|
| 1 | +#!/usr/bin/env python3 |
| 2 | + |
| 3 | +import os |
| 4 | +import subprocess |
| 5 | +import json |
| 6 | +import time |
| 7 | +from pprint import pprint |
| 8 | + |
| 9 | +verbose = os.environ.get('VERBOSE', False) |
| 10 | + |
| 11 | + |
| 12 | +def check_for_command(command): |
| 13 | + try: |
| 14 | + subprocess.check_output(["command", "-v", command]) |
| 15 | + except: |
| 16 | + print( |
| 17 | + f"Couldn't find required {command} command.") |
| 18 | + exit(1) |
| 19 | + |
| 20 | + |
| 21 | +check_for_command("jq") |
| 22 | +check_for_command("curl") |
| 23 | + |
| 24 | + |
| 25 | +def read_string_option(env_name, human_name): |
| 26 | + v = os.environ.get(env_name, '') |
| 27 | + if len(v) == 0: |
| 28 | + v = input(f"Please input {human_name} > ") |
| 29 | + if len(v) == 0: |
| 30 | + print("Invalid {human_name}") |
| 31 | + return read_string_option(env_name, human_name) |
| 32 | + return v |
| 33 | + |
| 34 | + |
| 35 | +def request_create_user(user_name, user_email): |
| 36 | + url = f"{CF_API}/{account_tag}/access/users" |
| 37 | + # could also take a `custom` attribute with a map, e.g. {"custom": { "datacenter": "DFW" }} |
| 38 | + body = {'name': user_name, 'email': user_email} |
| 39 | + return request_post(url, body) |
| 40 | + |
| 41 | + |
| 42 | +def request_list_client_ids(): |
| 43 | + client_ids_response = request_get( |
| 44 | + f"{CF_API}/{account_tag}/access/service_tokens/") |
| 45 | + |
| 46 | + return " ".join(response['client_id'] for response in client_ids_response['result']) |
| 47 | + |
| 48 | + |
| 49 | +def request_create_service_token(service_token_name): |
| 50 | + response = request_post( |
| 51 | + f"{CF_API}/{account_tag}/access/service_tokens/", {'name': service_token_name}) |
| 52 | + client_id = response['result']['client_id'] |
| 53 | + client_secret = response['result']['client_secret'] |
| 54 | + return (client_id, client_secret) |
| 55 | + |
| 56 | + |
| 57 | +def request_list_service_tokens(): |
| 58 | + return request_get(f"{CF_API}/{account_tag}/access/service_tokens/") |
| 59 | + |
| 60 | + |
| 61 | +def request_enable_service_token_for_doh(service_token_id): |
| 62 | + url = f"{CF_API}/{account_tag}/access/organizations/doh/{service_token_id}" |
| 63 | + return request_put(url,"") |
| 64 | + |
| 65 | + |
| 66 | +def request_doh_token(account_tag, user_id, client_id, client_secret): |
| 67 | + url = f"https://{team_name}.cloudflareaccess.com/cdn-cgi/access/doh-token?account-id={account_tag}&user-id={user_id}&auth-domain={team_name}.cloudflareaccess.com" |
| 68 | + command = ['curl', '-s', url, '-X', 'GET', |
| 69 | + '-H', f"Cf-Access-Client-Id: {client_id}", |
| 70 | + '-H', f"Cf-Access-Client-Secret: {client_secret}"] |
| 71 | + if verbose: |
| 72 | + print(f"Issuing request {' '.join(command)}") |
| 73 | + response = json.loads(subprocess.check_output(command)) |
| 74 | + if verbose: |
| 75 | + print("Got response:") |
| 76 | + pprint(response) |
| 77 | + return response['token'] |
| 78 | + |
| 79 | + |
| 80 | +def request_post(url, body): |
| 81 | + return request("POST", url, body) |
| 82 | + |
| 83 | +def request_put(url, body): |
| 84 | + return request("PUT", url, body) |
| 85 | + |
| 86 | +def request_get(url): |
| 87 | + return request("GET", url, None) |
| 88 | + |
| 89 | + |
| 90 | +def request(method, url, body): |
| 91 | + command = ['curl', '-s', url, '-X', method, '-H', f"X-Auth-Email: {email}", '-H', |
| 92 | + f"X-Auth-Key: {auth_key}", '-H', 'Content-Type: application/json'] |
| 93 | + if body: |
| 94 | + command.append('--data') |
| 95 | + command.append(json.dumps(body)) |
| 96 | + if verbose: |
| 97 | + print(f"Issuing request {' '.join(command)}") |
| 98 | + response = json.loads(subprocess.check_output(command)) |
| 99 | + if 'errors' in response and len(response['errors']) > 0: |
| 100 | + pprint(response) |
| 101 | + exit(-1) |
| 102 | + if verbose: |
| 103 | + print("Got response:") |
| 104 | + pprint(response) |
| 105 | + return response |
| 106 | + |
| 107 | + |
| 108 | +account_tag = read_string_option('CF_ACCOUNT_TAG', "account tag") |
| 109 | +email = read_string_option('CF_EMAIL', "auth email") |
| 110 | +auth_key = read_string_option('CF_AUTH_KEY', "auth key") |
| 111 | +team_name = read_string_option('CF_TEAM_NAME', "team name") |
| 112 | + |
| 113 | +print(f"Using {account_tag} as account tag") |
| 114 | +print(f"Using {email} as auth email") |
| 115 | +print(f"Using {team_name} as team name") |
| 116 | + |
| 117 | +CF_API = "https://api.cloudflare.com/client/v4/accounts" |
| 118 | + |
| 119 | +user_id = os.environ.get('USER_ID', "") |
| 120 | + |
| 121 | +if len(user_id) == 0: |
| 122 | + print("No USER_ID provided, creating one.") |
| 123 | + user_name = input('Please input a user name > ') |
| 124 | + user_email = input('Please input a user email > ') |
| 125 | + response = request_create_user(user_name, user_email) |
| 126 | + user_id = response['result']['id'] |
| 127 | + user_email = print(f"Created user with ID {user_id}") |
| 128 | +else: |
| 129 | + print(f"Using USER_ID={user_id}") |
| 130 | + |
| 131 | +client_ids = request_list_client_ids() |
| 132 | + |
| 133 | +client_id = os.environ.get('CLIENT_ID', "") |
| 134 | + |
| 135 | +if len(client_id) == 0: |
| 136 | + print(f"Found following client IDs: {client_ids}") |
| 137 | + client_id = input( |
| 138 | + 'Please input service token client ID ("new" to create a new one)> ') |
| 139 | + |
| 140 | +if len(client_id) != 0 and client_id != "new" and client_id not in client_ids: |
| 141 | + print("Client ID not found in account") |
| 142 | + exit(-1) |
| 143 | + |
| 144 | +client_secret = "" |
| 145 | +if client_id == "new": |
| 146 | + service_token_name = input('Please input name for service token > ') |
| 147 | + client_id, client_secret = request_create_service_token(service_token_name) |
| 148 | + print( |
| 149 | + f"Created service token with client_id {client_id} and client_secret {client_secret}. You may want to save these secrets.") |
| 150 | + |
| 151 | + |
| 152 | +if len(client_secret) == 0: |
| 153 | + client_secret = read_string_option('CLIENT_SECRET', "client secret") |
| 154 | + |
| 155 | +service_tokens_response = request_list_service_tokens() |
| 156 | + |
| 157 | +service_token_id = [result['id'] |
| 158 | + for result in service_tokens_response['result'] if result['client_id'] == client_id][0] |
| 159 | + |
| 160 | + |
| 161 | +print("Enabling DoH token generation for service token") |
| 162 | +request_enable_service_token_for_doh(service_token_id) |
| 163 | + |
| 164 | +print("Obtaining new DoH token (this request may fail if the previous ones haven't propagated yet)") |
| 165 | +try: |
| 166 | + doh_token = request_doh_token(account_tag, user_id, client_id, client_secret) |
| 167 | +except json.decoder.JSONDecodeError: |
| 168 | + print("Request failed, waiting for 60 seconds before retrying") |
| 169 | + time.sleep(60) |
| 170 | + doh_token = request_doh_token(account_tag, user_id, client_id, client_secret) |
| 171 | +print(f"\n\nGot token: {doh_token}\n") |
| 172 | + |
| 173 | +print("You can now make doh requests such as:\n" |
| 174 | + f"curl 'https://{account_tag}.cloudflare-gateway.com/dns-query?name=example.com' \\\n" |
| 175 | + " -H 'accept: application/dns-json' \\\n" |
| 176 | + f" -H 'CF-Authorization: {doh_token}' | jq") |
0 commit comments