[type/__dtnrch_getssl_script_henet] Preliminary support for CNAMEs

3 files changed, 94 insertions, 0 deletions

diff --git a/type/__dtnrch_getssl_script_henet/files/dns/dig.sh b/type/__dtnrch_getssl_script_henet/files/dns/dig.sh
new file mode 100644
index 0000000..299c845
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/files/dns/dig.sh
@@ -0,0 +1,23 @@
+find_auth_dns() (
+	domain=${1:?}
+
+	# until test -n "${ns-}" || test "${domain}" = "${domain##*.}"
+	# do
+		dig SOA +trace +nocomments "${domain}" 2>/dev/null | grep "IN\WSOA\W"
+
+	# 	domain=${domain#*.}
+	# done
+	test -n "${ns}" || return 2
+
+	# Check authority
+	:
+
+	: || return 1
+)
+
+resolve_cnames() (
+	:
+)
+
+find_auth_dns _acme-challenge.gw-01.mar-1.datenrei.ch
+find_auth_dns _acme-challenge.www-01.ssrq-sds-fds.ch
diff --git a/type/__dtnrch_getssl_script_henet/files/dns/nslookup.sh b/type/__dtnrch_getssl_script_henet/files/dns/nslookup.sh
new file mode 100644
index 0000000..c475e9a
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/files/dns/nslookup.sh
@@ -0,0 +1,46 @@
+find_auth_dns() (
+	domain=${1:?}
+
+	until test -n "${ns-}" || test "${domain}" = "${domain##*.}"
+	do
+		ns=$(
+			nslookup -debug -type=NS "${domain}" \
+			| awk '\
+			  /^Authoritative answer/ { block = "non-auth" }
+			  /^Non-authoritative answer:$/ { block = "non-auth" }
+
+			  debug && /^[ ]{4}([A-Z][A-Z ]*):$/ {
+				  debug_block = substr($0, 5, length - 6)
+			  }
+			  debug_block == "ANSWERS" && /nameserver = / {
+				  key = "nameserver = "
+				  origin = substr($0, index($0, key) + length(key))
+			  }
+			  END { print origin }')
+
+		domain=${domain#*.}
+	done
+	test -n "${ns}" || return 2
+
+	# Check authority
+	echo $ns
+	origin=$(
+		nslookup -debug -type=SOA "$1" "${ns}" \
+		| awk '\
+		  /^-+$/ { debug = !debug; debug_block = "" }
+		  debug && /^[ ]{4}([A-Z][A-Z ]*):$/ {
+			  debug_block = substr($0, 5, length - 6)
+		  }
+		  debug { print debug_block }
+		  debug_block ~ /AUTHORITY RECORDS?/ && /origin = / {
+			  key = "origin = "
+			  print substr($0, index($0, key) + length(key))
+		  }')
+
+	test -n "${origin}" && echo "${origin}" || return 1
+)
+
+resolve_cnames() (
+	domain=${1:?}
+	auth_dns
+)
diff --git a/type/__dtnrch_getssl_script_henet/manifest b/type/__dtnrch_getssl_script_henet/manifest
index 5986738..389e2cb 100755
--- a/type/__dtnrch_getssl_script_henet/manifest
+++ b/type/__dtnrch_getssl_script_henet/manifest
@@ -20,10 +20,35 @@ quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
 
 SCRIPTS_DIR=/usr/local/share/getssl
 
+os=$(cat "${__global:?}/explorer/os")
 state_should=$(cat "${__object:?}/parameter/state")
 
 script_names='dns_add_henet dns_del_henet'
 
+case ${os}
+in
+	(debian|devuan|ubuntu)
+		if test "${state_should}" != 'absent'
+		then
+			__package dnsutils
+			dns_impl=
+		fi
+		;;
+	# (openwrt)
+	# 	__package_opkg drill
+	# 	dns_impl=drill
+	# 	__package_opkg bind-dig
+	# 	dns_impl=dig
+	# 	__package_opkg bind-nslookup
+	# 	dns_impl=nslookup
+	# 	;;
+	(*)
+		printf 'Unsupported OS: %s\n' "${os}" >&2
+		printf 'Please provide a patch, if you can.\n' >&2
+		exit 1
+		;;
+esac
+
 case ${state_should}
 in
 	(present)