Paul Nguyen
5 years ago
1 changed files with 144 additions and 0 deletions
-
144deploy/panos.sh
@ -0,0 +1,144 @@ |
|||
#!/usr/bin/env sh |
|||
|
|||
# Script to deploy certificates to Palo Alto Networks PANOS via API |
|||
# Note PANOS API KEY and IP address needs to be set prior to running. |
|||
# The following variables exported from environment will be used. |
|||
# If not set then values previously saved in domain.conf file are used. |
|||
# |
|||
# Firewall admin with superuser and IP address is required. |
|||
# |
|||
# export PANOS_USER="" # required |
|||
# export PANOS_PASS="" # required |
|||
# export PANOS_HOST="" # required |
|||
|
|||
# This function is to parse the XML |
|||
parse_response() { |
|||
status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g') |
|||
message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g') |
|||
return 0 |
|||
} |
|||
|
|||
deployer() { |
|||
type=$1 # Types are cert, key, commit |
|||
_debug "**** Deploying $type *****" |
|||
|
|||
#Generate DEIM |
|||
delim="-----MultipartDelimiter$(date "+%s%N")" |
|||
nl="\015\012" |
|||
#Set Header |
|||
_H1="Content-Type: multipart/form-data; boundary=$delim" |
|||
if [ $type = 'cert' ]; then |
|||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")" |
|||
fi |
|||
if [ $type = 'key' ]; then |
|||
#Add key |
|||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")" |
|||
fi |
|||
#Close multipart |
|||
content="$content${nl}--$delim--${nl}" |
|||
#Convert CRLF |
|||
content=$(printf %b "$content") |
|||
|
|||
if [ $type = 'cert' ]; then |
|||
panos_url="https://$_panos_host/api/?type=import&category=certificate&certificate-name=$_cdomain&format=pem&key=$_panos_key" |
|||
fi |
|||
|
|||
if [ $type = 'key' ]; then |
|||
panos_url="https://$_panos_host/api/?type=import&category=private-key&certificate-name=$_cdomain&format=pem&passphrase=none&key=$_panos_key" |
|||
fi |
|||
if [ $type = 'commit' ]; then |
|||
cmd=$(_url_encode "<commit><partial><$_panos_user></$_panos_user></partial></commit>") |
|||
panos_url="https://$_panos_host/api/?type=commit&cmd=$cmd&key=$_panos_key" |
|||
fi |
|||
|
|||
if [ $type = 'key' ] || [ $type = 'cert' ]; then |
|||
response=$(_post "$content" "$panos_url" "" "POST") |
|||
else |
|||
response=$(_get $panos_url) |
|||
fi |
|||
_debug panos_url $panos_url |
|||
_debug "RESPONSE $response" |
|||
parse_response "$response" |
|||
_debug "STATUS IS $status" |
|||
_debug "MESSAGE IS $message" |
|||
# Saving response to variables |
|||
response_status=$status |
|||
# Check for cert upload error and handle gracefully. |
|||
|
|||
#DEBUG |
|||
_debug header "$_H1" |
|||
# _debug content "$content" |
|||
_debug response_status "$response_status" |
|||
if [ "$response_status" = "success" ]; then |
|||
_debug "Successfully deployed $type" |
|||
return 0 |
|||
else |
|||
_err "Deploy of type $type failed. Try deploying with --debug to troubleshoot." |
|||
_debug "$message" |
|||
return 1 |
|||
fi |
|||
} |
|||
|
|||
# This is the main function that will call the other functions to deploy everything. |
|||
panos_deploy() { |
|||
_cdomain="$1" |
|||
_ckey="$2" |
|||
_cfullchain="$5" |
|||
# PANOS HOST is required to make API calls to the PANOS/Panorama |
|||
if [ -z "$PANOS_HOST" ]; then |
|||
if [ -z "$_panos_host" ]; then |
|||
_err "PANOS_HOST not defined." |
|||
return 1 |
|||
fi |
|||
else |
|||
_debug "PANOS HOST is set. Save to domain conf." |
|||
_panos_host="$PANOS_HOST" |
|||
_savedomainconf _panos_host "$_panos_host" |
|||
fi |
|||
# Retrieve stored variables |
|||
_panos_user="$(_readaccountconf_mutable PANOS_USER)" |
|||
_panos_pass="$(_readaccountconf_mutable PANOS_PASS)" |
|||
# PANOS Credentials check |
|||
if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ]; then |
|||
_debug "PANOS_USER, PANOS_PASS is not defined" |
|||
if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ]; then |
|||
_err "No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables." |
|||
return 1 |
|||
else |
|||
_debug "ok" |
|||
fi |
|||
else |
|||
_debug "Saving environment variables" |
|||
# Encrypt and save user |
|||
_saveaccountconf_mutable PANOS_USER "$PANOS_USER" |
|||
_saveaccountconf_mutable PANOS_PASS "$PANOS_PASS" |
|||
_panos_user="$PANOS_USER" |
|||
_panos_pass="$PANOS_PASS" |
|||
fi |
|||
_debug "Let's use username and pass to generate token." |
|||
if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then |
|||
_err "Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST" |
|||
return 1 |
|||
else |
|||
_debug "Getting PANOS KEY" |
|||
panos_key_response=$(_get "https://$_panos_host/api/?type=keygen&user=$_panos_user&password=$_panos_pass") |
|||
_debug "PANOS KEY FULL RESPONSE $panos_key_response" |
|||
status=$(echo "$panos_key_response" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g') |
|||
_debug "STATUS IS $status" |
|||
if [ "$status" = "success" ]; then |
|||
panos_key=$(echo "$panos_key_response" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g') |
|||
_panos_key=$panos_key |
|||
else |
|||
_err "PANOS Key could not be set. Deploy with --debug to troubleshoot" |
|||
return 1 |
|||
fi |
|||
if [ -z "$_panos_host" ] && [ -z "$_panos_key" ] && [ -z "$_panos_user" ]; then |
|||
_err "Missing host, apikey, user." |
|||
return 1 |
|||
else |
|||
deployer cert |
|||
deployer key |
|||
deployer commit |
|||
fi |
|||
fi |
|||
} |
Write
Preview
Loading…
Cancel
Save
Reference in new issue