000..41f42980b
--- /dev/null
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gandi_livedns.sh
@@ -0,0 +1,123 @@
+#!/usr/bin/env sh
+
+# Gandi LiveDNS v5 API
+# http://doc.livedns.gandi.net/
+# currently under beta
+#
+# Requires GANDI API KEY set in GANDI_LIVEDNS_KEY set as environment variable
+#
+#Author: Frédéric Crozat
+#Report Bugs here: https://github.com/fcrozat/acme.sh
+#
+######## Public functions #####################
+
+GANDI_LIVEDNS_API="https://dns.beta.gandi.net/api/v5"
+
+#Usage: dns_gandi_livedns_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_gandi_livedns_add() {
+ fulldomain=$1
+ txtvalue=$2
+
+ if [ -z "$GANDI_LIVEDNS_KEY" ]; then
+ _err "No API key specifed for Gandi LiveDNS."
+ _err "Create your key and export it as GANDI_LIVEDNS_KEY"
+ return 1
+ fi
+
+ _saveaccountconf GANDI_LIVEDNS_KEY "$GANDI_LIVEDNS_KEY"
+
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "invalid domain"
+ return 1
+ fi
+ _debug fulldomain "$fulldomain"
+ _debug txtvalue "$txtvalue"
+ _debug domain "$_domain"
+ _debug sub_domain "$_sub_domain"
+
+ _gandi_livedns_rest PUT "domains/$_domain/records/$_sub_domain/TXT" "{\"rrset_ttl\": 300, \"rrset_values\":[\"$txtvalue\"]}" \
+ && _contains "$response" '{"message": "Zone Record Created"}' \
+ && _info "Add $(__green "success")"
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_gandi_livedns_rm() {
+ fulldomain=$1
+ txtvalue=$2
+
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "invalid domain"
+ return 1
+ fi
+
+ _debug fulldomain "$fulldomain"
+ _debug domain "$_domain"
+ _debug sub_domain "$_sub_domain"
+
+ _gandi_livedns_rest DELETE "domains/$_domain/records/$_sub_domain/TXT" ""
+
+}
+
+#################### Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+ domain=$1
+ i=2
+ p=1
+ while true; do
+ h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+ _debug h "$h"
+ if [ -z "$h" ]; then
+ #not valid
+ return 1
+ fi
+
+ if ! _gandi_livedns_rest GET "domains/$h"; then
+ return 1
+ fi
+
+ if _contains "$response" '"code": 401'; then
+ _err "$response"
+ return 1
+ elif _contains "$response" '"code": 404'; then
+ _debug "$h not found"
+ else
+ _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+ _domain="$h"
+ return 0
+ fi
+ p="$i"
+ i=$(_math "$i" + 1)
+ done
+ return 1
+}
+
+_gandi_livedns_rest() {
+ m=$1
+ ep="$2"
+ data="$3"
+ _debug "$ep"
+
+ export _H1="Content-Type: application/json"
+ export _H2="X-Api-Key: $GANDI_LIVEDNS_KEY"
+
+ if [ "$m" = "GET" ]; then
+ response="$(_get "$GANDI_LIVEDNS_API/$ep")"
+ else
+ _debug data "$data"
+ response="$(_post "$data" "$GANDI_LIVEDNS_API/$ep" "" "$m")"
+ fi
+
+ if [ "$?" != "0" ]; then
+ _err "error $ep"
+ return 1
+ fi
+ _debug2 response "$response"
+ return 0
+}
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gd.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gd.sh
index 1abeeacf4..f2dd1fd5a 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gd.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_gd.sh
@@ -40,7 +40,7 @@ dns_gd_add() {
if _gd_rest PUT "domains/$_domain/records/TXT/$_sub_domain" "[{\"data\":\"$txtvalue\"}]"; then
if [ "$response" = "{}" ]; then
_info "Added, sleeping 10 seconds"
- sleep 10
+ _sleep 10
#todo: check if the record takes effect
return 0
else
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lexicon.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lexicon.sh
index c38ff3e38..c09f16fd6 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lexicon.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lexicon.sh
@@ -34,7 +34,7 @@ dns_lexicon_add() {
# shellcheck disable=SC2018,SC2019
Lx_name=$(echo LEXICON_"${PROVIDER}"_USERNAME | tr 'a-z' 'A-Z')
Lx_name_v=$(eval echo \$"$Lx_name")
- _debug "$Lx_name" "$Lx_name_v"
+ _secure_debug "$Lx_name" "$Lx_name_v"
if [ "$Lx_name_v" ]; then
_saveaccountconf "$Lx_name" "$Lx_name_v"
eval export "$Lx_name"
@@ -43,7 +43,7 @@ dns_lexicon_add() {
# shellcheck disable=SC2018,SC2019
Lx_token=$(echo LEXICON_"${PROVIDER}"_TOKEN | tr 'a-z' 'A-Z')
Lx_token_v=$(eval echo \$"$Lx_token")
- _debug "$Lx_token" "$Lx_token_v"
+ _secure_debug "$Lx_token" "$Lx_token_v"
if [ "$Lx_token_v" ]; then
_saveaccountconf "$Lx_token" "$Lx_token_v"
eval export "$Lx_token"
@@ -52,7 +52,7 @@ dns_lexicon_add() {
# shellcheck disable=SC2018,SC2019
Lx_password=$(echo LEXICON_"${PROVIDER}"_PASSWORD | tr 'a-z' 'A-Z')
Lx_password_v=$(eval echo \$"$Lx_password")
- _debug "$Lx_password" "$Lx_password_v"
+ _secure_debug "$Lx_password" "$Lx_password_v"
if [ "$Lx_password_v" ]; then
_saveaccountconf "$Lx_password" "$Lx_password_v"
eval export "$Lx_password"
@@ -61,7 +61,7 @@ dns_lexicon_add() {
# shellcheck disable=SC2018,SC2019
Lx_domaintoken=$(echo LEXICON_"${PROVIDER}"_DOMAINTOKEN | tr 'a-z' 'A-Z')
Lx_domaintoken_v=$(eval echo \$"$Lx_domaintoken")
- _debug "$Lx_domaintoken" "$Lx_domaintoken_v"
+ _secure_debug "$Lx_domaintoken" "$Lx_domaintoken_v"
if [ "$Lx_domaintoken_v" ]; then
eval export "$Lx_domaintoken"
_saveaccountconf "$Lx_domaintoken" "$Lx_domaintoken_v"
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_linode.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_linode.sh
new file mode 100755
index 000000000..6d54e6c12
--- /dev/null
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_linode.sh
@@ -0,0 +1,183 @@
+#!/usr/bin/env sh
+
+#Author: Philipp Grosswiler
+
+LINODE_API_URL="https://api.linode.com/?api_key=$LINODE_API_KEY&api_action="
+
+######## Public functions #####################
+
+#Usage: dns_linode_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_linode_add() {
+ fulldomain="${1}"
+ txtvalue="${2}"
+
+ if ! _Linode_API; then
+ return 1
+ fi
+
+ _info "Using Linode"
+ _debug "Calling: dns_linode_add() '${fulldomain}' '${txtvalue}'"
+
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "Domain does not exist."
+ return 1
+ fi
+ _debug _domain_id "$_domain_id"
+ _debug _sub_domain "$_sub_domain"
+ _debug _domain "$_domain"
+
+ _parameters="&DomainID=$_domain_id&Type=TXT&Name=$_sub_domain&Target=$txtvalue"
+
+ if _rest GET "domain.resource.create" "$_parameters" && [ -n "$response" ]; then
+ _resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1)
+ _debug _resource_id "$_resource_id"
+
+ if [ -z "$_resource_id" ]; then
+ _err "Error adding the domain resource."
+ return 1
+ fi
+
+ _info "Domain resource successfully added."
+ return 0
+ fi
+
+ return 1
+}
+
+#Usage: dns_linode_rm _acme-challenge.www.domain.com
+dns_linode_rm() {
+ fulldomain="${1}"
+
+ if ! _Linode_API; then
+ return 1
+ fi
+
+ _info "Using Linode"
+ _debug "Calling: dns_linode_rm() '${fulldomain}'"
+
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "Domain does not exist."
+ return 1
+ fi
+ _debug _domain_id "$_domain_id"
+ _debug _sub_domain "$_sub_domain"
+ _debug _domain "$_domain"
+
+ _parameters="&DomainID=$_domain_id"
+
+ if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
+ response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+
+ resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
+ if [ "$resource" ]; then
+ _resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"RESOURCEID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
+ if [ "$_resource_id" ]; then
+ _debug _resource_id "$_resource_id"
+
+ _parameters="&DomainID=$_domain_id&ResourceID=$_resource_id"
+
+ if _rest GET "domain.resource.delete" "$_parameters" && [ -n "$response" ]; then
+ _resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1)
+ _debug _resource_id "$_resource_id"
+
+ if [ -z "$_resource_id" ]; then
+ _err "Error deleting the domain resource."
+ return 1
+ fi
+
+ _info "Domain resource successfully deleted."
+ return 0
+ fi
+ fi
+
+ return 1
+ fi
+
+ return 0
+ fi
+
+ return 1
+}
+
+#################### Private functions below ##################################
+
+_Linode_API() {
+ if [ -z "$LINODE_API_KEY" ]; then
+ LINODE_API_KEY=""
+
+ _err "You didn't specify the Linode API key yet."
+ _err "Please create your key and try again."
+
+ return 1
+ fi
+
+ _saveaccountconf LINODE_API_KEY "$LINODE_API_KEY"
+}
+
+#################### Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=12345
+_get_root() {
+ domain=$1
+ i=2
+ p=1
+
+ if _rest GET "domain.list"; then
+ response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+ while true; do
+ h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+ _debug h "$h"
+ if [ -z "$h" ]; then
+ #not valid
+ return 1
+ fi
+
+ hostedzone="$(echo "$response" | _egrep_o "{.*\"DOMAIN\":\s*\"$h\".*}")"
+ if [ "$hostedzone" ]; then
+ _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"DOMAINID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
+ if [ "$_domain_id" ]; then
+ _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+ _domain=$h
+ return 0
+ fi
+ return 1
+ fi
+ p=$i
+ i=$(_math "$i" + 1)
+ done
+ fi
+ return 1
+}
+
+#method method action data
+_rest() {
+ mtd="$1"
+ ep="$2"
+ data="$3"
+
+ _debug mtd "$mtd"
+ _debug ep "$ep"
+
+ export _H1="Accept: application/json"
+ export _H2="Content-Type: application/json"
+
+ if [ "$mtd" != "GET" ]; then
+ # both POST and DELETE.
+ _debug data "$data"
+ response="$(_post "$data" "$LINODE_API_URL$ep" "" "$mtd")"
+ else
+ response="$(_get "$LINODE_API_URL$ep$data")"
+ fi
+
+ if [ "$?" != "0" ]; then
+ _err "error $ep"
+ return 1
+ fi
+ _debug2 response "$response"
+ return 0
+}
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lua.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lua.sh
index 47f4497a6..00c544307 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lua.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_lua.sh
@@ -46,12 +46,12 @@ dns_lua_add() {
return 1
fi
- count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$fulldomain\"" | wc -l)
+ count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$fulldomain.\",\"type\":\"TXT\"" | wc -l | tr -d " ")
_debug count "$count"
if [ "$count" = "0" ]; then
_info "Adding record"
if _LUA_rest POST "zones/$_domain_id/records" "{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"content\":\"$txtvalue\",\"ttl\":120}"; then
- if printf -- "%s" "$response" | grep "$fulldomain" >/dev/null; then
+ if _contains "$response" "$fulldomain"; then
_info "Added"
#todo: check if the record takes effect
return 0
@@ -63,11 +63,11 @@ dns_lua_add() {
_err "Add txt record error."
else
_info "Updating record"
- record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*,\"name\":\"$fulldomain.\",\"type\":\"TXT\"" | cut -d: -f2 | cut -d, -f1)
+ record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*,\"name\":\"$fulldomain.\",\"type\":\"TXT\"" | _head_n 1 | cut -d: -f2 | cut -d, -f1)
_debug "record_id" "$record_id"
- _LUA_rest PUT "zones/$_domain_id/records/$record_id" "{\"id\":\"$record_id\",\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"content\":\"$txtvalue\",\"zone_id\":\"$_domain_id\",\"ttl\":120}"
- if [ "$?" = "0" ]; then
+ _LUA_rest PUT "zones/$_domain_id/records/$record_id" "{\"id\":$record_id,\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"content\":\"$txtvalue\",\"zone_id\":$_domain_id,\"ttl\":120}"
+ if [ "$?" = "0" ] && _contains "$response" "updated_at"; then
_info "Updated!"
#todo: check if the record takes effect
return 0
@@ -81,7 +81,36 @@ dns_lua_add() {
#fulldomain
dns_lua_rm() {
fulldomain=$1
+ txtvalue=$2
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "invalid domain"
+ return 1
+ fi
+ _debug _domain_id "$_domain_id"
+ _debug _sub_domain "$_sub_domain"
+ _debug _domain "$_domain"
+ _debug "Getting txt records"
+ _LUA_rest GET "zones/${_domain_id}/records"
+
+ count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$fulldomain.\",\"type\":\"TXT\"" | wc -l | tr -d " ")
+ _debug count "$count"
+ if [ "$count" = "0" ]; then
+ _info "Don't need to remove."
+ else
+ record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*,\"name\":\"$fulldomain.\",\"type\":\"TXT\"" | _head_n 1 | cut -d: -f2 | cut -d, -f1)
+ _debug "record_id" "$record_id"
+ if [ -z "$record_id" ]; then
+ _err "Can not get record id to remove."
+ return 1
+ fi
+ if ! _LUA_rest DELETE "/zones/$_domain_id/records/$record_id"; then
+ _err "Delete record error."
+ return 1
+ fi
+ _contains "$response" "$record_id"
+ fi
}
#################### Private functions below ##################################
@@ -99,6 +128,7 @@ _get_root() {
fi
while true; do
h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+ _debug h "$h"
if [ -z "$h" ]; then
#not valid
return 1
@@ -106,6 +136,7 @@ _get_root() {
if _contains "$response" "\"name\":\"$h\""; then
_domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*,\"name\":\"$h\"" | cut -d : -f 2 | cut -d , -f 1)
+ _debug _domain_id "$_domain_id"
if [ "$_domain_id" ]; then
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
_domain="$h"
@@ -127,7 +158,7 @@ _LUA_rest() {
export _H1="Accept: application/json"
export _H2="Authorization: Basic $LUA_auth"
- if [ "$data" ]; then
+ if [ "$m" != "GET" ]; then
_debug data "$data"
response="$(_post "$data" "$LUA_Api/$ep" "" "$m")"
else
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_me.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_me.sh
index a8405f8f3..3393fb757 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_me.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_me.sh
@@ -2,7 +2,7 @@
# bug reports to dev@1e.ca
-# ME_Key=qmlkdjflmkqdjf
+# ME_Key=qmlkdjflmkqdjf
# ME_Secret=qmsdlkqmlksdvnnpae
ME_Api=https://api.dnsmadeeasy.com/V2.0/dns/managed
@@ -78,7 +78,36 @@ dns_me_add() {
#fulldomain
dns_me_rm() {
fulldomain=$1
+ txtvalue=$2
+ _debug "First detect the root zone"
+ if ! _get_root "$fulldomain"; then
+ _err "invalid domain"
+ return 1
+ fi
+ _debug _domain_id "$_domain_id"
+ _debug _sub_domain "$_sub_domain"
+ _debug _domain "$_domain"
+ _debug "Getting txt records"
+ _me_rest GET "${_domain_id}/records?recordName=$_sub_domain&type=TXT"
+
+ count=$(printf "%s\n" "$response" | _egrep_o "\"totalRecords\":[^,]*" | cut -d : -f 2)
+ _debug count "$count"
+ if [ "$count" = "0" ]; then
+ _info "Don't need to remove."
+ else
+ record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*" | cut -d : -f 2 | head -n 1)
+ _debug "record_id" "$record_id"
+ if [ -z "$record_id" ]; then
+ _err "Can not get record id to remove."
+ return 1
+ fi
+ if ! _me_rest DELETE "$_domain_id/records/$record_id"; then
+ _err "Delete record error."
+ return 1
+ fi
+ _contains "$response" ''
+ fi
}
#################### Private functions below ##################################
@@ -124,13 +153,13 @@ _me_rest() {
_debug "$ep"
cdate=$(date -u +"%a, %d %b %Y %T %Z")
- hmac=$(printf "%s" "$cdate" | _hmac sha1 "$(_hex "$ME_Secret")" hex)
+ hmac=$(printf "%s" "$cdate" | _hmac sha1 "$(printf "%s" "$ME_Secret" | _hex_dump | tr -d " ")" hex)
export _H1="x-dnsme-apiKey: $ME_Key"
export _H2="x-dnsme-requestDate: $cdate"
export _H3="x-dnsme-hmac: $hmac"
- if [ "$data" ]; then
+ if [ "$m" != "GET" ]; then
_debug data "$data"
response="$(_post "$data" "$ME_Api/$ep" "" "$m")"
else
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_ovh.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_ovh.sh
index 35bf126ec..faf5b42b3 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_ovh.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/dnsapi/dns_ovh.sh
@@ -14,7 +14,7 @@
#'ovh-eu'
OVH_EU='https://eu.api.ovh.com/1.0'
-#'ovh-ca':
+#'ovh-ca':
OVH_CA='https://ca.api.ovh.com/1.0'
#'kimsufi-eu'
@@ -207,7 +207,7 @@ _ovh_authentication() {
_err "Unable to get consumerKey"
return 1
fi
- _debug consumerKey "$consumerKey"
+ _secure_debug consumerKey "$consumerKey"
OVH_CK="$consumerKey"
_saveaccountconf OVH_CK "$OVH_CK"
@@ -269,7 +269,7 @@ _ovh_rest() {
_ovh_t="$(_ovh_timestamp)"
_debug2 _ovh_t "$_ovh_t"
_ovh_p="$OVH_AS+$OVH_CK+$m+$_ovh_url+$data+$_ovh_t"
- _debug _ovh_p "$_ovh_p"
+ _secure_debug _ovh_p "$_ovh_p"
_ovh_hex="$(printf "%s" "$_ovh_p" | _digest sha1 hex)"
_debug2 _ovh_hex "$_ovh_hex"
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
index 8215a8262..583e3f9d6 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
@@ -5,7 +5,7 @@ ACME_DIRS="/var/etc/acme-client /var/etc/acme-client/certs /var/etc/acme-client/
for directory in ${ACME_DIRS}; do
mkdir -p ${directory}
chown -R root:wheel ${directory}
- chmod -R 755 ${directory}
+ chmod -R 750 ${directory}
done
exit 0
|