dns_aws.sh 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340
  1. #!/usr/bin/env sh
  2. #
  3. #AWS_ACCESS_KEY_ID="sdfsdfsdfljlbjkljlkjsdfoiwje"
  4. #
  5. #AWS_SECRET_ACCESS_KEY="xxxxxxx"
  6. #This is the Amazon Route53 api wrapper for acme.sh
  7. AWS_HOST="route53.amazonaws.com"
  8. AWS_URL="https://$AWS_HOST"
  9. AWS_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API"
  10. ######## Public functions #####################
  11. #Usage: dns_myapi_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
  12. dns_aws_add() {
  13. fulldomain=$1
  14. txtvalue=$2
  15. AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
  16. AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
  17. if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  18. _use_container_role || _use_instance_role
  19. fi
  20. if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  21. AWS_ACCESS_KEY_ID=""
  22. AWS_SECRET_ACCESS_KEY=""
  23. _err "You haven't specifed the aws route53 api key id and and api key secret yet."
  24. _err "Please create your key and try again. see $(__green $AWS_WIKI)"
  25. return 1
  26. fi
  27. #save for future use, unless using a role which will be fetched as needed
  28. if [ -z "$_using_role" ]; then
  29. _saveaccountconf_mutable AWS_ACCESS_KEY_ID "$AWS_ACCESS_KEY_ID"
  30. _saveaccountconf_mutable AWS_SECRET_ACCESS_KEY "$AWS_SECRET_ACCESS_KEY"
  31. fi
  32. _debug "First detect the root zone"
  33. if ! _get_root "$fulldomain"; then
  34. _err "invalid domain"
  35. return 1
  36. fi
  37. _debug _domain_id "$_domain_id"
  38. _debug _sub_domain "$_sub_domain"
  39. _debug _domain "$_domain"
  40. _info "Getting existing records for $fulldomain"
  41. if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
  42. return 1
  43. fi
  44. if _contains "$response" "<Name>$fulldomain.</Name>"; then
  45. _resource_record="$(echo "$response" | sed 's/<ResourceRecordSet>/"/g' | tr '"' "\n" | grep "<Name>$fulldomain.</Name>" | _egrep_o "<ResourceRecords.*</ResourceRecords>" | sed "s/<ResourceRecords>//" | sed "s#</ResourceRecords>##")"
  46. _debug "_resource_record" "$_resource_record"
  47. else
  48. _debug "single new add"
  49. fi
  50. if [ "$_resource_record" ] && _contains "$response" "$txtvalue"; then
  51. _info "The TXT record already exists. Skipping."
  52. return 0
  53. fi
  54. _debug "Adding records"
  55. _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>UPSERT</Action><ResourceRecordSet><Name>$fulldomain</Name><Type>TXT</Type><TTL>300</TTL><ResourceRecords>$_resource_record<ResourceRecord><Value>\"$txtvalue\"</Value></ResourceRecord></ResourceRecords></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
  56. if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
  57. _info "TXT record updated successfully."
  58. return 0
  59. fi
  60. return 1
  61. }
  62. #fulldomain txtvalue
  63. dns_aws_rm() {
  64. fulldomain=$1
  65. txtvalue=$2
  66. AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
  67. AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
  68. if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  69. _use_container_role || _use_instance_role
  70. fi
  71. _debug "First detect the root zone"
  72. if ! _get_root "$fulldomain"; then
  73. _err "invalid domain"
  74. return 1
  75. fi
  76. _debug _domain_id "$_domain_id"
  77. _debug _sub_domain "$_sub_domain"
  78. _debug _domain "$_domain"
  79. _info "Getting existing records for $fulldomain"
  80. if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
  81. return 1
  82. fi
  83. if _contains "$response" "<Name>$fulldomain.</Name>"; then
  84. _resource_record="$(echo "$response" | sed 's/<ResourceRecordSet>/"/g' | tr '"' "\n" | grep "<Name>$fulldomain.</Name>" | _egrep_o "<ResourceRecords.*</ResourceRecords>" | sed "s/<ResourceRecords>//" | sed "s#</ResourceRecords>##")"
  85. _debug "_resource_record" "$_resource_record"
  86. else
  87. _debug "no records exist, skip"
  88. return 0
  89. fi
  90. _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>DELETE</Action><ResourceRecordSet><ResourceRecords>$_resource_record</ResourceRecords><Name>$fulldomain.</Name><Type>TXT</Type><TTL>300</TTL></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
  91. if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
  92. _info "TXT record deleted successfully."
  93. return 0
  94. fi
  95. return 1
  96. }
  97. #################### Private functions below ##################################
  98. _get_root() {
  99. domain=$1
  100. i=2
  101. p=1
  102. if aws_rest GET "2013-04-01/hostedzone"; then
  103. while true; do
  104. h=$(printf "%s" "$domain" | cut -d . -f $i-100)
  105. _debug2 "Checking domain: $h"
  106. if [ -z "$h" ]; then
  107. if _contains "$response" "<IsTruncated>true</IsTruncated>" && _contains "$response" "<NextMarker>"; then
  108. _debug "IsTruncated"
  109. _nextMarker="$(echo "$response" | _egrep_o "<NextMarker>.*</NextMarker>" | cut -d '>' -f 2 | cut -d '<' -f 1)"
  110. _debug "NextMarker" "$_nextMarker"
  111. if aws_rest GET "2013-04-01/hostedzone" "marker=$_nextMarker"; then
  112. _debug "Truncated request OK"
  113. i=2
  114. p=1
  115. continue
  116. else
  117. _err "Truncated request error."
  118. fi
  119. fi
  120. #not valid
  121. _err "Invalid domain"
  122. return 1
  123. fi
  124. if _contains "$response" "<Name>$h.</Name>"; then
  125. hostedzone="$(echo "$response" | sed 's/<HostedZone>/#&/g' | tr '#' '\n' | _egrep_o "<HostedZone><Id>[^<]*<.Id><Name>$h.<.Name>.*<PrivateZone>false<.PrivateZone>.*<.HostedZone>")"
  126. _debug hostedzone "$hostedzone"
  127. if [ "$hostedzone" ]; then
  128. _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "<Id>.*<.Id>" | head -n 1 | _egrep_o ">.*<" | tr -d "<>")
  129. if [ "$_domain_id" ]; then
  130. _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
  131. _domain=$h
  132. return 0
  133. fi
  134. _err "Can't find domain with id: $h"
  135. return 1
  136. fi
  137. fi
  138. p=$i
  139. i=$(_math "$i" + 1)
  140. done
  141. fi
  142. return 1
  143. }
  144. _use_container_role() {
  145. # automatically set if running inside ECS
  146. if [ -z "$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" ]; then
  147. _debug "No ECS environment variable detected"
  148. return 1
  149. fi
  150. _use_metadata "169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
  151. }
  152. _use_instance_role() {
  153. _url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
  154. _debug "_url" "$_url"
  155. if ! _get "$_url" true 1 | _head_n 1 | grep -Fq 200; then
  156. _debug "Unable to fetch IAM role from instance metadata"
  157. return 1
  158. fi
  159. _aws_role=$(_get "$_url" "" 1)
  160. _debug "_aws_role" "$_aws_role"
  161. _use_metadata "$_url$_aws_role"
  162. }
  163. _use_metadata() {
  164. _aws_creds="$(
  165. _get "$1" "" 1 \
  166. | _normalizeJson \
  167. | tr '{,}' '\n' \
  168. | while read -r _line; do
  169. _key="$(echo "${_line%%:*}" | tr -d '"')"
  170. _value="${_line#*:}"
  171. _debug3 "_key" "$_key"
  172. _secure_debug3 "_value" "$_value"
  173. case "$_key" in
  174. AccessKeyId) echo "AWS_ACCESS_KEY_ID=$_value" ;;
  175. SecretAccessKey) echo "AWS_SECRET_ACCESS_KEY=$_value" ;;
  176. Token) echo "AWS_SESSION_TOKEN=$_value" ;;
  177. esac
  178. done \
  179. | paste -sd' ' -
  180. )"
  181. _secure_debug "_aws_creds" "$_aws_creds"
  182. if [ -z "$_aws_creds" ]; then
  183. return 1
  184. fi
  185. eval "$_aws_creds"
  186. _using_role=true
  187. }
  188. #method uri qstr data
  189. aws_rest() {
  190. mtd="$1"
  191. ep="$2"
  192. qsr="$3"
  193. data="$4"
  194. _debug mtd "$mtd"
  195. _debug ep "$ep"
  196. _debug qsr "$qsr"
  197. _debug data "$data"
  198. CanonicalURI="/$ep"
  199. _debug2 CanonicalURI "$CanonicalURI"
  200. CanonicalQueryString="$qsr"
  201. _debug2 CanonicalQueryString "$CanonicalQueryString"
  202. RequestDate="$(date -u +"%Y%m%dT%H%M%SZ")"
  203. _debug2 RequestDate "$RequestDate"
  204. #RequestDate="20161120T141056Z" ##############
  205. export _H1="x-amz-date: $RequestDate"
  206. aws_host="$AWS_HOST"
  207. CanonicalHeaders="host:$aws_host\nx-amz-date:$RequestDate\n"
  208. SignedHeaders="host;x-amz-date"
  209. if [ -n "$AWS_SESSION_TOKEN" ]; then
  210. export _H3="x-amz-security-token: $AWS_SESSION_TOKEN"
  211. CanonicalHeaders="${CanonicalHeaders}x-amz-security-token:$AWS_SESSION_TOKEN\n"
  212. SignedHeaders="${SignedHeaders};x-amz-security-token"
  213. fi
  214. _debug2 CanonicalHeaders "$CanonicalHeaders"
  215. _debug2 SignedHeaders "$SignedHeaders"
  216. RequestPayload="$data"
  217. _debug2 RequestPayload "$RequestPayload"
  218. Hash="sha256"
  219. CanonicalRequest="$mtd\n$CanonicalURI\n$CanonicalQueryString\n$CanonicalHeaders\n$SignedHeaders\n$(printf "%s" "$RequestPayload" | _digest "$Hash" hex)"
  220. _debug2 CanonicalRequest "$CanonicalRequest"
  221. HashedCanonicalRequest="$(printf "$CanonicalRequest%s" | _digest "$Hash" hex)"
  222. _debug2 HashedCanonicalRequest "$HashedCanonicalRequest"
  223. Algorithm="AWS4-HMAC-SHA256"
  224. _debug2 Algorithm "$Algorithm"
  225. RequestDateOnly="$(echo "$RequestDate" | cut -c 1-8)"
  226. _debug2 RequestDateOnly "$RequestDateOnly"
  227. Region="us-east-1"
  228. Service="route53"
  229. CredentialScope="$RequestDateOnly/$Region/$Service/aws4_request"
  230. _debug2 CredentialScope "$CredentialScope"
  231. StringToSign="$Algorithm\n$RequestDate\n$CredentialScope\n$HashedCanonicalRequest"
  232. _debug2 StringToSign "$StringToSign"
  233. kSecret="AWS4$AWS_SECRET_ACCESS_KEY"
  234. #kSecret="wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY" ############################
  235. _secure_debug2 kSecret "$kSecret"
  236. kSecretH="$(printf "%s" "$kSecret" | _hex_dump | tr -d " ")"
  237. _secure_debug2 kSecretH "$kSecretH"
  238. kDateH="$(printf "$RequestDateOnly%s" | _hmac "$Hash" "$kSecretH" hex)"
  239. _debug2 kDateH "$kDateH"
  240. kRegionH="$(printf "$Region%s" | _hmac "$Hash" "$kDateH" hex)"
  241. _debug2 kRegionH "$kRegionH"
  242. kServiceH="$(printf "$Service%s" | _hmac "$Hash" "$kRegionH" hex)"
  243. _debug2 kServiceH "$kServiceH"
  244. kSigningH="$(printf "%s" "aws4_request" | _hmac "$Hash" "$kServiceH" hex)"
  245. _debug2 kSigningH "$kSigningH"
  246. signature="$(printf "$StringToSign%s" | _hmac "$Hash" "$kSigningH" hex)"
  247. _debug2 signature "$signature"
  248. Authorization="$Algorithm Credential=$AWS_ACCESS_KEY_ID/$CredentialScope, SignedHeaders=$SignedHeaders, Signature=$signature"
  249. _debug2 Authorization "$Authorization"
  250. _H2="Authorization: $Authorization"
  251. _debug _H2 "$_H2"
  252. url="$AWS_URL/$ep"
  253. if [ "$qsr" ]; then
  254. url="$AWS_URL/$ep?$qsr"
  255. fi
  256. if [ "$mtd" = "GET" ]; then
  257. response="$(_get "$url")"
  258. else
  259. response="$(_post "$data" "$url")"
  260. fi
  261. _ret="$?"
  262. _debug2 response "$response"
  263. if [ "$_ret" = "0" ]; then
  264. if _contains "$response" "<ErrorResponse"; then
  265. _err "Response error:$response"
  266. return 1
  267. fi
  268. fi
  269. return "$_ret"
  270. }