deploy/panos.sh

   1 #!/usr/bin/env sh
   2
   3 # Script to deploy certificates to Palo Alto Networks PANOS via API
   4 # Note PANOS API KEY and IP address needs to be set prior to running.
   5 # The following variables exported from environment will be used.
   6 # If not set then values previously saved in domain.conf file are used.
   7 #
   8 # Firewall admin with superuser and IP address is required.
   9 #
  10 # REQURED:
  11 #     export PANOS_HOST=""
  12 #     export PANOS_USER=""    #User *MUST* have Commit and Import Permissions in XML API for Admin Role
  13 #     export PANOS_PASS=""
  14 #
  15 # The script will automatically generate a new API key if
  16 # no key is found, or if a saved key has expired or is invalid.
  17
  18 # This function is to parse the XML response from the firewall
  19 parse_response() {
  20   type=$2
  21   if [ "$type" = 'keygen' ]; then
  22     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
  23     if [ "$status" = "success" ]; then
  24       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
  25       _panos_key=$panos_key
  26     else
  27       message="PAN-OS Key could not be set."
  28     fi
  29   else
  30     status=$(echo "$1" | tr -d '\n' | sed 's/^.*"\([a-z]*\)".*/\1/g')
  31     message=$(echo "$1" | tr -d '\n' | sed 's/.*\(<result>\|<msg>\|<line>\)\([^<]*\).*/\2/g')
  32     _debug "Firewall message:  $message"
  33     if [ "$type" = 'keytest' ] && [ "$status" != "success" ]; then
  34       _debug "****  API Key has EXPIRED or is INVALID ****"
  35       unset _panos_key
  36     fi
  37   fi
  38   return 0
  39 }
  40
  41 #This function is used to deploy to the firewall
  42 deployer() {
  43   content=""
  44   type=$1 # Types are keytest, keygen, cert, key, commit
  45   panos_url="https://$_panos_host/api/"
  46
  47   #Test API Key by performing a lookup
  48   if [ "$type" = 'keytest' ]; then
  49     _debug "**** Testing saved API Key ****"
  50     _H1="Content-Type: application/x-www-form-urlencoded"
  51     # Get Version Info to test key
  52     content="type=version&key=$_panos_key"
  53     ## Exclude all scopes for the empty commit
  54     #_exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network><shared-object>exclude</shared-object>"
  55     #content="type=commit&action=partial&key=$_panos_key&cmd=<commit><partial>$_exclude_scope<admin><member>acmekeytest</member></admin></partial></commit>"
  56   fi
  57
  58   # Generate API Key
  59   if [ "$type" = 'keygen' ]; then
  60     _debug "**** Generating new API Key ****"
  61     _H1="Content-Type: application/x-www-form-urlencoded"
  62     content="type=keygen&user=$_panos_user&password=$_panos_pass"
  63     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
  64   fi
  65
  66   # Deploy Cert or Key
  67   if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
  68     _debug "**** Deploying $type ****"
  69     #Generate DELIM
  70     delim="-----MultipartDelimiter$(date "+%s%N")"
  71     nl="\015\012"
  72     #Set Header
  73     export _H1="Content-Type: multipart/form-data; boundary=$delim"
  74     if [ "$type" = 'cert' ]; then
  75       panos_url="${panos_url}?type=import"
  76       content="--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\ncertificate"
  77       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n$_cdomain"
  78       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n$_panos_key"
  79       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\npem"
  80       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
  81     fi
  82     if [ "$type" = 'key' ]; then
  83       panos_url="${panos_url}?type=import"
  84       content="--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\nprivate-key"
  85       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n$_cdomain"
  86       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n$_panos_key"
  87       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\npem"
  88       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n123456"
  89       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cdomain.key")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
  90     fi
  91     #Close multipart
  92     content="$content${nl}--$delim--${nl}${nl}"
  93     #Convert CRLF
  94     content=$(printf %b "$content")
  95   fi
  96
  97   # Commit changes
  98   if [ "$type" = 'commit' ]; then
  99     _debug "**** Committing changes ****"
 100     export _H1="Content-Type: application/x-www-form-urlencoded"
 101     #Check for force commit - will commit ALL uncommited changes to the firewall. Use with caution!
 102     if [ "$FORCE" ]; then
 103       _debug "Force switch detected.  Committing ALL changes to the firewall."
 104       cmd=$(printf "%s" "<commit><partial><force><admin><member>$_panos_user</member></admin></force></partial></commit>" | _url_encode)
 105     else
 106       _exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network>"
 107       cmd=$(printf "%s" "<commit><partial>$_exclude_scope<admin><member>$_panos_user</member></admin></partial></commit>" | _url_encode)
 108     fi
 109     content="type=commit&action=partial&key=$_panos_key&cmd=$cmd"
 110   fi
 111
 112   response=$(_post "$content" "$panos_url" "" "POST")
 113   parse_response "$response" "$type"
 114   # Saving response to variables
 115   response_status=$status
 116   _debug response_status "$response_status"
 117   if [ "$response_status" = "success" ]; then
 118     _debug "Successfully deployed $type"
 119     return 0
 120   else
 121     _err "Deploy of type $type failed. Try deploying with --debug to troubleshoot."
 122     _debug "$message"
 123     return 1
 124   fi
 125 }
 126
 127 # This is the main function that will call the other functions to deploy everything.
 128 panos_deploy() {
 129   _cdomain=$(echo "$1" | sed 's/*/WILDCARD_/g') #Wildcard Safe Filename
 130   _ckey="$2"
 131   _cfullchain="$5"
 132
 133   # VALID FILE CHECK
 134   if [ ! -f "$_ckey" ] || [ ! -f "$_cfullchain" ]; then
 135     _err "Unable to find a valid key and/or cert.  If this is an ECDSA/ECC cert, use the --ecc flag when deploying."
 136     return 1
 137   fi
 138
 139   # PANOS_HOST
 140   if [ "$PANOS_HOST" ]; then
 141     _debug "Detected ENV variable PANOS_HOST. Saving to file."
 142     _savedeployconf PANOS_HOST "$PANOS_HOST" 1
 143   else
 144     _debug "Attempting to load variable PANOS_HOST from file."
 145     _getdeployconf PANOS_HOST
 146   fi
 147
 148   # PANOS USER
 149   if [ "$PANOS_USER" ]; then
 150     _debug "Detected ENV variable PANOS_USER. Saving to file."
 151     _savedeployconf PANOS_USER "$PANOS_USER" 1
 152   else
 153     _debug "Attempting to load variable PANOS_USER from file."
 154     _getdeployconf PANOS_USER
 155   fi
 156
 157   # PANOS_PASS
 158   if [ "$PANOS_PASS" ]; then
 159     _debug "Detected ENV variable PANOS_PASS. Saving to file."
 160     _savedeployconf PANOS_PASS "$PANOS_PASS" 1
 161   else
 162     _debug "Attempting to load variable PANOS_PASS from file."
 163     _getdeployconf PANOS_PASS
 164   fi
 165
 166   # PANOS_KEY
 167   _getdeployconf PANOS_KEY
 168   if [ "$PANOS_KEY" ]; then
 169     _debug "Detected saved key."
 170     _panos_key=$PANOS_KEY
 171   else
 172     _debug "No key detected"
 173     unset _panos_key
 174   fi
 175
 176   #Store variables
 177   _panos_host=$PANOS_HOST
 178   _panos_user=$PANOS_USER
 179   _panos_pass=$PANOS_PASS
 180
 181   #Test API Key if found.  If the key is invalid, the variable _panos_key will be unset.
 182   if [ "$_panos_host" ] && [ "$_panos_key" ]; then
 183     _debug "**** Testing API KEY ****"
 184     deployer keytest
 185   fi
 186
 187   # Check for valid variables
 188   if [ -z "$_panos_host" ]; then
 189     _err "No host found. If this is your first time deploying, please set PANOS_HOST in ENV variables. You can delete it after you have successfully deployed the certs."
 190     return 1
 191   elif [ -z "$_panos_user" ]; then
 192     _err "No user found. If this is your first time deploying, please set PANOS_USER in ENV variables. You can delete it after you have successfully deployed the certs."
 193     return 1
 194   elif [ -z "$_panos_pass" ]; then
 195     _err "No password found. If this is your first time deploying, please set PANOS_PASS in ENV variables. You can delete it after you have successfully deployed the certs."
 196     return 1
 197   else
 198     # Generate a new API key if no valid API key is found
 199     if [ -z "$_panos_key" ]; then
 200       _debug "**** Generating new PANOS API KEY ****"
 201       deployer keygen
 202       _savedeployconf PANOS_KEY "$_panos_key" 1
 203     fi
 204
 205     # Confirm that a valid key was generated
 206     if [ -z "$_panos_key" ]; then
 207       _err "Unable to generate an API key.  The user and pass may be invalid or not authorized to generate a new key.  Please check the PANOS_USER and PANOS_PASS credentials and try again"
 208       return 1
 209     else
 210       deployer cert
 211       deployer key
 212       deployer commit
 213     fi
 214   fi
 215 }