Skip to content

Commit fc7f861

Browse files
NeilpangNeilpang
authored
Merge pull request #5290 from acmesh-official/dev
sync
2 parents fb27261 + d057a9b commit fc7f861

File tree

8 files changed

+190
-44
lines changed

8 files changed

+190
-44
lines changed

‎acme.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env sh
22

3-
VER=3.0.8
3+
VER=3.0.9
44

55
PROJECT_NAME="acme.sh"
66

@@ -2361,7 +2361,7 @@ _clear_conf() {
23612361
_sdkey="$2"
23622362
if [ "$_c_c_f" ]; then
23632363
_conf_data="$(cat "$_c_c_f")"
2364-
echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
2364+
echo "$_conf_data" | sed "/^$_sdkey *=.*$/d" >"$_c_c_f"
23652365
else
23662366
_err "Config file is empty, cannot clear"
23672367
fi

‎deploy/synology_dsm.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,9 @@ synology_dsm_deploy() {
113113

114114
# Default values for scheme, hostname and port
115115
# Defaulting to localhost and http, because it's localhost…
116-
[ -n "$SYNO_SCHEME" ] || SYNO_SCHEME="http"
117-
[ -n "$SYNO_HOSTNAME" ] || SYNO_HOSTNAME="localhost"
118-
[ -n "$SYNO_PORT" ] || SYNO_PORT="5000"
116+
[ -n "$SYNO_SCHEME" ] || SYNO_SCHEME=http
117+
[ -n "$SYNO_HOSTNAME" ] || SYNO_HOSTNAME=localhost
118+
[ -n "$SYNO_PORT" ] || SYNO_PORT=5000
119119
_savedeployconf SYNO_SCHEME "$SYNO_SCHEME"
120120
_savedeployconf SYNO_HOSTNAME "$SYNO_HOSTNAME"
121121
_savedeployconf SYNO_PORT "$SYNO_PORT"

‎deploy/unifi.sh

+68-16
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@
55
# - self-hosted Unifi Controller
66
# - Unifi Cloud Key (Gen1/2/2+)
77
# - Unifi Cloud Key running UnifiOS (v2.0.0+, Gen2/2+ only)
8+
# - Unifi Dream Machine
9+
# This has not been tested on other "all-in-one" devices such as
10+
# UDM Pro or Unifi Express.
11+
#
12+
# OS Version v2.0.0+
13+
# Network Application version 7.0.0+
14+
# OS version ~3.1 removed java and keytool from the UnifiOS.
15+
# Using PKCS12 format keystore appears to work fine.
16+
#
817
# Please report bugs to https://github.com/acmesh-official/acme.sh/issues/3359
918

1019
#returns 0 means success, otherwise error.
@@ -74,14 +83,16 @@ unifi_deploy() {
7483
_reload_cmd=""
7584

7685
# Unifi Controller environment (self hosted or any Cloud Key) --
77-
# auto-detect by file /usr/lib/unifi/data/keystore:
86+
# auto-detect by file /usr/lib/unifi/data/keystore
7887
_unifi_keystore="${DEPLOY_UNIFI_KEYSTORE:-/usr/lib/unifi/data/keystore}"
7988
if [ -f "$_unifi_keystore" ]; then
80-
_info "Installing certificate for Unifi Controller (Java keystore)"
8189
_debug _unifi_keystore "$_unifi_keystore"
8290
if ! _exists keytool; then
83-
_err "keytool not found"
84-
return 1
91+
_do_keytool=0
92+
_info "Installing certificate for Unifi Controller (PKCS12 keystore)."
93+
else
94+
_do_keytool=1
95+
_info "Installing certificate for Unifi Controller (Java keystore)"
8596
fi
8697
if [ ! -w "$_unifi_keystore" ]; then
8798
_err "The file $_unifi_keystore is not writable, please change the permission."
@@ -92,29 +103,65 @@ unifi_deploy() {
92103

93104
_debug "Generate import pkcs12"
94105
_import_pkcs12="$(_mktemp)"
106+
_debug "_toPkcs $_import_pkcs12 $_ckey $_ccert $_cca $_unifi_keypass unifi root"
95107
_toPkcs "$_import_pkcs12" "$_ckey" "$_ccert" "$_cca" "$_unifi_keypass" unifi root
96108
# shellcheck disable=SC2181
97109
if [ "$?" != "0" ]; then
98110
_err "Error generating pkcs12. Please re-run with --debug and report a bug."
99111
return 1
100112
fi
101113

102-
_debug "Import into keystore: $_unifi_keystore"
103-
if keytool -importkeystore \
104-
-deststorepass "$_unifi_keypass" -destkeypass "$_unifi_keypass" -destkeystore "$_unifi_keystore" \
105-
-srckeystore "$_import_pkcs12" -srcstoretype PKCS12 -srcstorepass "$_unifi_keypass" \
106-
-alias unifi -noprompt; then
107-
_debug "Import keystore success!"
108-
rm "$_import_pkcs12"
114+
# Save the existing keystore in case something goes wrong.
115+
mv -f "${_unifi_keystore}" "${_unifi_keystore}"_original
116+
_info "Previous keystore saved to ${_unifi_keystore}_original."
117+
118+
if [ "$_do_keytool" -eq 1 ]; then
119+
_debug "Import into keystore: $_unifi_keystore"
120+
if keytool -importkeystore \
121+
-deststorepass "$_unifi_keypass" -destkeypass "$_unifi_keypass" -destkeystore "$_unifi_keystore" \
122+
-srckeystore "$_import_pkcs12" -srcstoretype PKCS12 -srcstorepass "$_unifi_keypass" \
123+
-alias unifi -noprompt; then
124+
_debug "Import keystore success!"
125+
else
126+
_err "Error importing into Unifi Java keystore."
127+
_err "Please re-run with --debug and report a bug."
128+
_info "Restoring original keystore."
129+
mv -f "${_unifi_keystore}"_original "${_unifi_keystore}"
130+
rm "$_import_pkcs12"
131+
return 1
132+
fi
109133
else
110-
_err "Error importing into Unifi Java keystore."
111-
_err "Please re-run with --debug and report a bug."
112-
rm "$_import_pkcs12"
113-
return 1
134+
_debug "Copying new keystore to $_unifi_keystore"
135+
cp -f "$_import_pkcs12" "$_unifi_keystore"
136+
fi
137+
138+
# Update unifi service for certificate cipher compatibility
139+
if ${ACME_OPENSSL_BIN:-openssl} pkcs12 \
140+
-in "$_import_pkcs12" \
141+
-password pass:aircontrolenterprise \
142+
-nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
143+
-noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
144+
cp -f /usr/lib/unifi/data/system.properties /usr/lib/unifi/data/system.properties_original
145+
_info "Updating system configuration for cipher compatibility."
146+
_info "Saved original system config to /usr/lib/unifi/data/system.properties_original"
147+
sed -i '/unifi\.https\.ciphers/d' /usr/lib/unifi/data/system.properties
148+
echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>/usr/lib/unifi/data/system.properties
149+
sed -i '/unifi\.https\.sslEnabledProtocols/d' /usr/lib/unifi/data/system.properties
150+
echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>/usr/lib/unifi/data/system.properties
151+
_info "System configuration updated."
114152
fi
115153

154+
rm "$_import_pkcs12"
155+
156+
# Restarting unifi-core will bring up unifi, doing it out of order results in
157+
# a certificate error, and breaks wifiman.
158+
# Restart if we aren't doing unifi-core, otherwise stop for later restart.
116159
if systemctl -q is-active unifi; then
117-
_reload_cmd="${_reload_cmd:+$_reload_cmd && }service unifi restart"
160+
if [ ! -f "${DEPLOY_UNIFI_CORE_CONFIG:-/data/unifi-core/config}/unifi-core.key" ]; then
161+
_reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl restart unifi"
162+
else
163+
_reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl stop unifi"
164+
fi
118165
fi
119166
_services_updated="${_services_updated} unifi"
120167
_info "Install Unifi Controller certificate success!"
@@ -165,6 +212,11 @@ unifi_deploy() {
165212
return 1
166213
fi
167214

215+
# Save the existing certs in case something goes wrong.
216+
cp -f "${_unifi_core_config}"/unifi-core.crt "${_unifi_core_config}"/unifi-core_original.crt
217+
cp -f "${_unifi_core_config}"/unifi-core.key "${_unifi_core_config}"/unifi-core_original.key
218+
_info "Previous certificate and key saved to ${_unifi_core_config}/unifi-core_original.crt/key."
219+
168220
cat "$_cfullchain" >"${_unifi_core_config}/unifi-core.crt"
169221
cat "$_ckey" >"${_unifi_core_config}/unifi-core.key"
170222

‎dnsapi/dns_dynv6.sh

+5-5
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ dynv6_api="https://dynv6.com/api/v2"
1616
# Please Read this guide first: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
1717
#Usage: dns_dynv6_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
1818
dns_dynv6_add() {
19-
fulldomain=$1
20-
txtvalue=$2
19+
fulldomain="$(echo "$1" | _lower_case)"
20+
txtvalue="$2"
2121
_info "Using dynv6 api"
2222
_debug fulldomain "$fulldomain"
2323
_debug txtvalue "$txtvalue"
@@ -50,8 +50,8 @@ dns_dynv6_add() {
5050
#Usage: fulldomain txtvalue
5151
#Remove the txt record after validation.
5252
dns_dynv6_rm() {
53-
fulldomain=$1
54-
txtvalue=$2
53+
fulldomain="$(echo "$1" | _lower_case)"
54+
txtvalue="$2"
5555
_info "Using dynv6 API"
5656
_debug fulldomain "$fulldomain"
5757
_debug txtvalue "$txtvalue"
@@ -206,7 +206,7 @@ _get_zone_id() {
206206
return 1
207207
fi
208208

209-
zone_id="$(echo "$response" | tr '}' '\n' | grep "$selected" | tr ',' '\n' | grep id | tr -d '"')"
209+
zone_id="$(echo "$response" | tr '}' '\n' | grep "$selected" | tr ',' '\n' | grep '"id":' | tr -d '"')"
210210
_zone_id="${zone_id#id:}"
211211
_debug "zone id: $_zone_id"
212212
}

‎dnsapi/dns_inwx.sh

+12-1
Original file line numberDiff line numberDiff line change
@@ -163,13 +163,24 @@ _inwx_check_cookie() {
163163
return 1
164164
}
165165

166+
_htmlEscape() {
167+
_s="$1"
168+
_s=$(echo "$_s" | sed "s/&/&/g")
169+
_s=$(echo "$_s" | sed "s/</\&lt;/g")
170+
_s=$(echo "$_s" | sed "s/>/\&gt;/g")
171+
_s=$(echo "$_s" | sed 's/"/\&quot;/g')
172+
printf -- %s "$_s"
173+
}
174+
166175
_inwx_login() {
167176

168177
if _inwx_check_cookie; then
169178
_debug "Already logged in"
170179
return 0
171180
fi
172181

182+
XML_PASS=$(_htmlEscape "$INWX_Password")
183+
173184
xml_content=$(printf '<?xml version="1.0" encoding="UTF-8"?>
174185
<methodCall>
175186
<methodName>account.login</methodName>
@@ -193,7 +204,7 @@ _inwx_login() {
193204
</value>
194205
</param>
195206
</params>
196-
</methodCall>' "$INWX_User" "$INWX_Password")
207+
</methodCall>' "$INWX_User" "$XML_PASS")
197208

198209
response="$(_post "$xml_content" "$INWX_Api" "" "POST")"
199210

‎dnsapi/dns_ispconfig.sh

+2
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ Options:
1414
# User must provide login data and URL to the ISPConfig installation incl. port.
1515
# The remote user in ISPConfig must have access to:
1616
# - DNS txt Functions
17+
# - DNS zone functions
18+
# - Client functions
1719

1820
######## Public functions #####################
1921

‎dnsapi/dns_nsupdate.sh

+8-4
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,15 @@ dns_nsupdate_add() {
3939
[ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
4040
[ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
4141
if [ -z "${NSUPDATE_ZONE}" ]; then
42-
nsupdate -k "${NSUPDATE_KEY}" $nsdebug "${NSUPDATE_OPT}" <<EOF
42+
#shellcheck disable=SC2086
43+
nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
4344
server ${NSUPDATE_SERVER} ${NSUPDATE_SERVER_PORT}
4445
update add ${fulldomain}. 60 in txt "${txtvalue}"
4546
send
4647
EOF
4748
else
48-
nsupdate -k "${NSUPDATE_KEY}" $nsdebug "${NSUPDATE_OPT}" <<EOF
49+
#shellcheck disable=SC2086
50+
nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
4951
server ${NSUPDATE_SERVER} ${NSUPDATE_SERVER_PORT}
5052
zone ${NSUPDATE_ZONE}.
5153
update add ${fulldomain}. 60 in txt "${txtvalue}"
@@ -77,13 +79,15 @@ dns_nsupdate_rm() {
7779
[ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
7880
[ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
7981
if [ -z "${NSUPDATE_ZONE}" ]; then
80-
nsupdate -k "${NSUPDATE_KEY}" $nsdebug "${NSUPDATE_OPT}" <<EOF
82+
#shellcheck disable=SC2086
83+
nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
8184
server ${NSUPDATE_SERVER} ${NSUPDATE_SERVER_PORT}
8285
update delete ${fulldomain}. txt
8386
send
8487
EOF
8588
else
86-
nsupdate -k "${NSUPDATE_KEY}" $nsdebug "${NSUPDATE_OPT}" <<EOF
89+
#shellcheck disable=SC2086
90+
nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
8791
server ${NSUPDATE_SERVER} ${NSUPDATE_SERVER_PORT}
8892
zone ${NSUPDATE_ZONE}.
8993
update delete ${fulldomain}. txt

0 commit comments

Comments
 (0)