dnsapi/dns_aws.sh

   1 #!/usr/bin/env sh
   2
   3 #
   4 #AWS_ACCESS_KEY_ID="sdfsdfsdfljlbjkljlkjsdfoiwje"
   5 #
   6 #AWS_SECRET_ACCESS_KEY="xxxxxxx"
   7
   8 #This is the Amazon Route53 api wrapper for acme.sh
   9 #All `_sleep` commands are included to avoid Route53 throttling, see
  10 #https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DNSLimitations.html#limits-api-requests
  11
  12 AWS_HOST="route53.amazonaws.com"
  13 AWS_URL="https://$AWS_HOST"
  14
  15 AWS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API"
  16
  17 ########  Public functions #####################
  18
  19 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
  20 dns_aws_add() {
  21   fulldomain=$1
  22   txtvalue=$2
  23
  24   AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
  25   AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
  26   AWS_DNS_SLOWRATE="${AWS_DNS_SLOWRATE:-$(_readaccountconf_mutable AWS_DNS_SLOWRATE)}"
  27
  28   if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  29     _use_container_role || _use_instance_role
  30   fi
  31
  32   if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  33     AWS_ACCESS_KEY_ID=""
  34     AWS_SECRET_ACCESS_KEY=""
  35     _err "You haven't specified the aws route53 api key id and and api key secret yet."
  36     _err "Please create your key and try again. see $(__green $AWS_WIKI)"
  37     return 1
  38   fi
  39
  40   #save for future use, unless using a role which will be fetched as needed
  41   if [ -z "$_using_role" ]; then
  42     _saveaccountconf_mutable AWS_ACCESS_KEY_ID "$AWS_ACCESS_KEY_ID"
  43     _saveaccountconf_mutable AWS_SECRET_ACCESS_KEY "$AWS_SECRET_ACCESS_KEY"
  44     _saveaccountconf_mutable AWS_DNS_SLOWRATE "$AWS_DNS_SLOWRATE"
  45   fi
  46
  47   _debug "First detect the root zone"
  48   if ! _get_root "$fulldomain"; then
  49     _err "invalid domain"
  50     _sleep 1
  51     return 1
  52   fi
  53   _debug _domain_id "$_domain_id"
  54   _debug _sub_domain "$_sub_domain"
  55   _debug _domain "$_domain"
  56
  57   _info "Getting existing records for $fulldomain"
  58   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
  59     _sleep 1
  60     return 1
  61   fi
  62
  63   if _contains "$response" "<Name>$fulldomain.</Name>"; then
  64     _resource_record="$(echo "$response" | sed 's/<ResourceRecordSet>/"/g' | tr '"' "\n" | grep "<Name>$fulldomain.</Name>" | _egrep_o "<ResourceRecords.*</ResourceRecords>" | sed "s/<ResourceRecords>//" | sed "s#</ResourceRecords>##")"
  65     _debug "_resource_record" "$_resource_record"
  66   else
  67     _debug "single new add"
  68   fi
  69
  70   if [ "$_resource_record" ] && _contains "$response" "$txtvalue"; then
  71     _info "The TXT record already exists. Skipping."
  72     _sleep 1
  73     return 0
  74   fi
  75
  76   _debug "Adding records"
  77
  78   _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>UPSERT</Action><ResourceRecordSet><Name>$fulldomain</Name><Type>TXT</Type><TTL>300</TTL><ResourceRecords>$_resource_record<ResourceRecord><Value>\"$txtvalue\"</Value></ResourceRecord></ResourceRecords></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
  79
  80   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
  81     _info "TXT record updated successfully."
  82     if [ -n "$AWS_DNS_SLOWRATE" ]; then
  83       _info "Slow rate activated: sleeping for $AWS_DNS_SLOWRATE seconds"
  84       _sleep "$AWS_DNS_SLOWRATE"
  85     else
  86       _sleep 1
  87     fi
  88
  89     return 0
  90   fi
  91   _sleep 1
  92   return 1
  93 }
  94
  95 #fulldomain txtvalue
  96 dns_aws_rm() {
  97   fulldomain=$1
  98   txtvalue=$2
  99
 100   AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
 101   AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
 102   AWS_DNS_SLOWRATE="${AWS_DNS_SLOWRATE:-$(_readaccountconf_mutable AWS_DNS_SLOWRATE)}"
 103
 104   if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
 105     _use_container_role || _use_instance_role
 106   fi
 107
 108   _debug "First detect the root zone"
 109   if ! _get_root "$fulldomain"; then
 110     _err "invalid domain"
 111     _sleep 1
 112     return 1
 113   fi
 114   _debug _domain_id "$_domain_id"
 115   _debug _sub_domain "$_sub_domain"
 116   _debug _domain "$_domain"
 117
 118   _info "Getting existing records for $fulldomain"
 119   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
 120     _sleep 1
 121     return 1
 122   fi
 123
 124   if _contains "$response" "<Name>$fulldomain.</Name>"; then
 125     _resource_record="$(echo "$response" | sed 's/<ResourceRecordSet>/"/g' | tr '"' "\n" | grep "<Name>$fulldomain.</Name>" | _egrep_o "<ResourceRecords.*</ResourceRecords>" | sed "s/<ResourceRecords>//" | sed "s#</ResourceRecords>##")"
 126     _debug "_resource_record" "$_resource_record"
 127   else
 128     _debug "no records exist, skip"
 129     _sleep 1
 130     return 0
 131   fi
 132
 133   _aws_tmpl_xml="<ChangeResourceRecordSetsRequest xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><ChangeBatch><Changes><Change><Action>DELETE</Action><ResourceRecordSet><ResourceRecords>$_resource_record</ResourceRecords><Name>$fulldomain.</Name><Type>TXT</Type><TTL>300</TTL></ResourceRecordSet></Change></Changes></ChangeBatch></ChangeResourceRecordSetsRequest>"
 134
 135   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
 136     _info "TXT record deleted successfully."
 137     if [ -n "$AWS_DNS_SLOWRATE" ]; then
 138       _info "Slow rate activated: sleeping for $AWS_DNS_SLOWRATE seconds"
 139       _sleep "$AWS_DNS_SLOWRATE"
 140     else
 141       _sleep 1
 142     fi
 143
 144     return 0
 145   fi
 146   _sleep 1
 147   return 1
 148
 149 }
 150
 151 ####################  Private functions below ##################################
 152
 153 _get_root() {
 154   domain=$1
 155   i=2
 156   p=1
 157
 158   if aws_rest GET "2013-04-01/hostedzone"; then
 159     while true; do
 160       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
 161       _debug2 "Checking domain: $h"
 162       if [ -z "$h" ]; then
 163         if _contains "$response" "<IsTruncated>true</IsTruncated>" && _contains "$response" "<NextMarker>"; then
 164           _debug "IsTruncated"
 165           _nextMarker="$(echo "$response" | _egrep_o "<NextMarker>.*</NextMarker>" | cut -d '>' -f 2 | cut -d '<' -f 1)"
 166           _debug "NextMarker" "$_nextMarker"
 167           if aws_rest GET "2013-04-01/hostedzone" "marker=$_nextMarker"; then
 168             _debug "Truncated request OK"
 169             i=2
 170             p=1
 171             continue
 172           else
 173             _err "Truncated request error."
 174           fi
 175         fi
 176         #not valid
 177         _err "Invalid domain"
 178         return 1
 179       fi
 180
 181       if _contains "$response" "<Name>$h.</Name>"; then
 182         hostedzone="$(echo "$response" | sed 's/<HostedZone>/#&/g' | tr '#' '\n' | _egrep_o "<HostedZone><Id>[^<]*<.Id><Name>$h.<.Name>.*<PrivateZone>false<.PrivateZone>.*<.HostedZone>")"
 183         _debug hostedzone "$hostedzone"
 184         if [ "$hostedzone" ]; then
 185           _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "<Id>.*<.Id>" | head -n 1 | _egrep_o ">.*<" | tr -d "<>")
 186           if [ "$_domain_id" ]; then
 187             _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
 188             _domain=$h
 189             return 0
 190           fi
 191           _err "Can't find domain with id: $h"
 192           return 1
 193         fi
 194       fi
 195       p=$i
 196       i=$(_math "$i" + 1)
 197     done
 198   fi
 199   return 1
 200 }
 201
 202 _use_container_role() {
 203   # automatically set if running inside ECS
 204   if [ -z "$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" ]; then
 205     _debug "No ECS environment variable detected"
 206     return 1
 207   fi
 208   _use_metadata "169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
 209 }
 210
 211 _use_instance_role() {
 212   _url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
 213   _debug "_url" "$_url"
 214   if ! _get "$_url" true 1 | _head_n 1 | grep -Fq 200; then
 215     _debug "Unable to fetch IAM role from instance metadata"
 216     return 1
 217   fi
 218   _aws_role=$(_get "$_url" "" 1)
 219   _debug "_aws_role" "$_aws_role"
 220   _use_metadata "$_url$_aws_role"
 221 }
 222
 223 _use_metadata() {
 224   _aws_creds="$(
 225     _get "$1" "" 1 |
 226       _normalizeJson |
 227       tr '{,}' '\n' |
 228       while read -r _line; do
 229         _key="$(echo "${_line%%:*}" | tr -d '"')"
 230         _value="${_line#*:}"
 231         _debug3 "_key" "$_key"
 232         _secure_debug3 "_value" "$_value"
 233         case "$_key" in
 234         AccessKeyId) echo "AWS_ACCESS_KEY_ID=$_value" ;;
 235         SecretAccessKey) echo "AWS_SECRET_ACCESS_KEY=$_value" ;;
 236         Token) echo "AWS_SESSION_TOKEN=$_value" ;;
 237         esac
 238       done |
 239       paste -sd' ' -
 240   )"
 241   _secure_debug "_aws_creds" "$_aws_creds"
 242
 243   if [ -z "$_aws_creds" ]; then
 244     return 1
 245   fi
 246
 247   eval "$_aws_creds"
 248   _using_role=true
 249 }
 250
 251 #method uri qstr data
 252 aws_rest() {
 253   mtd="$1"
 254   ep="$2"
 255   qsr="$3"
 256   data="$4"
 257
 258   _debug mtd "$mtd"
 259   _debug ep "$ep"
 260   _debug qsr "$qsr"
 261   _debug data "$data"
 262
 263   CanonicalURI="/$ep"
 264   _debug2 CanonicalURI "$CanonicalURI"
 265
 266   CanonicalQueryString="$qsr"
 267   _debug2 CanonicalQueryString "$CanonicalQueryString"
 268
 269   RequestDate="$(date -u +"%Y%m%dT%H%M%SZ")"
 270   _debug2 RequestDate "$RequestDate"
 271
 272   #RequestDate="20161120T141056Z" ##############
 273
 274   export _H1="x-amz-date: $RequestDate"
 275
 276   aws_host="$AWS_HOST"
 277   CanonicalHeaders="host:$aws_host\nx-amz-date:$RequestDate\n"
 278   SignedHeaders="host;x-amz-date"
 279   if [ -n "$AWS_SESSION_TOKEN" ]; then
 280     export _H3="x-amz-security-token: $AWS_SESSION_TOKEN"
 281     CanonicalHeaders="${CanonicalHeaders}x-amz-security-token:$AWS_SESSION_TOKEN\n"
 282     SignedHeaders="${SignedHeaders};x-amz-security-token"
 283   fi
 284   _debug2 CanonicalHeaders "$CanonicalHeaders"
 285   _debug2 SignedHeaders "$SignedHeaders"
 286
 287   RequestPayload="$data"
 288   _debug2 RequestPayload "$RequestPayload"
 289
 290   Hash="sha256"
 291
 292   CanonicalRequest="$mtd\n$CanonicalURI\n$CanonicalQueryString\n$CanonicalHeaders\n$SignedHeaders\n$(printf "%s" "$RequestPayload" | _digest "$Hash" hex)"
 293   _debug2 CanonicalRequest "$CanonicalRequest"
 294
 295   HashedCanonicalRequest="$(printf "$CanonicalRequest%s" | _digest "$Hash" hex)"
 296   _debug2 HashedCanonicalRequest "$HashedCanonicalRequest"
 297
 298   Algorithm="AWS4-HMAC-SHA256"
 299   _debug2 Algorithm "$Algorithm"
 300
 301   RequestDateOnly="$(echo "$RequestDate" | cut -c 1-8)"
 302   _debug2 RequestDateOnly "$RequestDateOnly"
 303
 304   Region="us-east-1"
 305   Service="route53"
 306
 307   CredentialScope="$RequestDateOnly/$Region/$Service/aws4_request"
 308   _debug2 CredentialScope "$CredentialScope"
 309
 310   StringToSign="$Algorithm\n$RequestDate\n$CredentialScope\n$HashedCanonicalRequest"
 311
 312   _debug2 StringToSign "$StringToSign"
 313
 314   kSecret="AWS4$AWS_SECRET_ACCESS_KEY"
 315
 316   #kSecret="wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY" ############################
 317
 318   _secure_debug2 kSecret "$kSecret"
 319
 320   kSecretH="$(printf "%s" "$kSecret" | _hex_dump | tr -d " ")"
 321   _secure_debug2 kSecretH "$kSecretH"
 322
 323   kDateH="$(printf "$RequestDateOnly%s" | _hmac "$Hash" "$kSecretH" hex)"
 324   _debug2 kDateH "$kDateH"
 325
 326   kRegionH="$(printf "$Region%s" | _hmac "$Hash" "$kDateH" hex)"
 327   _debug2 kRegionH "$kRegionH"
 328
 329   kServiceH="$(printf "$Service%s" | _hmac "$Hash" "$kRegionH" hex)"
 330   _debug2 kServiceH "$kServiceH"
 331
 332   kSigningH="$(printf "%s" "aws4_request" | _hmac "$Hash" "$kServiceH" hex)"
 333   _debug2 kSigningH "$kSigningH"
 334
 335   signature="$(printf "$StringToSign%s" | _hmac "$Hash" "$kSigningH" hex)"
 336   _debug2 signature "$signature"
 337
 338   Authorization="$Algorithm Credential=$AWS_ACCESS_KEY_ID/$CredentialScope, SignedHeaders=$SignedHeaders, Signature=$signature"
 339   _debug2 Authorization "$Authorization"
 340
 341   _H2="Authorization: $Authorization"
 342   _debug _H2 "$_H2"
 343
 344   url="$AWS_URL/$ep"
 345   if [ "$qsr" ]; then
 346     url="$AWS_URL/$ep?$qsr"
 347   fi
 348
 349   if [ "$mtd" = "GET" ]; then
 350     response="$(_get "$url")"
 351   else
 352     response="$(_post "$data" "$url")"
 353   fi
 354
 355   _ret="$?"
 356   _debug2 response "$response"
 357   if [ "$_ret" = "0" ]; then
 358     if _contains "$response" "<ErrorResponse"; then
 359       _err "Response error:$response"
 360       return 1
 361     fi
 362   fi
 363
 364   return "$_ret"
 365 }