Jari Turkia
7 years ago
1 changed files with 358 additions and 0 deletions
@ -0,0 +1,358 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# vim: tabstop=4 shiftwidth=4 softtabstop=4 expandtab: |
||||
|
|
||||
|
|
||||
|
# See: |
||||
|
# https://developer.rackspace.com/docs/cloud-dns/v1/api-reference/ |
||||
|
|
||||
|
# Rackspace API authentication: |
||||
|
# Create file .rackspace.auth with your Rackspace API user credentials. |
||||
|
# The API user needs permission: DNS, Creator (View, Create, Edit) for adding to work. |
||||
|
# For deletion to work: DNS, Admin (View, Create, Edit, Delete) is needed. |
||||
|
# Example of a .rackspace.auth file: |
||||
|
# { "user": "my rackspace user", "key": "my rackspace API key" } |
||||
|
|
||||
|
# Example usage: |
||||
|
# ./acme.sh --keylength 4096 --issue -d "example.com" --dns dns_rackspace --dnssleep 10 |
||||
|
|
||||
|
|
||||
|
######## Public functions ##################### |
||||
|
|
||||
|
RACKSPACE_DOMAIN=0 |
||||
|
RACKSPACE_DOMAIN_ID=0 |
||||
|
RACKSPACE_RETRY=0 |
||||
|
|
||||
|
#Usage: dns_add _acme-challenge.www.domain.com "XKrxp6q0HG9i01zxXp5CPBs" |
||||
|
dns_rackspace_add() { |
||||
|
local fulldomain=$1 |
||||
|
local txtvalue=$2 |
||||
|
_info "Using Rackspace Cloud DNS API to add challenge into $fulldomain" |
||||
|
_debug fulldomain "$fulldomain" |
||||
|
_debug txtvalue "$txtvalue" |
||||
|
|
||||
|
_rackspace_sanity |
||||
|
_rackspace_authenticate |
||||
|
|
||||
|
# At this point, there is an authenticated session token that we can use. |
||||
|
local token_file=/tmp/.acme.rackspace.$EUID.token |
||||
|
local token=$(jq -r ".access.token.id" "$token_file") |
||||
|
local api_url=$(jq -r ".access.serviceCatalog[0].endpoints[0].publicURL" "$token_file") |
||||
|
local json_data |
||||
|
|
||||
|
# Try to find a domain from Rackspace that will have the new TXT-record. |
||||
|
# Start by stripping the hard-coded word "_acme-challenge." from the FQDN. |
||||
|
# Remainin record is a potential domain name in Rackspace. |
||||
|
if [[ ! "$fulldomain" =~ ^_acme-challenge\.(.+)$ ]]; then |
||||
|
_err "Failed to extract domain name from $fulldomain. Fatal error, cannot continue." |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
_rackspace_get_domain "${BASH_REMATCH[1]}" "$api_url" |
||||
|
if [ $? -gt 0 ]; then |
||||
|
# If the internal operation fails, an error will be emitted in the _rackspace_get_domain(). |
||||
|
# Ultimately, there is no way this operation can continue. |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
local text_rr=${fulldomain%.$RACKSPACE_DOMAIN} |
||||
|
if [ "$fulldomain" == "$text_rr" ]; then |
||||
|
_err "Found domain $RACKSPACE_DOMAIN for $fulldomain, but failed to create a RR for it. Fatal error, cannot continue." |
||||
|
exit 1 |
||||
|
fi |
||||
|
_info "Using domain $RACKSPACE_DOMAIN on Rackspace Cloud DNS. Adding $text_rr." |
||||
|
|
||||
|
# Add a record |
||||
|
read -r -d '' json_data <<END_OF_JSON |
||||
|
{ |
||||
|
"records" : [{ |
||||
|
"name" : "$fulldomain", |
||||
|
"type" : "TXT", |
||||
|
"data" : "$txtvalue" |
||||
|
}] |
||||
|
} |
||||
|
END_OF_JSON |
||||
|
|
||||
|
_debug "Rackspace API URL to use for adding: $api_url/domains/$RACKSPACE_DOMAIN_ID/records" |
||||
|
|
||||
|
json_data=$(curl --silent -X POST --data "$json_data" -H "X-Auth-Token: $token" -H "Content-Type: application/json" -H "Accept: application/json" "$api_url/domains/$RACKSPACE_DOMAIN_ID/records") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to add record to Rackspace Cloud DNS. Fatal error, cannot continue." |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
local status=$(echo "$json_data" | jq -r '.status') |
||||
|
if [ -z "$status" ] || [ "$status" == "null" ]; then |
||||
|
local code=$(echo "$json_data" | jq -r '."error-message"') |
||||
|
if [ -n "$code" ] && [ "$code" != "null" ]; then |
||||
|
_err "Failed to add record to Rackspace Cloud DNS. No permission to add! Fatal error: $code" |
||||
|
else |
||||
|
code=$(echo "$json_data" | jq -r .code) |
||||
|
_err "Failed to add record to Rackspace Cloud DNS. Status: HTTP/$code" |
||||
|
fi |
||||
|
exit 1 |
||||
|
fi |
||||
|
if [ "$status" == "RUNNING" ]; then |
||||
|
local callback_url=$(echo "$json_data" | jq -r '.callbackUrl') |
||||
|
if [ -z "$callback_url" ]; then |
||||
|
_err "Attempt to add record to Rackspace Cloud DNS most likely failed. There is no callback URL to query the operation status from." |
||||
|
return 1 |
||||
|
fi |
||||
|
while [ "$status" == "RUNNING" ]; do |
||||
|
sleep 2 |
||||
|
json_data=$(curl --silent -H "X-Auth-Token: $token" "$callback_url") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to query DNS add status from $callback_url" |
||||
|
return 1 |
||||
|
fi |
||||
|
status=$(echo "$json_data" | jq -r '.status') |
||||
|
done |
||||
|
|
||||
|
if [ "$status" == "ERROR" ]; then |
||||
|
_err "Failed to add record to Rackspace Cloud DNS, add status is: $status." |
||||
|
# See, if the add failed because the record already exists. |
||||
|
json_data=$(curl --silent -H "X-Auth-Token: $token" -H "Accept: application/json" "$api_url/domains/$RACKSPACE_DOMAIN_ID/records?type=TXT&name=$fulldomain") |
||||
|
if [ $? == 0 ] && [ -n "$json_data" ] && [ $RACKSPACE_RETRY == 0 ] ; then |
||||
|
# We have something ... |
||||
|
local record_id=$(echo "$json_data" | jq -r '.records[0].id') |
||||
|
if [ -n "$record_id" ] || [ "$record_id" != "null" ]; then |
||||
|
# Attempt to delete the record |
||||
|
_info "Found existing record! Deleting record $record_id on domain $RACKSPACE_DOMAIN." |
||||
|
json_data=$(curl --silent -X DELETE -H "X-Auth-Token: $token" -H "Accept: application/json" "$api_url/domains/$RACKSPACE_DOMAIN_ID/records/$record_id") |
||||
|
local status=$(echo "$json_data" | jq -r '.status') |
||||
|
if [ "$status" == "RUNNING" ]; then |
||||
|
_info "Succesfully deleted the record. Retrying ..." |
||||
|
RACKSPACE_RETRY=1 |
||||
|
sleep 3 |
||||
|
|
||||
|
# Call myself with same arguments. |
||||
|
dns_rackspace_add "$1" "$2" |
||||
|
return $? |
||||
|
else |
||||
|
_err "Failed to delete the record. Nothing else to try." |
||||
|
fi |
||||
|
fi |
||||
|
fi |
||||
|
|
||||
|
# end if $status = ERROR |
||||
|
fi |
||||
|
fi |
||||
|
if [ "$status" != "COMPLETED" ]; then |
||||
|
_err "Failed to add record to Rackspace Cloud DNS, add status is: $status." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
return 0 |
||||
|
} |
||||
|
|
||||
|
#Usage: fulldomain txtvalue |
||||
|
#Remove the txt record after validation. |
||||
|
dns_rackspace_rm() { |
||||
|
local fulldomain=$1 |
||||
|
local txtvalue=$2 |
||||
|
_info "Using Rackspace Cloud DNS API to remove challenge $fulldomain" |
||||
|
_debug fulldomain "$fulldomain" |
||||
|
_debug txtvalue "$txtvalue" |
||||
|
|
||||
|
_rackspace_sanity |
||||
|
_rackspace_authenticate |
||||
|
|
||||
|
# At this point, there is an authenticated session token that we can use. |
||||
|
local token_file=/tmp/.acme.rackspace.$EUID.token |
||||
|
local token=$(jq -r ".access.token.id" "$token_file") |
||||
|
local api_url=$(jq -r ".access.serviceCatalog[0].endpoints[0].publicURL" "$token_file") |
||||
|
local json_data |
||||
|
|
||||
|
# Try to find a domain from Rackspace that will have an existing TXT-record. |
||||
|
if [[ ! "$fulldomain" =~ ^_acme-challenge\.(.+)$ ]]; then |
||||
|
_err "Failed to extract domain name from $fulldomain." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_rackspace_get_domain "${BASH_REMATCH[1]}" "$api_url" |
||||
|
if [ $? -gt 0 ]; then |
||||
|
# If the internal operation fails, an error will be emitted in the _rackspace_get_domain(). |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
local text_rr=${fulldomain%.$RACKSPACE_DOMAIN} |
||||
|
_info "Using domain $RACKSPACE_DOMAIN on Rackspace Cloud DNS. Trying to find and remove $text_rr." |
||||
|
|
||||
|
_debug "Rackspace API URL to use for searching: $api_url/domains/$RACKSPACE_DOMAIN_ID/records" |
||||
|
|
||||
|
# Go search for TXT-records |
||||
|
json_data=$(curl --silent -H "X-Auth-Token: $token" -H "Accept: application/json" "$api_url/domains/$RACKSPACE_DOMAIN_ID/records?type=TXT&name=$fulldomain") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to search for TXT-record $fulldomain on Rackspace Cloud DNS." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
local record_id=$(echo "$json_data" | jq -r '.records[0].id') |
||||
|
if [ -z "$record_id" ] || [ "$record_id" == "null" ]; then |
||||
|
_err "TXT-record $fulldomain was not found. Nothing to delete." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_info "Deleting record $record_id on domain $RACKSPACE_DOMAIN." |
||||
|
json_data=$(curl --silent -X DELETE -H "X-Auth-Token: $token" -H "Accept: application/json" "$api_url/domains/$RACKSPACE_DOMAIN_ID/records/$record_id") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to delete record to Rackspace Cloud DNS. API-call failed." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
local status=$(echo "$json_data" | jq -r '.status') |
||||
|
if [ -z "$status" ] || [ "$status" == "null" ]; then |
||||
|
status=$(echo "$json_data" | jq -r '."error-message"') |
||||
|
if [ -n "$status" ] && [ "$status" != "null" ]; then |
||||
|
_err "Failed to delete record to Rackspace Cloud DNS. No permission to delete! Error: $status" |
||||
|
else |
||||
|
_err "Failed to delete record to Rackspace Cloud DNS. Unknown reason." |
||||
|
fi |
||||
|
return 1 |
||||
|
fi |
||||
|
if [ "$status" != "RUNNING" ]; then |
||||
|
_err "Failed to delete record to Rackspace Cloud DNS." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
return 0 |
||||
|
} |
||||
|
|
||||
|
#################### Private functions below ################################## |
||||
|
|
||||
|
|
||||
|
_rackspace_sanity() { |
||||
|
local needed=('curl' 'jq') |
||||
|
local cmd |
||||
|
|
||||
|
for cmd in "${needed[@]}"; do |
||||
|
which "$cmd" >& /dev/null |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Rackspace Cloud DNS API needs command: $cmd" |
||||
|
exit 1 |
||||
|
fi |
||||
|
done |
||||
|
} |
||||
|
|
||||
|
_rackspace_get_domain() { |
||||
|
local domain_to_use="$1" |
||||
|
local api_url="$2" |
||||
|
local domain_to_check |
||||
|
|
||||
|
# Get list of all domains this API user can manage. |
||||
|
local json_data=$(curl --silent -H "X-Auth-Token: $token" -H "Accept: application/json" "$api_url/domains") |
||||
|
if [ $? -gt 0 ] || [ -z "$json_data" ]; then |
||||
|
_err "Failed to retrieve domain list from Rackspace Cloud DNS API. Fatal error, cannot continue." |
||||
|
return 1 |
||||
|
fi |
||||
|
local status=$(echo "$json_data" | jq -r '."error-message"') |
||||
|
if [ -n "$status" ] && [ "$status" != "null" ]; then |
||||
|
_err "Configured user has no permission to retrieve domain list from Rackspace Cloud DNS API. Fatal error, cannot continue." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
# Iterate the domain list reverse-sorted. That will do a longest match comparison if there are |
||||
|
# subdomain used for the request, but will also match a shorter domain. |
||||
|
local matching_domain_idx hostmaster_email |
||||
|
while [ -z "$matching_domain_idx" ] && [[ $domain_to_use =~ \..+$ ]]; do |
||||
|
local domain_idx=0 |
||||
|
while [ "$domain_to_check" != "null" ]; do |
||||
|
domain_to_check=$(echo "$json_data" | jq -r '.domains|sort_by(.name)|reverse|.['$domain_idx'].name') |
||||
|
if [ "$domain_to_use" == "$domain_to_check" ]; then |
||||
|
matching_domain_idx=$domain_idx |
||||
|
hostmaster_email=$(echo "$json_data" | jq -r '.domains|sort_by(.name)|reverse|.['$domain_idx'].emailAddress') |
||||
|
RACKSPACE_DOMAIN="$domain_to_use" |
||||
|
RACKSPACE_DOMAIN_ID=$(echo "$json_data" | jq -r '.domains|sort_by(.name)|reverse|.['$domain_idx'].id') |
||||
|
break |
||||
|
fi |
||||
|
domain_idx=$(( domain_idx+1 )) |
||||
|
done |
||||
|
if [ -z "$matching_domain_idx" ]; then |
||||
|
# Eat out one level from the domain, if nothing found |
||||
|
domain_to_use=${domain_to_use#*.} |
||||
|
domain_to_check='' |
||||
|
fi |
||||
|
done |
||||
|
if [ -z "$matching_domain_idx" ]; then |
||||
|
_err "Failed to find the domain for $fulldomain to add a record. Fatal error, cannot continue." |
||||
|
return 1 |
||||
|
fi |
||||
|
if [ -z "$RACKSPACE_DOMAIN_ID" ] || [ "$RACKSPACE_DOMAIN_ID" == "null" ]; then |
||||
|
_err "Failed to get domain ID for domain $domain_to_use. Fatal error, cannot add record." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
return 0 |
||||
|
} |
||||
|
|
||||
|
_rackspace_authenticate() { |
||||
|
local token_file=/tmp/.acme.rackspace.$EUID.token |
||||
|
|
||||
|
if [ ! -e "$token_file" ]; then |
||||
|
_rackspace_get_token |
||||
|
fi |
||||
|
|
||||
|
local token=$(jq -r --exit-status .access.token.id "$token_file") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_rackspace_get_token |
||||
|
token=$(jq -r --exit-status .access.token.id "$token_file") |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to read access token from $token_file" |
||||
|
exit 1 |
||||
|
fi |
||||
|
fi |
||||
|
|
||||
|
curl --silent -H "X-Auth-Token: $token" "https://identity.api.rackspacecloud.com/v2.0/tokens/$token" | jq --exit-status .access.token.tenant > /dev/null |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to verify access token from $token_file" |
||||
|
exit 1 |
||||
|
fi |
||||
|
} |
||||
|
|
||||
|
_rackspace_get_token() { |
||||
|
local token_file=/tmp/.acme.rackspace.$EUID.token |
||||
|
local creds_file user key |
||||
|
local auth_json stat umask code |
||||
|
|
||||
|
creds_file="$_SCRIPT_HOME/.rackspace.auth" |
||||
|
if [ ! -e "$creds_file" ]; then |
||||
|
creds_file="$LE_WORKING_DIR/.rackspace.auth" |
||||
|
if [ ! -e "$creds_file" ]; then |
||||
|
_err "Rackspace Cloud DNS API needs credentials in .rackspace.auth file in $_SCRIPT_HOME/ or $LE_WORKING_DIR/" |
||||
|
exit 1 |
||||
|
fi |
||||
|
fi |
||||
|
|
||||
|
user=$(jq -r .user "$creds_file") |
||||
|
key=$(jq -r .key "$creds_file") |
||||
|
if [ -z "$user" ] || [ -z "$key" ]; then |
||||
|
_err "Failed to read Rackspace Cloud DNS API credentials from $creds_file" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
umask=$(umask) |
||||
|
umask 0077 |
||||
|
auth_json="{\"auth\":{\"RAX-KSKEY:apiKeyCredentials\":{\"username\":\"$user\",\"apiKey\":\"$key\"}}}" |
||||
|
curl --silent https://identity.api.rackspacecloud.com/v2.0/tokens -X POST -d "$auth_json" -H "Content-type: application/json" > $token_file |
||||
|
stat=$? |
||||
|
umask $umask |
||||
|
if [ $stat -gt 0 ]; then |
||||
|
_err "Failed to make an authentication request into Rackspace Cloud DNS API" |
||||
|
exit 1 |
||||
|
fi |
||||
|
jq . $token_file > /dev/null |
||||
|
if [ $? -gt 0 ]; then |
||||
|
_err "Failed to retrieve authentication JSON from Rackspace Cloud DNS API" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
code=$(jq -r --exit-status .access.token.tenant "$token_file") |
||||
|
stat=$? |
||||
|
if [ $stat -gt 0 ]; then |
||||
|
code=$(jq -r .unauthorized.code "$token_file") |
||||
|
_err "Failed to authenticate into Rackspace Cloud DNS API ($stat). Status: HTTP/$code" |
||||
|
rm -f "$token_file" |
||||
|
exit 1 |
||||
|
fi |
||||
|
} |
||||
|
|
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue