You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

455 lines
19 KiB

5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
4 years ago
5 years ago
5 years ago
5 years ago
4 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
4 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
4 years ago
4 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
  1. #!/usr/bin/env sh
  2. ## Name: dns_pleskxml.sh
  3. ## Created by Stilez.
  4. ## Also uses some code from PR#1832 by @romanlum (https://github.com/acmesh-official/acme.sh/pull/1832/files)
  5. ## This DNS-01 method uses the Plesk XML API described at:
  6. ## https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
  7. ## and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
  8. ## Note: a DNS ID with host = empty string is OK for this API, see
  9. ## https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
  10. ## For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
  11. ## So this API module can handle such a request, if needed.
  12. ## For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
  13. ## The user credentials (username+password) and URL/URI for the Plesk XML API must be set by the user
  14. ## before this module is called (case sensitive):
  15. ##
  16. ## ```
  17. ## export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"
  18. ## (or probably something similar)
  19. ## export pleskxml_user="my plesk username"
  20. ## export pleskxml_pass="my plesk password"
  21. ## ```
  22. ## Ok, let's issue a cert now:
  23. ## ```
  24. ## acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
  25. ## ```
  26. ##
  27. ## The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
  28. #################### INTERNAL VARIABLES + NEWLINE + API TEMPLATES ##################################
  29. pleskxml_init_checks_done=0
  30. # Variable containing bare newline - not a style issue
  31. # shellcheck disable=SC1004
  32. NEWLINE='\
  33. '
  34. pleskxml_tplt_get_domains="<packet><webspace><get><filter/><dataset><gen_info/></dataset></get></webspace></packet>"
  35. # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
  36. # Also used to test credentials and URI.
  37. # No params.
  38. pleskxml_tplt_get_additional_domains="<packet><site><get><filter/><dataset><gen_info/></dataset></get></site></packet>"
  39. # Get a list of additional domains that PLESK can manage, so we can check root domain + host for acme.sh
  40. # No params.
  41. pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
  42. # Get all DNS records for a Plesk domain ID.
  43. # PARAM = Plesk domain id to query
  44. pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
  45. # Add a TXT record to a domain.
  46. # PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
  47. pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
  48. # Delete a specific TXT record from a domain.
  49. # PARAM = the Plesk internal ID for the DNS record to be deleted
  50. #################### Public functions ##################################
  51. #Usage: dns_pleskxml_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
  52. dns_pleskxml_add() {
  53. fulldomain=$1
  54. txtvalue=$2
  55. _info "Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..."
  56. # Get credentials if not already checked, and confirm we can log in to Plesk XML API
  57. if ! _credential_check; then
  58. return 1
  59. fi
  60. # Get root and subdomain details, and Plesk domain ID
  61. if ! _pleskxml_get_root_domain "$fulldomain"; then
  62. return 1
  63. fi
  64. _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
  65. # printf using template in a variable - not a style issue
  66. # shellcheck disable=SC2059
  67. request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"
  68. if ! _call_api "$request"; then
  69. return 1
  70. fi
  71. # OK, we should have added a TXT record. Let's check and return success if so.
  72. # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
  73. results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
  74. if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then
  75. # Error - doesn't contain expected string. Something's wrong.
  76. _err 'Error when calling Plesk XML API.'
  77. _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
  78. _err 'This is unexpected: something has gone wrong.'
  79. _err 'The full response was:'
  80. _err "$pleskxml_prettyprint_result"
  81. return 1
  82. fi
  83. recid="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
  84. _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
  85. return 0
  86. }
  87. #Usage: dns_pleskxml_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
  88. dns_pleskxml_rm() {
  89. fulldomain=$1
  90. txtvalue=$2
  91. _info "Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..."
  92. # Get credentials if not already checked, and confirm we can log in to Plesk XML API
  93. if ! _credential_check; then
  94. return 1
  95. fi
  96. # Get root and subdomain details, and Plesk domain ID
  97. if ! _pleskxml_get_root_domain "$fulldomain"; then
  98. return 1
  99. fi
  100. _debug 'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs'
  101. # printf using template in a variable - not a style issue
  102. # shellcheck disable=SC2059
  103. request="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")"
  104. if ! _call_api "$request"; then
  105. return 1
  106. fi
  107. # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
  108. # Also strip out spaces between tags, redundant <data> and </data> group tags and any <self-closing/> tags
  109. reclist="$(
  110. _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' |
  111. sed 's# \{1,\}<\([a-zA-Z]\)#<\1#g;s#</\{0,1\}data>##g;s#<[a-z][^/<>]*/>##g' |
  112. grep "<site-id>${root_domain_id}</site-id>" |
  113. grep '<id>[0-9]\{1,\}</id>' |
  114. grep '<type>TXT</type>'
  115. )"
  116. if [ -z "$reclist" ]; then
  117. _err "No TXT records found for root domain $fulldomain (Plesk domain ID ${root_domain_id}). Exiting."
  118. return 1
  119. fi
  120. _debug "Got list of DNS TXT records for root Plesk domain ID ${root_domain_id} of root domain $fulldomain:"
  121. _debug "$reclist"
  122. # Extracting the id of the TXT record for the full domain (NOT case-sensitive) and corresponding value
  123. recid="$(
  124. _value "$reclist" |
  125. grep -i "<host>${fulldomain}.</host>" |
  126. grep "<value>${txtvalue}</value>" |
  127. sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/'
  128. )"
  129. _debug "Got id from line: $recid"
  130. if ! _value "$recid" | grep '^[0-9]\{1,\}$' >/dev/null; then
  131. _err "DNS records for root domain '${fulldomain}.' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
  132. _err "Cannot delete TXT record. Exiting."
  133. return 1
  134. fi
  135. _debug "Found Plesk record ID for target text string '${txtvalue}': ID=${recid}"
  136. _debug 'Calling Plesk XML API to remove TXT record'
  137. # printf using template in a variable - not a style issue
  138. # shellcheck disable=SC2059
  139. request="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")"
  140. if ! _call_api "$request"; then
  141. return 1
  142. fi
  143. # OK, we should have removed a TXT record. Let's check and return success if so.
  144. # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
  145. results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
  146. if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then
  147. # Error - doesn't contain expected string. Something's wrong.
  148. _err 'Error when calling Plesk XML API.'
  149. _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
  150. _err 'This is unexpected: something has gone wrong.'
  151. _err 'The full response was:'
  152. _err "$pleskxml_prettyprint_result"
  153. return 1
  154. fi
  155. _info "Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()."
  156. return 0
  157. }
  158. #################### Private functions below (utility functions) ##################################
  159. # Outputs value of a variable without additional newlines etc
  160. _value() {
  161. printf '%s' "$1"
  162. }
  163. # Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between
  164. # $1, $2 = where to cut
  165. # $3 = FQDN
  166. _valuecut() {
  167. printf '%s' "$3" | cut -d . -f "${1}-${2}"
  168. }
  169. # Counts '.' present in a domain name or other string
  170. # $1 = domain name
  171. _countdots() {
  172. _value "$1" | tr -dc '.' | wc -c | sed 's/ //g'
  173. }
  174. # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
  175. # $1 - result string from API
  176. # $2 - plain text tag to resplit on (usually "result" or "domain"). NOT REGEX
  177. # $3 - basic regex to recognise useful return lines
  178. # note: $3 matches via basic NOT extended regex (BRE), as extended regex capabilities not needed at the moment.
  179. # Last line could change to <sed -n '/.../p'> instead, with suitable escaping of ['"/$],
  180. # if future Plesk XML API changes ever require extended regex
  181. _api_response_split() {
  182. printf '%s' "$1" |
  183. sed 's/^ +//;s/ +$//' |
  184. tr -d '\n\r' |
  185. sed "s/<\/\{0,1\}$2>/${NEWLINE}/g" |
  186. grep "$3"
  187. }
  188. #################### Private functions below (DNS functions) ##################################
  189. # Calls Plesk XML API, and checks results for obvious issues
  190. _call_api() {
  191. request="$1"
  192. errtext=''
  193. _debug 'Entered _call_api(). Calling Plesk XML API with request:'
  194. _debug "'$request'"
  195. export _H1="HTTP_AUTH_LOGIN: $pleskxml_user"
  196. export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass"
  197. export _H3="content-Type: text/xml"
  198. export _H4="HTTP_PRETTY_PRINT: true"
  199. pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
  200. pleskxml_retcode="$?"
  201. _debug 'The responses from the Plesk XML server were:'
  202. _debug "retcode=$pleskxml_retcode. Literal response:"
  203. _debug "'$pleskxml_prettyprint_result'"
  204. # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
  205. # Also detect if there simply aren't any status lines (null result?) and report that, as well.
  206. # Remove <data></data> structure from result string, since it might contain <status> values that are related to the status of the domain and not to the API request
  207. statuslines_count_total="$(echo "$pleskxml_prettyprint_result" | sed '/<data>/,/<\/data>/d' | grep -c '^ *<status>[^<]*</status> *$')"
  208. statuslines_count_okay="$(echo "$pleskxml_prettyprint_result" | sed '/<data>/,/<\/data>/d' | grep -c '^ *<status>ok</status> *$')"
  209. _debug "statuslines_count_total=$statuslines_count_total."
  210. _debug "statuslines_count_okay=$statuslines_count_okay."
  211. if [ -z "$statuslines_count_total" ]; then
  212. # We have no status lines at all. Results are empty
  213. errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.'
  214. elif [ "$statuslines_count_okay" -ne "$statuslines_count_total" ]; then
  215. # We have some status lines that aren't "ok". Any available details are in API response fields "status" "errcode" and "errtext"
  216. # Workaround for basic regex:
  217. # - filter output to keep only lines like this: "SPACES<TAG>text</TAG>SPACES" (shouldn't be necessary with prettyprint but guarantees subsequent code is ok)
  218. # - then edit the 3 "useful" error tokens individually and remove closing tags on all lines
  219. # - then filter again to remove all lines not edited (which will be the lines not starting A-Z)
  220. errtext="$(
  221. _value "$pleskxml_prettyprint_result" |
  222. grep '^ *<[a-z]\{1,\}>[^<]*<\/[a-z]\{1,\}> *$' |
  223. sed 's/^ *<status>/Status: /;s/^ *<errcode>/Error code: /;s/^ *<errtext>/Error text: /;s/<\/.*$//' |
  224. grep '^[A-Z]'
  225. )"
  226. fi
  227. if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
  228. # Call failed, for reasons either in the retcode or the response text...
  229. if [ "$pleskxml_retcode" -eq 0 ]; then
  230. _err "The POST request was successfully sent to the Plesk server."
  231. else
  232. _err "The return code for the POST request was $pleskxml_retcode (non-zero = failure in submitting request to server)."
  233. fi
  234. if [ "$errtext" != "" ]; then
  235. _err 'The error responses received from the Plesk server were:'
  236. _err "$errtext"
  237. else
  238. _err "No additional error messages were received back from the Plesk server"
  239. fi
  240. _err "The Plesk XML API call failed."
  241. return 1
  242. fi
  243. _debug "Leaving _call_api(). Successful call."
  244. return 0
  245. }
  246. # Startup checks (credentials, URI)
  247. _credential_check() {
  248. _debug "Checking Plesk XML API login credentials and URI..."
  249. if [ "$pleskxml_init_checks_done" -eq 1 ]; then
  250. _debug "Initial checks already done, no need to repeat. Skipped."
  251. return 0
  252. fi
  253. pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
  254. pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
  255. pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
  256. if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then
  257. pleskxml_user=""
  258. pleskxml_pass=""
  259. pleskxml_uri=""
  260. _err "You didn't specify one or more of the Plesk XML API username, password, or URI."
  261. _err "Please create these and try again."
  262. _err "Instructions are in the 'dns_pleskxml' plugin source code or in the acme.sh documentation."
  263. return 1
  264. fi
  265. # Test the API is usable, by trying to read the list of managed domains...
  266. _call_api "$pleskxml_tplt_get_domains"
  267. if [ "$pleskxml_retcode" -ne 0 ]; then
  268. _err 'Failed to access Plesk XML API.'
  269. _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
  270. return 1
  271. fi
  272. _saveaccountconf_mutable pleskxml_uri "$pleskxml_uri"
  273. _saveaccountconf_mutable pleskxml_user "$pleskxml_user"
  274. _saveaccountconf_mutable pleskxml_pass "$pleskxml_pass"
  275. _debug "Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use."
  276. pleskxml_init_checks_done=1
  277. return 0
  278. }
  279. # For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
  280. # IMPORTANT NOTE: a result with host = empty string is OK for this API, see
  281. # https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
  282. # See notes at top of this file
  283. _pleskxml_get_root_domain() {
  284. original_full_domain_name="$1"
  285. _debug "Identifying DNS root domain for '$original_full_domain_name' that is managed by the Plesk account."
  286. # test if the domain as provided is valid for splitting.
  287. if [ "$(_countdots "$original_full_domain_name")" -eq 0 ]; then
  288. _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
  289. return 1
  290. fi
  291. _debug "Querying Plesk server for list of managed domains..."
  292. _call_api "$pleskxml_tplt_get_domains"
  293. if [ "$pleskxml_retcode" -ne 0 ]; then
  294. return 1
  295. fi
  296. # Generate a crude list of domains known to this Plesk account based on subscriptions.
  297. # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
  298. # for non-Western character sets.
  299. # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
  300. # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
  301. output="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')"
  302. debug_output="$(printf "%s" "$output" | sed -n 's:.*<name>\(.*\)</name>.*:\1:p')"
  303. _debug 'Domains managed by Plesk server are:'
  304. _debug "$debug_output"
  305. _debug "Querying Plesk server for list of additional managed domains..."
  306. _call_api "$pleskxml_tplt_get_additional_domains"
  307. if [ "$pleskxml_retcode" -ne 0 ]; then
  308. return 1
  309. fi
  310. # Generate a crude list of additional domains known to this Plesk account based on sites.
  311. # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
  312. # for non-Western character sets.
  313. # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
  314. # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
  315. output_additional="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')"
  316. debug_additional="$(printf "%s" "$output_additional" | sed -n 's:.*<name>\(.*\)</name>.*:\1:p')"
  317. _debug 'Additional domains managed by Plesk server are:'
  318. _debug "$debug_additional"
  319. # Concate the two outputs together.
  320. output="$(printf "%s" "$output $NEWLINE $output_additional")"
  321. debug_output="$(printf "%s" "$output" | sed -n 's:.*<name>\(.*\)</name>.*:\1:p')"
  322. _debug 'Domains (including additional) managed by Plesk server are:'
  323. _debug "$debug_output"
  324. # loop and test if domain, or any parent domain, is managed by Plesk
  325. # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
  326. root_domain_name="$original_full_domain_name"
  327. while true; do
  328. _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
  329. root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
  330. if [ -n "$root_domain_id" ]; then
  331. # Found a match
  332. # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
  333. # SO WE HANDLE IT AND DON'T PREVENT IT
  334. sub_domain_name="$(_value "$original_full_domain_name" | sed "s/\.\{0,1\}${root_domain_name}"'$//')"
  335. _info "Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
  336. return 0
  337. fi
  338. # No match, try next parent up (if any)...
  339. root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
  340. if [ "$(_countdots "$root_domain_name")" -eq 0 ]; then
  341. _debug "No match, and next parent would be a TLD..."
  342. _err "Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk."
  343. _err "Are you sure that this domain is managed by this Plesk server?"
  344. return 1
  345. fi
  346. _debug "No match, trying next parent up..."
  347. done
  348. }