traefik/vendor/github.com/xenolf/lego/providers/dns/gandi/gandi.go

452 lines
12 KiB
Go
Raw Normal View History

2017-02-07 21:33:23 +00:00
// Package gandi implements a DNS provider for solving the DNS-01
// challenge using Gandi DNS.
package gandi
import (
"bytes"
"encoding/xml"
2018-09-17 13:16:03 +00:00
"errors"
2017-02-07 21:33:23 +00:00
"fmt"
"io"
"io/ioutil"
"net/http"
"strings"
"sync"
"time"
2018-05-31 07:30:04 +00:00
"github.com/xenolf/lego/acme"
2018-07-03 10:44:04 +00:00
"github.com/xenolf/lego/platform/config/env"
2017-02-07 21:33:23 +00:00
)
// Gandi API reference: http://doc.rpc.gandi.net/index.html
// Gandi API domain examples: http://doc.rpc.gandi.net/domain/faq.html
2018-09-17 13:16:03 +00:00
const (
// defaultBaseURL Gandi XML-RPC endpoint used by Present and CleanUp
defaultBaseURL = "https://rpc.gandi.net/xmlrpc/"
minTTL = 300
2017-02-07 21:33:23 +00:00
)
2018-09-17 13:16:03 +00:00
// findZoneByFqdn determines the DNS zone of an fqdn.
// It is overridden during tests.
var findZoneByFqdn = acme.FindZoneByFqdn
// Config is used to configure the creation of the DNSProvider
type Config struct {
BaseURL string
APIKey string
PropagationTimeout time.Duration
PollingInterval time.Duration
TTL int
HTTPClient *http.Client
}
// NewDefaultConfig returns a default configuration for the DNSProvider
func NewDefaultConfig() *Config {
return &Config{
TTL: env.GetOrDefaultInt("GANDI_TTL", minTTL),
PropagationTimeout: env.GetOrDefaultSecond("GANDI_PROPAGATION_TIMEOUT", 40*time.Minute),
PollingInterval: env.GetOrDefaultSecond("GANDI_POLLING_INTERVAL", 60*time.Second),
HTTPClient: &http.Client{
Timeout: env.GetOrDefaultSecond("GANDI_HTTP_TIMEOUT", 60*time.Second),
},
}
}
2017-02-07 21:33:23 +00:00
// inProgressInfo contains information about an in-progress challenge
type inProgressInfo struct {
zoneID int // zoneID of gandi zone to restore in CleanUp
newZoneID int // zoneID of temporary gandi zone containing TXT record
authZone string // the domain name registered at gandi with trailing "."
}
// DNSProvider is an implementation of the
2018-05-31 07:30:04 +00:00
// acme.ChallengeProviderTimeout interface that uses Gandi's XML-RPC
2017-02-07 21:33:23 +00:00
// API to manage TXT records for a domain.
type DNSProvider struct {
inProgressFQDNs map[string]inProgressInfo
inProgressAuthZones map[string]struct{}
inProgressMu sync.Mutex
2018-09-17 13:16:03 +00:00
config *Config
2017-02-07 21:33:23 +00:00
}
// NewDNSProvider returns a DNSProvider instance configured for Gandi.
// Credentials must be passed in the environment variable: GANDI_API_KEY.
func NewDNSProvider() (*DNSProvider, error) {
2018-07-03 10:44:04 +00:00
values, err := env.Get("GANDI_API_KEY")
if err != nil {
2018-09-17 13:16:03 +00:00
return nil, fmt.Errorf("gandi: %v", err)
2018-07-03 10:44:04 +00:00
}
2018-09-17 13:16:03 +00:00
config := NewDefaultConfig()
config.APIKey = values["GANDI_API_KEY"]
return NewDNSProviderConfig(config)
2017-02-07 21:33:23 +00:00
}
2018-09-17 13:16:03 +00:00
// NewDNSProviderCredentials uses the supplied credentials
// to return a DNSProvider instance configured for Gandi.
// Deprecated
2017-02-07 21:33:23 +00:00
func NewDNSProviderCredentials(apiKey string) (*DNSProvider, error) {
2018-09-17 13:16:03 +00:00
config := NewDefaultConfig()
config.APIKey = apiKey
return NewDNSProviderConfig(config)
}
// NewDNSProviderConfig return a DNSProvider instance configured for Gandi.
func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
if config == nil {
return nil, errors.New("gandi: the configuration of the DNS provider is nil")
2017-02-07 21:33:23 +00:00
}
2018-09-17 13:16:03 +00:00
if config.APIKey == "" {
return nil, fmt.Errorf("gandi: no API Key given")
}
if config.BaseURL == "" {
config.BaseURL = defaultBaseURL
}
2017-02-07 21:33:23 +00:00
return &DNSProvider{
2018-09-17 13:16:03 +00:00
config: config,
2017-02-07 21:33:23 +00:00
inProgressFQDNs: make(map[string]inProgressInfo),
inProgressAuthZones: make(map[string]struct{}),
}, nil
}
// Present creates a TXT record using the specified parameters. It
// does this by creating and activating a new temporary Gandi DNS
// zone. This new zone contains the TXT record.
func (d *DNSProvider) Present(domain, token, keyAuth string) error {
2018-09-17 13:16:03 +00:00
fqdn, value, _ := acme.DNS01Record(domain, keyAuth)
if d.config.TTL < minTTL {
d.config.TTL = minTTL // 300 is gandi minimum value for ttl
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// find authZone and Gandi zone_id for fqdn
2018-05-31 07:30:04 +00:00
authZone, err := findZoneByFqdn(fqdn, acme.RecursiveNameservers)
2017-02-07 21:33:23 +00:00
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: findZoneByFqdn failure: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
zoneID, err := d.getZoneID(authZone)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// determine name of TXT record
if !strings.HasSuffix(
strings.ToLower(fqdn), strings.ToLower("."+authZone)) {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: unexpected authZone %s for fqdn %s", authZone, fqdn)
2017-02-07 21:33:23 +00:00
}
name := fqdn[:len(fqdn)-len("."+authZone)]
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// acquire lock and check there is not a challenge already in
// progress for this value of authZone
d.inProgressMu.Lock()
defer d.inProgressMu.Unlock()
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if _, ok := d.inProgressAuthZones[authZone]; ok {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: challenge already in progress for authZone %s", authZone)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// perform API actions to create and activate new gandi zone
// containing the required TXT record
2018-09-17 13:16:03 +00:00
newZoneName := fmt.Sprintf("%s [ACME Challenge %s]", acme.UnFqdn(authZone), time.Now().Format(time.RFC822Z))
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
newZoneID, err := d.cloneZone(zoneID, newZoneName)
if err != nil {
return err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
newZoneVersion, err := d.newZoneVersion(newZoneID)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2018-09-17 13:16:03 +00:00
err = d.addTXTRecord(newZoneID, newZoneVersion, name, value, d.config.TTL)
2017-02-07 21:33:23 +00:00
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
err = d.setZoneVersion(newZoneID, newZoneVersion)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
err = d.setZone(authZone, newZoneID)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// save data necessary for CleanUp
d.inProgressFQDNs[fqdn] = inProgressInfo{
zoneID: zoneID,
newZoneID: newZoneID,
authZone: authZone,
}
d.inProgressAuthZones[authZone] = struct{}{}
2018-09-17 13:16:03 +00:00
2017-02-07 21:33:23 +00:00
return nil
}
// CleanUp removes the TXT record matching the specified
// parameters. It does this by restoring the old Gandi DNS zone and
// removing the temporary one created by Present.
func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
2018-05-31 07:30:04 +00:00
fqdn, _, _ := acme.DNS01Record(domain, keyAuth)
2018-09-17 13:16:03 +00:00
2017-02-07 21:33:23 +00:00
// acquire lock and retrieve zoneID, newZoneID and authZone
d.inProgressMu.Lock()
defer d.inProgressMu.Unlock()
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if _, ok := d.inProgressFQDNs[fqdn]; !ok {
// if there is no cleanup information then just return
return nil
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
zoneID := d.inProgressFQDNs[fqdn].zoneID
newZoneID := d.inProgressFQDNs[fqdn].newZoneID
authZone := d.inProgressFQDNs[fqdn].authZone
delete(d.inProgressFQDNs, fqdn)
delete(d.inProgressAuthZones, authZone)
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// perform API actions to restore old gandi zone for authZone
err := d.setZone(authZone, zoneID)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("gandi: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
return d.deleteZone(newZoneID)
2017-02-07 21:33:23 +00:00
}
// Timeout returns the values (40*time.Minute, 60*time.Second) which
// are used by the acme package as timeout and check interval values
// when checking for DNS record propagation with Gandi.
func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
2018-09-17 13:16:03 +00:00
return d.config.PropagationTimeout, d.config.PollingInterval
2017-02-07 21:33:23 +00:00
}
// rpcCall makes an XML-RPC call to Gandi's RPC endpoint by
// marshalling the data given in the call argument to XML and sending
// that via HTTP Post to Gandi. The response is then unmarshalled into
// the resp argument.
2018-07-03 10:44:04 +00:00
func (d *DNSProvider) rpcCall(call *methodCall, resp response) error {
2017-02-07 21:33:23 +00:00
// marshal
b, err := xml.MarshalIndent(call, "", " ")
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("marshal error: %v", err)
2017-02-07 21:33:23 +00:00
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// post
b = append([]byte(`<?xml version="1.0"?>`+"\n"), b...)
2018-09-17 13:16:03 +00:00
respBody, err := d.httpPost(d.config.BaseURL, "text/xml", bytes.NewReader(b))
2017-02-07 21:33:23 +00:00
if err != nil {
return err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
// unmarshal
err = xml.Unmarshal(respBody, resp)
if err != nil {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("unmarshal error: %v", err)
2017-02-07 21:33:23 +00:00
}
if resp.faultCode() != 0 {
return rpcError{
faultCode: resp.faultCode(), faultString: resp.faultString()}
}
return nil
}
// functions to perform API actions
func (d *DNSProvider) getZoneID(domain string) (int, error) {
resp := &responseStruct{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.info",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramString{Value: domain},
},
}, resp)
if err != nil {
return 0, err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
var zoneID int
for _, member := range resp.StructMembers {
if member.Name == "zone_id" {
zoneID = member.ValueInt
}
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if zoneID == 0 {
2018-09-17 13:16:03 +00:00
return 0, fmt.Errorf("could not determine zone_id for %s", domain)
2017-02-07 21:33:23 +00:00
}
return zoneID, nil
}
func (d *DNSProvider) cloneZone(zoneID int, name string) (int, error) {
resp := &responseStruct{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.clone",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramInt{Value: zoneID},
paramInt{Value: 0},
paramStruct{
StructMembers: []structMember{
structMemberString{
Name: "name",
Value: name,
}},
},
},
}, resp)
if err != nil {
return 0, err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
var newZoneID int
for _, member := range resp.StructMembers {
if member.Name == "id" {
newZoneID = member.ValueInt
}
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if newZoneID == 0 {
2018-09-17 13:16:03 +00:00
return 0, fmt.Errorf("could not determine cloned zone_id")
2017-02-07 21:33:23 +00:00
}
return newZoneID, nil
}
func (d *DNSProvider) newZoneVersion(zoneID int) (int, error) {
resp := &responseInt{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.version.new",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramInt{Value: zoneID},
},
}, resp)
if err != nil {
return 0, err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if resp.Value == 0 {
2018-09-17 13:16:03 +00:00
return 0, fmt.Errorf("could not create new zone version")
2017-02-07 21:33:23 +00:00
}
return resp.Value, nil
}
func (d *DNSProvider) addTXTRecord(zoneID int, version int, name string, value string, ttl int) error {
resp := &responseStruct{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.record.add",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramInt{Value: zoneID},
paramInt{Value: version},
paramStruct{
StructMembers: []structMember{
structMemberString{
Name: "type",
Value: "TXT",
}, structMemberString{
Name: "name",
Value: name,
}, structMemberString{
Name: "value",
Value: value,
}, structMemberInt{
Name: "ttl",
Value: ttl,
}},
},
},
}, resp)
2018-05-31 07:30:04 +00:00
return err
2017-02-07 21:33:23 +00:00
}
func (d *DNSProvider) setZoneVersion(zoneID int, version int) error {
resp := &responseBool{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.version.set",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramInt{Value: zoneID},
paramInt{Value: version},
},
}, resp)
if err != nil {
return err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if !resp.Value {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("could not set zone version")
2017-02-07 21:33:23 +00:00
}
return nil
}
func (d *DNSProvider) setZone(domain string, zoneID int) error {
resp := &responseStruct{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.set",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramString{Value: domain},
paramInt{Value: zoneID},
},
}, resp)
if err != nil {
return err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
var respZoneID int
for _, member := range resp.StructMembers {
if member.Name == "zone_id" {
respZoneID = member.ValueInt
}
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if respZoneID != zoneID {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("could not set new zone_id for %s", domain)
2017-02-07 21:33:23 +00:00
}
return nil
}
func (d *DNSProvider) deleteZone(zoneID int) error {
resp := &responseBool{}
2018-07-03 10:44:04 +00:00
err := d.rpcCall(&methodCall{
2017-02-07 21:33:23 +00:00
MethodName: "domain.zone.delete",
Params: []param{
2018-09-17 13:16:03 +00:00
paramString{Value: d.config.APIKey},
2017-02-07 21:33:23 +00:00
paramInt{Value: zoneID},
},
}, resp)
if err != nil {
return err
}
2018-05-31 07:30:04 +00:00
2017-02-07 21:33:23 +00:00
if !resp.Value {
2018-09-17 13:16:03 +00:00
return fmt.Errorf("could not delete zone_id")
2017-02-07 21:33:23 +00:00
}
return nil
}
2018-09-17 13:16:03 +00:00
func (d *DNSProvider) httpPost(url string, bodyType string, body io.Reader) ([]byte, error) {
resp, err := d.config.HTTPClient.Post(url, bodyType, body)
if err != nil {
return nil, fmt.Errorf("HTTP Post Error: %v", err)
}
defer resp.Body.Close()
b, err := ioutil.ReadAll(resp.Body)
if err != nil {
return nil, fmt.Errorf("HTTP Post Error: %v", err)
}
return b, nil
}