You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

323 lines
9.1 KiB

  1. #!/bin/sh
  2. # Wrapper for acme.sh to work on openwrt.
  3. #
  4. # This program is free software; you can redistribute it and/or modify it under
  5. # the terms of the GNU General Public License as published by the Free Software
  6. # Foundation; either version 3 of the License, or (at your option) any later
  7. # version.
  8. #
  9. # Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10. CHECK_CRON=$1
  11. ACME=/usr/lib/acme/acme.sh
  12. export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
  13. export NO_TIMESTAMP=1
  14. UHTTPD_LISTEN_HTTP=
  15. STATE_DIR='/etc/acme'
  16. ACCOUNT_EMAIL=
  17. DEBUG=0
  18. NGINX_WEBSERVER=0
  19. UPDATE_NGINX=0
  20. UPDATE_UHTTPD=0
  21. . /lib/functions.sh
  22. check_cron()
  23. {
  24. [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
  25. echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
  26. /etc/init.d/cron start
  27. }
  28. log()
  29. {
  30. logger -t acme -s -p daemon.info -- "$@"
  31. }
  32. err()
  33. {
  34. logger -t acme -s -p daemon.err -- "$@"
  35. }
  36. debug()
  37. {
  38. [ "$DEBUG" -eq "1" ] && logger -t acme -s -p daemon.debug -- "$@"
  39. }
  40. get_listeners() {
  41. local proto rq sq listen remote state program
  42. netstat -nptl 2>/dev/null | while read proto rq sq listen remote state program; do
  43. case "$proto#$listen#$program" in
  44. tcp#*:80#[0-9]*/*) echo -n "${program%% *} " ;;
  45. esac
  46. done
  47. }
  48. run_acme()
  49. {
  50. debug "Running acme.sh as '$ACME $@'"
  51. $ACME "$@"
  52. }
  53. pre_checks()
  54. {
  55. main_domain="$1"
  56. log "Running pre checks for $main_domain."
  57. listeners="$(get_listeners)"
  58. debug "port80 listens: $listeners"
  59. for listener in $(get_listeners); do
  60. pid="${listener%/*}"
  61. cmd="${listener#*/}"
  62. case "$cmd" in
  63. uhttpd)
  64. debug "Found uhttpd listening on port 80; trying to disable."
  65. UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
  66. if [ -z "$UHTTPD_LISTEN_HTTP" ]; then
  67. err "$main_domain: Unable to find uhttpd listen config."
  68. err "Manually disable uhttpd or set webroot to continue."
  69. return 1
  70. fi
  71. uci set uhttpd.main.listen_http=''
  72. uci commit uhttpd || return 1
  73. if ! /etc/init.d/uhttpd reload ; then
  74. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  75. uci commit uhttpd
  76. return 1
  77. fi
  78. ;;
  79. nginx*)
  80. debug "Found nginx listening on port 80; trying to disable."
  81. NGINX_WEBSERVER=1
  82. local tries=0
  83. while grep -sq "$cmd" "/proc/$pid/cmdline" && kill -0 "$pid"; do
  84. /etc/init.d/nginx stop
  85. if [ $tries -gt 10 ]; then
  86. debug "Can't stop nginx. Terminating script."
  87. return 1
  88. fi
  89. debug "Waiting for nginx to stop..."
  90. tries=$((tries + 1))
  91. sleep 1
  92. done
  93. ;;
  94. "")
  95. debug "Nothing listening on port 80."
  96. ;;
  97. *)
  98. err "$main_domain: Cannot run in standalone mode; another daemon is listening on port 80."
  99. err "Disable other daemon or set webroot to continue."
  100. return 1
  101. ;;
  102. esac
  103. done
  104. iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  105. ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  106. debug "v4 input_rule: $(iptables -nvL input_rule)"
  107. debug "v6 input_rule: $(ip6tables -nvL input_rule)"
  108. return 0
  109. }
  110. post_checks()
  111. {
  112. log "Running post checks (cleanup)."
  113. # The comment ensures we only touch our own rules. If no rules exist, that
  114. # is fine, so hide any errors
  115. iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  116. ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  117. if [ -e /etc/init.d/uhttpd ] && ( [ -n "$UHTTPD_LISTEN_HTTP" ] || [ "$UPDATE_UHTTPD" -eq 1 ] ); then
  118. if [ -n "$UHTTPD_LISTEN_HTTP" ]; then
  119. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  120. UHTTPD_LISTEN_HTTP=
  121. fi
  122. uci commit uhttpd
  123. /etc/init.d/uhttpd reload
  124. fi
  125. if [ -e /etc/init.d/nginx ] && ( [ "$NGINX_WEBSERVER" -eq 1 ] || [ "$UPDATE_NGINX" -eq 1 ] ); then
  126. NGINX_WEBSERVER=0
  127. /etc/init.d/nginx restart
  128. fi
  129. }
  130. err_out()
  131. {
  132. post_checks
  133. exit 1
  134. }
  135. int_out()
  136. {
  137. post_checks
  138. trap - INT
  139. kill -INT $$
  140. }
  141. is_staging()
  142. {
  143. local main_domain
  144. local domain_dir
  145. main_domain="$1"
  146. domain_dir="$2"
  147. grep -q "acme-staging" "${domain_dir}/${main_domain}.conf"
  148. return $?
  149. }
  150. issue_cert()
  151. {
  152. local section="$1"
  153. local acme_args=
  154. local enabled
  155. local use_staging
  156. local update_uhttpd
  157. local update_nginx
  158. local keylength
  159. local keylength_ecc=0
  160. local domains
  161. local main_domain
  162. local moved_staging=0
  163. local failed_dir
  164. local webroot
  165. local dns
  166. local ret
  167. local domain_dir
  168. config_get_bool enabled "$section" enabled 0
  169. config_get_bool use_staging "$section" use_staging
  170. config_get_bool update_uhttpd "$section" update_uhttpd
  171. config_get_bool update_nginx "$section" update_nginx
  172. config_get domains "$section" domains
  173. config_get keylength "$section" keylength
  174. config_get webroot "$section" webroot
  175. config_get dns "$section" dns
  176. UPDATE_NGINX=$update_nginx
  177. UPDATE_UHTTPD=$update_uhttpd
  178. [ "$enabled" -eq "1" ] || return
  179. [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
  180. set -- $domains
  181. main_domain=$1
  182. [ -n "$webroot" ] || [ -n "$dns" ] || pre_checks "$main_domain" || return 1
  183. if echo $keylength | grep -q "^ec-"; then
  184. domain_dir="$STATE_DIR/${main_domain}_ecc"
  185. keylength_ecc=1
  186. else
  187. domain_dir="$STATE_DIR/${main_domain}"
  188. fi
  189. log "Running ACME for $main_domain"
  190. handle_credentials() {
  191. local credential="$1"
  192. eval export $credential
  193. }
  194. config_list_foreach "$section" credentials handle_credentials
  195. if [ -e "$domain_dir" ]; then
  196. if [ "$use_staging" -eq "0" ] && is_staging "$main_domain" "$domain_dir"; then
  197. log "Found previous cert issued using staging server. Moving it out of the way."
  198. mv "$domain_dir" "${domain_dir}.staging"
  199. moved_staging=1
  200. else
  201. log "Found previous cert config. Issuing renew."
  202. [ "$keylength_ecc" -eq "1" ] && acme_args="$acme_args --ecc"
  203. run_acme --home "$STATE_DIR" --renew -d "$main_domain" $acme_args && ret=0 || ret=1
  204. post_checks
  205. return $ret
  206. fi
  207. fi
  208. acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
  209. acme_args="$acme_args --keylength $keylength"
  210. [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
  211. [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
  212. if [ -n "$dns" ]; then
  213. log "Using dns mode"
  214. acme_args="$acme_args --dns $dns"
  215. elif [ -z "$webroot" ]; then
  216. log "Using standalone mode"
  217. acme_args="$acme_args --standalone --listen-v6"
  218. else
  219. if [ ! -d "$webroot" ]; then
  220. err "$main_domain: Webroot dir '$webroot' does not exist!"
  221. post_checks
  222. return 1
  223. fi
  224. log "Using webroot dir: $webroot"
  225. acme_args="$acme_args --webroot $webroot"
  226. fi
  227. if ! run_acme --home "$STATE_DIR" --issue $acme_args; then
  228. failed_dir="${domain_dir}.failed-$(date +%s)"
  229. err "Issuing cert for $main_domain failed. Moving state to $failed_dir"
  230. [ -d "$domain_dir" ] && mv "$domain_dir" "$failed_dir"
  231. if [ "$moved_staging" -eq "1" ]; then
  232. err "Restoring staging certificate"
  233. mv "${domain_dir}.staging" "${domain_dir}"
  234. fi
  235. post_checks
  236. return 1
  237. fi
  238. if [ -e /etc/init.d/uhttpd ] && [ "$update_uhttpd" -eq "1" ]; then
  239. uci set uhttpd.main.key="${domain_dir}/${main_domain}.key"
  240. uci set uhttpd.main.cert="${domain_dir}/fullchain.cer"
  241. # commit and reload is in post_checks
  242. fi
  243. if [ -e /etc/init.d/nginx ] && [ "$update_nginx" -eq "1" ]; then
  244. sed -i "s#ssl_certificate\ .*#ssl_certificate ${domain_dir}/fullchain.cer;#g" /etc/nginx/nginx.conf
  245. sed -i "s#ssl_certificate_key\ .*#ssl_certificate_key ${domain_dir}/${main_domain}.key;#g" /etc/nginx/nginx.conf
  246. # commit and reload is in post_checks
  247. fi
  248. post_checks
  249. }
  250. load_vars()
  251. {
  252. local section="$1"
  253. STATE_DIR=$(config_get "$section" state_dir)
  254. ACCOUNT_EMAIL=$(config_get "$section" account_email)
  255. DEBUG=$(config_get "$section" debug)
  256. }
  257. check_cron
  258. [ -n "$CHECK_CRON" ] && exit 0
  259. [ -e "/var/run/acme_boot" ] && rm -f "/var/run/acme_boot" && exit 0
  260. config_load acme
  261. config_foreach load_vars acme
  262. if [ -z "$STATE_DIR" ] || [ -z "$ACCOUNT_EMAIL" ]; then
  263. err "state_dir and account_email must be set"
  264. exit 1
  265. fi
  266. [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
  267. trap err_out HUP TERM
  268. trap int_out INT
  269. config_foreach issue_cert cert
  270. exit 0