From 2a0369532795fbe040c090d5d5b44dcbec4c0b57 Mon Sep 17 00:00:00 2001
From: Joshua Boniface <joshua@boniface.me>
Date: Tue, 24 Sep 2019 12:58:30 -0400
Subject: [PATCH 1/3] Flip the NSUPDATE_ZONE conditional status

Previously, the else was assumed to be the one where NSUPDATE_ZONE was
set. Flip this in order to facilitate adding additional nsupdate
configurations.
---
 dnsapi/dns_nsupdate.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index dfb3672a..e82a2251 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -25,16 +25,16 @@ dns_nsupdate_add() {
   _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -z "${NSUPDATE_ZONE}" ]; then
+  if [ -n "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
+zone ${NSUPDATE_ZONE}.
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
   else
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
-zone ${NSUPDATE_ZONE}.
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
@@ -62,16 +62,16 @@ dns_nsupdate_rm() {
   _info "removing ${fulldomain}. txt"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -z "${NSUPDATE_ZONE}" ]; then
+  if [ -n "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
 update delete ${fulldomain}. txt
+zone ${NSUPDATE_ZONE}.
 send
 EOF
   else
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
-zone ${NSUPDATE_ZONE}.
 update delete ${fulldomain}. txt
 send
 EOF

From 426ca01bcf4ececbe2fbf23ad29e5a53d7f2d1df Mon Sep 17 00:00:00 2001
From: Joshua Boniface <joshua@boniface.me>
Date: Tue, 24 Sep 2019 12:59:31 -0400
Subject: [PATCH 2/3] Implement CNAME-based nsupdate validation

Implements validation using CNAMEs and RFC2138, as described in the
Let's Encrypt documentation.

For instance, if requesting the domain "test.net" with a CNAME from
"_acme-challenge.test.net" to "_acme-challenge.ledomain.net". As per the
spec this is fully supported, but using RFC2138 and nsupdate, acme.sh
did not support this properly, instead trying to add the record to the
original fulldomain unconditionally.

To implement this, this commit adds an additional environment variable,
NSUPDATE_CNAME_ZONE, which would contain the target zone, for instance
in the example above, "ledomain.net". If this variable is set, nsupdate
then adds/removes the _acme-validation TXT record to that zone instead
of the requested zone, as well as printing a helpful message mentioning
that the CNAME must exist for this to succeed.
---
 dnsapi/dns_nsupdate.sh | 33 +++++++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index e82a2251..ca9945ae 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -10,6 +10,7 @@ dns_nsupdate_add() {
   NSUPDATE_SERVER_PORT="${NSUPDATE_SERVER_PORT:-$(_readaccountconf_mutable NSUPDATE_SERVER_PORT)}"
   NSUPDATE_KEY="${NSUPDATE_KEY:-$(_readaccountconf_mutable NSUPDATE_KEY)}"
   NSUPDATE_ZONE="${NSUPDATE_ZONE:-$(_readaccountconf_mutable NSUPDATE_ZONE)}"
+  NSUPDATE_CNAME_ZONE="${NSUPDATE_CNAME_ZONE:-$(_readaccountconf_mutable NSUPDATE_CNAME_ZONE)}"
 
   _checkKeyFile || return 1
 
@@ -18,14 +19,27 @@ dns_nsupdate_add() {
   _saveaccountconf_mutable NSUPDATE_SERVER_PORT "${NSUPDATE_SERVER_PORT}"
   _saveaccountconf_mutable NSUPDATE_KEY "${NSUPDATE_KEY}"
   _saveaccountconf_mutable NSUPDATE_ZONE "${NSUPDATE_ZONE}"
+  _saveaccountconf_mutable NSUPDATE_CNAME_ZONE "${NSUPDATE_CNAME_ZONE}"
 
   [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
 
-  _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
+  if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
+      _info "adding _acme-challenge.${NSUPDATE_CNAME_ZONE}. 60 in txt \"${txtvalue}\""
+      _info "the record ${fulldomain}. must be a CNAME to this record for validation to succeed"
+  else
+      _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
+  fi
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -n "${NSUPDATE_ZONE}" ]; then
+  if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
+    nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
+server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
+zone ${NSUPDATE_CNAME_ZONE}.
+update add _acme-challenge.${NSUPDATE_CNAME_ZONE}. 60 in txt "${txtvalue}"
+send
+EOF
+  elif [ -n "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
 zone ${NSUPDATE_ZONE}.
@@ -59,10 +73,21 @@ dns_nsupdate_rm() {
   _checkKeyFile || return 1
   [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
-  _info "removing ${fulldomain}. txt"
+  if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
+      _info "removing _acme-challenge.${NSUPDATE_CNAME_ZONE}. txt"
+  else
+      _info "removing ${fulldomain}. txt"
+  fi
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -n "${NSUPDATE_ZONE}" ]; then
+  if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
+    nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
+server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
+update delete _acme-challenge.${NSUPDATE_CNAME_ZONE}. txt
+zone ${NSUPDATE_CNAME_ZONE}.
+send
+EOF
+  elif [ -n "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
 server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
 update delete ${fulldomain}. txt

From 576fff37ec25ecafd5d7b7488c8d9311432b684d Mon Sep 17 00:00:00 2001
From: Joshua Boniface <joshua@boniface.me>
Date: Tue, 24 Sep 2019 15:38:46 -0400
Subject: [PATCH 3/3] Correct indentation of _info messages

---
 dnsapi/dns_nsupdate.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index ca9945ae..21da1481 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -25,10 +25,10 @@ dns_nsupdate_add() {
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
 
   if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
-      _info "adding _acme-challenge.${NSUPDATE_CNAME_ZONE}. 60 in txt \"${txtvalue}\""
-      _info "the record ${fulldomain}. must be a CNAME to this record for validation to succeed"
+    _info "adding _acme-challenge.${NSUPDATE_CNAME_ZONE}. 60 in txt \"${txtvalue}\""
+    _info "the record ${fulldomain}. must be a CNAME to this record for validation to succeed"
   else
-      _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
+    _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
   fi
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
@@ -74,9 +74,9 @@ dns_nsupdate_rm() {
   [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
   if [ -n "${NSUPDATE_CNAME_ZONE}" ]; then
-      _info "removing _acme-challenge.${NSUPDATE_CNAME_ZONE}. txt"
+    _info "removing _acme-challenge.${NSUPDATE_CNAME_ZONE}. txt"
   else
-      _info "removing ${fulldomain}. txt"
+    _info "removing ${fulldomain}. txt"
   fi
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"