deploy/fritzbox.sh

   1 #!/usr/bin/env sh
   2
   3 #Here is a script to deploy cert to an AVM FRITZ!Box router.
   4
   5 #returns 0 means success, otherwise error.
   6
   7 #DEPLOY_FRITZBOX_USERNAME="username"
   8 #DEPLOY_FRITZBOX_PASSWORD="password"
   9 #DEPLOY_FRITZBOX_URL="https://fritz.box"
  10
  11 # Kudos to wikrie at Github for his FRITZ!Box update script:
  12 # https://gist.github.com/wikrie/f1d5747a714e0a34d0582981f7cb4cfb
  13
  14 ########  Public functions #####################
  15
  16 #domain keyfile certfile cafile fullchain
  17 fritzbox_deploy() {
  18   _cdomain="$1"
  19   _ckey="$2"
  20   _ccert="$3"
  21   _cca="$4"
  22   _cfullchain="$5"
  23
  24   _debug _cdomain "$_cdomain"
  25   _debug _ckey "$_ckey"
  26   _debug _ccert "$_ccert"
  27   _debug _cca "$_cca"
  28   _debug _cfullchain "$_cfullchain"
  29
  30   if ! _exists iconv; then
  31     if ! _exists uconv; then
  32       if ! _exists perl; then
  33         _err "iconv or uconv or perl not found"
  34         return 1
  35       fi
  36     fi
  37   fi
  38
  39   # Clear traces of incorrectly stored values
  40   _clearaccountconf DEPLOY_FRITZBOX_USERNAME
  41   _clearaccountconf DEPLOY_FRITZBOX_PASSWORD
  42   _clearaccountconf DEPLOY_FRITZBOX_URL
  43
  44   # Read config from saved values or env
  45   _getdeployconf DEPLOY_FRITZBOX_USERNAME
  46   _getdeployconf DEPLOY_FRITZBOX_PASSWORD
  47   _getdeployconf DEPLOY_FRITZBOX_URL
  48
  49   _debug DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL"
  50   _debug DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME"
  51   _secure_debug DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD"
  52
  53   if [ -z "$DEPLOY_FRITZBOX_USERNAME" ]; then
  54     _err "FRITZ!Box username is not found, please define DEPLOY_FRITZBOX_USERNAME."
  55     return 1
  56   fi
  57   if [ -z "$DEPLOY_FRITZBOX_PASSWORD" ]; then
  58     _err "FRITZ!Box password is not found, please define DEPLOY_FRITZBOX_PASSWORD."
  59     return 1
  60   fi
  61   if [ -z "$DEPLOY_FRITZBOX_URL" ]; then
  62     _err "FRITZ!Box url is not found, please define DEPLOY_FRITZBOX_URL."
  63     return 1
  64   fi
  65
  66   # Save current values
  67   _savedeployconf DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME"
  68   _savedeployconf DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD"
  69   _savedeployconf DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL"
  70
  71   # Do not check for a valid SSL certificate, because initially the cert is not valid, so it could not install the LE generated certificate
  72   export HTTPS_INSECURE=1
  73
  74   _info "Log in to the FRITZ!Box"
  75   _fritzbox_challenge="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
  76   if _exists iconv; then
  77     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
  78   elif _exists uconv; then
  79     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | uconv -f ASCII -t UTF16LE | _digest md5 hex)"
  80   else
  81     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
  82   fi
  83   _fritzbox_sid="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua?sid=0000000000000000&username=${DEPLOY_FRITZBOX_USERNAME}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
  84
  85   if [ -z "${_fritzbox_sid}" ] || [ "${_fritzbox_sid}" = "0000000000000000" ]; then
  86     _err "Logging in to the FRITZ!Box failed. Please check username, password and URL."
  87     return 1
  88   fi
  89
  90   _info "Generate form POST request"
  91   _post_request="$(_mktemp)"
  92   _post_boundary="---------------------------$(date +%Y%m%d%H%M%S)"
  93   # _CERTPASSWORD_ is unset because Let's Encrypt certificates don't have a password. But if they ever do, here's the place to use it!
  94   _CERTPASSWORD_=
  95   {
  96     printf -- "--"
  97     printf -- "%s\r\n" "${_post_boundary}"
  98     printf "Content-Disposition: form-data; name=\"sid\"\r\n\r\n%s\r\n" "${_fritzbox_sid}"
  99     printf -- "--"
 100     printf -- "%s\r\n" "${_post_boundary}"
 101     printf "Content-Disposition: form-data; name=\"BoxCertPassword\"\r\n\r\n%s\r\n" "${_CERTPASSWORD_}"
 102     printf -- "--"
 103     printf -- "%s\r\n" "${_post_boundary}"
 104     printf "Content-Disposition: form-data; name=\"BoxCertImportFile\"; filename=\"BoxCert.pem\"\r\n"
 105     printf "Content-Type: application/octet-stream\r\n\r\n"
 106     cat "${_ckey}" "${_cfullchain}"
 107     printf "\r\n"
 108     printf -- "--"
 109     printf -- "%s--" "${_post_boundary}"
 110   } >>"${_post_request}"
 111
 112   _info "Upload certificate to the FRITZ!Box"
 113
 114   export _H1="Content-type: multipart/form-data boundary=${_post_boundary}"
 115   _post "$(cat "${_post_request}")" "${DEPLOY_FRITZBOX_URL}/cgi-bin/firmwarecfg" | grep SSL
 116
 117   retval=$?
 118   if [ $retval = 0 ]; then
 119     _info "Upload successful"
 120   else
 121     _err "Upload failed"
 122   fi
 123   rm "${_post_request}"
 124
 125   return $retval
 126 }