forked from TrueCloudLab/lego
Add Dyn DNS provider
This commit adds support for Dyn, specifically Dyn Managed DNS. Makes
use of the Dyn REST API [1] and requires 3 environment variables for
credentails:
DYN_CUSTOMER_NAME
DYN_USER_NAME
DYN_PASSWORD
The Dyn DNS API requires a session to be established first using the
credentials above, After creating a session an api token is used for
subsequent requests.
The unit test performs a "live test" and currently requires a valid Dyn
account and domain.
[1] https://help.dyn.com/rest/
This commit is contained in:
Andrew E. Bruno
parent
9ba0eda945
commit
b90b31980a
4 changed files with 300 additions and 0 deletions
|
|
@ -102,6 +102,7 @@ GLOBAL OPTIONS:
|
|||
namecheap: NAMECHEAP_API_USER, NAMECHEAP_API_KEY
|
||||
route53: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION
|
||||
rfc2136: RFC2136_TSIG_KEY, RFC2136_TSIG_SECRET, RFC2136_TSIG_ALGORITHM, RFC2136_NAMESERVER
|
||||
dyn: DYN_CUSTOMER_NAME, DYN_USER_NAME, DYN_PASSWORD
|
||||
manual: none
|
||||
--help, -h show help
|
||||
--version, -v print the version
|
||||
|
|
|
|||
240
acme/dns_challenge_dyn.go
Normal file
240
acme/dns_challenge_dyn.go
Normal file
|
|
@ -0,0 +1,240 @@
|
|||
package acme
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strconv"
|
||||
)
|
||||
|
||||
var dynBaseURL = "https://api.dynect.net/REST"
|
||||
|
||||
type DynResponse struct {
|
||||
// One of 'success', 'failure', or 'incomplete'
|
||||
Status string `json:"status"`
|
||||
|
||||
// The structure containing the actual results of the request
|
||||
Data json.RawMessage `json:"data"`
|
||||
|
||||
// The ID of the job that was created in response to a request.
|
||||
JobId int `json:"job_id"`
|
||||
|
||||
// A list of zero or more messages
|
||||
Messages json.RawMessage `json:"msgs"`
|
||||
}
|
||||
|
||||
// DNSProviderDyn is an implementation of the DNSProvider interface that uses
|
||||
// Dyn's Managed DNS API to manage TXT records for a domain.
|
||||
type DNSProviderDyn struct {
|
||||
customerName string
|
||||
userName string
|
||||
password string
|
||||
token string
|
||||
}
|
||||
|
||||
// NewDNSProviderDyn returns a new DNSProviderDyn instance. customerName is
|
||||
// the customer name of the Dyn account. userName is the user name. password is
|
||||
// the password.
|
||||
func NewDNSProviderDyn(customerName, userName, password string) (*DNSProviderDyn, error) {
|
||||
return &DNSProviderDyn{
|
||||
customerName: customerName,
|
||||
userName: userName,
|
||||
password: password,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (d *DNSProviderDyn) sendRequest(method, resource string, payload interface{}) (*DynResponse, error) {
|
||||
url := fmt.Sprintf("%s/%s", dynBaseURL, resource)
|
||||
|
||||
body, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
req, err := http.NewRequest(method, url, bytes.NewReader(body))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
if len(d.token) > 0 {
|
||||
req.Header.Set("Auth-Token", d.token)
|
||||
}
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode >= 400 {
|
||||
return nil, fmt.Errorf("Dyn API request failed with HTTP status code %d", resp.StatusCode)
|
||||
} else if resp.StatusCode == 307 {
|
||||
// TODO add support for HTTP 307 response and long running jobs
|
||||
return nil, fmt.Errorf("Dyn API request returned HTTP 307. This is currently unsupported")
|
||||
}
|
||||
|
||||
var dynRes DynResponse
|
||||
err = json.NewDecoder(resp.Body).Decode(&dynRes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if dynRes.Status == "failure" {
|
||||
// TODO add better error handling
|
||||
return nil, fmt.Errorf("Dyn API request failed: %s", dynRes.Messages)
|
||||
}
|
||||
|
||||
return &dynRes, nil
|
||||
}
|
||||
|
||||
// Starts a new Dyn API Session. Authenticates using customerName, userName,
|
||||
// password and receives a token to be used in for subsequent requests.
|
||||
func (d *DNSProviderDyn) login() error {
|
||||
type creds struct {
|
||||
Customer string `json:"customer_name"`
|
||||
User string `json:"user_name"`
|
||||
Pass string `json:"password"`
|
||||
}
|
||||
|
||||
type session struct {
|
||||
Token string `json:"token"`
|
||||
Version string `json:"version"`
|
||||
}
|
||||
|
||||
payload := &creds{Customer: d.customerName, User: d.userName, Pass: d.password}
|
||||
dynRes, err := d.sendRequest("POST", "Session", payload)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var s session
|
||||
err = json.Unmarshal(dynRes.Data, &s)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
d.token = s.Token
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Destroys Dyn Session
|
||||
func (d *DNSProviderDyn) logout() error {
|
||||
if len(d.token) == 0 {
|
||||
// nothing to do
|
||||
return nil
|
||||
}
|
||||
|
||||
url := fmt.Sprintf("%s/Session", dynBaseURL)
|
||||
req, err := http.NewRequest("DELETE", url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Auth-Token", d.token)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != 200 {
|
||||
return fmt.Errorf("Dyn API request failed to delete session with HTTP status code %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
d.token = ""
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Present creates a TXT record using the specified parameters
|
||||
func (d *DNSProviderDyn) Present(domain, token, keyAuth string) error {
|
||||
err := d.login()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
fqdn, value, ttl := DNS01Record(domain, keyAuth)
|
||||
|
||||
data := map[string]interface{}{
|
||||
"rdata": map[string]string{
|
||||
"txtdata": value,
|
||||
},
|
||||
"ttl": strconv.Itoa(ttl),
|
||||
}
|
||||
|
||||
resource := fmt.Sprintf("TXTRecord/%s/%s/", domain, fqdn)
|
||||
_, err = d.sendRequest("POST", resource, data)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = d.publish(domain, "Added TXT record for ACME dns-01 challenge using lego client")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = d.logout()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (d *DNSProviderDyn) publish(domain, notes string) error {
|
||||
type publish struct {
|
||||
Publish bool `json:"publish"`
|
||||
Notes string `json:"notes"`
|
||||
}
|
||||
|
||||
pub := &publish{Publish: true, Notes: notes}
|
||||
resource := fmt.Sprintf("Zone/%s/", domain)
|
||||
_, err := d.sendRequest("PUT", resource, pub)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// CleanUp removes the TXT record matching the specified parameters
|
||||
func (d *DNSProviderDyn) CleanUp(domain, token, keyAuth string) error {
|
||||
err := d.login()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
fqdn, _, _ := DNS01Record(domain, keyAuth)
|
||||
|
||||
resource := fmt.Sprintf("TXTRecord/%s/%s/", domain, fqdn)
|
||||
url := fmt.Sprintf("%s/%s", dynBaseURL, resource)
|
||||
req, err := http.NewRequest("DELETE", url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Auth-Token", d.token)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != 200 {
|
||||
return fmt.Errorf("Dyn API request failed to delete TXT record HTTP status code %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
err = d.publish(domain, "Removed TXT record for ACME dns-01 challenge using lego client")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = d.logout()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
53
acme/dns_challenge_dyn_test.go
Normal file
53
acme/dns_challenge_dyn_test.go
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
package acme
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
var (
|
||||
dynLiveTest bool
|
||||
dynCustomerName string
|
||||
dynUserName string
|
||||
dynPassword string
|
||||
dynDomain string
|
||||
)
|
||||
|
||||
func init() {
|
||||
dynCustomerName = os.Getenv("DYN_CUSTOMER_NAME")
|
||||
dynUserName = os.Getenv("DYN_USER_NAME")
|
||||
dynPassword = os.Getenv("DYN_PASSWORD")
|
||||
dynDomain = os.Getenv("DYN_DOMAIN")
|
||||
if len(dynCustomerName) > 0 && len(dynUserName) > 0 && len(dynPassword) > 0 && len(dynDomain) > 0 {
|
||||
dynLiveTest = true
|
||||
}
|
||||
}
|
||||
|
||||
func TestLiveDynPresent(t *testing.T) {
|
||||
if !dynLiveTest {
|
||||
t.Skip("skipping live test")
|
||||
}
|
||||
|
||||
provider, err := NewDNSProviderDyn(dynCustomerName, dynUserName, dynPassword)
|
||||
assert.NoError(t, err)
|
||||
|
||||
err = provider.Present(dynDomain, "", "123d==")
|
||||
assert.NoError(t, err)
|
||||
}
|
||||
|
||||
func TestLiveDynCleanUp(t *testing.T) {
|
||||
if !dynLiveTest {
|
||||
t.Skip("skipping live test")
|
||||
}
|
||||
|
||||
time.Sleep(time.Second * 1)
|
||||
|
||||
provider, err := NewDNSProviderDyn(dynCustomerName, dynUserName, dynPassword)
|
||||
assert.NoError(t, err)
|
||||
|
||||
err = provider.CleanUp(dynDomain, "", "123d==")
|
||||
assert.NoError(t, err)
|
||||
}
|
||||
|
|
@ -109,6 +109,12 @@ func setup(c *cli.Context) (*Configuration, *Account, *acme.Client) {
|
|||
tsigSecret := os.Getenv("RFC2136_TSIG_SECRET")
|
||||
|
||||
provider, err = rfc2136.NewDNSProvider(nameserver, tsigAlgorithm, tsigKey, tsigSecret)
|
||||
case "dyn":
|
||||
dynCustomerName := os.Getenv("DYN_CUSTOMER_NAME")
|
||||
dynUserName := os.Getenv("DYN_USER_NAME")
|
||||
dynPassword := os.Getenv("DYN_PASSWORD")
|
||||
|
||||
provider, err = acme.NewDNSProviderDyn(dynCustomerName, dynUserName, dynPassword)
|
||||
case "manual":
|
||||
provider, err = acme.NewDNSProviderManual()
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue