1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
|
#!/bin/sh
set -e
# This is a DNS hook that updated the tinydns (djbdns/dbndns) database. For a
# small period (default 90 secs), waits for dns propagation. On fail, reverts.
# Uses dig for resolution.
#
# Tries to figure out your tinydns root directory (overwrite if necessary).
# When the root directory contains a Makefile, invokes make(1), else
# tinydns-data(8). That way, you can notify downstream DNS server, eg with
# http://tindyns.org/dnsnotify
#
# Copy, move, or link this script to $ACME_HOOKS_DIR/tinydns
#
# You can test this script with
# ./tinydns.hook challenge-dns-start example.com "" "deadbeef"
# ./tinydns.hook challenge-dns-stop example.com "" "deadbeef"
#
# This script reads /etc/default/acme-tinydns and /etc/conf.d/acme-tinydns
# You can override the following variables there:
#
# DNS_SYNC_MAX Maximum time in seconds to wait for DNS propagation
# (default 90)
# SERVICE_ROOT Directory that contains daemontools(8) services
# (default one of /service /etc/service /etc/sv)
# SERVICE Directory with the tinydns(8) service for
# daemontools(8) (default ${SERVICE_ROOT}/tinydns)
# SERVICE_ENV Directory with the envdir(8) environment for the
# tinydns(8) service, if used. (default ${SERVICE}/en)
# ROOT Directory containing tinydns(8)'s data, especially
# the `data` file. (default: when ${SERVICE_ENV}/ROOT
# is a file, its contents, otherwise ${SERVICE}/root)
#
EXIT_UNKNOWN_EVENT="42"
DATA_MARKER_START='# -- ACMETOOL TINYDNS HOOK START --'
DATA_MARKER_STOP='# -- ACMETOOL TINYDNS HOOK STOP --'
# return 1 or 0 whether the given command exists
have_command() { command -v "${1}" 2>&1 >/dev/null; }
# strips everything before second-level-domain. TDLs not supported.
get_domain() {
echo "${1}" | sed -e 's/^\([^.]\{1,\}\.\)\{0,\}\([^.]\{1,\}\.[^.]\{1,\}\.\{0,1\}\)$/\2/'
}
# get primary dns server, prefer the one we are provisioning
get_ns() {
if [ -e "${SERVICE_ENV}/IP" ]; then
cat "${SERVICE_ENV}/IP"
else
DOMAIN="$(get_domain "${1}")"
dig +short SOA "${DOMAIN}" | cut -d' ' -f1
fi
}
get_all_ns() {
DOMAIN="$(get_domain "${1}")"
dig +short NS "${DOMAIN}"
}
# parse dnsq/dnsqr/tinydns-get output (we care for 1st field of data)
#answer: example.com ttl RECORD data
parse_dnsq() { grep '^answer: ' | cut -d' ' -f5; }
# parse DNS TXT record that still contains length prepended (as dnsq)
parse_dnstxt() { sed -e 's/^\(\\[[:digit:]]\{3\}\)\|.//'; }
# parse DNS TXT record still with quotes (as dig)
parse_digtxt() { TXT="${1#\"}"; echo "${TXT%\"}"; }
# Get content of given TXT record via DNS (opt from SERVER)
get_txt() {
TXT_HOST="${1}"
SERVER="${2}"
if [ -z "${SERVER}" ]; then
parse_digtxt "$(dig +short TXT "${TXT_HOST}")"
else
parse_digtxt "$(dig +short "@${SERVER}" TXT "${TXT_HOST}")"
fi
}
controls_domain() (
cd "${ROOT}"
tinydns-get soa "${1}" | grep -q '^answer:'
# if no answer, then no control
)
# set all variable we need and such
prepare() {
# set reliable path
PATH="$(command -p getconf PATH):${PATH}"
# add /command if available
[ -d /command ] && PATH="/command:${PATH}"
# make sure we all commands we need
for cmd in tinydns-get dig sleep sed grep cut mv wait echo; do
have_command "${cmd}"
done
# find tinydns root
for CANDIDATE in "${SERVICE_ROOT}" /service /etc/service /etc/sv; do
if [ -d "${CANDIDATE}" ]; then
SERVICE_ROOT="${CANDIDATE}"; break
fi
done
SERVICE="${SERVICE:-${SERVICE_ROOT}/tinydns}"
SERVICE_ENV="${SERVICE_ENV:-${SERVICE}/env}"
if [ -z "${ROOT}" ]; then
if [ -f "${SERVICE_ENV}/ROOT" ]; then
ROOT="$(cat "${SERVICE_ENV}/ROOT")"
else
ROOT="${SERVICE}/root"
fi
fi
# no tinydns root, no operation
[ -d "${ROOT}" ] || exit 1
}
# Get content of given TXT record via database
get_txt_record() (
cd "${ROOT}"
tinydns-get txt "${1}" | parse_dnsq | parse_dnstxt
)
# write txt record to database
set_txt_record() (
cd "${ROOT}"
if grep -q "${DATA_MARKER_START}" data; then :; else
echo "${DATA_MARKER_START}" >> data
echo "${DATA_MARKER_STOP}" >> data
fi
sed -e "/${DATA_MARKER_STOP}/i\'${1}:${2}:300" data > data.acmetmp \
&& mv data.acmetmp data
)
# remove txt record from database
del_txt_record() (
cd "${ROOT}"
sed -e "/^'${1}:${2}/d" data > data.acmetmp \
&& mv data.acmetmp data
)
# update tinydns database (aka commit)
update() (
cd "${ROOT}"
if have_command make && [ -f Makefile ]; then
make
else
tinydns-data
fi
)
# reload database and check this worked via DNS
reload() (
TXT_HOST="${1}"
CHALLENGE="${2}"
update
index="${DNS_SYNC_MAX:-90}"
export NS_STATUS=1
get_all_ns "${TXT_HOST}" | while read NAMESERVER; do
while [ "${index}" -gt 0 ]; do
sleep 5 &
if [ -z "${CHALLENGE}" ]; then
if [ -z "$(get_txt "${TXT_HOST}" "${NAMESERVER}")" ]; then export NS_STATUS=0; break; fi
else
if [ "$(get_txt "${TXT_HOST}" "${NAMESERVER}")" = "${CHALLENGE}" ]; then NS_STATUS=0; break; fi
fi
index="$((${index} - 5))"
wait
done
[ "${NS_STATUS}" -eq 0 ] || return 1 # reached here because of timeout
done
return 0
)
# CALLBACK: insert acme challange
start() {
HOST="${1}"; DOMAIN="${2}"; CHALLENGE="${3}"
TXT_HOST="_acme-challenge.${HOST}"
TXT_RECORD="$(get_txt_record "${TXT_HOST}" )"
[ "${TXT_RECORD}" = "${CHALLENGE}" ] && return 0 # challenge already there
[ -z "${TXT_RECORD}" ] # challenge not empty, doesn't match ours
set_txt_record "${TXT_HOST}" "${CHALLENGE}"
reload "${TXT_HOST}" "${CHALLENGE}" \
|| (del_txt_record "${TXT_HOST}"; update; return 1)
}
# CALLBACK: remove acme challange
stop() {
HOST="${1}"; DOMAIN="${2}"; CHALLENGE="${3}"
TXT_HOST="_acme-challenge.${HOST}"
[ "$(get_txt_record "${TXT_HOST}" )" = "${CHALLENGE}" ]
del_txt_record "${TXT_HOST}"
reload "${TXT_HOST}" "" \
|| (set_txt_record "${TXT_HOST}" "${CHALLENGE}" ; update; return 1)
}
# include configuration from known locations
[ -e "/etc/default/acme-tinydns" ] && . /etc/default/acme-tinydns
[ -e "/etc/conf.d/acme-tinydns" ] && . /etc/conf.d/acme-tinydns
# Contract is:
# ACME_STATE_DIR=/var/lib/acme /usr/lib/acme/hooks/tinydns \
# challenge-dns-start hostname.example.com target_file challenge
EVENT="${1}"
HOST="${2}"
TARGET_FILE="${3}"
CHALLENGE="${4}"
case "${EVENT}" in
challenge-dns-*)
prepare
DOMAIN="$(get_domain ${HOST})"
controls_domain "${DOMAIN}"
"${EVENT##challenge-dns-}" "${HOST}" "${DOMAIN}" "${CHALLENGE}"
;;
*)
exit "${EXIT_UNKNOWN_EVENT}"
;;
esac
|
