From 2f638e4edfa390aab07bb6ca48c9a0ef050355a6 Mon Sep 17 00:00:00 2001
From: root <root@helios.diagimm.fr>
Date: Sun, 9 Oct 2022 23:14:40 +0200
Subject: [PATCH] initial

---
 conf_tlsa-ovh.ini | 10 ++++++
 testCertTLSA.py   | 27 +++++++++++++++
 tlsa-ovh.py       | 86 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 123 insertions(+)
 create mode 100644 conf_tlsa-ovh.ini
 create mode 100644 testCertTLSA.py
 create mode 100755 tlsa-ovh.py

diff --git a/conf_tlsa-ovh.ini b/conf_tlsa-ovh.ini
new file mode 100644
index 0000000..707873a
--- /dev/null
+++ b/conf_tlsa-ovh.ini
@@ -0,0 +1,10 @@
+[default]
+endpoint=ovh-eu
+zoneName=[ENTER YOUR zoneName]
+subDomains=[ENTER subDomains LIKE _465._tcp,_25._tcp, _465._tcp.serv,_25._tcp.serv ...]
+cert=[PATH TO cert.pem]
+
+[ovh-eu]
+application_key=**ENTER APPLICATION KEY**
+application_secret=**ENTER APPLICATION KEY**
+consumer_key=**ENTER APPLICATION KEY**
diff --git a/testCertTLSA.py b/testCertTLSA.py
new file mode 100644
index 0000000..de78762
--- /dev/null
+++ b/testCertTLSA.py
@@ -0,0 +1,27 @@
+import hashlib
+import configparser
+import os
+
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+
+
+current_path = os.path.dirname(os.path.abspath(__file__)) + "/"
+config = configparser.ConfigParser()
+config.read(current_path + 'conf_tlsa-ovh.ini')
+cert = config['default']['cert']
+
+with open(cert, 'r') as f:
+    mx_pem_cert = f.read()
+mx_cert = x509.load_pem_x509_certificate(mx_pem_cert.encode('ascii'), default_backend())
+
+mx_pubkey = mx_cert.public_key()
+mx_pubkey_bytes = mx_pubkey.public_bytes(Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
+digest = hashlib.sha256(mx_pubkey_bytes).hexdigest()
+print(f'_25._tcp.example.com TLSA 3 0 1 {digest}')
+
+mx_der_certbytes = mx_cert.public_bytes(Encoding.DER)
+digest2 = hashlib.sha256(mx_der_certbytes).hexdigest()
+print(f'_25._tcp.example.com TLSA 3 1 1 {digest2}')
+
diff --git a/tlsa-ovh.py b/tlsa-ovh.py
new file mode 100755
index 0000000..72575e7
--- /dev/null
+++ b/tlsa-ovh.py
@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+import configparser
+import subprocess
+import ovh
+import os
+
+
+def set_records(list_tlsa, zoneName, cert):
+    for value in list_tlsa:
+        tab = value['subDomain'].replace('_', '').split(".")
+        i = len(tab)
+        
+        if i == 3:
+            port, proto, subDomain = tab
+            domain = subDomain + "." + zoneName
+        if i == 2:
+            port, proto = tab
+            domain = zoneName
+                    
+        if i != 2 and i != 3: exit(1)
+
+        cmd = "tlsa --certificate " + cert\
+              + " --port " + port\
+              + " --create "\
+              + domain
+
+        exitcode, output = subprocess.getstatusoutput(cmd)
+        if exitcode:
+            print("Error: " + output)
+            exit(exitcode)
+        target = ""
+        for line in output.splitlines():
+            if line.startswith("_"):
+                start = line.find("TLSA")
+                end = line.__len__()
+                target = line[start + 5:end]
+                if not target:
+                    print("Error: Target null for " + line)
+                    exit(1)
+        if value['id'] == 0:
+            client.post('/domain/zone/{zoneName}/record'.format(zoneName=zoneName),
+                        fieldType="TLSA", subDomain=value['subDomain'], target=target)
+        else:
+            client.put('/domain/zone/{zoneName}/record/{id}'.format(zoneName=zoneName, id=value['id']), target=target)
+
+
+def refresh(zoneName):
+    client.post('/domain/zone/{zoneName}/refresh'.format(zoneName=zoneName))
+
+
+# execute only if run as a script
+if __name__ == "__main__":
+    current_path = os.path.dirname(os.path.abspath(__file__)) + "/"
+    config = configparser.ConfigParser()
+    config.read(current_path + 'conf_tlsa-ovh.ini')
+    endpoint = config['default']['endpoint']
+    zoneName = config['default']['zoneName']
+    list_subDomain = config['default']['subDomains'].split(",")
+    cert =  config['default']['cert']
+    # Instantiate. Visit https://api.ovh.com/createToken/?GET=/me
+    # to get your credentials
+    client = ovh.Client(
+        endpoint=endpoint,
+        application_key=config[endpoint]['application_key'],
+        application_secret=config[endpoint]['application_secret'],
+        consumer_key=config[endpoint]['consumer_key'],
+    )
+    results = client.get("/domain/zone/{zoneName}/record".format(zoneName=zoneName))
+    list_tlsa = []
+    list_tlsa_subDomains = []
+
+    for i in results:
+        result = client.get('/domain/zone/{zoneName}/record/{id}'.format(zoneName=zoneName, id=i))
+        if result["fieldType"] == "TLSA":
+            list_tlsa.append(result)
+            list_tlsa_subDomains.append(result['subDomain'])
+
+    diff_subDomains = set(list_subDomain).difference(list_tlsa_subDomains)
+    list_diff_subDomains = []
+    for item in diff_subDomains:
+        list_diff_subDomains.append({'id': 0, 'subDomain': item})
+    
+    set_records(list_tlsa, zoneName, cert)
+    set_records(list_diff_subDomains, zoneName, cert)
+    refresh(zoneName)
+    exit(0)