You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

114 lines
4.0 KiB

7 years ago
  1. #!/usr/bin/env sh
  2. #Here is a script to deploy cert to an AVM FRITZ!Box router.
  3. #returns 0 means success, otherwise error.
  4. #DEPLOY_FRITZBOX_USERNAME="username"
  5. #DEPLOY_FRITZBOX_PASSWORD="password"
  6. #DEPLOY_FRITZBOX_URL="https://fritz.box"
  7. # Kudos to wikrie at Github for his FRITZ!Box update script:
  8. # https://gist.github.com/wikrie/f1d5747a714e0a34d0582981f7cb4cfb
  9. ######## Public functions #####################
  10. #domain keyfile certfile cafile fullchain
  11. fritzbox_deploy() {
  12. _cdomain="$1"
  13. _ckey="$2"
  14. _ccert="$3"
  15. _cca="$4"
  16. _cfullchain="$5"
  17. _debug _cdomain "$_cdomain"
  18. _debug _ckey "$_ckey"
  19. _debug _ccert "$_ccert"
  20. _debug _cca "$_cca"
  21. _debug _cfullchain "$_cfullchain"
  22. if ! _exists iconv; then
  23. if ! _exists perl; then
  24. _err "iconv or perl not found"
  25. return 1
  26. fi
  27. fi
  28. _fritzbox_username="${DEPLOY_FRITZBOX_USERNAME}"
  29. _fritzbox_password="${DEPLOY_FRITZBOX_PASSWORD}"
  30. _fritzbox_url="${DEPLOY_FRITZBOX_URL}"
  31. _debug _fritzbox_url "$_fritzbox_url"
  32. _debug _fritzbox_username "$_fritzbox_username"
  33. _secure_debug _fritzbox_password "$_fritzbox_password"
  34. if [ -z "$_fritzbox_username" ]; then
  35. _err "FRITZ!Box username is not found, please define DEPLOY_FRITZBOX_USERNAME."
  36. return 1
  37. fi
  38. if [ -z "$_fritzbox_password" ]; then
  39. _err "FRITZ!Box password is not found, please define DEPLOY_FRITZBOX_PASSWORD."
  40. return 1
  41. fi
  42. if [ -z "$_fritzbox_url" ]; then
  43. _err "FRITZ!Box url is not found, please define DEPLOY_FRITZBOX_URL."
  44. return 1
  45. fi
  46. _saveaccountconf DEPLOY_FRITZBOX_USERNAME "${_fritzbox_username}"
  47. _saveaccountconf DEPLOY_FRITZBOX_PASSWORD "${_fritzbox_password}"
  48. _saveaccountconf DEPLOY_FRITZBOX_URL "${_fritzbox_url}"
  49. # Do not check for a valid SSL certificate, because initially the cert is not valid, so it could not install the LE generated certificate
  50. export HTTPS_INSECURE=1
  51. _info "Log in to the FRITZ!Box"
  52. _fritzbox_challenge="$(_get "${_fritzbox_url}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
  53. if _exists iconv; then
  54. _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | md5sum | awk '{print $1}')"
  55. else
  56. _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | md5sum | awk '{print $1}')"
  57. fi
  58. _fritzbox_sid="$(_get "${_fritzbox_url}/login_sid.lua?sid=0000000000000000&username=${_fritzbox_username}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
  59. if [ -z "${_fritzbox_sid}" ] || [ "${_fritzbox_sid}" = "0000000000000000" ]; then
  60. _err "Logging in to the FRITZ!Box failed. Please check username, password and URL."
  61. return 1
  62. fi
  63. _info "Generate form POST request"
  64. _post_request="$(_mktemp)"
  65. _post_boundary="---------------------------$(date +%Y%m%d%H%M%S)"
  66. # _CERTPASSWORD_ is unset because Let's Encrypt certificates don't have a password. But if they ever do, here's the place to use it!
  67. _CERTPASSWORD_=
  68. {
  69. printf -- "--"
  70. printf -- "%s\r\n" "${_post_boundary}"
  71. printf "Content-Disposition: form-data; name=\"sid\"\r\n\r\n%s\r\n" "${_fritzbox_sid}"
  72. printf -- "--"
  73. printf -- "%s\r\n" "${_post_boundary}"
  74. printf "Content-Disposition: form-data; name=\"BoxCertPassword\"\r\n\r\n%s\r\n" "${_CERTPASSWORD_}"
  75. printf -- "--"
  76. printf -- "%s\r\n" "${_post_boundary}"
  77. printf "Content-Disposition: form-data; name=\"BoxCertImportFile\"; filename=\"BoxCert.pem\"\r\n"
  78. printf "Content-Type: application/octet-stream\r\n\r\n"
  79. cat "${_ckey}" "${_cfullchain}"
  80. printf "\r\n"
  81. printf -- "--"
  82. printf -- "%s--" "${_post_boundary}"
  83. } >>"${_post_request}"
  84. _info "Upload certificate to the FRITZ!Box"
  85. export _H1="Content-type: multipart/form-data boundary=${_post_boundary}"
  86. _post "$(cat "${_post_request}")" "${_fritzbox_url}/cgi-bin/firmwarecfg" | grep SSL
  87. retval=$?
  88. if [ $retval = 0 ]; then
  89. _info "Upload successful"
  90. else
  91. _err "Upload failed"
  92. fi
  93. rm "${_post_request}"
  94. return $retval
  95. }