coosld/dnsmgr
1
0
Fork 0
mirror of https://github.com/netcccyun/dnsmgr.git synced 2026-02-21 15:31:12 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'netcccyun:main' into main

Browse Source
This commit is contained in:
深山大柠檬 2025-12-28 23:56:35 +08:00 committed by GitHub
commit 8a795ef0ab
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 136 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/controller/Cert.php
View File

@ -304,10 +304,6 @@ class Cert extends BaseController
}
}
if ($certInfo['keytype'] == 'ECC') {
$privatekey = CertHelper::ensureECPrivateKeyFormat($privatekey);
}
$order = [
'aid' => 0,
'keytype' => $certInfo['keytype'],
@ -371,10 +367,6 @@ class Cert extends BaseController
if ($certInfo['code'] == -1) return json($certInfo);
$domains = $certInfo['domains'];
if ($certInfo['keytype'] == 'ECC') {
$privatekey = CertHelper::ensureECPrivateKeyFormat($privatekey);
}
$order = [
'aid' => 0,
'keytype' => $certInfo['keytype'],

18
app/lib/CertHelper.php
View File

@ -407,24 +407,6 @@ location / {
return false;
}
/**
* 确保ECC私钥使用EC专用格式标识
* 某些程序需要EC标识才能正确识别ECC私钥
*/
public static function ensureECPrivateKeyFormat($private_key)
{
if (strpos($private_key, '-----BEGIN EC PRIVATE KEY-----') !== false) {
return $private_key;
}
if (strpos($private_key, '-----BEGIN PRIVATE KEY-----') !== false) {
$private_key = preg_replace('/^-----BEGIN PRIVATE KEY-----$/m', '-----BEGIN EC PRIVATE KEY-----', $private_key);
$private_key = preg_replace('/^-----END PRIVATE KEY-----$/m', '-----END EC PRIVATE KEY-----', $private_key);
}
return $private_key;
}
public static function getPfx($fullchain, $privatekey, $pwd = '123456')
{
openssl_pkcs12_export($fullchain, $pfx, $privatekey, $pwd);

9
app/lib/DeployHelper.php
View File

@ -1224,6 +1224,7 @@ ctrl+x 保存退出',
['value'=>'tse', 'label'=>'云原生API网关TSE'],
['value'=>'tcb', 'label'=>'云开发TCB'],
['value'=>'lighthouse', 'label'=>'轻量应用服务器'],
['value'=>'update', 'label'=>'更新证书内容（证书ID不变）'],
],
'value' => 'cdn',
'required' => true,
@ -1327,6 +1328,14 @@ ctrl+x 保存退出',
'note' => 'CDN、EO、WAF多个域名可用,隔开，其他只能填写1个域名',
'required' => true,
],
'cert_id' => [
'name' => '证书ID',
'type' => 'input',
'placeholder' => '要更新的证书ID，在我的证书列表查看',
'show' => 'product==\'update\'',
'required' => true,
'note' => '当前接口需联系加白使用',
],
],
],
'huawei' => [

5
app/lib/acme/ACMECert.php
View File

@ -4,7 +4,6 @@ namespace app\lib\acme;
use Exception;
use stdClass;
use app\lib\CertHelper;
/**
* ACMECert
@ -369,12 +368,10 @@ class ACMECert extends ACMEv2
if (version_compare(PHP_VERSION, '7.1.0') < 0) throw new Exception('PHP >= 7.1.0 required for EC keys !');
$map = array('256' => 'prime256v1', '384' => 'secp384r1', '521' => 'secp521r1');
if (isset($map[$curve_name])) $curve_name = $map[$curve_name];
$pem = $this->generateKey(array(
return $this->generateKey(array(
'curve_name' => $curve_name,
'private_key_type' => OPENSSL_KEYTYPE_EC
));
return CertHelper::ensureECPrivateKeyFormat($pem);
}
public function parseCertificate($cert_pem)

11
app/lib/deploy/ssh.php
View File

@ -159,9 +159,14 @@ class ssh implements DeployInterface
file_put_contents($privateKeyPath, $this->config['privatekey']);
file_put_contents($publicKeyPath, $publicKey);
umask($umask);
$passphrase = $this->config['passphrase'] ?? null; // 私钥密码
if (!ssh2_auth_pubkey_file($connection, $this->config['username'], $publicKeyPath, $privateKeyPath, $passphrase)) {
throw new Exception('私钥认证失败');
if (!empty($this->config['passphrase'])) {
if (!ssh2_auth_pubkey_file($connection, $this->config['username'], $publicKeyPath, $privateKeyPath, $this->config['passphrase'])) {
throw new Exception('私钥认证失败');
}
} else {
if (!ssh2_auth_pubkey_file($connection, $this->config['username'], $publicKeyPath, $privateKeyPath)) {
throw new Exception('私钥认证失败');
}
}
} else {
if (!ssh2_auth_password($connection, $this->config['username'], $this->config['password'])) {

92
app/lib/deploy/tencent.php
View File

@ -31,6 +31,9 @@ class tencent implements DeployInterface
public function deploy($fullchain, $privatekey, $config, &$info)
{
if ($config['product'] == 'update') {
return $this->update_cert($fullchain, $privatekey, $config);
}
$cert_id = $this->get_cert_id($fullchain, $privatekey);
if (!$cert_id) throw new Exception('证书ID获取失败');
if ($config['product'] == 'cos') {
@ -281,6 +284,95 @@ class tencent implements DeployInterface
$this->log('边缘安全加速域名 ' . $config['domain'] . ' 部署证书成功！');
}
private function update_cert($fullchain, $privatekey, $config)
{
if (empty($config['cert_id'])) throw new Exception('证书ID不能为空');
$param = [
'CertificateIds' => [$config['cert_id']],
'IsCache' => 1,
];
try {
$data = $this->client->request('CreateCertificateBindResourceSyncTask', $param);
if (empty($data['CertTaskIds'])) throw new Exception('返回任务ID为空');
} catch (Exception $e) {
throw new Exception('创建关联云资源查询任务失败：' . $e->getMessage());
}
$task_id = $data['CertTaskIds'][0]['TaskId'];
$this->log('创建关联云资源查询任务成功 TaskId=' . $task_id);
$retry = 0;
$resource_result = null;
while ($retry++ < 30) {
sleep(2);
$param = [
'TaskIds' => [$task_id],
];
try {
$data = $this->client->request('DescribeCertificateBindResourceTaskResult', $param);
if (empty($data['SyncTaskBindResourceResult'])) throw new Exception('返回结果为空');
} catch (Exception $e) {
throw new Exception('查询关联云资源任务结果失败：' . $e->getMessage());
}
$taskResult = $data['SyncTaskBindResourceResult'][0];
if ($taskResult['Status'] == 1) {
$resource_result = $taskResult['BindResourceResult'];
break;
} elseif ($taskResult['Status'] == 2) {
throw new Exception('关联云资源查询任务执行失败：' . isset($taskResult['Error']) ? $taskResult['Error']['Message'] : '未知错误');
}
};
if (!$resource_result) {
throw new Exception('关联云资源查询任务超时未完成，请稍后重试');
}
$resourceTypes = [];
$resourceTypesRegions = [];
foreach ($resource_result as $res) {
if ($res['ResourceType'] != 'clb') continue;
$totalCount = 0;
$regions = [];
foreach ($res['BindResourceRegionResult'] as $regionRes) {
if ($regionRes['TotalCount'] > 0) {
$totalCount += $regionRes['TotalCount'];
if (!empty($regionRes['Region'])) {
$regions[] = $regionRes['Region'];
}
}
}
if ($totalCount > 0) {
$resourceTypes[] = $res['ResourceType'];
if (!empty($regions)) {
$resourceTypesRegions[] = [
'ResourceType' => $res['ResourceType'],
'Regions' => $regions,
];
}
}
}
$param = [
'OldCertificateId' => $config['cert_id'],
'CertificatePublicKey' => $fullchain,
'CertificatePrivateKey' => $privatekey,
'ResourceTypes' => $resourceTypes,
'ResourceTypesRegions' => $resourceTypesRegions,
];
$retry = 0;
while ($retry++ < 10) {
try {
$data = $this->client->request('UploadUpdateCertificateInstance', $param);
} catch (Exception $e) {
throw new Exception('更新证书内容失败：' . $e->getMessage());
}
if ($data['DeployStatus'] == 1) {
break;
}
sleep(1);
}
$this->log('更新证书内容成功，可能需要一些时间完成各资源的证书更新部署');
}
public function setLogger($func)
{
$this->logger = $func;

26
app/lib/deploy/upyun.php
View File

@ -31,9 +31,15 @@ class upyun implements DeployInterface
$this->login();
$url = 'https://console.upyun.com/api/https/certificate/';
// 如果是 EC 证书，调整私钥头为 EC PRIVATE KEY
$privatekey_send = $privatekey;
if ($this->isEcCertificate($fullchain)) {
$privatekey_send = str_replace('-----BEGIN PRIVATE KEY-----', '-----BEGIN EC PRIVATE KEY-----', $privatekey_send);
$privatekey_send = str_replace('-----END PRIVATE KEY-----', '-----END EC PRIVATE KEY-----', $privatekey_send);
}
$params = [
'certificate' => $fullchain,
'private_key' => $privatekey,
'private_key' => $privatekey_send,
];
$response = http_request($url, http_build_query($params), null, $this->cookie, null, $this->proxy);
$result = json_decode($response['body'], true);
@ -130,4 +136,22 @@ class upyun implements DeployInterface
call_user_func($this->logger, $txt);
}
}
/**
* 判断是否为 EC (ECDSA) 证书
*/
private function isEcCertificate($fullchain)
{
// 提取第一个证书
if (!preg_match('/-----BEGIN CERTIFICATE-----\s*(.+?)\s*-----END CERTIFICATE-----/s', $fullchain, $m)) {
return false;
}
$pubKey = openssl_pkey_get_public($m[0]);
if (!$pubKey) return false;
$details = openssl_pkey_get_details($pubKey);
return $details && ($details['type'] ?? 0) === OPENSSL_KEYTYPE_EC;
}
}

2
config/app.php
View File

@ -31,7 +31,7 @@ return [
'show_error_msg' => true,
'exception_tmpl' => \think\facade\App::getAppPath() . 'view/exception.tpl',
'version' => '1043',
'version' => '1044',
'dbversion' => '1040'
];