dehydrated-bigip-http-01

#!/usr/bin/env bash

# pull in common functions
. ${BASEDIR}/hooks/dehydrated-bigip-common
# pull in config
. ${BASEDIR}/hooks/dehydrated-bigip-loadconfig
 
log "** Adding common iControl REST API Function **"

#-----------------------------------------------------------------------
#---------------[ iRule & Data Group Functions]-------------------------
#-----------------------------------------------------------------------

#-------------------------------------------------------
# Function: createDataGroup()
# Creates and 'internal' Data Group on the BIGIP.
# $1 => name of Data Group
# $2 => DG type:  string, ip, integer
#-------------------------------------------------------
createDataGroup() {
  OUT=$(restCall "POST" "/tm/ltm/data-group/internal" "{ \"name\": \"${1}\", \"type\": \"${2}\" }")
  log "createDataGroup(): `echo $OUT | python -mjson.tool`"
  if [[ $(echo $OUT | jsonq '["kind"]') != "tm:ltm:data-group:internal:internalstate" ]]; then
    echo "ERROR: Unable to create Data Group ${1}"
    return 1
  fi
  return 0
}

#-------------------------------------------------------
# Function: addToDataGroup()
#   Adds to an existing Data Group.  This fucntion is much more complex,
#  since you need to capture all the existing entries into an JSON array,
#  insert the new entry, then send them all back. [Yes, it gets ugly with large lists]
# $1 => Name of Data Group
# $2 => Item to insert into group
# $3 => Item value to insert into group
#-------------------------------------------------------
addToDataGroup() {
  OUT=$(restCall "GET" "/tm/ltm/data-group/internal/~${BIGIP_DATAGROUP_PARTITION}~${1}")
  log "addToDataGroup()[Initial GET]: `echo $OUT | python -mjson.tool`"
  ## Grab all the current records and add the new one to the end of the JSON array.
  if [[ $(echo $OUT | grep records) == "" ]]; then
    # No records yet, so add the first one.
    TT="[ { \"name\": \"${2}\", \"data\": \"${3}\" } ]"
  else
    TT=$(echo $OUT | python -c "import sys,json; input=json.load(sys.stdin); tt=input[\"records\"]; tt.append({ \"name\": \"${2}\", \"data\": \"${3}\" }); print json.dumps(tt)")
  fi
  log "addToDataGroup()[Record Insert]: `echo \"{ \"records\": ${TT} }\"`"
  ##  Overwrite the old records list with the new one.
  TS=$(echo "{ \"records\": ${TT} }")
  OUT=$(restCall "PUT" "/tm/ltm/data-group/internal/~${BIGIP_DATAGROUP_PARTITION}~${1}" "{ \"records\": ${TT} }")
  log "addToDataGroup()[Write Back Results]: `echo $OUT | python -mjson.tool`"
  if [[ $(echo $OUT | jsonq '["kind"]') != "tm:ltm:data-group:internal:internalstate" ]]; then
    echo "ERROR: Data Group records were not added correctly."
    return 1
  fi
  return 0
}

#-------------------------------------------------------
# Function: deleteFromDataGroup()
#   Deletes an entry from an existing Data Group.  This fucntion is much more complex,
#  since you need to capture all the existing entries into an JSON array,
#  insert the new entry, then send them all back. [Yes, it gets ugly with large lists]
# $1 => Name of Data Group
# $2 => Item to delete from group
#-------------------------------------------------------
deleteFromDataGroup() {
  OUT=$(restCall "GET" "/tm/ltm/data-group/internal/~${BIGIP_DATAGROUP_PARTITION}~${1}")
  log "deleteFromDataGroup()[Initial GET]: `echo $OUT | python -mjson.tool`"
  ## Grab all the current records and add the new one to the end of the JSON array.
  if [[ $(echo $OUT | grep records) == "" ]]; then
    # No records; re-write empty data group
    TT=""
  else
    # Re-format records; removing the record identified by ${2}
    TT=$(echo $OUT | python -c "import sys,json; input=json.load(sys.stdin); tt=input[\"records\"]; print json.dumps(tt)" | sed -E -e "s/\{\"name\": \"${2}\", \"data\": \"[a-zA-Z0-9\.\-]*\"},* *//" -e "s/\{\"data\": \"[a-zA-Z0-9\.\-]*\", \"name\": \"${2}\"},* *//")
  fi

  log "deleteFromDataGroup()[Record Removed]: `echo \"{ \"records\": ${TT} }\"`"

  if [ "${TT}x" != "x" ] ; then
    ##  Overwrite the old records list with the new one.
    TS=$(echo "{ \"records\": ${TT} }")
    OUT=$(restCall "PUT" "/tm/ltm/data-group/internal/~${BIGIP_DATAGROUP_PARTITION}~${1}" "{ \"records\": ${TT} }")
    log "deleteFromDataGroup()[Write Back Results]: `echo $OUT | python -mjson.tool`"
    if [[ $(echo $OUT | jsonq '["kind"]') != "tm:ltm:data-group:internal:internalstate" ]]; then
      echo "ERROR: Data Group records were not deleted correctly."
      return 1
    fi
  fi

  return 0
}

# dehydrated hooks

deploy_challenge() {
    local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"

    # This hook is called once for every domain that needs to be
    # validated, including any alternative names you may have listed.
    #
    # Parameters:
    # - DOMAIN
    #   The domain name (CN or subject alternative name) being
    #   validated.
    # - TOKEN_FILENAME
    #   The name of the file containing the token to be served for HTTP
    #   validation. Should be served by your web server as
    #   /.well-known/acme-challenge/${TOKEN_FILENAME}.
    # - TOKEN_VALUE
    #   The token value that needs to be served for validation. For DNS
    #   validation, this is what you want to put in the _acme-challenge
    #   TXT record. For HTTP validation it is the value that is expected
    #   be found in the $TOKEN_FILENAME file.

    echo "NOTE: Deploying challenge to F5 BIG-IP (${DOMAIN}/${TOKEN_FILENAME}/${TOKEN_VALUE})"

    if (! whenAvailable); then
      echo "ERROR: BIGIP Not responding... Please check to see if it is running!"
      return 1
    fi

    OUT=$(addToDataGroup "${BIGIP_DATA_GROUP_NAME}" "${TOKEN_FILENAME}" "${TOKEN_VALUE}")

    if ! $OUT; then
      echo "Error: Token for ${DOMAIN} was not added correctly!"
      exit 1
    fi
}

clean_challenge() {
    local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"

    # This hook is called after attempting to validate each domain,
    # whether or not validation was successful. Here you can delete
    # files or DNS records that are no longer needed.
    #
    # The parameters are the same as for deploy_challenge.

    echo "NOTE: Removing challenge from F5 BIG-IP (${DOMAIN}/${TOKEN_FILENAME})"

    if (! whenAvailable); then
      echo "ERROR: BIGIP Not responding... Please check to see if it is running!"
      return 1
    fi

    OUT=$(deleteFromDataGroup "${BIGIP_DATA_GROUP_NAME}" "${TOKEN_FILENAME}")

    #if ! $OUT; then
    #  echo "Error: Token for ${DOMAIN} was not added correctly!"
    #  exit 1
    #fi
}


HANDLER="$1"; shift
if [ -n "$(type -t $HANDLER)" ] && [ "$(type -t $HANDLER)" = function ]; then
  # deploy certificates to each BIG-IP
  for BIGIP_DEVICE in ${BIGIP_DEVICE_LIST} ; do
    echo "check if ${BIGIP_DEVICE} is Active in cluster";
    if isActive ; then
      echo "Active device, deploy hook on ${BIGIP_DEVICE}"
      "$HANDLER" "$@"
    else
      echo "Device ${BIGIP_DEVICE} is passive in cluster, skip hook"
    fi
  done
fi

# EOF