deploy/panos.sh

   1 #!/usr/bin/env sh
   2
   3 # Script to deploy certificates to Palo Alto Networks PANOS via API
   4 # Note PANOS API KEY and IP address needs to be set prior to running.
   5 # The following variables exported from environment will be used.
   6 # If not set then values previously saved in domain.conf file are used.
   7 #
   8 # Firewall admin with superuser and IP address is required.
   9 #
  10 # export PANOS_USER=""  # required
  11 # export PANOS_PASS=""  # required
  12 # export PANOS_HOST=""  # required
  13
  14 # This function is to parse the XML
  15 parse_response() {
  16   type=$2
  17   if [ "$type" = 'keygen' ]; then
  18     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
  19     if [ "$status" = "success" ]; then
  20       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
  21       _panos_key=$panos_key
  22     else
  23       message="PAN-OS Key could not be set."
  24     fi
  25   else
  26     status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
  27     message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
  28   fi
  29   return 0
  30 }
  31
  32 deployer() {
  33   type=$1 # Types are keygen, cert, key, commit
  34   _debug "**** Deploying $type *****"
  35   panos_url="https://$_panos_host/api/"
  36   if [ "$type" = 'keygen' ]; then
  37     _H1="Content-Type: application/x-www-form-urlencoded"
  38     content="type=keygen&user=$_panos_user&password=$_panos_pass"
  39     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
  40   fi
  41
  42   if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
  43     #Generate DEIM
  44     delim="-----MultipartDelimiter$(date "+%s%N")"
  45     nl="\015\012"
  46     #Set Header
  47     export _H1="Content-Type: multipart/form-data; boundary=$delim"
  48     if [ "$type" = 'cert' ]; then
  49       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
  50       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
  51       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
  52       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
  53       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
  54       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
  55     fi
  56     if [ "$type" = 'key' ]; then
  57       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
  58       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
  59       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
  60       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
  61       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
  62       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\nnone"
  63       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
  64     fi
  65     #Close multipart
  66     content="$content${nl}--$delim--${nl}"
  67     #Convert CRLF
  68     content=$(printf %b "$content")
  69   fi
  70
  71   if [ "$type" = 'commit' ]; then
  72     export _H1="Content-Type: application/x-www-form-urlencoded"
  73     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
  74     content="type=commit&key=$_panos_key&cmd=$cmd"
  75   fi
  76   response=$(_post "$content" "$panos_url" "" "POST")
  77   parse_response "$response" "$type"
  78   # Saving response to variables
  79   response_status=$status
  80   #DEBUG
  81   _debug response_status "$response_status"
  82   if [ "$response_status" = "success" ]; then
  83     _debug "Successfully deployed $type"
  84     return 0
  85   else
  86     _err "Deploy of type $type failed. Try deploying with --debug to troubleshoot."
  87     _debug "$message"
  88     return 1
  89   fi
  90 }
  91
  92 # This is the main function that will call the other functions to deploy everything.
  93 panos_deploy() {
  94   _cdomain="$1"
  95   _ckey="$2"
  96   _cfullchain="$5"
  97   # PANOS ENV VAR check
  98   if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ] || [ -z "$PANOS_HOST" ]; then
  99     _debug "No ENV variables found lets check for saved variables"
 100     _getdeployconf PANOS_USER
 101     _getdeployconf PANOS_PASS
 102     _getdeployconf PANOS_HOST
 103     _panos_user=$PANOS_USER
 104     _panos_pass=$PANOS_PASS
 105     _panos_host=$PANOS_HOST
 106     if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ] && [ -z "$_panos_host" ]; then
 107       _err "No host, user and pass found.. If this is the first time deploying please set PANOS_HOST, PANOS_USER and PANOS_PASS in environment variables. Delete them after you have succesfully deployed certs."
 108       return 1
 109     else
 110       _debug "Using saved env variables."
 111     fi
 112   else
 113     _debug "Detected ENV variables to be saved to the deploy conf."
 114     # Encrypt and save user
 115     _savedeployconf PANOS_USER "$PANOS_USER" 1
 116     _savedeployconf PANOS_PASS "$PANOS_PASS" 1
 117     _savedeployconf PANOS_HOST "$PANOS_HOST" 1
 118     _panos_user="$PANOS_USER"
 119     _panos_pass="$PANOS_PASS"
 120     _panos_host="$PANOS_HOST"
 121   fi
 122   _debug "Let's use username and pass to generate token."
 123   if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then
 124     _err "Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST"
 125     return 1
 126   else
 127     _debug "Getting PANOS KEY"
 128     deployer keygen
 129     if [ -z "$_panos_key" ]; then
 130       _err "Missing apikey."
 131       return 1
 132     else
 133       deployer cert
 134       deployer key
 135       deployer commit
 136     fi
 137   fi
 138 }