dns_desec.sh 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204
  1. #!/usr/bin/env sh
  2. #
  3. # deSEC.io Domain API
  4. #
  5. # Author: Zheng Qian
  6. #
  7. # deSEC API doc
  8. # https://desec.readthedocs.io/en/latest/
  9. REST_API="https://desec.io/api/v1/domains"
  10. ######## Public functions #####################
  11. #Usage: dns_desec_add _acme-challenge.foobar.dedyn.io "d41d8cd98f00b204e9800998ecf8427e"
  12. dns_desec_add() {
  13. fulldomain=$1
  14. txtvalue=$2
  15. _info "Using desec.io api"
  16. _debug fulldomain "$fulldomain"
  17. _debug txtvalue "$txtvalue"
  18. DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
  19. DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
  20. if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
  21. DEDYN_TOKEN=""
  22. DEDYN_NAME=""
  23. _err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
  24. _err "Please create your key and try again."
  25. _err "e.g."
  26. _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
  27. _err "export DEDYN_NAME=foobar.dedyn.io"
  28. return 1
  29. fi
  30. #save the api token and name to the account conf file.
  31. _saveaccountconf_mutable DEDYN_TOKEN "$DEDYN_TOKEN"
  32. _saveaccountconf_mutable DEDYN_NAME "$DEDYN_NAME"
  33. _debug "First detect the root zone"
  34. if ! _get_root "$fulldomain" "$REST_API/"; then
  35. _err "invalid domain"
  36. return 1
  37. fi
  38. _debug _sub_domain "$_sub_domain"
  39. _debug _domain "$_domain"
  40. # Get existing TXT record
  41. _debug "Getting txt records"
  42. txtvalues="\"\\\"$txtvalue\\\"\""
  43. _desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
  44. if [ "$_code" = "200" ]; then
  45. oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
  46. _debug "existing TXT found"
  47. _debug oldtxtvalues "$oldtxtvalues"
  48. if [ -n "$oldtxtvalues" ]; then
  49. for oldtxtvalue in $oldtxtvalues; do
  50. txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
  51. done
  52. fi
  53. fi
  54. _debug txtvalues "$txtvalues"
  55. _info "Adding record"
  56. body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
  57. if _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"; then
  58. if _contains "$response" "$txtvalue"; then
  59. _info "Added, OK"
  60. return 0
  61. else
  62. _err "Add txt record error."
  63. return 1
  64. fi
  65. fi
  66. _err "Add txt record error."
  67. return 1
  68. }
  69. #Usage: fulldomain txtvalue
  70. #Remove the txt record after validation.
  71. dns_desec_rm() {
  72. fulldomain=$1
  73. txtvalue=$2
  74. _info "Using desec.io api"
  75. _debug fulldomain "$fulldomain"
  76. _debug txtvalue "$txtvalue"
  77. DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
  78. DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
  79. if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
  80. DEDYN_TOKEN=""
  81. DEDYN_NAME=""
  82. _err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
  83. _err "Please create your key and try again."
  84. _err "e.g."
  85. _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
  86. _err "export DEDYN_NAME=foobar.dedyn.io"
  87. return 1
  88. fi
  89. _debug "First detect the root zone"
  90. if ! _get_root "$fulldomain" "$REST_API/"; then
  91. _err "invalid domain"
  92. return 1
  93. fi
  94. _debug _sub_domain "$_sub_domain"
  95. _debug _domain "$_domain"
  96. # Get existing TXT record
  97. _debug "Getting txt records"
  98. txtvalues=""
  99. _desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
  100. if [ "$_code" = "200" ]; then
  101. oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
  102. _debug "existing TXT found"
  103. _debug oldtxtvalues "$oldtxtvalues"
  104. if [ -n "$oldtxtvalues" ]; then
  105. for oldtxtvalue in $oldtxtvalues; do
  106. if [ "$txtvalue" != "$oldtxtvalue" ]; then
  107. txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
  108. fi
  109. done
  110. fi
  111. fi
  112. txtvalues="$(echo "$txtvalues" | cut -c3-)"
  113. _debug txtvalues "$txtvalues"
  114. _info "Deleting record"
  115. body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
  116. _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"
  117. if [ "$_code" = "200" ]; then
  118. _info "Deleted, OK"
  119. return 0
  120. fi
  121. _err "Delete txt record error."
  122. return 1
  123. }
  124. #################### Private functions below ##################################
  125. _desec_rest() {
  126. m="$1"
  127. ep="$2"
  128. data="$3"
  129. export _H1="Authorization: Token $DEDYN_TOKEN"
  130. export _H2="Accept: application/json"
  131. export _H3="Content-Type: application/json"
  132. if [ "$m" != "GET" ]; then
  133. _secure_debug2 data "$data"
  134. response="$(_post "$data" "$ep" "" "$m")"
  135. else
  136. response="$(_get "$ep")"
  137. fi
  138. _ret="$?"
  139. _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
  140. _debug "http response code $_code"
  141. _secure_debug2 response "$response"
  142. if [ "$_ret" != "0" ]; then
  143. _err "error $ep"
  144. return 1
  145. fi
  146. response="$(printf "%s" "$response" | _normalizeJson)"
  147. return 0
  148. }
  149. #_acme-challenge.www.domain.com
  150. #returns
  151. # _sub_domain=_acme-challenge.www
  152. # _domain=domain.com
  153. _get_root() {
  154. domain="$1"
  155. ep="$2"
  156. i=2
  157. p=1
  158. while true; do
  159. h=$(printf "%s" "$domain" | cut -d . -f $i-100)
  160. _debug h "$h"
  161. if [ -z "$h" ]; then
  162. #not valid
  163. return 1
  164. fi
  165. if ! _desec_rest GET "$ep"; then
  166. return 1
  167. fi
  168. if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
  169. _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
  170. _domain=$h
  171. return 0
  172. fi
  173. p=$i
  174. i=$(_math "$i" + 1)
  175. done
  176. return 1
  177. }