fix: cert upload uses multipart/form-data with cert+key+domain
This commit is contained in:
parent
d420f179a2
commit
b948399d1d
1 changed files with 62 additions and 34 deletions
|
|
@ -1,12 +1,15 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"io"
|
||||
"mime/multipart"
|
||||
"net/http"
|
||||
"net/http/cookiejar"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
|
@ -33,14 +36,7 @@ func main() {
|
|||
resp.Body.Close()
|
||||
|
||||
re := regexp.MustCompile(`content="([^"]+)"`)
|
||||
match := re.FindStringSubmatch(string(body))
|
||||
var csrf string
|
||||
for _, m := range match {
|
||||
if len(m) > 20 {
|
||||
csrf = m
|
||||
break
|
||||
}
|
||||
}
|
||||
csrf := extractCSRF(string(body), re)
|
||||
if csrf == "" {
|
||||
fmt.Fprintf(os.Stderr, "FAIL: could not extract CSRF token\n")
|
||||
os.Exit(1)
|
||||
|
|
@ -60,66 +56,79 @@ func main() {
|
|||
body, _ = io.ReadAll(resp.Body)
|
||||
resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != 200 || !strings.Contains(string(body), `"ok"`) {
|
||||
if resp.StatusCode != 200 || !strings.Contains(strings.ToLower(string(body)), `"ok"`) {
|
||||
fmt.Fprintf(os.Stderr, "FAIL: login failed (status=%d): %s\n", resp.StatusCode, strings.TrimSpace(string(body)))
|
||||
os.Exit(1)
|
||||
}
|
||||
fmt.Printf("OK: Logged in as %s\n", username)
|
||||
|
||||
// Step 3: Upload cert for each domain
|
||||
// Step 3: Upload cert for each domain using multipart/form-data
|
||||
certsDir := "/opt/nextworkspace/config/zoraxy/conf/certs"
|
||||
success := true
|
||||
for _, domain := range domains {
|
||||
// Try .pem first, then .crt for backward compatibility
|
||||
certFile := certsDir + "/" + domain + ".pem"
|
||||
if _, err := os.Stat(certFile); os.IsNotExist(err) {
|
||||
certFile = certsDir + "/" + domain + ".crt"
|
||||
}
|
||||
certData, err := os.ReadFile(certFile)
|
||||
// Try .pem first, then .crt
|
||||
pemPath := filepath.Join(certsDir, domain+".pem")
|
||||
crtPath := filepath.Join(certsDir, domain+".crt")
|
||||
keyPath := filepath.Join(certsDir, domain+".key")
|
||||
|
||||
certData, err := os.ReadFile(pemPath)
|
||||
if err != nil {
|
||||
fmt.Printf("SKIP: %s (no cert file)\n", domain)
|
||||
continue
|
||||
certData, err = os.ReadFile(crtPath)
|
||||
if err != nil {
|
||||
fmt.Printf("SKIP: %s (no cert file)\n", domain)
|
||||
continue
|
||||
}
|
||||
}
|
||||
keyData, err := os.ReadFile(keyPath)
|
||||
if err != nil {
|
||||
fmt.Printf("WARN: %s (no key file), uploading cert only\n", domain)
|
||||
}
|
||||
|
||||
// Get fresh CSRF for each upload
|
||||
// Build multipart form
|
||||
var buf bytes.Buffer
|
||||
w := multipart.NewWriter(&buf)
|
||||
w.WriteField("domain", domain)
|
||||
|
||||
certWriter, _ := w.CreateFormFile("cert", domain+".pem")
|
||||
certWriter.Write(certData)
|
||||
|
||||
if keyData != nil {
|
||||
keyWriter, _ := w.CreateFormFile("key", domain+".key")
|
||||
keyWriter.Write(keyData)
|
||||
}
|
||||
w.Close()
|
||||
|
||||
// Get fresh CSRF
|
||||
resp, err := client.Get("http://127.0.0.1:8000/login.html")
|
||||
if err != nil {
|
||||
fmt.Printf("WARN: %s csrf fetch failed: %v\n", domain, err)
|
||||
continue
|
||||
}
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
b, _ := io.ReadAll(resp.Body)
|
||||
resp.Body.Close()
|
||||
match = re.FindStringSubmatch(string(body))
|
||||
csrf = ""
|
||||
for _, m := range match {
|
||||
if len(m) > 20 {
|
||||
csrf = m
|
||||
break
|
||||
}
|
||||
}
|
||||
csrf = extractCSRF(string(b), re)
|
||||
if csrf == "" {
|
||||
fmt.Printf("WARN: %s no CSRF token\n", domain)
|
||||
continue
|
||||
}
|
||||
|
||||
uploadURL := fmt.Sprintf("http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=%s", domain)
|
||||
req, _ := http.NewRequest("POST", uploadURL, strings.NewReader(string(certData)))
|
||||
req, _ := http.NewRequest("POST", "http://127.0.0.1:8000/api/cert/upload", &buf)
|
||||
req.Header.Set("Content-Type", w.FormDataContentType())
|
||||
req.Header.Set("X-CSRF-Token", csrf)
|
||||
req.Header.Set("Content-Type", "application/x-pem-file")
|
||||
|
||||
resp, err = client.Do(req)
|
||||
if err != nil {
|
||||
fmt.Printf("WARN: %s upload failed: %v\n", domain, err)
|
||||
fmt.Printf("FAIL: %s request failed: %v\n", domain, err)
|
||||
success = false
|
||||
continue
|
||||
}
|
||||
body, _ = io.ReadAll(resp.Body)
|
||||
b, _ = io.ReadAll(resp.Body)
|
||||
resp.Body.Close()
|
||||
|
||||
if resp.StatusCode == 200 {
|
||||
fmt.Printf("OK: %s cert uploaded\n", domain)
|
||||
} else {
|
||||
fmt.Printf("FAIL: %s (status=%d): %s\n", domain, resp.StatusCode, strings.TrimSpace(string(body)))
|
||||
fmt.Printf("FAIL: %s (status=%d): %s\n", domain, resp.StatusCode, strings.TrimSpace(string(b)))
|
||||
success = false
|
||||
}
|
||||
}
|
||||
|
|
@ -128,3 +137,22 @@ func main() {
|
|||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func extractCSRF(html string, re *regexp.Regexp) string {
|
||||
match := re.FindAllStringSubmatch(html, -1)
|
||||
for _, m := range match {
|
||||
if len(m) > 1 && len(m[1]) > 20 {
|
||||
return m[1]
|
||||
}
|
||||
}
|
||||
// Try looking for the specific zoraxy.csrf.Token pattern
|
||||
idx := strings.Index(html, "zoraxy.csrf.Token")
|
||||
if idx >= 0 {
|
||||
sub := html[idx:]
|
||||
m := re.FindStringSubmatch(sub)
|
||||
if len(m) > 1 {
|
||||
return m[1]
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue