You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

243 lines
7.4 KiB

8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
  1. #!/usr/bin/env sh
  2. #
  3. #AWS_ACCESS_KEY_ID="sdfsdfsdfljlbjkljlkjsdfoiwje"
  4. #
  5. #AWS_SECRET_ACCESS_KEY="xxxxxxx"
  6. #This is the Amazon Route53 api wrapper for acme.sh
  7. AWS_HOST="route53.amazonaws.com"
  8. AWS_URL="https://$AWS_HOST"
  9. AWS_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API"
  10. ######## Public functions #####################
  11. #Usage: dns_myapi_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
  12. dns_aws_add() {
  13. fulldomain=$1
  14. txtvalue=$2
  15. if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  16. AWS_ACCESS_KEY_ID=""
  17. AWS_SECRET_ACCESS_KEY=""
  18. _err "You don't specify aws route53 api key id and and api key secret yet."
  19. _err "Please create you key and try again. see $(__green $AWS_WIKI)"
  20. return 1
  21. fi
  22. if [ -z "$AWS_SESSION_TOKEN" ]; then
  23. _saveaccountconf AWS_ACCESS_KEY_ID "$AWS_ACCESS_KEY_ID"
  24. _saveaccountconf AWS_SECRET_ACCESS_KEY "$AWS_SECRET_ACCESS_KEY"
  25. fi
  26. _debug "First detect the root zone"
  27. if ! _get_root "$fulldomain"; then
  28. _err "invalid domain"
  29. return 1
  30. fi
  31. _debug _domain_id "$_domain_id"
  32. _debug _sub_domain "$_sub_domain"
  33. _debug _domain "$_domain"
  34. _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>UPSERT</Action><ResourceRecordSet><Name>$fulldomain</Name><Type>TXT</Type><TTL>300</TTL><ResourceRecords><ResourceRecord><Value>\"$txtvalue\"</Value></ResourceRecord></ResourceRecords></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
  35. if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
  36. _info "txt record updated success."
  37. return 0
  38. fi
  39. return 1
  40. }
  41. #fulldomain txtvalue
  42. dns_aws_rm() {
  43. fulldomain=$1
  44. txtvalue=$2
  45. _debug "First detect the root zone"
  46. if ! _get_root "$fulldomain"; then
  47. _err "invalid domain"
  48. return 1
  49. fi
  50. _debug _domain_id "$_domain_id"
  51. _debug _sub_domain "$_sub_domain"
  52. _debug _domain "$_domain"
  53. _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>DELETE</Action><ResourceRecordSet><ResourceRecords><ResourceRecord><Value>\"$txtvalue\"</Value></ResourceRecord></ResourceRecords><Name>$fulldomain.</Name><Type>TXT</Type><TTL>300</TTL></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
  54. if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
  55. _info "txt record deleted success."
  56. return 0
  57. fi
  58. return 1
  59. }
  60. #################### Private functions below ##################################
  61. _get_root() {
  62. domain=$1
  63. i=2
  64. p=1
  65. if aws_rest GET "2013-04-01/hostedzone"; then
  66. _debug "response" "$response"
  67. while true; do
  68. h=$(printf "%s" "$domain" | cut -d . -f $i-100)
  69. if [ -z "$h" ]; then
  70. if _contains "$response" "<IsTruncated>true</IsTruncated>" && _contains "$response" "<NextMarker>"; then
  71. _debug "IsTruncated"
  72. _nextMarker="$(echo "$response" | _egrep_o "<NextMarker>.*</NextMarker>" | cut -d '>' -f 2 | cut -d '<' -f 1)"
  73. _debug "NextMarker" "$_nextMarker"
  74. if aws_rest GET "2013-04-01/hostedzone" "marker=$_nextMarker"; then
  75. _debug "Truncated request OK"
  76. i=2
  77. p=1
  78. continue
  79. else
  80. _err "Truncated request error."
  81. fi
  82. fi
  83. #not valid
  84. return 1
  85. fi
  86. if _contains "$response" "<Name>$h.</Name>"; then
  87. hostedzone="$(echo "$response" | sed 's/<HostedZone>/#&/g' | tr '#' '\n' | _egrep_o "<HostedZone><Id>[^<]*<.Id><Name>$h.<.Name>.*<.HostedZone>")"
  88. _debug hostedzone "$hostedzone"
  89. if [ -z "$hostedzone" ]; then
  90. _err "Error, can not get hostedzone."
  91. return 1
  92. fi
  93. _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "<Id>.*<.Id>" | head -n 1 | _egrep_o ">.*<" | tr -d "<>")
  94. if [ "$_domain_id" ]; then
  95. _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
  96. _domain=$h
  97. return 0
  98. fi
  99. return 1
  100. fi
  101. p=$i
  102. i=$(_math "$i" + 1)
  103. done
  104. fi
  105. return 1
  106. }
  107. #method uri qstr data
  108. aws_rest() {
  109. mtd="$1"
  110. ep="$2"
  111. qsr="$3"
  112. data="$4"
  113. _debug mtd "$mtd"
  114. _debug ep "$ep"
  115. _debug qsr "$qsr"
  116. _debug data "$data"
  117. CanonicalURI="/$ep"
  118. _debug2 CanonicalURI "$CanonicalURI"
  119. CanonicalQueryString="$qsr"
  120. _debug2 CanonicalQueryString "$CanonicalQueryString"
  121. RequestDate="$(date -u +"%Y%m%dT%H%M%SZ")"
  122. _debug2 RequestDate "$RequestDate"
  123. #RequestDate="20161120T141056Z" ##############
  124. export _H1="x-amz-date: $RequestDate"
  125. aws_host="$AWS_HOST"
  126. CanonicalHeaders="host:$aws_host\nx-amz-date:$RequestDate\n"
  127. SignedHeaders="host;x-amz-date"
  128. if [ -n "$AWS_SESSION_TOKEN" ]; then
  129. export _H3="x-amz-security-token: $AWS_SESSION_TOKEN"
  130. CanonicalHeaders="${CanonicalHeaders}x-amz-security-token:$AWS_SESSION_TOKEN\n"
  131. SignedHeaders="${SignedHeaders};x-amz-security-token"
  132. fi
  133. _debug2 CanonicalHeaders "$CanonicalHeaders"
  134. _debug2 SignedHeaders "$SignedHeaders"
  135. RequestPayload="$data"
  136. _debug2 RequestPayload "$RequestPayload"
  137. Hash="sha256"
  138. CanonicalRequest="$mtd\n$CanonicalURI\n$CanonicalQueryString\n$CanonicalHeaders\n$SignedHeaders\n$(printf "%s" "$RequestPayload" | _digest "$Hash" hex)"
  139. _debug2 CanonicalRequest "$CanonicalRequest"
  140. HashedCanonicalRequest="$(printf "$CanonicalRequest%s" | _digest "$Hash" hex)"
  141. _debug2 HashedCanonicalRequest "$HashedCanonicalRequest"
  142. Algorithm="AWS4-HMAC-SHA256"
  143. _debug2 Algorithm "$Algorithm"
  144. RequestDateOnly="$(echo "$RequestDate" | cut -c 1-8)"
  145. _debug2 RequestDateOnly "$RequestDateOnly"
  146. Region="us-east-1"
  147. Service="route53"
  148. CredentialScope="$RequestDateOnly/$Region/$Service/aws4_request"
  149. _debug2 CredentialScope "$CredentialScope"
  150. StringToSign="$Algorithm\n$RequestDate\n$CredentialScope\n$HashedCanonicalRequest"
  151. _debug2 StringToSign "$StringToSign"
  152. kSecret="AWS4$AWS_SECRET_ACCESS_KEY"
  153. #kSecret="wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY" ############################
  154. _secure_debug2 kSecret "$kSecret"
  155. kSecretH="$(printf "%s" "$kSecret" | _hex_dump | tr -d " ")"
  156. _secure_debug2 kSecretH "$kSecretH"
  157. kDateH="$(printf "$RequestDateOnly%s" | _hmac "$Hash" "$kSecretH" hex)"
  158. _debug2 kDateH "$kDateH"
  159. kRegionH="$(printf "$Region%s" | _hmac "$Hash" "$kDateH" hex)"
  160. _debug2 kRegionH "$kRegionH"
  161. kServiceH="$(printf "$Service%s" | _hmac "$Hash" "$kRegionH" hex)"
  162. _debug2 kServiceH "$kServiceH"
  163. kSigningH="$(printf "aws4_request%s" | _hmac "$Hash" "$kServiceH" hex)"
  164. _debug2 kSigningH "$kSigningH"
  165. signature="$(printf "$StringToSign%s" | _hmac "$Hash" "$kSigningH" hex)"
  166. _debug2 signature "$signature"
  167. Authorization="$Algorithm Credential=$AWS_ACCESS_KEY_ID/$CredentialScope, SignedHeaders=$SignedHeaders, Signature=$signature"
  168. _debug2 Authorization "$Authorization"
  169. _H2="Authorization: $Authorization"
  170. _debug _H2 "$_H2"
  171. url="$AWS_URL/$ep"
  172. if [ "$qsr" ]; then
  173. url="$AWS_URL/$ep?$qsr"
  174. fi
  175. if [ "$mtd" = "GET" ]; then
  176. response="$(_get "$url")"
  177. else
  178. response="$(_post "$data" "$url")"
  179. fi
  180. _ret="$?"
  181. if [ "$_ret" = "0" ]; then
  182. if _contains "$response" "<ErrorResponse"; then
  183. _err "Response error:$response"
  184. return 1
  185. fi
  186. fi
  187. return "$_ret"
  188. }