From e49b20df8176a8eed55825fd16977255192f767c Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 5 Sep 2021 07:54:41 +0200 Subject: Adding upstream version 20210905. Signed-off-by: Daniel Baumann --- dehydrated/bin/dehydrated-hook | 115 +++++++++++++++++++++++++++++++++++++ dehydrated/bin/dehydrated-hook.d | 115 ------------------------------------- dehydrated/bin/dehydrated-nsupdate | 8 ++- 3 files changed, 122 insertions(+), 116 deletions(-) create mode 100755 dehydrated/bin/dehydrated-hook delete mode 100755 dehydrated/bin/dehydrated-hook.d (limited to 'dehydrated/bin') diff --git a/dehydrated/bin/dehydrated-hook b/dehydrated/bin/dehydrated-hook new file mode 100755 index 0000000..4e7b7ff --- /dev/null +++ b/dehydrated/bin/dehydrated-hook @@ -0,0 +1,115 @@ +#!/bin/sh + +# Open Infrastructure: service-tools + +# Copyright (C) 2014-2021 Daniel Baumann +# +# SPDX-License-Identifier: GPL-3.0+ +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +set -e + +HOOKS="/etc/dehydrated/hook.d" + +deploy_challenge () +{ + export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" + + run-parts --regex '^deploy_challenge.*' "${HOOKS}" +} + +clean_challenge () +{ + export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" + + run-parts --regex '^clean_challenge.*' "${HOOKS}" +} + +sync_cert () +{ + export KEYFILE="${1}" CERTFILE="${2}" FULLCHAINFILE="${3}" CHAINFILE="${4}" REQUESTFILE="${5}" + + run-parts --regex '^sync_cert.*' "${HOOKS}" +} + +deploy_cert () +{ + export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" + + run-parts --regex '^deploy_cert.*' "${HOOKS}" +} + +deploy_ocsp () +{ + export DOMAIN="${1}" OCSPFILE="${2}" TIMESTAMP="${3}" + + run-parts --regex '^deploy_ocsp.*' "${HOOKS}" +} + +unchanged_cert () +{ + export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" + + run-parts --regex '^unchanged_cert.*' "${HOOKS}" +} + +invalid_challenge () +{ + export DOMAIN="${1}" RESPONSE="${2}" + + run-parts --regex '^invalid_challenge.*' "${HOOKS}" +} + +request_failure () +{ + export STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}" HEADERS="${4}" + + run-parts --regex '^request_failure.*' "${HOOKS}" +} + +generate_csr () +{ + export DOMAIN="${1}" CERTDIR="${2}" ALTNAMES="${3}" + + run-parts --regex '^generate_csr.*' "${HOOKS}" +} + +startup_hook () +{ + run-parts --regex '^startup_hook.*' "${HOOKS}" +} + +exit_hook () +{ + export ERROR="${1:-}" + + run-parts --regex '^exit_hook.*' "${HOOKS}" +} + +HANDLER="${1}" + +if [ -z "${HANDLER}" ] +then + echo "Usage: ${0} HANDLER" >&2 + exit 1 +fi + +shift + +case "${HANDLER}" in + deploy_challenge|clean_challenge|sync_cert|deploy_cert|deploy_ocsp|unchanged_cert|invalid_challenge|request_failure|generate_csr|startup_hook|exit_hook) + "${HANDLER}" "${@}" + ;; +esac diff --git a/dehydrated/bin/dehydrated-hook.d b/dehydrated/bin/dehydrated-hook.d deleted file mode 100755 index 4e7b7ff..0000000 --- a/dehydrated/bin/dehydrated-hook.d +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/sh - -# Open Infrastructure: service-tools - -# Copyright (C) 2014-2021 Daniel Baumann -# -# SPDX-License-Identifier: GPL-3.0+ -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -set -e - -HOOKS="/etc/dehydrated/hook.d" - -deploy_challenge () -{ - export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" - - run-parts --regex '^deploy_challenge.*' "${HOOKS}" -} - -clean_challenge () -{ - export DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}" - - run-parts --regex '^clean_challenge.*' "${HOOKS}" -} - -sync_cert () -{ - export KEYFILE="${1}" CERTFILE="${2}" FULLCHAINFILE="${3}" CHAINFILE="${4}" REQUESTFILE="${5}" - - run-parts --regex '^sync_cert.*' "${HOOKS}" -} - -deploy_cert () -{ - export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}" - - run-parts --regex '^deploy_cert.*' "${HOOKS}" -} - -deploy_ocsp () -{ - export DOMAIN="${1}" OCSPFILE="${2}" TIMESTAMP="${3}" - - run-parts --regex '^deploy_ocsp.*' "${HOOKS}" -} - -unchanged_cert () -{ - export DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" - - run-parts --regex '^unchanged_cert.*' "${HOOKS}" -} - -invalid_challenge () -{ - export DOMAIN="${1}" RESPONSE="${2}" - - run-parts --regex '^invalid_challenge.*' "${HOOKS}" -} - -request_failure () -{ - export STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}" HEADERS="${4}" - - run-parts --regex '^request_failure.*' "${HOOKS}" -} - -generate_csr () -{ - export DOMAIN="${1}" CERTDIR="${2}" ALTNAMES="${3}" - - run-parts --regex '^generate_csr.*' "${HOOKS}" -} - -startup_hook () -{ - run-parts --regex '^startup_hook.*' "${HOOKS}" -} - -exit_hook () -{ - export ERROR="${1:-}" - - run-parts --regex '^exit_hook.*' "${HOOKS}" -} - -HANDLER="${1}" - -if [ -z "${HANDLER}" ] -then - echo "Usage: ${0} HANDLER" >&2 - exit 1 -fi - -shift - -case "${HANDLER}" in - deploy_challenge|clean_challenge|sync_cert|deploy_cert|deploy_ocsp|unchanged_cert|invalid_challenge|request_failure|generate_csr|startup_hook|exit_hook) - "${HANDLER}" "${@}" - ;; -esac diff --git a/dehydrated/bin/dehydrated-nsupdate b/dehydrated/bin/dehydrated-nsupdate index ec8cf7f..7b6ea34 100755 --- a/dehydrated/bin/dehydrated-nsupdate +++ b/dehydrated/bin/dehydrated-nsupdate @@ -103,6 +103,11 @@ do fi done +if [ -n "${TSIG_KEYFILE}" ] && [ -e "${TSIG_KEYFILE}" ] +then + NSUPDATE_OPTIONS="-k ${TSIG_KEYFILE}" +fi + NAMESERVERS="$(${DIG} +short NS "${ZONE}")" # update nameservers @@ -110,11 +115,12 @@ for NAMESERVER in ${NAMESERVERS} do echo -n " + sending '${HOOK_ACTION}' for ${TXT_RECORD} to ${NAMESERVER}..." +# shellcheck disable=SC2086 echo "server ${NAMESERVER} zone ${ZONE} ttl 0 update ${HOOK_ACTION} ${TXT_RECORD} 0 TXT ${TOKEN_VALUE} -send" | "${NSUPDATE}" +send" | "${NSUPDATE}" ${NSUPDATE_OPTIONS} echo " done." done -- cgit v1.2.3