You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

410 lines
12 KiB

  1. #!/bin/sh
  2. # Wrapper for uacme to work on openwrt.
  3. #
  4. # This program is free software; you can redistribute it and/or modify it under
  5. # the terms of the GNU General Public License as published by the Free Software
  6. # Foundation; either version 3 of the License, or (at your option) any later
  7. # version.
  8. #
  9. # Initial Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10. # Adapted for uacme: Lucian Cristian <lucian.cristian@gmail.com>
  11. CHECK_CRON=$1
  12. #check for installed packages, for now, support only one
  13. if [ -e "/usr/lib/acme/acme.sh" ]; then
  14. ACME=/usr/lib/acme/acme.sh
  15. APP=acme
  16. elif [ -e "/usr/sbin/uacme" ]; then
  17. ACME=/usr/sbin/uacme
  18. HPROGRAM=/usr/share/uacme/uacme.sh
  19. APP=uacme
  20. else
  21. echo "Please install ACME or uACME package"
  22. return 1
  23. fi
  24. export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
  25. export NO_TIMESTAMP=1
  26. UHTTPD_LISTEN_HTTP=
  27. STATE_DIR='/etc/acme'
  28. STAGING_STATE_DIR='/etc/acme/staging'
  29. ACCOUNT_EMAIL=
  30. DEBUG=0
  31. NGINX_WEBSERVER=0
  32. UPDATE_NGINX=0
  33. UPDATE_UHTTPD=0
  34. UPDATE_HAPROXY=0
  35. USER_CLEANUP=
  36. . /lib/functions.sh
  37. check_cron()
  38. {
  39. [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
  40. echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
  41. /etc/init.d/cron start
  42. }
  43. log()
  44. {
  45. logger -t $APP -s -p daemon.info "$@"
  46. }
  47. err()
  48. {
  49. logger -t $APP -s -p daemon.err "$@"
  50. }
  51. debug()
  52. {
  53. [ "$DEBUG" -eq "1" ] && logger -t $APP -s -p daemon.debug "$@"
  54. }
  55. get_listeners() {
  56. local proto rq sq listen remote state program
  57. netstat -nptl 2>/dev/null | while read proto listen program; do
  58. case "$proto#$listen#$program" in
  59. tcp#*:80#[0-9]*/*) echo -n "${program%% *} " ;;
  60. esac
  61. done
  62. }
  63. pre_checks()
  64. {
  65. main_domain="$1"
  66. log "Running pre checks for $main_domain."
  67. listeners="$(get_listeners)"
  68. debug "port80 listens: $listeners"
  69. for listener in $(get_listeners); do
  70. pid="${listener%/*}"
  71. cmd="${listener#*/}"
  72. case "$cmd" in
  73. uhttpd)
  74. debug "Found uhttpd listening on port 80"
  75. if [ "$APP" = "acme" ]; then
  76. UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
  77. if [ -z "$UHTTPD_LISTEN_HTTP" ]; then
  78. err "$main_domain: Unable to find uhttpd listen config."
  79. err "Manually disable uhttpd or set webroot to continue."
  80. return 1
  81. fi
  82. uci set uhttpd.main.listen_http=''
  83. uci commit uhttpd || return 1
  84. if ! /etc/init.d/uhttpd reload ; then
  85. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  86. uci commit uhttpd
  87. return 1
  88. fi
  89. fi
  90. ;;
  91. nginx*)
  92. debug "Found nginx listening on port 80"
  93. NGINX_WEBSERVER=1
  94. if [ "$APP" = "acme" ]; then
  95. local tries=0
  96. while grep -sq "$cmd" "/proc/$pid/cmdline" && kill -0 "$pid"; do
  97. /etc/init.d/nginx stop
  98. if [ $tries -gt 10 ]; then
  99. debug "Can't stop nginx. Terminating script."
  100. return 1
  101. fi
  102. debug "Waiting for nginx to stop..."
  103. tries=$((tries + 1))
  104. sleep 1
  105. done
  106. fi
  107. ;;
  108. "")
  109. err "Nothing listening on port 80."
  110. err "Standalone mode not supported, setup uhttpd or nginx"
  111. return 1
  112. ;;
  113. *)
  114. err "$main_domain: unsupported (apache/haproxy?) daemon is listening on port 80."
  115. err "if webroot is set on your current webserver comment line 132 (return 1) from this script."
  116. return 1
  117. ;;
  118. esac
  119. done
  120. iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  121. debug "v4 input_rule: $(iptables -nvL input_rule)"
  122. if [ -e "/usr/sbin/ip6tables" ]; then
  123. ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
  124. debug "v6 input_rule: $(ip6tables -nvL input_rule)"
  125. fi
  126. return 0
  127. }
  128. post_checks()
  129. {
  130. log "Running post checks (cleanup)."
  131. # The comment ensures we only touch our own rules. If no rules exist, that
  132. # is fine, so hide any errors
  133. iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  134. if [ -e "/usr/sbin/ip6tables" ]; then
  135. ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
  136. fi
  137. if [ -e /etc/init.d/uhttpd ] && [ "$UPDATE_UHTTPD" -eq 1 ]; then
  138. uci commit uhttpd
  139. /etc/init.d/uhttpd reload
  140. log "Restarting uhttpd..."
  141. fi
  142. if [ -e /etc/init.d/nginx ] && ( [ "$NGINX_WEBSERVER" -eq 1 ] || [ "$UPDATE_NGINX" -eq 1 ]; ); then
  143. NGINX_WEBSERVER=0
  144. /etc/init.d/nginx restart
  145. log "Restarting nginx..."
  146. fi
  147. if [ -e /etc/init.d/haproxy ] && [ "$UPDATE_HAPROXY" -eq 1 ]; then
  148. /etc/init.d/haproxy restart
  149. log "Restarting haproxy..."
  150. fi
  151. if [ -n "$USER_CLEANUP" ] && [ -f "$USER_CLEANUP" ]; then
  152. log "Running user-provided cleanup script from $USER_CLEANUP."
  153. "$USER_CLEANUP" || return 1
  154. fi
  155. }
  156. err_out()
  157. {
  158. post_checks
  159. exit 1
  160. }
  161. int_out()
  162. {
  163. post_checks
  164. trap - INT
  165. kill -INT $$
  166. }
  167. is_staging()
  168. {
  169. local main_domain="$1"
  170. grep -q "acme-staging" "$STATE_DIR/$main_domain/${main_domain}.conf"
  171. return $?
  172. }
  173. issue_cert()
  174. {
  175. local section="$1"
  176. local acme_args=
  177. local debug=
  178. local enabled
  179. local use_staging
  180. local update_uhttpd
  181. local update_nginx
  182. local update_haproxy
  183. local keylength
  184. local domains
  185. local main_domain
  186. local failed_dir
  187. local webroot
  188. local dns
  189. local user_setup
  190. local user_cleanup
  191. local ret
  192. local staging=
  193. local HOOK=
  194. config_get_bool enabled "$section" enabled 0
  195. config_get_bool use_staging "$section" use_staging
  196. config_get_bool update_uhttpd "$section" update_uhttpd
  197. config_get_bool update_nginx "$section" update_nginx
  198. config_get_bool update_haproxy "$section" update_haproxy
  199. config_get domains "$section" domains
  200. config_get keylength "$section" keylength
  201. config_get webroot "$section" webroot
  202. config_get dns "$section" dns
  203. config_get user_setup "$section" user_setup
  204. config_get user_cleanup "$section" user_cleanup
  205. UPDATE_NGINX=$update_nginx
  206. UPDATE_UHTTPD=$update_uhttpd
  207. UPDATE_HAPROXY=$update_haproxy
  208. USER_CLEANUP=$user_cleanup
  209. [ "$enabled" -eq "1" ] || return
  210. if [ "$APP" = "uacme" ]; then
  211. [ "$DEBUG" -eq "1" ] && debug="--verbose --verbose"
  212. elif [ "$APP" = "acme" ]; then
  213. [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
  214. fi
  215. [ "$use_staging" -eq "1" ] && STATE_DIR="$STAGING_STATE_DIR" && staging="--staging"
  216. set -- $domains
  217. main_domain=$1
  218. if [ -n "$user_setup" ] && [ -f "$user_setup" ]; then
  219. log "Running user-provided setup script from $user_setup."
  220. "$user_setup" "$main_domain" || return 1
  221. else
  222. [ -n "$webroot" ] || [ -n "$dns" ] || pre_checks "$main_domain" || return 1
  223. fi
  224. log "Running $APP for $main_domain"
  225. if [ "$APP" = "uacme" ]; then
  226. if [ ! -f "$STATE_DIR/private/key.pem" ]; then
  227. log "Create a new ACME account with email $ACCOUNT_EMAIL use staging=$use_staging"
  228. $ACME $debug --confdir "$STATE_DIR" $staging --yes new $ACCOUNT_EMAIL
  229. fi
  230. if [ -f "$STATE_DIR/$main_domain/cert.pem" ]; then
  231. log "Found previous cert config, use staging=$use_staging. Issuing renew."
  232. export CHALLENGE_PATH="$webroot"
  233. $ACME $debug --confdir "$STATE_DIR" $staging --never-create issue $domains --hook=$HPROGRAM && ret=0 || ret=1
  234. post_checks
  235. return $ret
  236. fi
  237. fi
  238. if [ "$APP" = "acme" ]; then
  239. handle_credentials() {
  240. local credential="$1"
  241. eval export "$credential"
  242. }
  243. config_list_foreach "$section" credentials handle_credentials
  244. if [ -e "$STATE_DIR/$main_domain" ]; then
  245. if [ "$use_staging" -eq "0" ] && is_staging "$main_domain"; then
  246. log "Found previous cert issued using staging server. Moving it out of the way."
  247. mv "$STATE_DIR/$main_domain" "$STATE_DIR/$main_domain.staging"
  248. else
  249. log "Found previous cert config. Issuing renew."
  250. $ACME --home "$STATE_DIR" --renew -d "$main_domain" "$acme_args" && ret=0 || ret=1
  251. post_checks
  252. return $ret
  253. fi
  254. fi
  255. fi
  256. acme_args="$acme_args --bits $keylength"
  257. acme_args="$acme_args $(for d in $domains; do echo -n " $d "; done)"
  258. if [ "$APP" = "acme" ]; then
  259. [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
  260. [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
  261. fi
  262. if [ -n "$dns" ]; then
  263. #TO-DO
  264. if [ "$APP" = "acme" ]; then
  265. log "Using dns mode"
  266. acme_args="$acme_args --dns $dns"
  267. else
  268. log "Using dns mode, dns-01 is not wrapped yet"
  269. return 1
  270. # uacme_args="$uacme_args --dns $dns"
  271. fi
  272. elif [ -z "$webroot" ]; then
  273. if [ "$APP" = "acme" ]; then
  274. log "Using standalone mode"
  275. acme_args="$acme_args --standalone --listen-v6"
  276. else
  277. log "Standalone not supported by $APP"
  278. return 1
  279. fi
  280. else
  281. if [ ! -d "$webroot" ]; then
  282. err "$main_domain: Webroot dir '$webroot' does not exist!"
  283. post_checks
  284. return 1
  285. fi
  286. log "Using webroot dir: $webroot"
  287. if [ "$APP" = "uacme" ]; then
  288. export CHALLENGE_PATH="$webroot"
  289. else
  290. acme_args="$acme_args --webroot $webroot"
  291. fi
  292. fi
  293. if [ "$APP" = "uacme" ]; then
  294. workdir="--confdir"
  295. HOOK="--hook=$HPROGRAM"
  296. else
  297. workdir="--home"
  298. fi
  299. if ! $ACME $debug $workdir "$STATE_DIR" $staging issue $acme_args $HOOK; then
  300. failed_dir="$STATE_DIR/${main_domain}.failed-$(date +%s)"
  301. err "Issuing cert for $main_domain failed. Moving state to $failed_dir"
  302. [ -d "$STATE_DIR/$main_domain" ] && mv "$STATE_DIR/$main_domain" "$failed_dir"
  303. [ -d "$STATE_DIR/private/$main_domain" ] && mv "$STATE_DIR/private/$main_domain" "$failed_dir"
  304. post_checks
  305. return 1
  306. fi
  307. if [ -e /etc/init.d/uhttpd ] && [ "$update_uhttpd" -eq "1" ]; then
  308. if [ "$APP" = "uacme" ]; then
  309. uci set uhttpd.main.key="$STATE_DIR/private/${main_domain}/key.pem"
  310. uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/cert.pem"
  311. else
  312. uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
  313. uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
  314. fi
  315. # commit and reload is in post_checks
  316. fi
  317. if [ -e /etc/init.d/nginx ] && [ "$update_nginx" -eq "1" ]; then
  318. if [ "$APP" = "uacme" ]; then
  319. sed -i "s#ssl_certificate\ .*#ssl_certificate $STATE_DIR/${main_domain}/cert.pem;#g" /etc/nginx/nginx.conf
  320. sed -i "s#ssl_certificate_key\ .*#ssl_certificate_key $STATE_DIR/private/${main_domain}/key.pem;#g" /etc/nginx/nginx.conf
  321. else
  322. sed -i "s#ssl_certificate\ .*#ssl_certificate $STATE_DIR/${main_domain}/fullchain.cer;#g" /etc/nginx/nginx.conf
  323. sed -i "s#ssl_certificate_key\ .*#ssl_certificate_key $STATE_DIR/${main_domain}/${main_domain}.key;#g" /etc/nginx/nginx.conf
  324. fi
  325. # commit and reload is in post_checks
  326. fi
  327. if [ -e /etc/init.d/haproxy ] && [ "$update_haproxy" -eq 1 ]; then
  328. if [ "$APP" = "uacme" ]; then
  329. cat $STATE_DIR/${main_domain}/cert.pem $STATE_DIR/private/${main_domain}/key.pem > $STATE_DIR/${main_domain}/full_haproxy.pem
  330. else
  331. cat $STATE_DIR/${main_domain}/fullchain.cer $STATE_DIR/${main_domain}/${main_domain}.key > $STATE_DIR/${main_domain}/full_haproxy.pem
  332. fi
  333. fi
  334. post_checks
  335. }
  336. load_vars()
  337. {
  338. local section="$1"
  339. STATE_DIR=$(config_get "$section" state_dir)
  340. STAGING_STATE_DIR=$STATE_DIR/staging
  341. ACCOUNT_EMAIL=$(config_get "$section" account_email)
  342. DEBUG=$(config_get "$section" debug)
  343. }
  344. check_cron
  345. [ -n "$CHECK_CRON" ] && exit 0
  346. [ -e "/var/run/acme_boot" ] && rm -f "/var/run/acme_boot" && exit 0
  347. config_load acme
  348. config_foreach load_vars acme
  349. if [ -z "$STATE_DIR" ] || [ -z "$ACCOUNT_EMAIL" ]; then
  350. err "state_dir and account_email must be set"
  351. exit 1
  352. fi
  353. [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
  354. [ -d "$STAGING_STATE_DIR" ] || mkdir -p "$STAGING_STATE_DIR"
  355. trap err_out HUP TERM
  356. trap int_out INT
  357. config_foreach issue_cert cert
  358. exit 0