From 7d64e141e45be32479773f8a4fb44bd8304dacc1 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 12 Jul 2017 20:24:54 +0200
Subject: [PATCH 01/17] Add dns_he - DNS API script for Hurricane Electric DNS
 service

... Although not yet fully Posix compatible.
---
 dnsapi/README.md |  18 +++++
 dnsapi/dns_he.sh | 200 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 218 insertions(+)
 create mode 100755 dnsapi/dns_he.sh

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 41f89a88..15399048 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -572,6 +572,24 @@ acme.sh --issue --dns dns_dyn -d example.com -d www.example.com
 
 The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+# 30. Use Hurricane Electric
+
+Hurricane Electric doesn't have an API so just set your login credentials like so:
+
+```
+export HE_Username="yourusername"
+export HE_Password="password"
+```
+
+Then you can issue your certificate:
+
+```
+acme.sh --issue --dns dns_he -d example.com -d www.example.com
+```
+
+The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+Please report any issues to https://github.com/angel333/acme.sh or to <me@ondrejsimek.com>.
 
 # Use custom API
 
diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
new file mode 100755
index 00000000..269db8d2
--- /dev/null
+++ b/dnsapi/dns_he.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env sh
+
+# TODO Somehow use _get instead of curl - not sure how to support
+#      cookies though...
+
+########################################################################
+# Hurricane Electric hook script for acme.sh
+#
+# Environment variables:
+#
+#  - $HE_Username  (your dns.he.net username)
+#  - $HE_Password  (your dns.he.net password)
+#
+# Author: Ondrej Simek <me@ondrejsimek.com>
+# Git repo: https://github.com/angel333/acme.sh
+
+
+#-- dns_he_add() - Add TXT record --------------------------------------
+# Usage: dns_he_add _acme-challenge.subdomain.domain.com "XyZ123..."
+
+dns_he_add() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 Hurricane Electric hook"
+
+  _authenticate || return 1
+  _saveaccountconf HE_Username "$HE_Username"
+  _saveaccountconf HE_Password "$HE_Password"
+
+  # fills in the $_zone_id
+  _find_zone $_full_domain || return 1
+  _debug "Zone id \"$_zone_id\" will be used."
+
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "account=" \
+    --form "menu=edit_zone" \
+    --form "Type=TXT" \
+    --form "hosted_dns_zoneid=$_zone_id" \
+    --form "hosted_dns_recordid=" \
+    --form "hosted_dns_editzone=1" \
+    --form "Priority=" \
+    --form "Name=$_full_domain" \
+    --form "Content=$_txt_value" \
+    --form "TTL=300" \
+    --form "hosted_dns_editrecord=Submit" \
+    "https://dns.he.net/" \
+    > /dev/null
+}
+
+
+#-- dns_he_rm() - Remove TXT record ------------------------------------
+# Usage: dns_he_rm _acme-challenge.subdomain.domain.com "XyZ123..."
+
+dns_he_rm() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Cleaning up after DNS-01 Hurricane Electric hook"
+
+  _authenticate || return 1
+
+  # fills in the $_zone_id
+  _find_zone $_full_domain || return 1
+  _debug "Zone id \"$_zone_id\" will be used."
+
+  # Find the record id to clean
+  _record_id=$( \
+    curl -L --silent --show-error --cookie "$_he_cookie" \
+      "https://dns.he.net/?hosted_dns_zoneid=$_zone_id&menu=edit_zone&hosted_dns_editzone" \
+      | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
+      | tail -n 1 \
+      | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
+      | cut -b 2- \
+      | _egrep_o "[[:digit:]]+" \
+      | head -n1) # ... oh my, what have I done...
+
+  # Remove the record
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "menu=edit_zone" \
+    --form "hosted_dns_zoneid=$_zone_id" \
+    --form "hosted_dns_recordid=$_record_id" \
+    --form "hosted_dns_editzone=1" \
+    --form "hosted_dns_delrecord=1" \
+    --form "hosted_dns_delconfirm=delete" \
+    --form "hosted_dns_editzone=1" \
+    "https://dns.he.net/" \
+    | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
+    > /dev/null
+  if [ $? -eq 0 ]; then
+    _info "Record removed successfuly."
+  else
+    _err \
+      "Could not clean (remove) up the record. Please go to HE" \
+      "administration interface and clean it by hand."
+  fi
+}
+
+
+########################## PRIVATE FUNCTIONS ###########################
+
+
+#-- _find_zone() -------------------------------------------------------
+
+# Usage: _authenticate
+#
+# - needs $HE_Username and $HE_Password
+# - sets the $_he_cookie
+
+_authenticate() {
+  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+    _err \
+      'No auth details provided. Please set user credentials using the \
+      \$HE_Username and \$HE_Password envoronment variables.'
+    return 1
+  fi
+  # Just get a session
+  _he_cookie=$( \
+    curl -L --silent --show-error -I "https://dns.he.net/" \
+      | grep '^Set-Cookie:' \
+      | _egrep_o 'CGISESSID=[a-z0-9]*')
+  # Attempt login
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "email=${HE_Username}" \
+    --form "pass=${HE_Password}" \
+    "https://dns.he.net/" \
+    > /dev/null
+  # TODO detect unsuccessful logins
+}
+
+
+#-- _find_zone() -------------------------------------------------------
+
+# Returns the most specific zone found in administration interface.
+#
+# - needs $_he_cookie
+#
+# Example:
+#
+# _find_zone first.second.third.co.uk
+#
+# ... will return the first zone that exists in admin out of these:
+# - "first.second.third.co.uk"
+# - "second.third.co.uk"
+# - "third.co.uk"
+# - "co.uk" <-- unlikely
+# - "uk"    <-'
+#
+# (another approach would be something like this:
+#   https://github.com/hlandau/acme/blob/master/_doc/dns.hook
+#   - that's better if there are multiple pages. It's so much simpler.
+# )
+
+_find_zone() {
+
+  _domain="$1"
+
+  ## _all_zones is an array that looks like this:
+  ## ( zone1:id zone2:id ... )
+  _all_zones=( $(curl -L --silent --show-error --cookie "$_he_cookie" \
+    "https://dns.he.net/" \
+    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
+    | cut -d '"' -f 3,5 --output-delimiter=":" \
+  ) )
+
+  _strip_counter=1
+  while [ true ]
+  do
+    _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
+
+    # All possible zone names have been tried
+    if [ "$_attempted_zone" == "" ]
+    then
+      _err "No zone for domain \"$_domain\" found."
+      break
+    fi
+
+    # Walk through all zones on the account
+    #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
+    for i in ${_all_zones[@]}
+    do
+      _zone_name=$(echo $i | cut -d ':' -f 1)
+      _zone_id=$(echo $i | cut -d ':' -f 2)
+      if [ "$_zone_name" == "$_attempted_zone" ]
+      then
+        # Zone found - we got $_zone_name and $_zone_id, let's get out...
+        _debug "Found relevant zone \"$_zone_name\" with id" \
+          "\"$_zone_id\" - will be used for domain \"$_domain\"."
+        return 0
+      fi
+    done
+
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
+      variation."
+    _strip_counter=$(expr $_strip_counter + 1)
+  done
+
+  # No zone found.
+  return 1
+}
+
+# vim: et:ts=2:sw=2:

From 4285d81ca9d2805e99cf4ed0b601891b4ffd77ce Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 05:00:02 +0200
Subject: [PATCH 02/17] Get rid of curl.

---
 dnsapi/dns_he.sh | 102 +++++++++++++++++------------------------------
 1 file changed, 37 insertions(+), 65 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 269db8d2..141268ac 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -1,8 +1,5 @@
 #!/usr/bin/env sh
 
-# TODO Somehow use _get instead of curl - not sure how to support
-#      cookies though...
-
 ########################################################################
 # Hurricane Electric hook script for acme.sh
 #
@@ -23,7 +20,12 @@ dns_he_add() {
   _txt_value=$2
   _info "Using DNS-01 Hurricane Electric hook"
 
-  _authenticate || return 1
+  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+    _err \
+      'No auth details provided. Please set user credentials using the \
+      \$HE_Username and \$HE_Password envoronment variables.'
+    return 1
+  fi
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
@@ -31,20 +33,20 @@ dns_he_add() {
   _find_zone $_full_domain || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "account=" \
-    --form "menu=edit_zone" \
-    --form "Type=TXT" \
-    --form "hosted_dns_zoneid=$_zone_id" \
-    --form "hosted_dns_recordid=" \
-    --form "hosted_dns_editzone=1" \
-    --form "Priority=" \
-    --form "Name=$_full_domain" \
-    --form "Content=$_txt_value" \
-    --form "TTL=300" \
-    --form "hosted_dns_editrecord=Submit" \
-    "https://dns.he.net/" \
-    > /dev/null
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&account="
+  body="$body&account="
+  body="$body&menu=edit_zone"
+  body="$body&Type=TXT"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&hosted_dns_recordid="
+  body="$body&hosted_dns_editzone=1"
+  body="$body&Priority="
+  body="$body&Name=$_full_domain"
+  body="$body&Content=$_txt_value"
+  body="$body&TTL=300"
+  body="$body&hosted_dns_editrecord=Submit"
+  _post $body "https://dns.he.net/" >/dev/null
 }
 
 
@@ -56,16 +58,16 @@ dns_he_rm() {
   _txt_value=$2
   _info "Cleaning up after DNS-01 Hurricane Electric hook"
 
-  _authenticate || return 1
-
   # fills in the $_zone_id
   _find_zone $_full_domain || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   # Find the record id to clean
-  _record_id=$( \
-    curl -L --silent --show-error --cookie "$_he_cookie" \
-      "https://dns.he.net/?hosted_dns_zoneid=$_zone_id&menu=edit_zone&hosted_dns_editzone" \
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&menu=edit_zone"
+  body="$body&hosted_dns_editzone="
+  _record_id=$(_post $body "https://dns.he.net/" \
       | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
       | tail -n 1 \
       | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
@@ -74,15 +76,15 @@ dns_he_rm() {
       | head -n1) # ... oh my, what have I done...
 
   # Remove the record
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "menu=edit_zone" \
-    --form "hosted_dns_zoneid=$_zone_id" \
-    --form "hosted_dns_recordid=$_record_id" \
-    --form "hosted_dns_editzone=1" \
-    --form "hosted_dns_delrecord=1" \
-    --form "hosted_dns_delconfirm=delete" \
-    --form "hosted_dns_editzone=1" \
-    "https://dns.he.net/" \
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&menu=edit_zone"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&hosted_dns_recordid=$_record_id"
+  body="$body&hosted_dns_editzone=1"
+  body="$body&hosted_dns_delrecord=1"
+  body="$body&hosted_dns_delconfirm=delete"
+  body="$body&hosted_dns_editzone=1"
+  _post $body "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
     > /dev/null
   if [ $? -eq 0 ]; then
@@ -98,41 +100,10 @@ dns_he_rm() {
 ########################## PRIVATE FUNCTIONS ###########################
 
 
-#-- _find_zone() -------------------------------------------------------
-
-# Usage: _authenticate
-#
-# - needs $HE_Username and $HE_Password
-# - sets the $_he_cookie
-
-_authenticate() {
-  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
-    _err \
-      'No auth details provided. Please set user credentials using the \
-      \$HE_Username and \$HE_Password envoronment variables.'
-    return 1
-  fi
-  # Just get a session
-  _he_cookie=$( \
-    curl -L --silent --show-error -I "https://dns.he.net/" \
-      | grep '^Set-Cookie:' \
-      | _egrep_o 'CGISESSID=[a-z0-9]*')
-  # Attempt login
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "email=${HE_Username}" \
-    --form "pass=${HE_Password}" \
-    "https://dns.he.net/" \
-    > /dev/null
-  # TODO detect unsuccessful logins
-}
-
-
 #-- _find_zone() -------------------------------------------------------
 
 # Returns the most specific zone found in administration interface.
 #
-# - needs $_he_cookie
-#
 # Example:
 #
 # _find_zone first.second.third.co.uk
@@ -155,8 +126,9 @@ _find_zone() {
 
   ## _all_zones is an array that looks like this:
   ## ( zone1:id zone2:id ... )
-  _all_zones=( $(curl -L --silent --show-error --cookie "$_he_cookie" \
-    "https://dns.he.net/" \
+
+  body="email=${HE_Username}&pass=${HE_Password}"
+  _all_zones=( $(_post $body "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
     | cut -d '"' -f 3,5 --output-delimiter=":" \
   ) )

From 8ca45d3d03718c4ba7dc89eb030209ebe2be9ac7 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 05:13:33 +0200
Subject: [PATCH 03/17] Add HE to README

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 5a3a3adf..7d4353c6 100644
--- a/README.md
+++ b/README.md
@@ -338,6 +338,7 @@ You don't have to do anything manually!
 1. Name.com API
 1. Dyn Managed DNS API
 1. Yandex PDD API (https://pdd.yandex.ru)
+1. Hurricane Electric DNS service (https://dns.he.net)
 
 
 And: 

From f7299403f7b7c0642fee665a7780ef0d8794681f Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 07:31:55 +0200
Subject: [PATCH 04/17] Incorporate Neilpang's comments

---
 dnsapi/dns_he.sh | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 141268ac..019a7a0b 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -20,7 +20,7 @@ dns_he_add() {
   _txt_value=$2
   _info "Using DNS-01 Hurricane Electric hook"
 
-  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+  if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
     _err \
       'No auth details provided. Please set user credentials using the \
       \$HE_Username and \$HE_Password envoronment variables.'
@@ -46,7 +46,8 @@ dns_he_add() {
   body="$body&Content=$_txt_value"
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
-  _post $body "https://dns.he.net/" >/dev/null
+  response="$(_post $body "https://dns.he.net/")"
+  _debug2 response "$response"
 }
 
 
@@ -68,12 +69,14 @@ dns_he_rm() {
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
   _record_id=$(_post $body "https://dns.he.net/" \
-      | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
-      | tail -n 1 \
-      | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
-      | cut -b 2- \
-      | _egrep_o "[[:digit:]]+" \
-      | head -n1) # ... oh my, what have I done...
+    | tr -d '\n' \
+    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
+    | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
+    | _egrep_o "^[0-9]+"
+  )
+  # The series of egreps above could have been done a bit shorter but
+  #  I wanted to double-check whether it's the correct record (in case
+  #  HE changes their website somehow).
 
   # Remove the record
   body="email=${HE_Username}&pass=${HE_Password}"
@@ -134,12 +137,12 @@ _find_zone() {
   ) )
 
   _strip_counter=1
-  while [ true ]
+  while true
   do
     _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
 
     # All possible zone names have been tried
-    if [ "$_attempted_zone" == "" ]
+    if [ -z "$_attempted_zone" ]
     then
       _err "No zone for domain \"$_domain\" found."
       break
@@ -151,7 +154,7 @@ _find_zone() {
     do
       _zone_name=$(echo $i | cut -d ':' -f 1)
       _zone_id=$(echo $i | cut -d ':' -f 2)
-      if [ "$_zone_name" == "$_attempted_zone" ]
+      if [ "$_zone_name" = "$_attempted_zone" ]
       then
         # Zone found - we got $_zone_name and $_zone_id, let's get out...
         _debug "Found relevant zone \"$_zone_name\" with id" \
@@ -162,7 +165,7 @@ _find_zone() {
 
     _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
       variation."
-    _strip_counter=$(expr $_strip_counter + 1)
+    _strip_counter=$(_math $_strip_counter + 1)
   done
 
   # No zone found.

From ff74778dea38ef22fb13fbdf452991c4a70135a1 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 26 Jul 2017 20:15:34 +0200
Subject: [PATCH 05/17] Fix few issues from Travis

---
 dnsapi/dns_he.sh | 45 ++++++++++++++++++---------------------------
 1 file changed, 18 insertions(+), 27 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 019a7a0b..1a6f8dbc 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -21,16 +21,14 @@ dns_he_add() {
   _info "Using DNS-01 Hurricane Electric hook"
 
   if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
-    _err \
-      'No auth details provided. Please set user credentials using the \
-      \$HE_Username and \$HE_Password envoronment variables.'
+    _err "No auth details provided. Please set user credentials using the \$HE_Username and \$HE_Password envoronment variables."
     return 1
   fi
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
   # fills in the $_zone_id
-  _find_zone $_full_domain || return 1
+  _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   body="email=${HE_Username}&pass=${HE_Password}"
@@ -46,11 +44,10 @@ dns_he_add() {
   body="$body&Content=$_txt_value"
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
-  response="$(_post $body "https://dns.he.net/")"
+  response="$(_post "$body" "https://dns.he.net/")"
   _debug2 response "$response"
 }
 
-
 #-- dns_he_rm() - Remove TXT record ------------------------------------
 # Usage: dns_he_rm _acme-challenge.subdomain.domain.com "XyZ123..."
 
@@ -60,7 +57,7 @@ dns_he_rm() {
   _info "Cleaning up after DNS-01 Hurricane Electric hook"
 
   # fills in the $_zone_id
-  _find_zone $_full_domain || return 1
+  _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   # Find the record id to clean
@@ -68,7 +65,7 @@ dns_he_rm() {
   body="$body&hosted_dns_zoneid=$_zone_id"
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
-  _record_id=$(_post $body "https://dns.he.net/" \
+  _record_id=$(_post "$body" "https://dns.he.net/" \
     | tr -d '\n' \
     | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
     | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
@@ -87,9 +84,9 @@ dns_he_rm() {
   body="$body&hosted_dns_delrecord=1"
   body="$body&hosted_dns_delconfirm=delete"
   body="$body&hosted_dns_editzone=1"
-  _post $body "https://dns.he.net/" \
+  _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
-    > /dev/null
+    >/dev/null
   if [ $? -eq 0 ]; then
     _info "Record removed successfuly."
   else
@@ -99,12 +96,9 @@ dns_he_rm() {
   fi
 }
 
-
 ########################## PRIVATE FUNCTIONS ###########################
 
-
 #-- _find_zone() -------------------------------------------------------
-
 # Returns the most specific zone found in administration interface.
 #
 # Example:
@@ -131,31 +125,28 @@ _find_zone() {
   ## ( zone1:id zone2:id ... )
 
   body="email=${HE_Username}&pass=${HE_Password}"
-  _all_zones=( $(_post $body "https://dns.he.net/" \
+  # TODO arrays aren't supported in POSIX sh
+  _all_zones=($(_post $body "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
-    | cut -d '"' -f 3,5 --output-delimiter=":" \
-  ) )
+    | cut -d '"' -f 3,5 --output-delimiter=":"
+  ))
 
   _strip_counter=1
-  while true
-  do
-    _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
+  while true; do
+    _attempted_zone=$(echo "$_domain" | cut -d . -f ${_strip_counter}-)
 
     # All possible zone names have been tried
-    if [ -z "$_attempted_zone" ]
-    then
+    if [ -z "$_attempted_zone" ]; then
       _err "No zone for domain \"$_domain\" found."
       break
     fi
 
     # Walk through all zones on the account
     #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
-    for i in ${_all_zones[@]}
-    do
-      _zone_name=$(echo $i | cut -d ':' -f 1)
-      _zone_id=$(echo $i | cut -d ':' -f 2)
-      if [ "$_zone_name" = "$_attempted_zone" ]
-      then
+    for i in ${_all_zones[@]}; do
+      _zone_name=$(echo "$i" | cut -d ':' -f 1)
+      _zone_id=$(echo "$i" | cut -d ':' -f 2)
+      if [ "$_zone_name" = "$_attempted_zone" ]; then
         # Zone found - we got $_zone_name and $_zone_id, let's get out...
         _debug "Found relevant zone \"$_zone_name\" with id" \
           "\"$_zone_id\" - will be used for domain \"$_domain\"."

From 1546b7e5a971578cef11f960a44aadad3a45b754 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 26 Jul 2017 20:21:36 +0200
Subject: [PATCH 06/17] Missing quotes

---
 dnsapi/dns_he.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 1a6f8dbc..3e23b2e0 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -126,7 +126,7 @@ _find_zone() {
 
   body="email=${HE_Username}&pass=${HE_Password}"
   # TODO arrays aren't supported in POSIX sh
-  _all_zones=($(_post $body "https://dns.he.net/" \
+  _all_zones=($(_post "$body" "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
     | cut -d '"' -f 3,5 --output-delimiter=":"
   ))

From aefed1d1b9a5264f460aa94e119cb8a40f8bdddd Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:04:53 +0200
Subject: [PATCH 07/17] Get rid of shell arrays.

---
 dnsapi/dns_he.sh | 73 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 26 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3e23b2e0..ada5f794 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -121,16 +121,19 @@ _find_zone() {
 
   _domain="$1"
 
-  ## _all_zones is an array that looks like this:
-  ## ( zone1:id zone2:id ... )
-
   body="email=${HE_Username}&pass=${HE_Password}"
-  # TODO arrays aren't supported in POSIX sh
-  _all_zones=($(_post "$body" "https://dns.he.net/" \
-    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
-    | cut -d '"' -f 3,5 --output-delimiter=":"
-  ))
-
+  _matches=$(_post "$body" "https://dns.he.net/" \
+    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+"
+  )
+  # Zone names and zone IDs are in same order
+  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5 --output-delimiter=":")
+  _zone_names=$(echo "$_matches" | cut -d '"' -f 3 --output-delimiter=":")
+  _debug2 "These are the zones on this HE account:"
+  _debug2 "$_zone_names"
+  _debug2 "And these are their respective IDs:"
+  _debug2 "$_zone_ids"
+
+  # Walk through all possible zone names
   _strip_counter=1
   while true; do
     _attempted_zone=$(echo "$_domain" | cut -d . -f ${_strip_counter}-)
@@ -138,28 +141,46 @@ _find_zone() {
     # All possible zone names have been tried
     if [ -z "$_attempted_zone" ]; then
       _err "No zone for domain \"$_domain\" found."
-      break
+      return 1
     fi
 
-    # Walk through all zones on the account
-    #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
-    for i in ${_all_zones[@]}; do
-      _zone_name=$(echo "$i" | cut -d ':' -f 1)
-      _zone_id=$(echo "$i" | cut -d ':' -f 2)
-      if [ "$_zone_name" = "$_attempted_zone" ]; then
-        # Zone found - we got $_zone_name and $_zone_id, let's get out...
-        _debug "Found relevant zone \"$_zone_name\" with id" \
-          "\"$_zone_id\" - will be used for domain \"$_domain\"."
-        return 0
-      fi
-    done
-
-    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
-      variation."
+    _debug "Looking for zone \"${_attempted_zone}\""
+    _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
+    if [ -n "$_line_num" ]; then
+      _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
+      _debug "Found relevant zone \"$_attempted_zone\" with id" \
+        "\"$_zone_id\" - will be used for domain \"$_domain\"."
+      return 0
+    fi
+
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
+      "specific zone."
     _strip_counter=$(_math $_strip_counter + 1)
   done
+}
 
-  # No zone found.
+#-- _find_linenum()-----------------------------------------------------
+# Returns line number of line (supplied as an argument) in STDIN.
+#
+# Example:
+#
+#   printf "a\nb\nc" | _find_linenum "b"
+#
+#   This will:
+#    - print out 2 because that's the line number of "b"
+#    - return code 0 because it was found
+
+_find_linenum() {
+  _current_line_num=0
+  while read line; do
+    _current_line_num=$(expr "$_current_line_num" + 1)
+    if [ "$line" = "$1" ]; then
+      # Found! Let's echo the line number and quit
+      echo $_current_line_num
+      return 0
+    fi
+  done
+  # Not found
   return 1
 }
 

From 235b5b0c154331879b70fd149d1fe7df19eac4c8 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:06:19 +0200
Subject: [PATCH 08/17] Small cosmetic fixes.

---
 dnsapi/dns_he.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index ada5f794..51418aa9 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -11,7 +11,6 @@
 # Author: Ondrej Simek <me@ondrejsimek.com>
 # Git repo: https://github.com/angel333/acme.sh
 
-
 #-- dns_he_add() - Add TXT record --------------------------------------
 # Usage: dns_he_add _acme-challenge.subdomain.domain.com "XyZ123..."
 
@@ -86,7 +85,7 @@ dns_he_rm() {
   body="$body&hosted_dns_editzone=1"
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
-    >/dev/null
+      >/dev/null
   if [ $? -eq 0 ]; then
     _info "Record removed successfuly."
   else

From 577380e98e33c32f87d74df07d0d9d862b89b5be Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:44:55 +0200
Subject: [PATCH 09/17] Few fixes for shellcheck

---
 dnsapi/dns_he.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 51418aa9..9b789d35 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -154,7 +154,7 @@ _find_zone() {
 
     _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
       "specific zone."
-    _strip_counter=$(_math $_strip_counter + 1)
+    _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }
 
@@ -171,11 +171,11 @@ _find_zone() {
 
 _find_linenum() {
   _current_line_num=0
-  while read line; do
-    _current_line_num=$(expr "$_current_line_num" + 1)
+  while read -r line; do
+    _current_line_num=$(_math "$_current_line_num" + 1)
     if [ "$line" = "$1" ]; then
       # Found! Let's echo the line number and quit
-      echo $_current_line_num
+      echo "$_current_line_num"
       return 0
     fi
   done

From 8534e3b2f7fd16477b811c262f60e9b63cb85e32 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 13:58:47 +0200
Subject: [PATCH 10/17] Make shellcheck happier

---
 dnsapi/dns_he.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 9b789d35..3ca00af9 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -20,6 +20,8 @@ dns_he_add() {
   _info "Using DNS-01 Hurricane Electric hook"
 
   if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
+    HE_Username=
+    HE_Password=
     _err "No auth details provided. Please set user credentials using the \$HE_Username and \$HE_Password envoronment variables."
     return 1
   fi

From d6780f9e49f18bf503f46c5d4859289e593935c0 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 15:29:35 +0200
Subject: [PATCH 11/17] Retain an exit code

---
 dnsapi/dns_he.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3ca00af9..ab4393c7 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -46,7 +46,9 @@ dns_he_add() {
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
   response="$(_post "$body" "https://dns.he.net/")"
+  exitcode=$?
   _debug2 response "$response"
+  return $exitvalue
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------

From ccf9a9976c1b7cf31c60a4b74ead0f30fba1de28 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 18:33:25 +0200
Subject: [PATCH 12/17] Fix the previous rushed commit.

---
 dnsapi/dns_he.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index ab4393c7..2fb1101e 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -46,9 +46,14 @@ dns_he_add() {
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
   response="$(_post "$body" "https://dns.he.net/")"
-  exitcode=$?
+  exit_code="$?"
+  if [ "$exit_code" -eq 0 ]; then
+    _info "TXT record added successfuly."
+  else
+    _err "Couldn't add the TXT record."
+    return "$exit_code"
+  fi
   _debug2 response "$response"
-  return $exitvalue
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------
@@ -90,7 +95,7 @@ dns_he_rm() {
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
-  if [ $? -eq 0 ]; then
+  if [ "$?" -eq 0 ]; then
     _info "Record removed successfuly."
   else
     _err \

From 31b67ab92efd23802acb8510126418b83e1af8db Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 13:52:28 +0200
Subject: [PATCH 13/17] Few non-critical fixes.

---
 dnsapi/dns_he.sh | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 2fb1101e..a160e16a 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -28,13 +28,12 @@ dns_he_add() {
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
-  # fills in the $_zone_id
+  # Fills in the $_zone_id
   _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   body="email=${HE_Username}&pass=${HE_Password}"
   body="$body&account="
-  body="$body&account="
   body="$body&menu=edit_zone"
   body="$body&Type=TXT"
   body="$body&hosted_dns_zoneid=$_zone_id"
@@ -91,16 +90,13 @@ dns_he_rm() {
   body="$body&hosted_dns_editzone=1"
   body="$body&hosted_dns_delrecord=1"
   body="$body&hosted_dns_delconfirm=delete"
-  body="$body&hosted_dns_editzone=1"
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
   if [ "$?" -eq 0 ]; then
     _info "Record removed successfuly."
   else
-    _err \
-      "Could not clean (remove) up the record. Please go to HE" \
-      "administration interface and clean it by hand."
+    _err "Could not clean (remove) up the record. Please go to HE administration interface and clean it by hand."
   fi
 }
 
@@ -134,8 +130,8 @@ _find_zone() {
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+"
   )
   # Zone names and zone IDs are in same order
-  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5 --output-delimiter=":")
-  _zone_names=$(echo "$_matches" | cut -d '"' -f 3 --output-delimiter=":")
+  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5)
+  _zone_names=$(echo "$_matches" | cut -d '"' -f 3)
   _debug2 "These are the zones on this HE account:"
   _debug2 "$_zone_names"
   _debug2 "And these are their respective IDs:"
@@ -156,13 +152,11 @@ _find_zone() {
     _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
     if [ -n "$_line_num" ]; then
       _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
-      _debug "Found relevant zone \"$_attempted_zone\" with id" \
-        "\"$_zone_id\" - will be used for domain \"$_domain\"."
+      _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi
 
-    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
-      "specific zone."
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less specific zone."
     _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }

From a25b2af66cd6a4c69ee673ec32aaebd068079042 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:25:07 +0200
Subject: [PATCH 14/17] Get rid of _find_num

---
 dnsapi/dns_he.sh | 41 ++++++++++++-----------------------------
 1 file changed, 12 insertions(+), 29 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index a160e16a..7dde55d4 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -149,9 +149,18 @@ _find_zone() {
     fi
 
     _debug "Looking for zone \"${_attempted_zone}\""
-    _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
-    if [ -n "$_line_num" ]; then
-      _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
+
+    # Take care of "." and only match whole lines. Note that grep -F
+    # cannot be used because there's no way to make it match whole
+    # lines.
+    regex="^$(echo "$_attempted_zone" | sed 's/\./\\./g')$"
+    line_num=$(echo "$_zone_names" \
+      | grep -n "$regex" \
+      | cut -d : -f 1
+    )
+
+    if [ -n "$line_num" ]; then
+      _zone_id=$(echo "$_zone_ids" | sed "${line_num}q;d")
       _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi
@@ -160,30 +169,4 @@ _find_zone() {
     _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }
-
-#-- _find_linenum()-----------------------------------------------------
-# Returns line number of line (supplied as an argument) in STDIN.
-#
-# Example:
-#
-#   printf "a\nb\nc" | _find_linenum "b"
-#
-#   This will:
-#    - print out 2 because that's the line number of "b"
-#    - return code 0 because it was found
-
-_find_linenum() {
-  _current_line_num=0
-  while read -r line; do
-    _current_line_num=$(_math "$_current_line_num" + 1)
-    if [ "$line" = "$1" ]; then
-      # Found! Let's echo the line number and quit
-      echo "$_current_line_num"
-      return 0
-    fi
-  done
-  # Not found
-  return 1
-}
-
 # vim: et:ts=2:sw=2:

From f438ff4bab695818932149d5b6bcecb1b6bed712 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:29:13 +0200
Subject: [PATCH 15/17] Fix an improbable corner case.

---
 dnsapi/dns_he.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 7dde55d4..152d469c 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -72,10 +72,11 @@ dns_he_rm() {
   body="$body&hosted_dns_zoneid=$_zone_id"
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
+  domain_regex="$(echo "$_full_domain" | sed 's/\./\\./g')" # escape dots
   _record_id=$(_post "$body" "https://dns.he.net/" \
     | tr -d '\n' \
-    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
-    | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
+    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${domain_regex}','TXT'\)" \
+    | _egrep_o "[0-9]+','${domain_regex}','TXT'\)$" \
     | _egrep_o "^[0-9]+"
   )
   # The series of egreps above could have been done a bit shorter but

From baa1160594921e465ee798b77c5add4ed6b1d907 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:31:27 +0200
Subject: [PATCH 16/17] Make Shellcheck happier about exit codes

---
 dnsapi/dns_he.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 152d469c..3a1e6979 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -94,10 +94,12 @@ dns_he_rm() {
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
-  if [ "$?" -eq 0 ]; then
+  exit_code="$?"
+  if [ "$exit_code" -eq 0 ]; then
     _info "Record removed successfuly."
   else
     _err "Could not clean (remove) up the record. Please go to HE administration interface and clean it by hand."
+    return "$exit_code"
   fi
 }
 

From 4dd69a8b1adaacfbb5a4894a8a5fc0403e3b4e88 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:40:56 +0200
Subject: [PATCH 17/17] Exit codes, exit codes... Exit codes everywhere...

---
 dnsapi/dns_he.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3a1e6979..7d86eb7a 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -50,9 +50,9 @@ dns_he_add() {
     _info "TXT record added successfuly."
   else
     _err "Couldn't add the TXT record."
-    return "$exit_code"
   fi
   _debug2 response "$response"
+  return "$exit_code"
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------