mirror of
https://github.com/acmesh-official/acme.sh.git
synced 2026-10-21 21:31:51 +00:00
Eyal Kalderon
228a140094
* Add `deploy/redfish.sh` and implement Redfish session log in/out
Since `acme.sh` intends to keep third-party dependencies to a minimum,
this implementation will not rely on `redfishtool`.
* Detect BMC manager and replace existing cert with ACME cert
* Reuse `_toPkcs8` defined in `acme.sh`
* Return early if unsupported key algorithms or bit lengths are used
* Improve robustness and UX a bit
* Support opt-in automatic restart of BMC
* Improve log output and inline docs some more
* Remove `test-redfish-deploy-hook.sh` test harness
The business logic has been implemented, so it should be safe to delete
this test harness now and just interact with `acme.sh` directly.
* Trim `_redfish_` prefixes from local variables
Since each deploy hook is executed within its own subshell, there's no
risk of polluting the outer `acme.sh` environment nor any other deploy
hooks that might follow.
* Save deploy configuration changes to disk
* Tweak deploy hook log messages a bit
* Add `DEPLOY_REDFISH_MANAGER` environment variable
* Add function for checking HTTP status code
* Add more helper functions, clean up log output a bit more
* Return early from non-zero `curl` exit codes
* Only upload leaf cert in `--sign-csr` mode
* Fix bug with RSA key compatibility error message
* Remove `_redfish_load_deploy_conf` helper, use consistent var naming
* Add several more helper functions
* Check whether server supports Certificate schema >=1.4.0
Redfish servers with a schema version older than this don't support
uploading private keys + full certificate chains directly. Instead, the
CSR must be generated on the server and signed with `acme.sh --sign-csr`
prior to deployment.
* Clarify environment variable naming a bit
* Don't implicitly opt into `HTTPS_INSECURE`
* Feedback: Fix lower-bound RSA key length check
* Feedback: Verify file existence with `-f` flag
* Feedback: Correctly map `TPM_ECC_CURVE` key length values
* Feedback: Replace exact HTTP 204 checks with 2xx instead
* Feedback: Use POSIX-compliant alternative to `\+`
* Feedback: Get session token from body instead of HTTP header
* Feedback: Save PKCS#8 private key directly to variable
* Feedback: Drop `jq` dependency, handle missing action info
* Fix regression in `_redfish_rest()` error reporting
* Simplify construction of expected certificate JSON string
Confirmed with a real-world test that the value of `_certificate_str`
is unchanged before and after applying this commit. See below:
diff --git a/deploy/redfish.sh b/deploy/redfish.sh
index e485fd60..3459b71a 100644
--- a/deploy/redfish.sh
+++ b/deploy/redfish.sh
@@ -131,6 +131,10 @@ redfish_deploy() {
printf '%s\n' "${_ckey_pkcs8}"
cat "${_cfullchain}"
} | _json_encode)"
+
+ _new_certificate_str="$(echo "${_ckey_pkcs8}" | cat - "${_cfullchain}" | _json_encode)"
+ [ "${_certificate_str}" = "${_new_certificate_str}" ] || return 123
+
_certificate_type='PEMchain'
else
_info "Private key and full certificate chain not available; we must be using a server-generated CSR."
* Include link to `redfish-generate-csr.sh` helper script in error message
* Feedback: Drop use of `paste` and `expr`
* Feedback: Remove stale `_err` invocation
* Feedback: Correctly deal with whitespace after colon
* Feedback: Handle `\n` in username and password in Dash shell
It seems that `echo` in Dash automatically converts `\n` into a line
break, causing usernames and/or passwords containing a literal
backslash-n to reach the BMC with a newline, breaking login. It
seems that `printf '%s'` doesn't have the same issue, so we use those to
format `_username` and `_password` instead of `echo`.
* Feedback: Link to acme.sh wiki instead of Gist
* Feedback: Fix `Certificate` schema version check
* Feedback: Better handle missing key algo/length/curve info
This commit changes how the deploy hook detects which cryptographic
algorithms are supported by the server if not explicitly declared in
`KeyPairAlgorithm`. Instead of blindly assuming RSA, we instead check
for the presence of `KeyBitLength` and/or `KeyCurveId` fields and try to
make an educated guess. If not enough info exists to determine key
compatibility, we fail-open instead of failing closed; the server will
yell at us anyway if `ReplaceCertificate` doesn't support something.
* Feedback: Fix character escaping of username/password
* Feedback: Correctly parse inline `KeyBitLength@Redfish.AllowableValues`
This metadatum is represented as a JSON array of allowed values, not a
numeric range with min/max. Make sure to treat the element in the list
as the maximum, and not assume the list is at most 2 elements long.
* Feedback: Add "\n" to format string for Solaris compatibility
* Feedback: Use POSIX parameter expansion instead of `rev`