deploy/fritzbox.sh

   1 #!/usr/bin/env sh
   2
   3 #Here is a script to deploy cert to an AVM FRITZ!Box router.
   4
   5 #returns 0 means success, otherwise error.
   6
   7 #DEPLOY_FRITZBOX_USERNAME="username"
   8 #DEPLOY_FRITZBOX_PASSWORD="password"
   9 #DEPLOY_FRITZBOX_URL="https://fritz.box"
  10
  11 # Kudos to wikrie at Github for his FRITZ!Box update script:
  12 # https://gist.github.com/wikrie/f1d5747a714e0a34d0582981f7cb4cfb
  13
  14 ########  Public functions #####################
  15
  16 #domain keyfile certfile cafile fullchain
  17 fritzbox_deploy() {
  18   _cdomain="$1"
  19   _ckey="$2"
  20   _ccert="$3"
  21   _cca="$4"
  22   _cfullchain="$5"
  23
  24   _debug _cdomain "$_cdomain"
  25   _debug _ckey "$_ckey"
  26   _debug _ccert "$_ccert"
  27   _debug _cca "$_cca"
  28   _debug _cfullchain "$_cfullchain"
  29
  30   if ! _exists iconv; then
  31     if ! _exists uconv; then
  32       if ! _exists perl; then
  33         _err "iconv or uconv or perl not found"
  34         return 1
  35       fi
  36     fi
  37   fi
  38
  39   _fritzbox_username="${DEPLOY_FRITZBOX_USERNAME}"
  40   _fritzbox_password="${DEPLOY_FRITZBOX_PASSWORD}"
  41   _fritzbox_url="${DEPLOY_FRITZBOX_URL}"
  42
  43   _debug _fritzbox_url "$_fritzbox_url"
  44   _debug _fritzbox_username "$_fritzbox_username"
  45   _secure_debug _fritzbox_password "$_fritzbox_password"
  46   if [ -z "$_fritzbox_username" ]; then
  47     _err "FRITZ!Box username is not found, please define DEPLOY_FRITZBOX_USERNAME."
  48     return 1
  49   fi
  50   if [ -z "$_fritzbox_password" ]; then
  51     _err "FRITZ!Box password is not found, please define DEPLOY_FRITZBOX_PASSWORD."
  52     return 1
  53   fi
  54   if [ -z "$_fritzbox_url" ]; then
  55     _err "FRITZ!Box url is not found, please define DEPLOY_FRITZBOX_URL."
  56     return 1
  57   fi
  58
  59   _saveaccountconf DEPLOY_FRITZBOX_USERNAME "${_fritzbox_username}"
  60   _saveaccountconf DEPLOY_FRITZBOX_PASSWORD "${_fritzbox_password}"
  61   _saveaccountconf DEPLOY_FRITZBOX_URL "${_fritzbox_url}"
  62
  63   # Do not check for a valid SSL certificate, because initially the cert is not valid, so it could not install the LE generated certificate
  64   export HTTPS_INSECURE=1
  65
  66   _info "Log in to the FRITZ!Box"
  67   _fritzbox_challenge="$(_get "${_fritzbox_url}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
  68   if _exists iconv; then
  69     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
  70   elif _exists uconv; then
  71     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | uconv -f ASCII -t UTF16LE | _digest md5 hex)"
  72   else
  73     _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
  74   fi
  75   _fritzbox_sid="$(_get "${_fritzbox_url}/login_sid.lua?sid=0000000000000000&username=${_fritzbox_username}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
  76
  77   if [ -z "${_fritzbox_sid}" ] || [ "${_fritzbox_sid}" = "0000000000000000" ]; then
  78     _err "Logging in to the FRITZ!Box failed. Please check username, password and URL."
  79     return 1
  80   fi
  81
  82   _info "Generate form POST request"
  83   _post_request="$(_mktemp)"
  84   _post_boundary="---------------------------$(date +%Y%m%d%H%M%S)"
  85   # _CERTPASSWORD_ is unset because Let's Encrypt certificates don't have a password. But if they ever do, here's the place to use it!
  86   _CERTPASSWORD_=
  87   {
  88     printf -- "--"
  89     printf -- "%s\r\n" "${_post_boundary}"
  90     printf "Content-Disposition: form-data; name=\"sid\"\r\n\r\n%s\r\n" "${_fritzbox_sid}"
  91     printf -- "--"
  92     printf -- "%s\r\n" "${_post_boundary}"
  93     printf "Content-Disposition: form-data; name=\"BoxCertPassword\"\r\n\r\n%s\r\n" "${_CERTPASSWORD_}"
  94     printf -- "--"
  95     printf -- "%s\r\n" "${_post_boundary}"
  96     printf "Content-Disposition: form-data; name=\"BoxCertImportFile\"; filename=\"BoxCert.pem\"\r\n"
  97     printf "Content-Type: application/octet-stream\r\n\r\n"
  98     cat "${_ckey}" "${_cfullchain}"
  99     printf "\r\n"
 100     printf -- "--"
 101     printf -- "%s--" "${_post_boundary}"
 102   } >>"${_post_request}"
 103
 104   _info "Upload certificate to the FRITZ!Box"
 105
 106   export _H1="Content-type: multipart/form-data boundary=${_post_boundary}"
 107   _post "$(cat "${_post_request}")" "${_fritzbox_url}/cgi-bin/firmwarecfg" | grep SSL
 108
 109   retval=$?
 110   if [ $retval = 0 ]; then
 111     _info "Upload successful"
 112   else
 113     _err "Upload failed"
 114   fi
 115   rm "${_post_request}"
 116
 117   return $retval
 118 }