]>
Commit | Line | Data |
---|---|---|
bc291141 | 1 | #!/usr/bin/env sh |
2 | ||
3 | ## Name: dns_pleskxml.sh | |
4 | ## Created by Stilez. | |
d795fac3 | 5 | ## Also uses some code from PR#1832 by @romanlum (https://github.com/acmesh-official/acme.sh/pull/1832/files) |
bc291141 | 6 | |
05ced9fb | 7 | ## This DNS-01 method uses the Plesk XML API described at: |
bc291141 | 8 | ## https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709 |
9 | ## and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784 | |
10 | ||
11 | ## Note: a DNS ID with host = empty string is OK for this API, see | |
12 | ## https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798 | |
13 | ## For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action. | |
14 | ## So this API module can handle such a request, if needed. | |
15 | ||
16 | ## For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records. | |
17 | ||
05ced9fb | 18 | ## The user credentials (username+password) and URL/URI for the Plesk XML API must be set by the user |
19 | ## before this module is called (case sensitive): | |
bc291141 | 20 | ## |
21 | ## ``` | |
22 | ## export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php" | |
23 | ## (or probably something similar) | |
24 | ## export pleskxml_user="my plesk username" | |
25 | ## export pleskxml_pass="my plesk password" | |
26 | ## ``` | |
27 | ||
28 | ## Ok, let's issue a cert now: | |
29 | ## ``` | |
30 | ## acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com | |
31 | ## ``` | |
32 | ## | |
33 | ## The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed. | |
34 | ||
35 | #################### INTERNAL VARIABLES + NEWLINE + API TEMPLATES ################################## | |
36 | ||
37 | pleskxml_init_checks_done=0 | |
38 | ||
39 | # Variable containing bare newline - not a style issue | |
40 | # shellcheck disable=SC1004 | |
41 | NEWLINE='\ | |
42 | ' | |
43 | ||
44 | pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>" | |
45 | # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh | |
46 | # Also used to test credentials and URI. | |
47 | # No params. | |
48 | ||
49 | pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>" | |
50 | # Get all DNS records for a Plesk domain ID. | |
51 | # PARAM = Plesk domain id to query | |
52 | ||
53 | pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>" | |
54 | # Add a TXT record to a domain. | |
55 | # PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value | |
56 | ||
57 | pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>" | |
58 | # Delete a specific TXT record from a domain. | |
59 | # PARAM = the Plesk internal ID for the DNS record to be deleted | |
60 | ||
61 | #################### Public functions ################################## | |
62 | ||
63 | #Usage: dns_pleskxml_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs" | |
64 | dns_pleskxml_add() { | |
65 | fulldomain=$1 | |
66 | txtvalue=$2 | |
67 | ||
68 | _info "Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..." | |
69 | ||
70 | # Get credentials if not already checked, and confirm we can log in to Plesk XML API | |
71 | if ! _credential_check; then | |
72 | return 1 | |
73 | fi | |
74 | ||
75 | # Get root and subdomain details, and Plesk domain ID | |
76 | if ! _pleskxml_get_root_domain "$fulldomain"; then | |
77 | return 1 | |
78 | fi | |
79 | ||
80 | _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record' | |
81 | ||
82 | # printf using template in a variable - not a style issue | |
83 | # shellcheck disable=SC2059 | |
84 | request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")" | |
85 | if ! _call_api "$request"; then | |
86 | return 1 | |
87 | fi | |
88 | ||
89 | # OK, we should have added a TXT record. Let's check and return success if so. | |
90 | # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result> | |
91 | ||
92 | results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')" | |
93 | ||
896778ce | 94 | if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then |
bc291141 | 95 | # Error - doesn't contain expected string. Something's wrong. |
96 | _err 'Error when calling Plesk XML API.' | |
97 | _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.' | |
98 | _err 'This is unexpected: something has gone wrong.' | |
51cfd996 | 99 | _err 'The full response was:' |
6d0e4bed | 100 | _err "$pleskxml_prettyprint_result" |
bc291141 | 101 | return 1 |
102 | fi | |
103 | ||
cbacc779 | 104 | recid="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')" |
bc291141 | 105 | |
106 | _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()." | |
107 | ||
108 | return 0 | |
109 | } | |
110 | ||
111 | #Usage: dns_pleskxml_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs" | |
112 | dns_pleskxml_rm() { | |
113 | fulldomain=$1 | |
114 | txtvalue=$2 | |
115 | ||
116 | _info "Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..." | |
117 | ||
118 | # Get credentials if not already checked, and confirm we can log in to Plesk XML API | |
119 | if ! _credential_check; then | |
120 | return 1 | |
121 | fi | |
122 | ||
123 | # Get root and subdomain details, and Plesk domain ID | |
124 | if ! _pleskxml_get_root_domain "$fulldomain"; then | |
125 | return 1 | |
126 | fi | |
127 | ||
128 | _debug 'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs' | |
129 | ||
130 | # printf using template in a variable - not a style issue | |
131 | # shellcheck disable=SC2059 | |
132 | request="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")" | |
133 | if ! _call_api "$request"; then | |
134 | return 1 | |
135 | fi | |
136 | ||
137 | # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have) | |
6d0e4bed | 138 | # Also strip out spaces between tags, redundant <data> and </data> group tags and any <self-closing/> tags |
19c43451 | 139 | reclist="$( |
140 | _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | | |
141 | sed 's# \{1,\}<\([a-zA-Z]\)#<\1#g;s#</\{0,1\}data>##g;s#<[a-z][^/<>]*/>##g' | | |
142 | grep "<site-id>${root_domain_id}</site-id>" | | |
143 | grep '<id>[0-9]\{1,\}</id>' | | |
144 | grep '<type>TXT</type>' | |
bc291141 | 145 | )" |
146 | ||
147 | if [ -z "$reclist" ]; then | |
148 | _err "No TXT records found for root domain ${root_domain_name} (Plesk domain ID ${root_domain_id}). Exiting." | |
149 | return 1 | |
150 | fi | |
151 | ||
6d0e4bed | 152 | _debug "Got list of DNS TXT records for root domain '$root_domain_name':" |
153 | _debug "$reclist" | |
bc291141 | 154 | |
19c43451 | 155 | recid="$( |
156 | _value "$reclist" | | |
157 | grep "<host>${fulldomain}.</host>" | | |
158 | grep "<value>${txtvalue}</value>" | | |
159 | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/' | |
bc291141 | 160 | )" |
161 | ||
896778ce | 162 | if ! _value "$recid" | grep '^[0-9]\{1,\}$' >/dev/null; then |
bc291141 | 163 | _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'" |
164 | _err "Cannot delete TXT record. Exiting." | |
165 | return 1 | |
166 | fi | |
167 | ||
168 | _debug "Found Plesk record ID for target text string '${txtvalue}': ID=${recid}" | |
169 | _debug 'Calling Plesk XML API to remove TXT record' | |
170 | ||
171 | # printf using template in a variable - not a style issue | |
172 | # shellcheck disable=SC2059 | |
173 | request="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")" | |
174 | if ! _call_api "$request"; then | |
175 | return 1 | |
176 | fi | |
177 | ||
178 | # OK, we should have removed a TXT record. Let's check and return success if so. | |
179 | # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result> | |
180 | ||
181 | results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')" | |
182 | ||
896778ce | 183 | if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then |
bc291141 | 184 | # Error - doesn't contain expected string. Something's wrong. |
185 | _err 'Error when calling Plesk XML API.' | |
186 | _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.' | |
187 | _err 'This is unexpected: something has gone wrong.' | |
6d0e4bed | 188 | _err 'The full response was:' |
189 | _err "$pleskxml_prettyprint_result" | |
bc291141 | 190 | return 1 |
191 | fi | |
192 | ||
193 | _info "Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()." | |
194 | return 0 | |
195 | } | |
196 | ||
d7affad0 | 197 | #################### Private functions below (utility functions) ################################## |
bc291141 | 198 | |
199 | # Outputs value of a variable without additional newlines etc | |
200 | _value() { | |
201 | printf '%s' "$1" | |
202 | } | |
203 | ||
204 | # Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between | |
205 | # $1, $2 = where to cut | |
206 | # $3 = FQDN | |
207 | _valuecut() { | |
208 | printf '%s' "$3" | cut -d . -f "${1}-${2}" | |
209 | } | |
210 | ||
43011f3b | 211 | # Counts '.' present in a domain name or other string |
d7affad0 | 212 | # $1 = domain name |
213 | _countdots() { | |
43011f3b | 214 | _value "$1" | tr -dc '.' | wc -c | sed 's/ //g' |
d7affad0 | 215 | } |
216 | ||
bc291141 | 217 | # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines |
218 | # $1 - result string from API | |
a8d670fc | 219 | # $2 - plain text tag to resplit on (usually "result" or "domain"). NOT REGEX |
2d1a776d | 220 | # $3 - basic regex to recognise useful return lines |
221 | # note: $3 matches via basic NOT extended regex (BRE), as extended regex capabilities not needed at the moment. | |
a8d670fc | 222 | # Last line could change to <sed -n '/.../p'> instead, with suitable escaping of ['"/$], |
2d1a776d | 223 | # if future Plesk XML API changes ever require extended regex |
bc291141 | 224 | _api_response_split() { |
19c43451 | 225 | printf '%s' "$1" | |
226 | sed 's/^ +//;s/ +$//' | | |
227 | tr -d '\n\r' | | |
228 | sed "s/<\/\{0,1\}$2>/${NEWLINE}/g" | | |
229 | grep "$3" | |
bc291141 | 230 | } |
231 | ||
d7affad0 | 232 | #################### Private functions below (DNS functions) ################################## |
233 | ||
bc291141 | 234 | # Calls Plesk XML API, and checks results for obvious issues |
235 | _call_api() { | |
236 | request="$1" | |
237 | errtext='' | |
238 | ||
6d0e4bed | 239 | _debug 'Entered _call_api(). Calling Plesk XML API with request:' |
240 | _debug "'$request'" | |
bc291141 | 241 | |
242 | export _H1="HTTP_AUTH_LOGIN: $pleskxml_user" | |
243 | export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass" | |
244 | export _H3="content-Type: text/xml" | |
245 | export _H4="HTTP_PRETTY_PRINT: true" | |
246 | pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")" | |
247 | pleskxml_retcode="$?" | |
6d0e4bed | 248 | _debug 'The responses from the Plesk XML server were:' |
249 | _debug "retcode=$pleskxml_retcode. Literal response:" | |
250 | _debug "'$pleskxml_prettyprint_result'" | |
bc291141 | 251 | |
252 | # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly. | |
253 | # Also detect if there simply aren't any status lines (null result?) and report that, as well. | |
254 | ||
896778ce | 255 | statuslines_count_total="$(echo "$pleskxml_prettyprint_result" | grep -c '^ *<status>[^<]*</status> *$')" |
256 | statuslines_count_okay="$(echo "$pleskxml_prettyprint_result" | grep -c '^ *<status>ok</status> *$')" | |
bc291141 | 257 | |
896778ce | 258 | if [ -z "$statuslines_count_total" ]; then |
bc291141 | 259 | |
260 | # We have no status lines at all. Results are empty | |
261 | errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.' | |
262 | ||
896778ce | 263 | elif [ "$statuslines_count_okay" -ne "$statuslines_count_total" ]; then |
264 | ||
265 | # We have some status lines that aren't "ok". Any available details are in API response fields "status" "errcode" and "errtext" | |
19c43451 | 266 | # Workaround for basic regex: |
896778ce | 267 | # - filter output to keep only lines like this: "SPACES<TAG>text</TAG>SPACES" (shouldn't be necessary with prettyprint but guarantees subsequent code is ok) |
268 | # - then edit the 3 "useful" error tokens individually and remove closing tags on all lines | |
269 | # - then filter again to remove all lines not edited (which will be the lines not starting A-Z) | |
19c43451 | 270 | errtext="$( |
271 | _value "$pleskxml_prettyprint_result" | | |
272 | grep '^ *<[a-z]\{1,\}>[^<]*<\/[a-z]\{1,\}> *$' | | |
273 | sed 's/^ *<status>/Status: /;s/^ *<errcode>/Error code: /;s/^ *<errtext>/Error text: /;s/<\/.*$//' | | |
274 | grep '^[A-Z]' | |
896778ce | 275 | )" |
276 | ||
bc291141 | 277 | fi |
278 | ||
279 | if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then | |
d7affad0 | 280 | # Call failed, for reasons either in the retcode or the response text... |
281 | ||
282 | if [ "$pleskxml_retcode" -eq 0 ]; then | |
283 | _err "The POST request was successfully sent to the Plesk server." | |
284 | else | |
896778ce | 285 | _err "The return code for the POST request was $pleskxml_retcode (non-zero = failure in submitting request to server)." |
d7affad0 | 286 | fi |
287 | ||
bc291141 | 288 | if [ "$errtext" != "" ]; then |
6d0e4bed | 289 | _err 'The error responses received from the Plesk server were:' |
290 | _err "$errtext" | |
bc291141 | 291 | else |
292 | _err "No additional error messages were received back from the Plesk server" | |
293 | fi | |
d7affad0 | 294 | |
295 | _err "The Plesk XML API call failed." | |
bc291141 | 296 | return 1 |
d7affad0 | 297 | |
bc291141 | 298 | fi |
299 | ||
300 | _debug "Leaving _call_api(). Successful call." | |
301 | ||
302 | return 0 | |
303 | } | |
304 | ||
305 | # Startup checks (credentials, URI) | |
306 | _credential_check() { | |
307 | _debug "Checking Plesk XML API login credentials and URI..." | |
308 | ||
309 | if [ "$pleskxml_init_checks_done" -eq 1 ]; then | |
310 | _debug "Initial checks already done, no need to repeat. Skipped." | |
311 | return 0 | |
312 | fi | |
313 | ||
314 | pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}" | |
315 | pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}" | |
316 | pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}" | |
317 | ||
bc291141 | 318 | if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then |
319 | pleskxml_user="" | |
320 | pleskxml_pass="" | |
321 | pleskxml_uri="" | |
322 | _err "You didn't specify one or more of the Plesk XML API username, password, or URI." | |
323 | _err "Please create these and try again." | |
3441bd0e | 324 | _err "Instructions are in the 'dns_pleskxml' plugin source code or in the acme.sh documentation." |
bc291141 | 325 | return 1 |
326 | fi | |
327 | ||
328 | # Test the API is usable, by trying to read the list of managed domains... | |
329 | _call_api "$pleskxml_tplt_get_domains" | |
330 | if [ "$pleskxml_retcode" -ne 0 ]; then | |
6d0e4bed | 331 | _err 'Failed to access Plesk XML API.' |
bc291141 | 332 | _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again." |
333 | return 1 | |
334 | fi | |
335 | ||
336 | _saveaccountconf_mutable pleskxml_uri "$pleskxml_uri" | |
337 | _saveaccountconf_mutable pleskxml_user "$pleskxml_user" | |
338 | _saveaccountconf_mutable pleskxml_pass "$pleskxml_pass" | |
339 | ||
340 | _debug "Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use." | |
341 | ||
342 | pleskxml_init_checks_done=1 | |
343 | ||
344 | return 0 | |
345 | } | |
346 | ||
347 | # For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any. | |
348 | ||
349 | # IMPORTANT NOTE: a result with host = empty string is OK for this API, see | |
350 | # https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798 | |
351 | # See notes at top of this file | |
352 | ||
353 | _pleskxml_get_root_domain() { | |
d7affad0 | 354 | original_full_domain_name="$1" |
cbacc779 | 355 | |
356 | _debug "Identifying DNS root domain for '$original_full_domain_name' that is managed by the Plesk account." | |
bc291141 | 357 | |
358 | # test if the domain as provided is valid for splitting. | |
359 | ||
05247dc4 | 360 | if [ "$(_countdots "$original_full_domain_name")" -eq 0 ]; then |
bc291141 | 361 | _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record." |
362 | return 1 | |
363 | fi | |
364 | ||
365 | _debug "Querying Plesk server for list of managed domains..." | |
366 | ||
367 | _call_api "$pleskxml_tplt_get_domains" | |
368 | if [ "$pleskxml_retcode" -ne 0 ]; then | |
369 | return 1 | |
370 | fi | |
371 | ||
372 | # Generate a crude list of domains known to this Plesk account. | |
373 | # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields, | |
374 | # for non-Western character sets. | |
375 | # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag | |
376 | # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned. | |
377 | ||
a8d670fc | 378 | output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')" |
bc291141 | 379 | |
6d0e4bed | 380 | _debug 'Domains managed by Plesk server are (ignore the hacked output):' |
381 | _debug "$output" | |
bc291141 | 382 | |
383 | # loop and test if domain, or any parent domain, is managed by Plesk | |
384 | # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain | |
385 | ||
cbacc779 | 386 | root_domain_name="$original_full_domain_name" |
387 | ||
d7affad0 | 388 | while true; do |
bc291141 | 389 | |
390 | _debug "Checking if '$root_domain_name' is managed by the Plesk server..." | |
391 | ||
a8d670fc | 392 | root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')" |
bc291141 | 393 | |
394 | if [ -n "$root_domain_id" ]; then | |
395 | # Found a match | |
396 | # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT. | |
397 | # SO WE HANDLE IT AND DON'T PREVENT IT | |
a8d670fc | 398 | sub_domain_name="$(_value "$original_full_domain_name" | sed "s/\.\{0,1\}${root_domain_name}"'$//')" |
d7affad0 | 399 | _info "Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning." |
bc291141 | 400 | return 0 |
401 | fi | |
402 | ||
403 | # No match, try next parent up (if any)... | |
404 | ||
bc291141 | 405 | root_domain_name="$(_valuecut 2 1000 "$root_domain_name")" |
bc291141 | 406 | |
38854bd8 | 407 | if [ "$(_countdots "$root_domain_name")" -eq 0 ]; then |
d7affad0 | 408 | _debug "No match, and next parent would be a TLD..." |
409 | _err "Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk." | |
410 | _err "Are you sure that this domain is managed by this Plesk server?" | |
411 | return 1 | |
412 | fi | |
bc291141 | 413 | |
d7affad0 | 414 | _debug "No match, trying next parent up..." |
bc291141 | 415 | |
d7affad0 | 416 | done |
bc291141 | 417 | } |