]>
Commit | Line | Data |
---|---|---|
d9a9695f PN |
1 | #!/usr/bin/env sh |
2 | ||
3 | # Script to deploy certificates to Palo Alto Networks PANOS via API | |
4 | # Note PANOS API KEY and IP address needs to be set prior to running. | |
5 | # The following variables exported from environment will be used. | |
6 | # If not set then values previously saved in domain.conf file are used. | |
7 | # | |
8 | # Firewall admin with superuser and IP address is required. | |
9 | # | |
a8fba65c | 10 | # REQURED: |
edd1b60c | 11 | # export PANOS_HOST="" |
12 | # export PANOS_USER="" #User *MUST* have Commit and Import Permissions in XML API for Admin Role | |
a8fba65c | 13 | # export PANOS_PASS="" |
14 | # | |
edd1b60c | 15 | # The script will automatically generate a new API key if |
a8fba65c | 16 | # no key is found, or if a saved key has expired or is invalid. |
edd1b60c | 17 | |
2e2e7cd0 | 18 | # This function is to parse the XML response from the firewall |
d9a9695f | 19 | parse_response() { |
c2812896 | 20 | type=$2 |
5dcb4176 | 21 | if [ "$type" = 'keygen' ]; then |
c2812896 PN |
22 | status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g') |
23 | if [ "$status" = "success" ]; then | |
24 | panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g') | |
25 | _panos_key=$panos_key | |
c2812896 PN |
26 | else |
27 | message="PAN-OS Key could not be set." | |
28 | fi | |
29 | else | |
e69a19db | 30 | status=$(echo "$1" | tr -d '\n' | sed 's/^.*"\([a-z]*\)".*/\1/g') |
31 | message=$(echo "$1" | tr -d '\n' | sed 's/.*\(<result>\|<msg>\|<line>\)\([^<]*\).*/\2/g') | |
32 | _debug "Firewall message: $message" | |
a8fba65c | 33 | if [ "$type" = 'keytest' ] && [ "$status" != "success" ]; then |
34 | _debug "**** API Key has EXPIRED or is INVALID ****" | |
df753e26 | 35 | unset _panos_key |
36 | fi | |
c2812896 | 37 | fi |
d9a9695f PN |
38 | return 0 |
39 | } | |
40 | ||
2e2e7cd0 | 41 | #This function is used to deploy to the firewall |
d9a9695f | 42 | deployer() { |
21450a08 | 43 | content="" |
a8fba65c | 44 | type=$1 # Types are keytest, keygen, cert, key, commit |
c2812896 | 45 | panos_url="https://$_panos_host/api/" |
7623025b | 46 | |
edd1b60c | 47 | #Test API Key by performing a lookup |
a8fba65c | 48 | if [ "$type" = 'keytest' ]; then |
49 | _debug "**** Testing saved API Key ****" | |
df753e26 | 50 | _H1="Content-Type: application/x-www-form-urlencoded" |
edd1b60c | 51 | # Get Version Info to test key |
52 | content="type=version&key=$_panos_key" | |
53 | ## Exclude all scopes for the empty commit | |
54 | #_exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network><shared-object>exclude</shared-object>" | |
55 | #content="type=commit&action=partial&key=$_panos_key&cmd=<commit><partial>$_exclude_scope<admin><member>acmekeytest</member></admin></partial></commit>" | |
df753e26 | 56 | fi |
57 | ||
58 | # Generate API Key | |
5dcb4176 | 59 | if [ "$type" = 'keygen' ]; then |
a8fba65c | 60 | _debug "**** Generating new API Key ****" |
c2812896 PN |
61 | _H1="Content-Type: application/x-www-form-urlencoded" |
62 | content="type=keygen&user=$_panos_user&password=$_panos_pass" | |
63 | # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}" | |
d9a9695f | 64 | fi |
c2812896 | 65 | |
2e2e7cd0 | 66 | # Deploy Cert or Key |
5dcb4176 | 67 | if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then |
a8fba65c | 68 | _debug "**** Deploying $type ****" |
69 | #Generate DELIM | |
cbdb8bd9 PN |
70 | delim="-----MultipartDelimiter$(date "+%s%N")" |
71 | nl="\015\012" | |
72 | #Set Header | |
73 | export _H1="Content-Type: multipart/form-data; boundary=$delim" | |
5dcb4176 | 74 | if [ "$type" = 'cert' ]; then |
0453d656 BTG |
75 | panos_url="${panos_url}?type=import" |
76 | content="--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\ncertificate" | |
77 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n$_cdomain" | |
78 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n$_panos_key" | |
79 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\npem" | |
c2812896 PN |
80 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")" |
81 | fi | |
5dcb4176 | 82 | if [ "$type" = 'key' ]; then |
0453d656 BTG |
83 | panos_url="${panos_url}?type=import" |
84 | content="--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\nprivate-key" | |
85 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n$_cdomain" | |
86 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n$_panos_key" | |
87 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\npem" | |
88 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n123456" | |
cbb7082a | 89 | content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cdomain.key")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")" |
c2812896 PN |
90 | fi |
91 | #Close multipart | |
0453d656 | 92 | content="$content${nl}--$delim--${nl}${nl}" |
c2812896 PN |
93 | #Convert CRLF |
94 | content=$(printf %b "$content") | |
d9a9695f PN |
95 | fi |
96 | ||
2e2e7cd0 | 97 | # Commit changes |
5dcb4176 | 98 | if [ "$type" = 'commit' ]; then |
a8fba65c | 99 | _debug "**** Committing changes ****" |
71bc993e | 100 | export _H1="Content-Type: application/x-www-form-urlencoded" |
e69a19db | 101 | #Check for force commit - will commit ALL uncommited changes to the firewall. Use with caution! |
2e2e7cd0 | 102 | if [ "$FORCE" ]; then |
e69a19db | 103 | _debug "Force switch detected. Committing ALL changes to the firewall." |
104 | cmd=$(printf "%s" "<commit><partial><force><admin><member>$_panos_user</member></admin></force></partial></commit>" | _url_encode) | |
a8fba65c | 105 | else |
e69a19db | 106 | _exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network>" |
107 | cmd=$(printf "%s" "<commit><partial>$_exclude_scope<admin><member>$_panos_user</member></admin></partial></commit>" | _url_encode) | |
a8fba65c | 108 | fi |
e69a19db | 109 | content="type=commit&action=partial&key=$_panos_key&cmd=$cmd" |
d9a9695f | 110 | fi |
2e2e7cd0 | 111 | |
c2812896 | 112 | response=$(_post "$content" "$panos_url" "" "POST") |
71bc993e | 113 | parse_response "$response" "$type" |
d9a9695f PN |
114 | # Saving response to variables |
115 | response_status=$status | |
d9a9695f PN |
116 | _debug response_status "$response_status" |
117 | if [ "$response_status" = "success" ]; then | |
118 | _debug "Successfully deployed $type" | |
119 | return 0 | |
120 | else | |
121 | _err "Deploy of type $type failed. Try deploying with --debug to troubleshoot." | |
122 | _debug "$message" | |
123 | return 1 | |
124 | fi | |
125 | } | |
126 | ||
127 | # This is the main function that will call the other functions to deploy everything. | |
128 | panos_deploy() { | |
7623025b | 129 | _cdomain=$(echo "$1" | sed 's/*/WILDCARD_/g') #Wildcard Safe Filename |
d9a9695f PN |
130 | _ckey="$2" |
131 | _cfullchain="$5" | |
ae035deb | 132 | |
126df964 | 133 | |
b556908c | 134 | # VALID FILE CHECK |
135 | if [ ! -f "$_ckey" ] || [ ! -f "$_cfullchain" ]; then | |
136 | _err "Unable to find a valid key and/or cert. If this is an ECDSA/ECC cert, use the --ecc flag when deploying." | |
137 | return 1 | |
cbb7082a | 138 | fi |
a8fba65c | 139 | |
a8fba65c | 140 | # PANOS_HOST |
141 | if [ "$PANOS_HOST" ]; then | |
142 | _debug "Detected ENV variable PANOS_HOST. Saving to file." | |
143 | _savedeployconf PANOS_HOST "$PANOS_HOST" 1 | |
d9a9695f | 144 | else |
a8fba65c | 145 | _debug "Attempting to load variable PANOS_HOST from file." |
146 | _getdeployconf PANOS_HOST | |
147 | fi | |
148 | ||
149 | # PANOS USER | |
150 | if [ "$PANOS_USER" ]; then | |
151 | _debug "Detected ENV variable PANOS_USER. Saving to file." | |
1fe3d808 | 152 | _savedeployconf PANOS_USER "$PANOS_USER" 1 |
a8fba65c | 153 | else |
154 | _debug "Attempting to load variable PANOS_USER from file." | |
155 | _getdeployconf PANOS_USER | |
156 | fi | |
157 | ||
0ebc9f7a | 158 | # PANOS_PASS |
a8fba65c | 159 | if [ "$PANOS_PASS" ]; then |
160 | _debug "Detected ENV variable PANOS_PASS. Saving to file." | |
1fe3d808 | 161 | _savedeployconf PANOS_PASS "$PANOS_PASS" 1 |
a8fba65c | 162 | else |
163 | _debug "Attempting to load variable PANOS_PASS from file." | |
164 | _getdeployconf PANOS_PASS | |
d9a9695f | 165 | fi |
a8fba65c | 166 | |
ae035deb | 167 | # PANOS_KEY |
168 | _getdeployconf PANOS_KEY | |
169 | if [ "$PANOS_KEY" ]; then | |
170 | _debug "Detected saved key." | |
171 | _panos_key=$PANOS_KEY | |
172 | else | |
173 | _debug "No key detected" | |
174 | unset _panos_key | |
175 | fi | |
176 | ||
177 | ||
a8fba65c | 178 | #Store variables |
179 | _panos_host=$PANOS_HOST | |
a8fba65c | 180 | _panos_user=$PANOS_USER |
181 | _panos_pass=$PANOS_PASS | |
df753e26 | 182 | |
edd1b60c | 183 | |
184 | #Test API Key if found. If the key is invalid, the variable _panos_key will be unset. | |
a8fba65c | 185 | if [ "$_panos_host" ] && [ "$_panos_key" ]; then |
186 | _debug "**** Testing API KEY ****" | |
187 | deployer keytest | |
188 | fi | |
189 | ||
190 | # Check for valid variables | |
191 | if [ -z "$_panos_host" ]; then | |
2e2e7cd0 | 192 | _err "No host found. If this is your first time deploying, please set PANOS_HOST in ENV variables. You can delete it after you have successfully deployed the certs." |
193 | return 1 | |
194 | elif [ -z "$_panos_user" ]; then | |
126df964 | 195 | _err "No user found. If this is your first time deploying, please set PANOS_USER in ENV variables. You can delete it after you have successfully deployed the certs." |
a8fba65c | 196 | return 1 |
edd1b60c | 197 | elif [ -z "$_panos_pass" ]; then |
198 | _err "No password found. If this is your first time deploying, please set PANOS_PASS in ENV variables. You can delete it after you have successfully deployed the certs." | |
a8fba65c | 199 | return 1 |
200 | else | |
201 | # Generate a new API key if no valid API key is found | |
df753e26 | 202 | if [ -z "$_panos_key" ]; then |
203 | _debug "**** Generating new PANOS API KEY ****" | |
204 | deployer keygen | |
205 | _savedeployconf PANOS_KEY "$_panos_key" 1 | |
206 | fi | |
207 | ||
7623025b | 208 | # Confirm that a valid key was generated |
c2812896 | 209 | if [ -z "$_panos_key" ]; then |
2e2e7cd0 | 210 | _err "Unable to generate an API key. The user and pass may be invalid or not authorized to generate a new key. Please check the PANOS_USER and PANOS_PASS credentials and try again" |
d9a9695f PN |
211 | return 1 |
212 | else | |
213 | deployer cert | |
214 | deployer key | |
215 | deployer commit | |
216 | fi | |
217 | fi | |
cbdb8bd9 | 218 | } |