From 7d64e141e45be32479773f8a4fb44bd8304dacc1 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 12 Jul 2017 20:24:54 +0200
Subject: [PATCH 01/24] Add dns_he - DNS API script for Hurricane Electric DNS
 service

... Although not yet fully Posix compatible.
---
 dnsapi/README.md |  18 +++++
 dnsapi/dns_he.sh | 200 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 218 insertions(+)
 create mode 100755 dnsapi/dns_he.sh

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 41f89a88..15399048 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -572,6 +572,24 @@ acme.sh --issue --dns dns_dyn -d example.com -d www.example.com
 
 The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+# 30. Use Hurricane Electric
+
+Hurricane Electric doesn't have an API so just set your login credentials like so:
+
+```
+export HE_Username="yourusername"
+export HE_Password="password"
+```
+
+Then you can issue your certificate:
+
+```
+acme.sh --issue --dns dns_he -d example.com -d www.example.com
+```
+
+The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+Please report any issues to https://github.com/angel333/acme.sh or to <me@ondrejsimek.com>.
 
 # Use custom API
 
diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
new file mode 100755
index 00000000..269db8d2
--- /dev/null
+++ b/dnsapi/dns_he.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env sh
+
+# TODO Somehow use _get instead of curl - not sure how to support
+#      cookies though...
+
+########################################################################
+# Hurricane Electric hook script for acme.sh
+#
+# Environment variables:
+#
+#  - $HE_Username  (your dns.he.net username)
+#  - $HE_Password  (your dns.he.net password)
+#
+# Author: Ondrej Simek <me@ondrejsimek.com>
+# Git repo: https://github.com/angel333/acme.sh
+
+
+#-- dns_he_add() - Add TXT record --------------------------------------
+# Usage: dns_he_add _acme-challenge.subdomain.domain.com "XyZ123..."
+
+dns_he_add() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 Hurricane Electric hook"
+
+  _authenticate || return 1
+  _saveaccountconf HE_Username "$HE_Username"
+  _saveaccountconf HE_Password "$HE_Password"
+
+  # fills in the $_zone_id
+  _find_zone $_full_domain || return 1
+  _debug "Zone id \"$_zone_id\" will be used."
+
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "account=" \
+    --form "menu=edit_zone" \
+    --form "Type=TXT" \
+    --form "hosted_dns_zoneid=$_zone_id" \
+    --form "hosted_dns_recordid=" \
+    --form "hosted_dns_editzone=1" \
+    --form "Priority=" \
+    --form "Name=$_full_domain" \
+    --form "Content=$_txt_value" \
+    --form "TTL=300" \
+    --form "hosted_dns_editrecord=Submit" \
+    "https://dns.he.net/" \
+    > /dev/null
+}
+
+
+#-- dns_he_rm() - Remove TXT record ------------------------------------
+# Usage: dns_he_rm _acme-challenge.subdomain.domain.com "XyZ123..."
+
+dns_he_rm() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Cleaning up after DNS-01 Hurricane Electric hook"
+
+  _authenticate || return 1
+
+  # fills in the $_zone_id
+  _find_zone $_full_domain || return 1
+  _debug "Zone id \"$_zone_id\" will be used."
+
+  # Find the record id to clean
+  _record_id=$( \
+    curl -L --silent --show-error --cookie "$_he_cookie" \
+      "https://dns.he.net/?hosted_dns_zoneid=$_zone_id&menu=edit_zone&hosted_dns_editzone" \
+      | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
+      | tail -n 1 \
+      | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
+      | cut -b 2- \
+      | _egrep_o "[[:digit:]]+" \
+      | head -n1) # ... oh my, what have I done...
+
+  # Remove the record
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "menu=edit_zone" \
+    --form "hosted_dns_zoneid=$_zone_id" \
+    --form "hosted_dns_recordid=$_record_id" \
+    --form "hosted_dns_editzone=1" \
+    --form "hosted_dns_delrecord=1" \
+    --form "hosted_dns_delconfirm=delete" \
+    --form "hosted_dns_editzone=1" \
+    "https://dns.he.net/" \
+    | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
+    > /dev/null
+  if [ $? -eq 0 ]; then
+    _info "Record removed successfuly."
+  else
+    _err \
+      "Could not clean (remove) up the record. Please go to HE" \
+      "administration interface and clean it by hand."
+  fi
+}
+
+
+########################## PRIVATE FUNCTIONS ###########################
+
+
+#-- _find_zone() -------------------------------------------------------
+
+# Usage: _authenticate
+#
+# - needs $HE_Username and $HE_Password
+# - sets the $_he_cookie
+
+_authenticate() {
+  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+    _err \
+      'No auth details provided. Please set user credentials using the \
+      \$HE_Username and \$HE_Password envoronment variables.'
+    return 1
+  fi
+  # Just get a session
+  _he_cookie=$( \
+    curl -L --silent --show-error -I "https://dns.he.net/" \
+      | grep '^Set-Cookie:' \
+      | _egrep_o 'CGISESSID=[a-z0-9]*')
+  # Attempt login
+  curl -L --silent --show-error --cookie "$_he_cookie" \
+    --form "email=${HE_Username}" \
+    --form "pass=${HE_Password}" \
+    "https://dns.he.net/" \
+    > /dev/null
+  # TODO detect unsuccessful logins
+}
+
+
+#-- _find_zone() -------------------------------------------------------
+
+# Returns the most specific zone found in administration interface.
+#
+# - needs $_he_cookie
+#
+# Example:
+#
+# _find_zone first.second.third.co.uk
+#
+# ... will return the first zone that exists in admin out of these:
+# - "first.second.third.co.uk"
+# - "second.third.co.uk"
+# - "third.co.uk"
+# - "co.uk" <-- unlikely
+# - "uk"    <-'
+#
+# (another approach would be something like this:
+#   https://github.com/hlandau/acme/blob/master/_doc/dns.hook
+#   - that's better if there are multiple pages. It's so much simpler.
+# )
+
+_find_zone() {
+
+  _domain="$1"
+
+  ## _all_zones is an array that looks like this:
+  ## ( zone1:id zone2:id ... )
+  _all_zones=( $(curl -L --silent --show-error --cookie "$_he_cookie" \
+    "https://dns.he.net/" \
+    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
+    | cut -d '"' -f 3,5 --output-delimiter=":" \
+  ) )
+
+  _strip_counter=1
+  while [ true ]
+  do
+    _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
+
+    # All possible zone names have been tried
+    if [ "$_attempted_zone" == "" ]
+    then
+      _err "No zone for domain \"$_domain\" found."
+      break
+    fi
+
+    # Walk through all zones on the account
+    #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
+    for i in ${_all_zones[@]}
+    do
+      _zone_name=$(echo $i | cut -d ':' -f 1)
+      _zone_id=$(echo $i | cut -d ':' -f 2)
+      if [ "$_zone_name" == "$_attempted_zone" ]
+      then
+        # Zone found - we got $_zone_name and $_zone_id, let's get out...
+        _debug "Found relevant zone \"$_zone_name\" with id" \
+          "\"$_zone_id\" - will be used for domain \"$_domain\"."
+        return 0
+      fi
+    done
+
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
+      variation."
+    _strip_counter=$(expr $_strip_counter + 1)
+  done
+
+  # No zone found.
+  return 1
+}
+
+# vim: et:ts=2:sw=2:

From 4285d81ca9d2805e99cf4ed0b601891b4ffd77ce Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 05:00:02 +0200
Subject: [PATCH 02/24] Get rid of curl.

---
 dnsapi/dns_he.sh | 102 +++++++++++++++++------------------------------
 1 file changed, 37 insertions(+), 65 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 269db8d2..141268ac 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -1,8 +1,5 @@
 #!/usr/bin/env sh
 
-# TODO Somehow use _get instead of curl - not sure how to support
-#      cookies though...
-
 ########################################################################
 # Hurricane Electric hook script for acme.sh
 #
@@ -23,7 +20,12 @@ dns_he_add() {
   _txt_value=$2
   _info "Using DNS-01 Hurricane Electric hook"
 
-  _authenticate || return 1
+  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+    _err \
+      'No auth details provided. Please set user credentials using the \
+      \$HE_Username and \$HE_Password envoronment variables.'
+    return 1
+  fi
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
@@ -31,20 +33,20 @@ dns_he_add() {
   _find_zone $_full_domain || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "account=" \
-    --form "menu=edit_zone" \
-    --form "Type=TXT" \
-    --form "hosted_dns_zoneid=$_zone_id" \
-    --form "hosted_dns_recordid=" \
-    --form "hosted_dns_editzone=1" \
-    --form "Priority=" \
-    --form "Name=$_full_domain" \
-    --form "Content=$_txt_value" \
-    --form "TTL=300" \
-    --form "hosted_dns_editrecord=Submit" \
-    "https://dns.he.net/" \
-    > /dev/null
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&account="
+  body="$body&account="
+  body="$body&menu=edit_zone"
+  body="$body&Type=TXT"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&hosted_dns_recordid="
+  body="$body&hosted_dns_editzone=1"
+  body="$body&Priority="
+  body="$body&Name=$_full_domain"
+  body="$body&Content=$_txt_value"
+  body="$body&TTL=300"
+  body="$body&hosted_dns_editrecord=Submit"
+  _post $body "https://dns.he.net/" >/dev/null
 }
 
 
@@ -56,16 +58,16 @@ dns_he_rm() {
   _txt_value=$2
   _info "Cleaning up after DNS-01 Hurricane Electric hook"
 
-  _authenticate || return 1
-
   # fills in the $_zone_id
   _find_zone $_full_domain || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   # Find the record id to clean
-  _record_id=$( \
-    curl -L --silent --show-error --cookie "$_he_cookie" \
-      "https://dns.he.net/?hosted_dns_zoneid=$_zone_id&menu=edit_zone&hosted_dns_editzone" \
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&menu=edit_zone"
+  body="$body&hosted_dns_editzone="
+  _record_id=$(_post $body "https://dns.he.net/" \
       | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
       | tail -n 1 \
       | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
@@ -74,15 +76,15 @@ dns_he_rm() {
       | head -n1) # ... oh my, what have I done...
 
   # Remove the record
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "menu=edit_zone" \
-    --form "hosted_dns_zoneid=$_zone_id" \
-    --form "hosted_dns_recordid=$_record_id" \
-    --form "hosted_dns_editzone=1" \
-    --form "hosted_dns_delrecord=1" \
-    --form "hosted_dns_delconfirm=delete" \
-    --form "hosted_dns_editzone=1" \
-    "https://dns.he.net/" \
+  body="email=${HE_Username}&pass=${HE_Password}"
+  body="$body&menu=edit_zone"
+  body="$body&hosted_dns_zoneid=$_zone_id"
+  body="$body&hosted_dns_recordid=$_record_id"
+  body="$body&hosted_dns_editzone=1"
+  body="$body&hosted_dns_delrecord=1"
+  body="$body&hosted_dns_delconfirm=delete"
+  body="$body&hosted_dns_editzone=1"
+  _post $body "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
     > /dev/null
   if [ $? -eq 0 ]; then
@@ -98,41 +100,10 @@ dns_he_rm() {
 ########################## PRIVATE FUNCTIONS ###########################
 
 
-#-- _find_zone() -------------------------------------------------------
-
-# Usage: _authenticate
-#
-# - needs $HE_Username and $HE_Password
-# - sets the $_he_cookie
-
-_authenticate() {
-  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
-    _err \
-      'No auth details provided. Please set user credentials using the \
-      \$HE_Username and \$HE_Password envoronment variables.'
-    return 1
-  fi
-  # Just get a session
-  _he_cookie=$( \
-    curl -L --silent --show-error -I "https://dns.he.net/" \
-      | grep '^Set-Cookie:' \
-      | _egrep_o 'CGISESSID=[a-z0-9]*')
-  # Attempt login
-  curl -L --silent --show-error --cookie "$_he_cookie" \
-    --form "email=${HE_Username}" \
-    --form "pass=${HE_Password}" \
-    "https://dns.he.net/" \
-    > /dev/null
-  # TODO detect unsuccessful logins
-}
-
-
 #-- _find_zone() -------------------------------------------------------
 
 # Returns the most specific zone found in administration interface.
 #
-# - needs $_he_cookie
-#
 # Example:
 #
 # _find_zone first.second.third.co.uk
@@ -155,8 +126,9 @@ _find_zone() {
 
   ## _all_zones is an array that looks like this:
   ## ( zone1:id zone2:id ... )
-  _all_zones=( $(curl -L --silent --show-error --cookie "$_he_cookie" \
-    "https://dns.he.net/" \
+
+  body="email=${HE_Username}&pass=${HE_Password}"
+  _all_zones=( $(_post $body "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
     | cut -d '"' -f 3,5 --output-delimiter=":" \
   ) )

From 8ca45d3d03718c4ba7dc89eb030209ebe2be9ac7 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 05:13:33 +0200
Subject: [PATCH 03/24] Add HE to README

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 5a3a3adf..7d4353c6 100644
--- a/README.md
+++ b/README.md
@@ -338,6 +338,7 @@ You don't have to do anything manually!
 1. Name.com API
 1. Dyn Managed DNS API
 1. Yandex PDD API (https://pdd.yandex.ru)
+1. Hurricane Electric DNS service (https://dns.he.net)
 
 
 And: 

From f7299403f7b7c0642fee665a7780ef0d8794681f Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sun, 23 Jul 2017 07:31:55 +0200
Subject: [PATCH 04/24] Incorporate Neilpang's comments

---
 dnsapi/dns_he.sh | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 141268ac..019a7a0b 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -20,7 +20,7 @@ dns_he_add() {
   _txt_value=$2
   _info "Using DNS-01 Hurricane Electric hook"
 
-  if [ -z "$HE_Username" ] && [ -z "$HE_Password" ]; then
+  if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
     _err \
       'No auth details provided. Please set user credentials using the \
       \$HE_Username and \$HE_Password envoronment variables.'
@@ -46,7 +46,8 @@ dns_he_add() {
   body="$body&Content=$_txt_value"
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
-  _post $body "https://dns.he.net/" >/dev/null
+  response="$(_post $body "https://dns.he.net/")"
+  _debug2 response "$response"
 }
 
 
@@ -68,12 +69,14 @@ dns_he_rm() {
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
   _record_id=$(_post $body "https://dns.he.net/" \
-      | grep -A 1 "data=\"\(&quot;\)\?${_txt_value}\(&quot;\)\?\"" \
-      | tail -n 1 \
-      | _egrep_o "'[[:digit:]]+','[^']+','TXT'" \
-      | cut -b 2- \
-      | _egrep_o "[[:digit:]]+" \
-      | head -n1) # ... oh my, what have I done...
+    | tr -d '\n' \
+    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
+    | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
+    | _egrep_o "^[0-9]+"
+  )
+  # The series of egreps above could have been done a bit shorter but
+  #  I wanted to double-check whether it's the correct record (in case
+  #  HE changes their website somehow).
 
   # Remove the record
   body="email=${HE_Username}&pass=${HE_Password}"
@@ -134,12 +137,12 @@ _find_zone() {
   ) )
 
   _strip_counter=1
-  while [ true ]
+  while true
   do
     _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
 
     # All possible zone names have been tried
-    if [ "$_attempted_zone" == "" ]
+    if [ -z "$_attempted_zone" ]
     then
       _err "No zone for domain \"$_domain\" found."
       break
@@ -151,7 +154,7 @@ _find_zone() {
     do
       _zone_name=$(echo $i | cut -d ':' -f 1)
       _zone_id=$(echo $i | cut -d ':' -f 2)
-      if [ "$_zone_name" == "$_attempted_zone" ]
+      if [ "$_zone_name" = "$_attempted_zone" ]
       then
         # Zone found - we got $_zone_name and $_zone_id, let's get out...
         _debug "Found relevant zone \"$_zone_name\" with id" \
@@ -162,7 +165,7 @@ _find_zone() {
 
     _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
       variation."
-    _strip_counter=$(expr $_strip_counter + 1)
+    _strip_counter=$(_math $_strip_counter + 1)
   done
 
   # No zone found.

From 29b21b828b01b37ad9f6536cba27af79a1f6aac3 Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Wed, 26 Jul 2017 09:44:11 -0400
Subject: [PATCH 05/24] Fix DNS API scripts on *BSD

\n isn't available in all regex/sed
---
 dnsapi/dns_ad.sh      | 3 ++-
 dnsapi/dns_do.sh      | 6 ++++--
 dnsapi/dns_freedns.sh | 6 ++++--
 dnsapi/dns_linode.sh  | 6 ++++--
 dnsapi/dns_vscale.sh  | 3 ++-
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_ad.sh b/dnsapi/dns_ad.sh
index fc4a664b..79b8c2ab 100755
--- a/dnsapi/dns_ad.sh
+++ b/dnsapi/dns_ad.sh
@@ -92,7 +92,8 @@ _get_root() {
   p=1
 
   if _ad_rest GET "domain/"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
+&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"
diff --git a/dnsapi/dns_do.sh b/dnsapi/dns_do.sh
index 3a2f8f49..fb6d7dec 100755
--- a/dnsapi/dns_do.sh
+++ b/dnsapi/dns_do.sh
@@ -69,9 +69,11 @@ _dns_do_list_rrs() {
   fi
   _rr_list="$(echo "${response}" \
     | tr -d "\n\r\t" \
-    | sed -e 's/<item xsi:type="ns2:Map">/\n/g' \
+    | sed -e 's/<item xsi:type="ns2:Map">/\
+/g' \
     | grep ">$(_regexcape "$fulldomain")</value>" \
-    | sed -e 's/<\/item>/\n/g' \
+    | sed -e 's/<\/item>/\
+/g' \
     | grep '>id</key><value' \
     | _egrep_o '>[0-9]{1,16}<' \
     | tr -d '><')"
diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 53da4118..d9677632 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -77,7 +77,8 @@ dns_freedns_add() {
       | grep -i -e '</\?TABLE\|</\?TD\|</\?TR\|</\?TH' \
       | sed 's/^[\ \t]*//g' \
       | tr -d '\n' \
-      | sed 's/<\/TR[^>]*>/\n/Ig' \
+      | sed 's/<\/TR[^>]*>/\
+/Ig' \
       | sed 's/<\/\?\(TABLE\|TR\)[^>]*>//Ig' \
       | sed 's/^<T[DH][^>]*>\|<\/\?T[DH][^>]*>$//Ig' \
       | sed 's/<\/T[DH][^>]*><T[DH][^>]*>/,/Ig' \
@@ -216,7 +217,8 @@ dns_freedns_rm() {
       | grep -i -e '</\?TABLE\|</\?TD\|</\?TR\|</\?TH' \
       | sed 's/^[\ \t]*//g' \
       | tr -d '\n' \
-      | sed 's/<\/TR[^>]*>/\n/Ig' \
+      | sed 's/<\/TR[^>]*>/\
+/Ig' \
       | sed 's/<\/\?\(TABLE\|TR\)[^>]*>//Ig' \
       | sed 's/^<T[DH][^>]*>\|<\/\?T[DH][^>]*>$//Ig' \
       | sed 's/<\/T[DH][^>]*><T[DH][^>]*>/,/Ig' \
diff --git a/dnsapi/dns_linode.sh b/dnsapi/dns_linode.sh
index 6d54e6c1..d84ad5fb 100755
--- a/dnsapi/dns_linode.sh
+++ b/dnsapi/dns_linode.sh
@@ -68,7 +68,8 @@ dns_linode_rm() {
   _parameters="&DomainID=$_domain_id"
 
   if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
+&/g')"
 
     resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
@@ -128,7 +129,8 @@ _get_root() {
   p=1
 
   if _rest GET "domain.list"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
+&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"
diff --git a/dnsapi/dns_vscale.sh b/dnsapi/dns_vscale.sh
index e50b7d8b..fcd162c9 100755
--- a/dnsapi/dns_vscale.sh
+++ b/dnsapi/dns_vscale.sh
@@ -93,7 +93,8 @@ _get_root() {
   p=1
 
   if _vscale_rest GET "domains/"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
+&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"

From ff74778dea38ef22fb13fbdf452991c4a70135a1 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 26 Jul 2017 20:15:34 +0200
Subject: [PATCH 06/24] Fix few issues from Travis

---
 dnsapi/dns_he.sh | 45 ++++++++++++++++++---------------------------
 1 file changed, 18 insertions(+), 27 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 019a7a0b..1a6f8dbc 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -21,16 +21,14 @@ dns_he_add() {
   _info "Using DNS-01 Hurricane Electric hook"
 
   if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
-    _err \
-      'No auth details provided. Please set user credentials using the \
-      \$HE_Username and \$HE_Password envoronment variables.'
+    _err "No auth details provided. Please set user credentials using the \$HE_Username and \$HE_Password envoronment variables."
     return 1
   fi
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
   # fills in the $_zone_id
-  _find_zone $_full_domain || return 1
+  _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   body="email=${HE_Username}&pass=${HE_Password}"
@@ -46,11 +44,10 @@ dns_he_add() {
   body="$body&Content=$_txt_value"
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
-  response="$(_post $body "https://dns.he.net/")"
+  response="$(_post "$body" "https://dns.he.net/")"
   _debug2 response "$response"
 }
 
-
 #-- dns_he_rm() - Remove TXT record ------------------------------------
 # Usage: dns_he_rm _acme-challenge.subdomain.domain.com "XyZ123..."
 
@@ -60,7 +57,7 @@ dns_he_rm() {
   _info "Cleaning up after DNS-01 Hurricane Electric hook"
 
   # fills in the $_zone_id
-  _find_zone $_full_domain || return 1
+  _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   # Find the record id to clean
@@ -68,7 +65,7 @@ dns_he_rm() {
   body="$body&hosted_dns_zoneid=$_zone_id"
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
-  _record_id=$(_post $body "https://dns.he.net/" \
+  _record_id=$(_post "$body" "https://dns.he.net/" \
     | tr -d '\n' \
     | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
     | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
@@ -87,9 +84,9 @@ dns_he_rm() {
   body="$body&hosted_dns_delrecord=1"
   body="$body&hosted_dns_delconfirm=delete"
   body="$body&hosted_dns_editzone=1"
-  _post $body "https://dns.he.net/" \
+  _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
-    > /dev/null
+    >/dev/null
   if [ $? -eq 0 ]; then
     _info "Record removed successfuly."
   else
@@ -99,12 +96,9 @@ dns_he_rm() {
   fi
 }
 
-
 ########################## PRIVATE FUNCTIONS ###########################
 
-
 #-- _find_zone() -------------------------------------------------------
-
 # Returns the most specific zone found in administration interface.
 #
 # Example:
@@ -131,31 +125,28 @@ _find_zone() {
   ## ( zone1:id zone2:id ... )
 
   body="email=${HE_Username}&pass=${HE_Password}"
-  _all_zones=( $(_post $body "https://dns.he.net/" \
+  # TODO arrays aren't supported in POSIX sh
+  _all_zones=($(_post $body "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
-    | cut -d '"' -f 3,5 --output-delimiter=":" \
-  ) )
+    | cut -d '"' -f 3,5 --output-delimiter=":"
+  ))
 
   _strip_counter=1
-  while true
-  do
-    _attempted_zone=$(echo $_domain | cut -d . -f ${_strip_counter}-)
+  while true; do
+    _attempted_zone=$(echo "$_domain" | cut -d . -f ${_strip_counter}-)
 
     # All possible zone names have been tried
-    if [ -z "$_attempted_zone" ]
-    then
+    if [ -z "$_attempted_zone" ]; then
       _err "No zone for domain \"$_domain\" found."
       break
     fi
 
     # Walk through all zones on the account
     #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
-    for i in ${_all_zones[@]}
-    do
-      _zone_name=$(echo $i | cut -d ':' -f 1)
-      _zone_id=$(echo $i | cut -d ':' -f 2)
-      if [ "$_zone_name" = "$_attempted_zone" ]
-      then
+    for i in ${_all_zones[@]}; do
+      _zone_name=$(echo "$i" | cut -d ':' -f 1)
+      _zone_id=$(echo "$i" | cut -d ':' -f 2)
+      if [ "$_zone_name" = "$_attempted_zone" ]; then
         # Zone found - we got $_zone_name and $_zone_id, let's get out...
         _debug "Found relevant zone \"$_zone_name\" with id" \
           "\"$_zone_id\" - will be used for domain \"$_domain\"."

From 1546b7e5a971578cef11f960a44aadad3a45b754 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Wed, 26 Jul 2017 20:21:36 +0200
Subject: [PATCH 07/24] Missing quotes

---
 dnsapi/dns_he.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 1a6f8dbc..3e23b2e0 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -126,7 +126,7 @@ _find_zone() {
 
   body="email=${HE_Username}&pass=${HE_Password}"
   # TODO arrays aren't supported in POSIX sh
-  _all_zones=($(_post $body "https://dns.he.net/" \
+  _all_zones=($(_post "$body" "https://dns.he.net/" \
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
     | cut -d '"' -f 3,5 --output-delimiter=":"
   ))

From d39649f30d6718d7b0ec7e1e746a518b23bfd9be Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Thu, 27 Jul 2017 08:52:46 -0400
Subject: [PATCH 08/24] Revert non-linode scripts since they're untested

---
 dnsapi/dns_ad.sh      | 3 +--
 dnsapi/dns_do.sh      | 6 ++----
 dnsapi/dns_freedns.sh | 6 ++----
 dnsapi/dns_vscale.sh  | 3 +--
 4 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_ad.sh b/dnsapi/dns_ad.sh
index 79b8c2ab..fc4a664b 100755
--- a/dnsapi/dns_ad.sh
+++ b/dnsapi/dns_ad.sh
@@ -92,8 +92,7 @@ _get_root() {
   p=1
 
   if _ad_rest GET "domain/"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
-&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"
diff --git a/dnsapi/dns_do.sh b/dnsapi/dns_do.sh
index fb6d7dec..3a2f8f49 100755
--- a/dnsapi/dns_do.sh
+++ b/dnsapi/dns_do.sh
@@ -69,11 +69,9 @@ _dns_do_list_rrs() {
   fi
   _rr_list="$(echo "${response}" \
     | tr -d "\n\r\t" \
-    | sed -e 's/<item xsi:type="ns2:Map">/\
-/g' \
+    | sed -e 's/<item xsi:type="ns2:Map">/\n/g' \
     | grep ">$(_regexcape "$fulldomain")</value>" \
-    | sed -e 's/<\/item>/\
-/g' \
+    | sed -e 's/<\/item>/\n/g' \
     | grep '>id</key><value' \
     | _egrep_o '>[0-9]{1,16}<' \
     | tr -d '><')"
diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index d9677632..53da4118 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -77,8 +77,7 @@ dns_freedns_add() {
       | grep -i -e '</\?TABLE\|</\?TD\|</\?TR\|</\?TH' \
       | sed 's/^[\ \t]*//g' \
       | tr -d '\n' \
-      | sed 's/<\/TR[^>]*>/\
-/Ig' \
+      | sed 's/<\/TR[^>]*>/\n/Ig' \
       | sed 's/<\/\?\(TABLE\|TR\)[^>]*>//Ig' \
       | sed 's/^<T[DH][^>]*>\|<\/\?T[DH][^>]*>$//Ig' \
       | sed 's/<\/T[DH][^>]*><T[DH][^>]*>/,/Ig' \
@@ -217,8 +216,7 @@ dns_freedns_rm() {
       | grep -i -e '</\?TABLE\|</\?TD\|</\?TR\|</\?TH' \
       | sed 's/^[\ \t]*//g' \
       | tr -d '\n' \
-      | sed 's/<\/TR[^>]*>/\
-/Ig' \
+      | sed 's/<\/TR[^>]*>/\n/Ig' \
       | sed 's/<\/\?\(TABLE\|TR\)[^>]*>//Ig' \
       | sed 's/^<T[DH][^>]*>\|<\/\?T[DH][^>]*>$//Ig' \
       | sed 's/<\/T[DH][^>]*><T[DH][^>]*>/,/Ig' \
diff --git a/dnsapi/dns_vscale.sh b/dnsapi/dns_vscale.sh
index fcd162c9..e50b7d8b 100755
--- a/dnsapi/dns_vscale.sh
+++ b/dnsapi/dns_vscale.sh
@@ -93,8 +93,7 @@ _get_root() {
   p=1
 
   if _vscale_rest GET "domains/"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
-&/g')"
+    response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"

From aefed1d1b9a5264f460aa94e119cb8a40f8bdddd Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:04:53 +0200
Subject: [PATCH 09/24] Get rid of shell arrays.

---
 dnsapi/dns_he.sh | 69 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 45 insertions(+), 24 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3e23b2e0..ada5f794 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -121,16 +121,19 @@ _find_zone() {
 
   _domain="$1"
 
-  ## _all_zones is an array that looks like this:
-  ## ( zone1:id zone2:id ... )
-
   body="email=${HE_Username}&pass=${HE_Password}"
-  # TODO arrays aren't supported in POSIX sh
-  _all_zones=($(_post "$body" "https://dns.he.net/" \
-    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+" \
-    | cut -d '"' -f 3,5 --output-delimiter=":"
-  ))
+  _matches=$(_post "$body" "https://dns.he.net/" \
+    | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+"
+  )
+  # Zone names and zone IDs are in same order
+  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5 --output-delimiter=":")
+  _zone_names=$(echo "$_matches" | cut -d '"' -f 3 --output-delimiter=":")
+  _debug2 "These are the zones on this HE account:"
+  _debug2 "$_zone_names"
+  _debug2 "And these are their respective IDs:"
+  _debug2 "$_zone_ids"
 
+  # Walk through all possible zone names
   _strip_counter=1
   while true; do
     _attempted_zone=$(echo "$_domain" | cut -d . -f ${_strip_counter}-)
@@ -138,28 +141,46 @@ _find_zone() {
     # All possible zone names have been tried
     if [ -z "$_attempted_zone" ]; then
       _err "No zone for domain \"$_domain\" found."
-      break
+      return 1
     fi
 
-    # Walk through all zones on the account
-    #echo "$_all_zones" | while IFS=' ' read _zone_name _zone_id
-    for i in ${_all_zones[@]}; do
-      _zone_name=$(echo "$i" | cut -d ':' -f 1)
-      _zone_id=$(echo "$i" | cut -d ':' -f 2)
-      if [ "$_zone_name" = "$_attempted_zone" ]; then
-        # Zone found - we got $_zone_name and $_zone_id, let's get out...
-        _debug "Found relevant zone \"$_zone_name\" with id" \
-          "\"$_zone_id\" - will be used for domain \"$_domain\"."
-        return 0
-      fi
-    done
+    _debug "Looking for zone \"${_attempted_zone}\""
+    _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
+    if [ -n "$_line_num" ]; then
+      _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
+      _debug "Found relevant zone \"$_attempted_zone\" with id" \
+        "\"$_zone_id\" - will be used for domain \"$_domain\"."
+      return 0
+    fi
 
-    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try another \
-      variation."
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
+      "specific zone."
     _strip_counter=$(_math $_strip_counter + 1)
   done
+}
 
-  # No zone found.
+#-- _find_linenum()-----------------------------------------------------
+# Returns line number of line (supplied as an argument) in STDIN.
+#
+# Example:
+#
+#   printf "a\nb\nc" | _find_linenum "b"
+#
+#   This will:
+#    - print out 2 because that's the line number of "b"
+#    - return code 0 because it was found
+
+_find_linenum() {
+  _current_line_num=0
+  while read line; do
+    _current_line_num=$(expr "$_current_line_num" + 1)
+    if [ "$line" = "$1" ]; then
+      # Found! Let's echo the line number and quit
+      echo $_current_line_num
+      return 0
+    fi
+  done
+  # Not found
   return 1
 }
 

From 235b5b0c154331879b70fd149d1fe7df19eac4c8 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:06:19 +0200
Subject: [PATCH 10/24] Small cosmetic fixes.

---
 dnsapi/dns_he.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index ada5f794..51418aa9 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -11,7 +11,6 @@
 # Author: Ondrej Simek <me@ondrejsimek.com>
 # Git repo: https://github.com/angel333/acme.sh
 
-
 #-- dns_he_add() - Add TXT record --------------------------------------
 # Usage: dns_he_add _acme-challenge.subdomain.domain.com "XyZ123..."
 
@@ -86,7 +85,7 @@ dns_he_rm() {
   body="$body&hosted_dns_editzone=1"
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
-    >/dev/null
+      >/dev/null
   if [ $? -eq 0 ]; then
     _info "Record removed successfuly."
   else

From 577380e98e33c32f87d74df07d0d9d862b89b5be Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Thu, 27 Jul 2017 18:44:55 +0200
Subject: [PATCH 11/24] Few fixes for shellcheck

---
 dnsapi/dns_he.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 51418aa9..9b789d35 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -154,7 +154,7 @@ _find_zone() {
 
     _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
       "specific zone."
-    _strip_counter=$(_math $_strip_counter + 1)
+    _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }
 
@@ -171,11 +171,11 @@ _find_zone() {
 
 _find_linenum() {
   _current_line_num=0
-  while read line; do
-    _current_line_num=$(expr "$_current_line_num" + 1)
+  while read -r line; do
+    _current_line_num=$(_math "$_current_line_num" + 1)
     if [ "$line" = "$1" ]; then
       # Found! Let's echo the line number and quit
-      echo $_current_line_num
+      echo "$_current_line_num"
       return 0
     fi
   done

From 8e6cf669ad01905d4d9e22f7a2874dcba8c7e263 Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Thu, 27 Jul 2017 14:15:19 -0400
Subject: [PATCH 12/24] Try awk instead for \n replacements

---
 dnsapi/dns_linode.sh | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_linode.sh b/dnsapi/dns_linode.sh
index d84ad5fb..ee3b1c8b 100755
--- a/dnsapi/dns_linode.sh
+++ b/dnsapi/dns_linode.sh
@@ -68,8 +68,7 @@ dns_linode_rm() {
   _parameters="&DomainID=$_domain_id"
 
   if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
-&/g')"
+    response="$(echo "$response" | tr -d "\n" | awk '{ gsub("{","\n{",$1); print $1 }')"
 
     resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
@@ -129,8 +128,7 @@ _get_root() {
   p=1
 
   if _rest GET "domain.list"; then
-    response="$(echo "$response" | tr -d "\n" | sed 's/{/\
-&/g')"
+    response="$(echo "$response" | tr -d "\n" | awk '{ gsub("{","\n{",$1); print $1 }')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"

From 8534e3b2f7fd16477b811c262f60e9b63cb85e32 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 13:58:47 +0200
Subject: [PATCH 13/24] Make shellcheck happier

---
 dnsapi/dns_he.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 9b789d35..3ca00af9 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -20,6 +20,8 @@ dns_he_add() {
   _info "Using DNS-01 Hurricane Electric hook"
 
   if [ -z "$HE_Username" ] || [ -z "$HE_Password" ]; then
+    HE_Username=
+    HE_Password=
     _err "No auth details provided. Please set user credentials using the \$HE_Username and \$HE_Password envoronment variables."
     return 1
   fi

From d6780f9e49f18bf503f46c5d4859289e593935c0 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 15:29:35 +0200
Subject: [PATCH 14/24] Retain an exit code

---
 dnsapi/dns_he.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3ca00af9..ab4393c7 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -46,7 +46,9 @@ dns_he_add() {
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
   response="$(_post "$body" "https://dns.he.net/")"
+  exitcode=$?
   _debug2 response "$response"
+  return $exitvalue
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------

From ab1efd923b56b9014f07e7fcac7a81325d93d0b8 Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Fri, 28 Jul 2017 10:26:56 -0400
Subject: [PATCH 15/24] back to sed

---
 dnsapi/dns_linode.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_linode.sh b/dnsapi/dns_linode.sh
index ee3b1c8b..00634d5d 100755
--- a/dnsapi/dns_linode.sh
+++ b/dnsapi/dns_linode.sh
@@ -68,7 +68,7 @@ dns_linode_rm() {
   _parameters="&DomainID=$_domain_id"
 
   if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
-    response="$(echo "$response" | tr -d "\n" | awk '{ gsub("{","\n{",$1); print $1 }')"
+    response="$(echo "$response" | tr -d "\n" | sed $'s/{/\\\n&/g')"
 
     resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
@@ -128,7 +128,7 @@ _get_root() {
   p=1
 
   if _rest GET "domain.list"; then
-    response="$(echo "$response" | tr -d "\n" | awk '{ gsub("{","\n{",$1); print $1 }')"
+    response="$(echo "$response" | tr -d "\n" | sed $'s/{/\\\n&/g')"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"

From ccf9a9976c1b7cf31c60a4b74ead0f30fba1de28 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Fri, 28 Jul 2017 18:33:25 +0200
Subject: [PATCH 16/24] Fix the previous rushed commit.

---
 dnsapi/dns_he.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index ab4393c7..2fb1101e 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -46,9 +46,14 @@ dns_he_add() {
   body="$body&TTL=300"
   body="$body&hosted_dns_editrecord=Submit"
   response="$(_post "$body" "https://dns.he.net/")"
-  exitcode=$?
+  exit_code="$?"
+  if [ "$exit_code" -eq 0 ]; then
+    _info "TXT record added successfuly."
+  else
+    _err "Couldn't add the TXT record."
+    return "$exit_code"
+  fi
   _debug2 response "$response"
-  return $exitvalue
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------
@@ -90,7 +95,7 @@ dns_he_rm() {
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
-  if [ $? -eq 0 ]; then
+  if [ "$?" -eq 0 ]; then
     _info "Record removed successfuly."
   else
     _err \

From 31b67ab92efd23802acb8510126418b83e1af8db Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 13:52:28 +0200
Subject: [PATCH 17/24] Few non-critical fixes.

---
 dnsapi/dns_he.sh | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 2fb1101e..a160e16a 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -28,13 +28,12 @@ dns_he_add() {
   _saveaccountconf HE_Username "$HE_Username"
   _saveaccountconf HE_Password "$HE_Password"
 
-  # fills in the $_zone_id
+  # Fills in the $_zone_id
   _find_zone "$_full_domain" || return 1
   _debug "Zone id \"$_zone_id\" will be used."
 
   body="email=${HE_Username}&pass=${HE_Password}"
   body="$body&account="
-  body="$body&account="
   body="$body&menu=edit_zone"
   body="$body&Type=TXT"
   body="$body&hosted_dns_zoneid=$_zone_id"
@@ -91,16 +90,13 @@ dns_he_rm() {
   body="$body&hosted_dns_editzone=1"
   body="$body&hosted_dns_delrecord=1"
   body="$body&hosted_dns_delconfirm=delete"
-  body="$body&hosted_dns_editzone=1"
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
   if [ "$?" -eq 0 ]; then
     _info "Record removed successfuly."
   else
-    _err \
-      "Could not clean (remove) up the record. Please go to HE" \
-      "administration interface and clean it by hand."
+    _err "Could not clean (remove) up the record. Please go to HE administration interface and clean it by hand."
   fi
 }
 
@@ -134,8 +130,8 @@ _find_zone() {
     | _egrep_o "delete_dom.*name=\"[^\"]+\" value=\"[0-9]+"
   )
   # Zone names and zone IDs are in same order
-  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5 --output-delimiter=":")
-  _zone_names=$(echo "$_matches" | cut -d '"' -f 3 --output-delimiter=":")
+  _zone_ids=$(echo "$_matches" | cut -d '"' -f 5)
+  _zone_names=$(echo "$_matches" | cut -d '"' -f 3)
   _debug2 "These are the zones on this HE account:"
   _debug2 "$_zone_names"
   _debug2 "And these are their respective IDs:"
@@ -156,13 +152,11 @@ _find_zone() {
     _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
     if [ -n "$_line_num" ]; then
       _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
-      _debug "Found relevant zone \"$_attempted_zone\" with id" \
-        "\"$_zone_id\" - will be used for domain \"$_domain\"."
+      _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi
 
-    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less" \
-      "specific zone."
+    _debug "Zone \"$_attempted_zone\" doesn't exist, let's try a less specific zone."
     _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }

From a25b2af66cd6a4c69ee673ec32aaebd068079042 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:25:07 +0200
Subject: [PATCH 18/24] Get rid of _find_num

---
 dnsapi/dns_he.sh | 41 ++++++++++++-----------------------------
 1 file changed, 12 insertions(+), 29 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index a160e16a..7dde55d4 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -149,9 +149,18 @@ _find_zone() {
     fi
 
     _debug "Looking for zone \"${_attempted_zone}\""
-    _line_num=$(echo "$_zone_names" | _find_linenum "$_attempted_zone")
-    if [ -n "$_line_num" ]; then
-      _zone_id=$(echo "$_zone_ids" | sed "${_line_num}q;d")
+
+    # Take care of "." and only match whole lines. Note that grep -F
+    # cannot be used because there's no way to make it match whole
+    # lines.
+    regex="^$(echo "$_attempted_zone" | sed 's/\./\\./g')$"
+    line_num=$(echo "$_zone_names" \
+      | grep -n "$regex" \
+      | cut -d : -f 1
+    )
+
+    if [ -n "$line_num" ]; then
+      _zone_id=$(echo "$_zone_ids" | sed "${line_num}q;d")
       _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi
@@ -160,30 +169,4 @@ _find_zone() {
     _strip_counter=$(_math "$_strip_counter" + 1)
   done
 }
-
-#-- _find_linenum()-----------------------------------------------------
-# Returns line number of line (supplied as an argument) in STDIN.
-#
-# Example:
-#
-#   printf "a\nb\nc" | _find_linenum "b"
-#
-#   This will:
-#    - print out 2 because that's the line number of "b"
-#    - return code 0 because it was found
-
-_find_linenum() {
-  _current_line_num=0
-  while read -r line; do
-    _current_line_num=$(_math "$_current_line_num" + 1)
-    if [ "$line" = "$1" ]; then
-      # Found! Let's echo the line number and quit
-      echo "$_current_line_num"
-      return 0
-    fi
-  done
-  # Not found
-  return 1
-}
-
 # vim: et:ts=2:sw=2:

From f438ff4bab695818932149d5b6bcecb1b6bed712 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:29:13 +0200
Subject: [PATCH 19/24] Fix an improbable corner case.

---
 dnsapi/dns_he.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 7dde55d4..152d469c 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -72,10 +72,11 @@ dns_he_rm() {
   body="$body&hosted_dns_zoneid=$_zone_id"
   body="$body&menu=edit_zone"
   body="$body&hosted_dns_editzone="
+  domain_regex="$(echo "$_full_domain" | sed 's/\./\\./g')" # escape dots
   _record_id=$(_post "$body" "https://dns.he.net/" \
     | tr -d '\n' \
-    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${_full_domain}','TXT'\)" \
-    | _egrep_o "[0-9]+','${_full_domain}','TXT'\)$" \
+    | _egrep_o "data=\"&quot;${_txt_value}&quot;([^>]+>){6}[^<]+<[^;]+;deleteRecord\('[0-9]+','${domain_regex}','TXT'\)" \
+    | _egrep_o "[0-9]+','${domain_regex}','TXT'\)$" \
     | _egrep_o "^[0-9]+"
   )
   # The series of egreps above could have been done a bit shorter but

From baa1160594921e465ee798b77c5add4ed6b1d907 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:31:27 +0200
Subject: [PATCH 20/24] Make Shellcheck happier about exit codes

---
 dnsapi/dns_he.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 152d469c..3a1e6979 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -94,10 +94,12 @@ dns_he_rm() {
   _post "$body" "https://dns.he.net/" \
     | grep '<div id="dns_status" onClick="hideThis(this);">Successfully removed record.</div>' \
       >/dev/null
-  if [ "$?" -eq 0 ]; then
+  exit_code="$?"
+  if [ "$exit_code" -eq 0 ]; then
     _info "Record removed successfuly."
   else
     _err "Could not clean (remove) up the record. Please go to HE administration interface and clean it by hand."
+    return "$exit_code"
   fi
 }
 

From 4dd69a8b1adaacfbb5a4894a8a5fc0403e3b4e88 Mon Sep 17 00:00:00 2001
From: Ondrej Simek <me@ondrejsimek.com>
Date: Sat, 29 Jul 2017 14:40:56 +0200
Subject: [PATCH 21/24] Exit codes, exit codes... Exit codes everywhere...

---
 dnsapi/dns_he.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index 3a1e6979..7d86eb7a 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -50,9 +50,9 @@ dns_he_add() {
     _info "TXT record added successfuly."
   else
     _err "Couldn't add the TXT record."
-    return "$exit_code"
   fi
   _debug2 response "$response"
+  return "$exit_code"
 }
 
 #-- dns_he_rm() - Remove TXT record ------------------------------------

From 8eab77f3c607075ff1cd59b59f76b074f1d46605 Mon Sep 17 00:00:00 2001
From: Brian Candler <b.candler@pobox.com>
Date: Mon, 24 Jul 2017 14:23:01 +0100
Subject: [PATCH 22/24] Add deployment script for unifi controller

---
 acme.sh         |  28 +++++++++++---
 deploy/unifi.sh | 100 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 123 insertions(+), 5 deletions(-)
 create mode 100644 deploy/unifi.sh

diff --git a/acme.sh b/acme.sh
index 9486bcc5..60eef4bb 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1182,6 +1182,28 @@ _ss() {
   return 1
 }
 
+#outfile key cert cacert [password [name [caname]]]
+_toPkcs() {
+  _cpfx="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  pfxPassword="$5"
+  pfxName="$6"
+  pfxCaname="$7"
+
+  if [ "$pfxCaname" ]; then
+    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
+  elif [ "$pfxName" ]; then
+    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
+  elif [ "$pfxPassword" ]; then
+    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
+  else
+    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
+  fi
+
+}
+
 #domain [password] [isEcc]
 toPkcs() {
   domain="$1"
@@ -1195,11 +1217,7 @@ toPkcs() {
 
   _initpath "$domain" "$_isEcc"
 
-  if [ "$pfxPassword" ]; then
-    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
-  else
-    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
-  fi
+  _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
 
   if [ "$?" = "0" ]; then
     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
diff --git a/deploy/unifi.sh b/deploy/unifi.sh
new file mode 100644
index 00000000..184aa62e
--- /dev/null
+++ b/deploy/unifi.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env sh
+
+#Here is a script to deploy cert to unifi server.
+
+#returns 0 means success, otherwise error.
+
+#DEPLOY_UNIFI_KEYSTORE="/usr/lib/unifi/data/keystore"
+#DEPLOY_UNIFI_KEYPASS="aircontrolenterprise"
+#DEPLOY_UNIFI_RELOAD="service unifi restart"
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+unifi_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  if ! _exists keytool; then
+    _err "keytool not found"
+    return 1
+  fi
+
+  DEFAULT_UNIFI_KEYSTORE="/usr/lib/unifi/data/keystore"
+  _unifi_keystore="${DEPLOY_UNIFI_KEYSTORE:-$DEFAULT_UNIFI_KEYSTORE}"
+  DEFAULT_UNIFI_KEYPASS="aircontrolenterprise"
+  _unifi_keypass="${DEPLOY_UNIFI_KEYPASS:-$DEFAULT_UNIFI_KEYPASS}"
+  DEFAULT_UNIFI_RELOAD="service unifi restart"
+  _reload="${DEPLOY_UNIFI_RELOAD:-$DEFAULT_UNIFI_RELOAD}"
+
+  _debug _unifi_keystore "$_unifi_keystore"
+  if [ ! -f "$_unifi_keystore" ]; then
+    if [ -z "$DEPLOY_UNIFI_KEYSTORE" ]; then
+      _err "unifi keystore is not found, please define DEPLOY_UNIFI_KEYSTORE"
+      return 1
+    else
+      _err "It seems that the specified unifi keystore is not valid, please check."
+      return 1
+    fi
+  fi
+  if [ ! -w "$_unifi_keystore" ]; then
+    _err "The file $_unifi_keystore is not writable, please change the permission."
+    return 1
+  fi
+
+  _info "Generate import pkcs12"
+  _import_pkcs12="$(_mktemp)"
+  _toPkcs "$_import_pkcs12" "$_ckey" "$_ccert" "$_cca" "$_unifi_keypass" unifi root
+  if [ "$?" != "0" ]; then
+    _err "Oops, error creating import pkcs12, please report bug to us."
+    return 1
+  fi
+
+  _info "Modify unifi keystore: $_unifi_keystore"
+  if keytool -importkeystore \
+    -deststorepass "$_unifi_keypass" -destkeypass "$_unifi_keypass" -destkeystore "$_unifi_keystore" \
+    -srckeystore "$_import_pkcs12" -srcstoretype PKCS12 -srcstorepass "$_unifi_keypass" \
+    -alias unifi -noprompt; then
+    _info "Import keystore success!"
+    rm "$_import_pkcs12"
+  else
+    _err "Import unifi keystore error, please report bug to us."
+    rm "$_import_pkcs12"
+    return 1
+  fi
+
+  _info "Run reload: $_reload"
+  if eval "$_reload"; then
+    _info "Reload success!"
+    if [ "$DEPLOY_UNIFI_KEYSTORE" ]; then
+      _savedomainconf DEPLOY_UNIFI_KEYSTORE "$DEPLOY_UNIFI_KEYSTORE"
+    else
+      _cleardomainconf DEPLOY_UNIFI_KEYSTORE
+    fi
+    if [ "$DEPLOY_UNIFI_KEYPASS" ]; then
+      _savedomainconf DEPLOY_UNIFI_KEYPASS "$DEPLOY_UNIFI_KEYPASS"
+    else
+      _cleardomainconf DEPLOY_UNIFI_KEYPASS
+    fi
+    if [ "$DEPLOY_UNIFI_RELOAD" ]; then
+      _savedomainconf DEPLOY_UNIFI_RELOAD "$DEPLOY_UNIFI_RELOAD"
+    else
+      _cleardomainconf DEPLOY_UNIFI_RELOAD
+    fi
+    return 0
+  else
+    _err "Reload error"
+    return 1
+  fi
+  return 0
+
+}

From cd3a4573f26c03315121f505ac97b45c511d9cb9 Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Mon, 31 Jul 2017 08:37:30 -0400
Subject: [PATCH 23/24] Fix shell check errors

---
 dnsapi/dns_linode.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_linode.sh b/dnsapi/dns_linode.sh
index 00634d5d..26ca53e4 100755
--- a/dnsapi/dns_linode.sh
+++ b/dnsapi/dns_linode.sh
@@ -68,7 +68,7 @@ dns_linode_rm() {
   _parameters="&DomainID=$_domain_id"
 
   if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
-    response="$(echo "$response" | tr -d "\n" | sed $'s/{/\\\n&/g')"
+    response="$(echo "$response" | tr -d "\n"  | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
 
     resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
@@ -128,7 +128,7 @@ _get_root() {
   p=1
 
   if _rest GET "domain.list"; then
-    response="$(echo "$response" | tr -d "\n" | sed $'s/{/\\\n&/g')"
+    response="$(echo "$response" | tr -d "\n"  | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"

From c145f24621455f8608c179fc253d1fd00244bb6f Mon Sep 17 00:00:00 2001
From: Jeremy Knope <jerome@blackpixel.com>
Date: Thu, 3 Aug 2017 09:47:45 -0400
Subject: [PATCH 24/24] Remove extra space

---
 dnsapi/dns_linode.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_linode.sh b/dnsapi/dns_linode.sh
index 26ca53e4..ead5b164 100755
--- a/dnsapi/dns_linode.sh
+++ b/dnsapi/dns_linode.sh
@@ -68,7 +68,7 @@ dns_linode_rm() {
   _parameters="&DomainID=$_domain_id"
 
   if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then
-    response="$(echo "$response" | tr -d "\n"  | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
+    response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
 
     resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
@@ -128,7 +128,7 @@ _get_root() {
   p=1
 
   if _rest GET "domain.list"; then
-    response="$(echo "$response" | tr -d "\n"  | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
+    response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       _debug h "$h"