]>
Commit | Line | Data |
---|---|---|
f6da19ba MF |
1 | #!/usr/bin/env sh |
2 | ||
3 | #Here is a script to deploy cert to an AVM FRITZ!Box router. | |
4 | ||
5 | #returns 0 means success, otherwise error. | |
6 | ||
7 | #DEPLOY_FRITZBOX_USERNAME="username" | |
8 | #DEPLOY_FRITZBOX_PASSWORD="password" | |
9 | #DEPLOY_FRITZBOX_URL="https://fritz.box" | |
10 | ||
412e4e6c MF |
11 | # Kudos to wikrie at Github for his FRITZ!Box update script: |
12 | # https://gist.github.com/wikrie/f1d5747a714e0a34d0582981f7cb4cfb | |
13 | ||
f6da19ba MF |
14 | ######## Public functions ##################### |
15 | ||
16 | #domain keyfile certfile cafile fullchain | |
17 | fritzbox_deploy() { | |
18 | _cdomain="$1" | |
19 | _ckey="$2" | |
20 | _ccert="$3" | |
21 | _cca="$4" | |
22 | _cfullchain="$5" | |
23 | ||
24 | _debug _cdomain "$_cdomain" | |
25 | _debug _ckey "$_ckey" | |
26 | _debug _ccert "$_ccert" | |
27 | _debug _cca "$_cca" | |
28 | _debug _cfullchain "$_cfullchain" | |
29 | ||
4bb48825 | 30 | if ! _exists iconv; then |
ed01fd4e M |
31 | if ! _exists uconv; then |
32 | if ! _exists perl; then | |
33 | _err "iconv or uconv or perl not found" | |
34 | return 1 | |
35 | fi | |
80b40c02 | 36 | fi |
f6da19ba MF |
37 | fi |
38 | ||
6aa1ec08 FW |
39 | # Clear traces of incorrectly stored values |
40 | _clearaccountconf DEPLOY_FRITZBOX_USERNAME | |
41 | _clearaccountconf DEPLOY_FRITZBOX_PASSWORD | |
42 | _clearaccountconf DEPLOY_FRITZBOX_URL | |
43 | ||
44 | # Read config from saved values or env | |
45 | _getdeployconf DEPLOY_FRITZBOX_USERNAME | |
46 | _getdeployconf DEPLOY_FRITZBOX_PASSWORD | |
47 | _getdeployconf DEPLOY_FRITZBOX_URL | |
48 | ||
49 | _debug DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL" | |
50 | _debug DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME" | |
51 | _secure_debug DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD" | |
52 | ||
53 | if [ -z "$DEPLOY_FRITZBOX_USERNAME" ]; then | |
f6da19ba MF |
54 | _err "FRITZ!Box username is not found, please define DEPLOY_FRITZBOX_USERNAME." |
55 | return 1 | |
56 | fi | |
6aa1ec08 | 57 | if [ -z "$DEPLOY_FRITZBOX_PASSWORD" ]; then |
f6da19ba MF |
58 | _err "FRITZ!Box password is not found, please define DEPLOY_FRITZBOX_PASSWORD." |
59 | return 1 | |
60 | fi | |
6aa1ec08 | 61 | if [ -z "$DEPLOY_FRITZBOX_URL" ]; then |
f6da19ba MF |
62 | _err "FRITZ!Box url is not found, please define DEPLOY_FRITZBOX_URL." |
63 | return 1 | |
64 | fi | |
65 | ||
6aa1ec08 FW |
66 | # Save current values |
67 | _savedeployconf DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME" | |
68 | _savedeployconf DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD" | |
69 | _savedeployconf DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL" | |
4bb48825 | 70 | |
bd8b1a25 MF |
71 | # Do not check for a valid SSL certificate, because initially the cert is not valid, so it could not install the LE generated certificate |
72 | export HTTPS_INSECURE=1 | |
73 | ||
4bb48825 | 74 | _info "Log in to the FRITZ!Box" |
6aa1ec08 | 75 | _fritzbox_challenge="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')" |
80b40c02 | 76 | if _exists iconv; then |
6aa1ec08 | 77 | _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)" |
ed01fd4e | 78 | elif _exists uconv; then |
6aa1ec08 | 79 | _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | uconv -f ASCII -t UTF16LE | _digest md5 hex)" |
80b40c02 | 80 | else |
6aa1ec08 | 81 | _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)" |
80b40c02 | 82 | fi |
6aa1ec08 | 83 | _fritzbox_sid="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua?sid=0000000000000000&username=${DEPLOY_FRITZBOX_USERNAME}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')" |
4bb48825 | 84 | |
a3a92ff1 | 85 | if [ -z "${_fritzbox_sid}" ] || [ "${_fritzbox_sid}" = "0000000000000000" ]; then |
4bb48825 MF |
86 | _err "Logging in to the FRITZ!Box failed. Please check username, password and URL." |
87 | return 1 | |
88 | fi | |
f6da19ba MF |
89 | |
90 | _info "Generate form POST request" | |
91 | _post_request="$(_mktemp)" | |
92 | _post_boundary="---------------------------$(date +%Y%m%d%H%M%S)" | |
a098167b MF |
93 | # _CERTPASSWORD_ is unset because Let's Encrypt certificates don't have a password. But if they ever do, here's the place to use it! |
94 | _CERTPASSWORD_= | |
a3a92ff1 | 95 | { |
1e30718d MF |
96 | printf -- "--" |
97 | printf -- "%s\r\n" "${_post_boundary}" | |
6cb5377d | 98 | printf "Content-Disposition: form-data; name=\"sid\"\r\n\r\n%s\r\n" "${_fritzbox_sid}" |
1e30718d MF |
99 | printf -- "--" |
100 | printf -- "%s\r\n" "${_post_boundary}" | |
6cb5377d | 101 | printf "Content-Disposition: form-data; name=\"BoxCertPassword\"\r\n\r\n%s\r\n" "${_CERTPASSWORD_}" |
1e30718d MF |
102 | printf -- "--" |
103 | printf -- "%s\r\n" "${_post_boundary}" | |
6cb5377d MF |
104 | printf "Content-Disposition: form-data; name=\"BoxCertImportFile\"; filename=\"BoxCert.pem\"\r\n" |
105 | printf "Content-Type: application/octet-stream\r\n\r\n" | |
72e1eb88 | 106 | cat "${_ckey}" "${_cfullchain}" |
6cb5377d | 107 | printf "\r\n" |
1e30718d MF |
108 | printf -- "--" |
109 | printf -- "%s--" "${_post_boundary}" | |
a3a92ff1 | 110 | } >>"${_post_request}" |
f6da19ba MF |
111 | |
112 | _info "Upload certificate to the FRITZ!Box" | |
f6da19ba | 113 | |
bd8b1a25 | 114 | export _H1="Content-type: multipart/form-data boundary=${_post_boundary}" |
6aa1ec08 | 115 | _post "$(cat "${_post_request}")" "${DEPLOY_FRITZBOX_URL}/cgi-bin/firmwarecfg" | grep SSL |
bd8b1a25 MF |
116 | |
117 | retval=$? | |
8ee5ede8 | 118 | if [ $retval = 0 ]; then |
bd8b1a25 MF |
119 | _info "Upload successful" |
120 | else | |
121 | _err "Upload failed" | |
122 | fi | |
f6da19ba MF |
123 | rm "${_post_request}" |
124 | ||
bd8b1a25 | 125 | return $retval |
f6da19ba | 126 | } |