You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

253 lines
6.8 KiB

  1. #!/bin/sh
  2. # Wrapper for acme.sh to work on openwrt.
  3. #
  4. # This program is free software; you can redistribute it and/or modify it under
  5. # the terms of the GNU General Public License as published by the Free Software
  6. # Foundation; either version 3 of the License, or (at your option) any later
  7. # version.
  8. #
  9. # Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10. CHECK_CRON=$1
  11. ACME=/usr/lib/acme/acme.sh
  12. export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
  13. export NO_TIMESTAMP=1
  14. UHTTPD_LISTEN_HTTP=
  15. STATE_DIR='/etc/acme'
  16. ACCOUNT_EMAIL=
  17. DEBUG=0
  18. . /lib/functions.sh
  19. check_cron()
  20. {
  21. [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
  22. echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
  23. /etc/init.d/cron start
  24. }
  25. log()
  26. {
  27. logger -t acme -s -p daemon.info "$@"
  28. }
  29. err()
  30. {
  31. logger -t acme -s -p daemon.err "$@"
  32. }
  33. debug()
  34. {
  35. [ "$DEBUG" -eq "1" ] && logger -t acme -s -p daemon.debug "$@"
  36. }
  37. get_listeners()
  38. {
  39. netstat -nptl 2>/dev/null | awk 'match($4, /:80$/){split($7, parts, "/"); print parts[2];}' | uniq | tr "\n" " "
  40. }
  41. pre_checks()
  42. {
  43. main_domain="$1"
  44. log "Running pre checks for $main_domain."
  45. listeners="$(get_listeners)"
  46. debug "port80 listens: $listeners"
  47. case "$listeners" in
  48. "uhttpd")
  49. debug "Found uhttpd listening on port 80; trying to disable."
  50. UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
  51. if [ -z "$UHTTPD_LISTEN_HTTP" ]; then
  52. err "$main_domain: Unable to find uhttpd listen config."
  53. err "Manually disable uhttpd or set webroot to continue."
  54. return 1
  55. fi
  56. uci set uhttpd.main.listen_http=''
  57. uci commit uhttpd || return 1
  58. if ! /etc/init.d/uhttpd reload ; then
  59. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  60. uci commit uhttpd
  61. return 1
  62. fi
  63. ;;
  64. "")
  65. debug "Nothing listening on port 80."
  66. ;;
  67. *)
  68. err "$main_domain: Cannot run in standalone mode; another daemon is listening on port 80."
  69. err "Disable other daemon or set webroot to continue."
  70. return 1
  71. ;;
  72. esac
  73. iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  74. ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  75. debug "v4 input_rule: $(iptables -nvL input_rule)"
  76. debug "v6 input_rule: $(ip6tables -nvL input_rule)"
  77. return 0
  78. }
  79. post_checks()
  80. {
  81. log "Running post checks (cleanup)."
  82. # The comment ensures we only touch our own rules. If no rules exist, that
  83. # is fine, so hide any errors
  84. iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  85. ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  86. if [ -e /etc/init.d/uhttpd ] && [ -n "$UHTTPD_LISTEN_HTTP" ]; then
  87. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  88. uci commit uhttpd
  89. /etc/init.d/uhttpd reload
  90. UHTTPD_LISTEN_HTTP=
  91. fi
  92. }
  93. err_out()
  94. {
  95. post_checks
  96. exit 1
  97. }
  98. int_out()
  99. {
  100. post_checks
  101. trap - INT
  102. kill -INT $$
  103. }
  104. is_staging()
  105. {
  106. local main_domain="$1"
  107. grep -q "acme-staging" "$STATE_DIR/$main_domain/${main_domain}.conf"
  108. return $?
  109. }
  110. issue_cert()
  111. {
  112. local section="$1"
  113. local acme_args=
  114. local enabled
  115. local use_staging
  116. local update_uhttpd
  117. local keylength
  118. local domains
  119. local main_domain
  120. local moved_staging=0
  121. local failed_dir
  122. local webroot
  123. local dns
  124. config_get_bool enabled "$section" enabled 0
  125. config_get_bool use_staging "$section" use_staging
  126. config_get_bool update_uhttpd "$section" update_uhttpd
  127. config_get domains "$section" domains
  128. config_get keylength "$section" keylength
  129. config_get webroot "$section" webroot
  130. config_get dns "$section" dns
  131. [ "$enabled" -eq "1" ] || return
  132. [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
  133. set -- $domains
  134. main_domain=$1
  135. [ -n "$webroot" ] || [ -n "$dns" ] || pre_checks "$main_domain" || return 1
  136. log "Running ACME for $main_domain"
  137. if [ -e "$STATE_DIR/$main_domain" ]; then
  138. if [ "$use_staging" -eq "0" ] && is_staging "$main_domain"; then
  139. log "Found previous cert issued using staging server. Moving it out of the way."
  140. mv "$STATE_DIR/$main_domain" "$STATE_DIR/$main_domain.staging"
  141. moved_staging=1
  142. else
  143. log "Found previous cert config. Issuing renew."
  144. $ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1
  145. return 0
  146. fi
  147. fi
  148. acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
  149. acme_args="$acme_args --keylength $keylength"
  150. [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
  151. [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
  152. if [ -n "$dns" ]; then
  153. log "Using dns mode"
  154. acme_args="$acme_args --dns $dns"
  155. elif [ -z "$webroot" ]; then
  156. log "Using standalone mode"
  157. acme_args="$acme_args --standalone"
  158. else
  159. if [ ! -d "$webroot" ]; then
  160. err "$main_domain: Webroot dir '$webroot' does not exist!"
  161. return 1
  162. fi
  163. log "Using webroot dir: $webroot"
  164. acme_args="$acme_args --webroot $webroot"
  165. fi
  166. handle_credentials() {
  167. local credential="$1"
  168. eval export $credential
  169. }
  170. config_list_foreach "$section" credentials handle_credentials
  171. if ! $ACME --home "$STATE_DIR" --issue $acme_args; then
  172. failed_dir="$STATE_DIR/${main_domain}.failed-$(date +%s)"
  173. err "Issuing cert for $main_domain failed. Moving state to $failed_dir"
  174. [ -d "$STATE_DIR/$main_domain" ] && mv "$STATE_DIR/$main_domain" "$failed_dir"
  175. if [ "$moved_staging" -eq "1" ]; then
  176. err "Restoring staging certificate"
  177. mv "$STATE_DIR/${main_domain}.staging" "$STATE_DIR/${main_domain}"
  178. fi
  179. return 1
  180. fi
  181. if [ "$update_uhttpd" -eq "1" ]; then
  182. uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
  183. uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
  184. # commit and reload is in post_checks
  185. fi
  186. post_checks
  187. }
  188. load_vars()
  189. {
  190. local section="$1"
  191. STATE_DIR=$(config_get "$section" state_dir)
  192. ACCOUNT_EMAIL=$(config_get "$section" account_email)
  193. DEBUG=$(config_get "$section" debug)
  194. }
  195. check_cron
  196. [ -n "$CHECK_CRON" ] && exit 0
  197. config_load acme
  198. config_foreach load_vars acme
  199. if [ -z "$STATE_DIR" ] || [ -z "$ACCOUNT_EMAIL" ]; then
  200. err "state_dir and account_email must be set"
  201. exit 1
  202. fi
  203. [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
  204. trap err_out HUP TERM
  205. trap int_out INT
  206. config_foreach issue_cert cert
  207. exit 0