diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2021-08-28 09:22:15 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2021-08-28 09:22:27 +0000 |
commit | be6735f4d9fd2138bb78110779bbff13ab9f6fa3 (patch) | |
tree | d115aab736d93525d444e73645f6ab049b8f8e5f /dehydrated/bin | |
parent | Releasing debian version 20190301-lts1-2. (diff) | |
download | open-infrastructure-service-tools-be6735f4d9fd2138bb78110779bbff13ab9f6fa3.tar.xz open-infrastructure-service-tools-be6735f4d9fd2138bb78110779bbff13ab9f6fa3.zip |
Merging upstream version 20210828.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rwxr-xr-x | dehydrated/bin/dehydrated-cron | 7 | ||||
-rwxr-xr-x | dehydrated/bin/dehydrated-hook.d | 96 | ||||
-rwxr-xr-x | dehydrated/bin/dehydrated-nsupdate | 92 |
3 files changed, 195 insertions, 0 deletions
diff --git a/dehydrated/bin/dehydrated-cron b/dehydrated/bin/dehydrated-cron new file mode 100755 index 0000000..09e1a44 --- /dev/null +++ b/dehydrated/bin/dehydrated-cron @@ -0,0 +1,7 @@ +#!/bin/sh + +set -e + +mkdir -p /var/log/dehydrated +dehydrated -gcd >> /var/log/dehydrated/dehydrated.log +chown -R root:adm /var/log/dehydrated diff --git a/dehydrated/bin/dehydrated-hook.d b/dehydrated/bin/dehydrated-hook.d new file mode 100755 index 0000000..2d9a5af --- /dev/null +++ b/dehydrated/bin/dehydrated-hook.d @@ -0,0 +1,96 @@ +#!/bin/sh + +set -e + +HOOKS="/etc/dehydrated/hook.d" + +deploy_challenge () +{ + export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" + + run-parts --regex '^deploy_challenge.*' "${HOOKS}" +} + +clean_challenge () +{ + export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" + + run-parts --regex '^clean_challenge.*' "${HOOKS}" +} + +sync_cert () +{ + export KEYFILE="${1}" CERTFILE="${2}" FULLCHAINFILE="${3}" CHAINFILE="${4}" REQUESTFILE="${5}" + + run-parts --regex '^sync_cert.*' "${HOOKS}" +} + +deploy_cert () +{ + export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" + + run-parts --regex '^deploy_cert.*' "${HOOKS}" +} + +deploy_ocsp () +{ + export DOMAIN="${1}" OCSPFILE="${2}" TIMESTAMP="${3}" + + run-parts --regex '^deploy_ocsp.*' "${HOOKS}" +} + +unchanged_cert () +{ + export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" + + run-parts --regex '^unchanged_cert.*' "${HOOKS}" +} + +invalid_challenge () +{ + export DOMAIN="${1}" RESPONSE="${2}" + + run-parts --regex '^invalid_challenge.*' "${HOOKS}" +} + +request_failure () +{ + export STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}" HEADERS="${4}" + + run-parts --regex '^request_failure.*' "${HOOKS}" +} + +generate_csr () +{ + export DOMAIN="${1}" CERTDIR="${2}" ALTNAMES="${3}" + + run-parts --regex '^generate_csr.*' "${HOOKS}" +} + +startup_hook () +{ + run-parts --regex '^startup_hook.*' "${HOOKS}" +} + +exit_hook () +{ + export ERROR="${1:-}" + + run-parts --regex '^exit_hook.*' "${HOOKS}" +} + +HANDLER="${1}" + +if [ -z "${HANDLER}" ] +then + echo "Usage: ${0} HANDLER" >&2 + exit 1 +fi + +shift + +case "${HANDLER}" in + deploy_challenge|clean_challenge|sync_cert|deploy_cert|deploy_ocsp|unchanged_cert|invalid_challenge|request_failure|generate_csr|startup_hook|exit_hook) + "${HANDLER}" "${@}" + ;; +esac diff --git a/dehydrated/bin/dehydrated-nsupdate b/dehydrated/bin/dehydrated-nsupdate new file mode 100755 index 0000000..f901d2e --- /dev/null +++ b/dehydrated/bin/dehydrated-nsupdate @@ -0,0 +1,92 @@ +#!/bin/sh + +set -e + +HOOK="$(basename "${0}")" +HOOK_ACTION="$(echo "${HOOK}" | awk -F. '{ print $1 }')" + +# set nsupdate action +case "${HOOK}" in + clean_challenge.*) + HOOK_ACTION="delete" + ;; + + deploy_challenge.*) + HOOK_ACTION="add" + ;; + + *) + echo "'${HOOK}': no such hook action '${HOOK_ACTION}'" >&2 + echo "'${HOOK}': use 'clean_challenge.' or 'deploy_challenge.' as prefix in your symlink" >&2 + exit 1 + ;; +esac + +# alternatives handling for dig +if command -v kdig > /dev/null 2>&1 +then + # knot-dnsutils + DIG="kdig" +elif command -v dig > /dev/null 2>&1 +then + # bind-dnsutils + DIG="dig" +else + echo "'${HOOK}': need dig from bind-dnsutils or knot-dnsutils" >&2 + exit 1 +fi + +# alternatives handling for nsupdate +if command -v knsupdate > /dev/null 2>&1 +then + # knot-dnsutils + NSUPDATE="knsupdate" +elif command -v nsupdate > /dev/null 2>&1 +then + # bind-dnsutils + NSUPDATE="nsupdate" +else + echo "'${HOOK}': need nsupdate from bind-dnsutils or knot-dnsutils" >&2 + exit 1 +fi + +# find txt record to update +CNAME="$(${DIG} "_acme-challenge.${DOMAIN}" 2>&1 | awk '/CNAME/ { print $5 }' | tail -n1)" + +if [ -n "${CNAME}" ] +then + UPDATE_DOMAIN="${CNAME}" +else + UPDATE_DOMAIN="_acme-challenge.${DOMAIN}" +fi + +# find nameservers to update +ZONE="${UPDATE_DOMAIN}" + +while true +do + NAMESERVERS="$(${DIG} NS "${ZONE}" 2>&1 | awk '/NS/ { print $5 }' | tail -n1)" + + if [ -n "${NAMESERVERS}" ] + then + break + else + ZONE="$(echo "${ZONE}" | cut -d '.' -f 2-)" + fi +done + +NAMESERVERS="$(${DIG} +short NS "${ZONE}")" + +# update nameservers +for NAMESERVER in ${NAMESERVERS} +do + echo -n " + Adding TXT record (${UPDATE_DOMAIN})..." + +echo "server ${NAMESERVER} +zone ${ZONE} +ttl 0 +update ${HOOK_ACTION} ${UPDATE_DOMAIN} 0 TXT ${TOKEN_VALUE} +send" | "${NSUPDATE}" + + echo " done." +done |