From 4bf1f579f51d7343c1b643f7bb357ba9e48d0cd6 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 16:28:57 +0200
Subject: [PATCH 01/13] Add OPNsense Bind API Support

---
 dnsapi/dns_opnsense.sh | 262 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 262 insertions(+)
 create mode 100755 dnsapi/dns_opnsense.sh

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
new file mode 100755
index 00000000..aa123541
--- /dev/null
+++ b/dnsapi/dns_opnsense.sh
@@ -0,0 +1,262 @@
+#!/usr/bin/env sh
+
+#OPNsense Bind API
+#https://docs.opnsense.org/development/api.html
+#
+#OPNs_Host="opnsense.example.com"
+#OPNs_Port="443"
+#OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
+#OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
+#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+
+########  Public functions #####################
+#Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
+#fulldomain
+#txtvalue
+dns_opnsense_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! set_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+#fulldomain
+dns_opnsense_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! rm_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+set_record() {
+  _info "Adding record"
+  fulldomain=$1
+  new_challenge=$2
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _return_str=""
+  _record_string=""
+  _build_record_string "$_domainid" "$_host" "$new_challenge"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Update
+    if _opns_rest "POST" "/record/setRecord/${_uuid}" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+
+  else
+    #create
+    if _opns_rest "POST" "/record/addRecord" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+  fi
+
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
+  then
+    _opns_rest "POST" "/service/reconfigure" "{}"
+    _debug "Record created"
+  else
+    _err "Error createing record $_record_string"
+    return 1
+  fi
+
+  return 0
+}
+
+rm_record() {
+  _info "Remove record"
+  fulldomain=$1
+  new_challenge="$2"
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Delete
+    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
+      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+        _opns_rest "POST" "/service/reconfigure" "{}"
+        _debug "Record deleted"
+      else
+        _err "Error delteting record $fulldomain"
+        return 1
+      fi
+    else
+        _err "Error delteting record $fulldomain"
+        return 1
+    fi
+  else
+    _info "Record not found, nothing to remove"
+  fi
+
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _domainid=domid
+ #_domain=domain.com
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  if _opns_rest "GET" "/domain/get"; then
+    _domain_response="$response"
+  else
+    return 1
+  fi
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+    _debug h "$h"
+    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+
+    if [ -n "$id" ];then
+      _debug id "$id"
+      _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain="${h}"
+      _domainid="${id}"
+      return 0
+    fi
+    p=$i
+    i=$(_math $i + 1)
+  done
+  _debug "$domain not found"
+
+  return 1
+}
+
+_opns_rest() {
+  method=$1
+  ep=$2
+  data=$3
+  #Percent encode user and token
+  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
+  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  export _H1="Content-Type: application/json"
+  if [ ! "$method" = "GET" ]; then
+    _debug data "$data"
+    export _H1="Content-Type: application/json"
+    response="$(_post "$data" "$opnsense_url" "" "$method")"
+  else
+    export _H1=""
+    response="$(_get "$opnsense_url")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+
+  return 0
+}
+
+_build_record_string() {
+  _record_string="{\"record\":{\"enabled\":\"1\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"}}"
+}
+
+_existingchallenge() {
+  if _opns_rest "GET" "/record/searchRecord"; then
+    _record_response="$response"
+  else
+    return 1
+  fi
+  _uuid=""
+  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+
+  if [ -n "$_uuid" ];then
+    _debug uuid "$_uuid"
+    return 0
+  fi
+  _debug "${2}.$1{1} record not found"
+
+  return 1
+}
+
+_opns_check_auth() {
+  OPNs_Host="${OPNs_Host:-$(_readaccountconf_mutable OPNs_Host)}"
+  OPNs_Port="${OPNs_Port:-$(_readaccountconf_mutable OPNs_Port)}"
+  OPNs_Key="${OPNs_Key:-$(_readaccountconf_mutable OPNs_Key)}"
+  OPNs_Token="${OPNs_Token:-$(_readaccountconf_mutable OPNs_Token)}"
+  OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
+
+  if [ -z "$OPNs_Host" ]; then
+    OPNs_Host="localhost"
+    _err "You don't specify OPNsense address."
+  fi
+
+  if [ -z "$OPNs_Port" ]; then
+    OPNs_Port="443"
+    _err "You don't specify OPNsense Port."
+  fi
+
+  if [ -z "$OPNs_Api_Insecure" ]; then
+    OPNs_Api_Insecure="0"
+  fi
+
+  if [ -z "$OPNs_Key" ]; then
+    OPNs_Key=""
+    _err "You don't specify OPNsense api key id."
+    _err "Please set you OPNs_Key and try again."
+    return 1
+  fi
+
+  if [ -z "$OPNs_Token" ]; then
+    OPNs_Token=""
+    _err "You don't specify OPNsense token."
+    _err "Please create you OPNs_Token and try again."
+    return 1
+  fi
+
+  #save the api addr and key to the account conf file.
+  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
+  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
+  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
+  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
+  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+
+  if ! _opns_rest "GET" "/general/get";then
+    _err "Can't Access OPNsense"
+    return 1
+  fi
+  return 0
+}

From dfb4883c936bed4377424aa3df3bb4a5a4576c2c Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:17:32 +0200
Subject: [PATCH 02/13] Some fixes

---
 dnsapi/dns_opnsense.sh | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index aa123541..8b7942a7 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -7,7 +7,7 @@
 #OPNs_Port="443"
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -74,8 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
-  then
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -103,8 +102,8 @@ rm_record() {
   _uuid=""
   if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
     # Delete
-    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
-      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+    if _opns_rest "POST" "/record/delRecord/${_uuid}" "\{\}"; then
+      if echo "$_return_str" | _egrep_o "\"result\":\"deleted\"" >/dev/null; then
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
@@ -112,8 +111,8 @@ rm_record() {
         return 1
       fi
     else
-        _err "Error delteting record $fulldomain"
-        return 1
+      _err "Error delteting record $fulldomain"
+      return 1
     fi
   else
     _info "Record not found, nothing to remove"
@@ -126,7 +125,7 @@ rm_record() {
 #_acme-challenge.www.domain.com
 #returns
 # _domainid=domid
- #_domain=domain.com
+#_domain=domain.com
 _get_root() {
   domain=$1
   i=2
@@ -144,9 +143,9 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
 
-    if [ -n "$id" ];then
+    if [ -n "$id" ]; then
       _debug id "$id"
       _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain="${h}"
@@ -166,8 +165,8 @@ _opns_rest() {
   ep=$2
   data=$3
   #Percent encode user and token
-  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
-  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+  key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
+  token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
   export _H1="Content-Type: application/json"
@@ -200,9 +199,9 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
 
-  if [ -n "$_uuid" ];then
+  if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"
     return 0
   fi
@@ -254,7 +253,7 @@ _opns_check_auth() {
   _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
-  if ! _opns_rest "GET" "/general/get";then
+  if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1
   fi

From ec654d2355b47571f6d6fc1cbfcc3a8e808491c3 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:24:00 +0200
Subject: [PATCH 03/13] More space removing

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 8b7942a7..ac8be539 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -74,7 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
+  if echo "$_return_str" | _egrep_o "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -143,7 +143,7 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
 
     if [ -n "$id" ]; then
       _debug id "$id"
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From bfa6e52470de86363112c4e265721cd36ed2e400 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 20:50:20 +0200
Subject: [PATCH 04/13] another whitespace

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ac8be539..ff6f8a54 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
+  _uuid=$(echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From c0449a3ed22e102cd68f959460619dd9ceff18cc Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:04:20 +0200
Subject: [PATCH 05/13] Only save Attributes if it is set

---
 dnsapi/dns_opnsense.sh | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ff6f8a54..ea9677b7 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -220,22 +220,32 @@ _opns_check_auth() {
   if [ -z "$OPNs_Host" ]; then
     OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
+    return 1
+  else
+    _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
   if [ -z "$OPNs_Port" ]; then
     OPNs_Port="443"
-    _err "You don't specify OPNsense Port."
+  else
+    _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
+  else
+  #save the api addr and key to the account conf file.
+    _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
     OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
@@ -243,15 +253,10 @@ _opns_check_auth() {
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-  #save the api addr and key to the account conf file.
-  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
-  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
-  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
-  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
-  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"

From 430956d3043d0a958fa696fe51a1d88f5c77d48d Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:13:35 +0200
Subject: [PATCH 06/13] Fix whitespaces

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ea9677b7..abd85abb 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -234,7 +234,7 @@ _opns_check_auth() {
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
   else
-  #save the api addr and key to the account conf file.
+    #save the api addr and key to the account conf file.
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"

From b85c1a88614b531698133565643e618482904f06 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:22:15 +0200
Subject: [PATCH 07/13] Fix additional line

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index abd85abb..0f7cdea6 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -257,7 +257,6 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1

From 0b3ae1f9727787f46eec66ce796e030a5474a845 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:10:30 +0100
Subject: [PATCH 08/13] Add suggestions

---
 dnsapi/dns_opnsense.sh | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 0f7cdea6..97f18d1a 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,15 +4,19 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443"
+#OPNs_Port="443" (optional, defaults to 443 if unset)
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
 #fulldomain
 #txtvalue
+OPNs_DefaultPort=443
+OPNs_DefaultApi_Insecure=0
+
+
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2
@@ -168,7 +172,7 @@ _opns_rest() {
   key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
   token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
-  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
@@ -218,29 +222,30 @@ _opns_check_auth() {
   OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
 
   if [ -z "$OPNs_Host" ]; then
-    OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
     return 1
   else
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if [ -z "$OPNs_Port" ]; then
-    OPNs_Port="443"
+  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+    _err 'OPNs_Port specified but not numeric value'
+    return 1
+  elif [ -z "$OPNs_Port" ]; then
+    _info "OPNSense port not specified. Defaulting to using port $OPNs_DefaultPort"
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-
-  if [ -z "$OPNs_Api_Insecure" ]; then
-    OPNs_Api_Insecure="0"
-  else
-    #save the api addr and key to the account conf file.
+  
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+    _err 'OPNs_Api_Insecure specified but not 0/1 value'
+    return 1
+  elif [ -n "$OPNs_Api_Insecure" ]; then
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
@@ -249,7 +254,6 @@ _opns_check_auth() {
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    OPNs_Token=""
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1

From afdf8a78c0a42e22265309c522ee3cda4993e227 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:18:09 +0100
Subject: [PATCH 09/13] fix space

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 97f18d1a..afd96c3e 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -236,7 +236,7 @@ _opns_check_auth() {
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-  
+
   if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1

From fc8d9df5162bdec5e401edc4e8d6faba80e92d89 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:33:38 +0100
Subject: [PATCH 10/13] fix newline

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index afd96c3e..6dde12a5 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -16,7 +16,6 @@
 OPNs_DefaultPort=443
 OPNs_DefaultApi_Insecure=0
 
-
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2

From 18fc42e63b5f4491502b8a2203036c93b1c4eaba Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <langenbachs@gmail.com>
Date: Thu, 7 Nov 2019 22:06:32 +0100
Subject: [PATCH 11/13] typos and integrate suggestions from stilez

---
 dnsapi/dns_opnsense.sh | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 6dde12a5..4fbe9447 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,10 +4,13 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443" (optional, defaults to 443 if unset)
+#OPNs_Port="443"
+# optional, defaults to 443 if unset
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0
+# optional, defaults to 0 if unset
+# Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -44,15 +47,16 @@ dns_opnsense_rm() {
 }
 
 set_record() {
-  _info "Adding record"
   fulldomain=$1
   new_challenge=$2
+  _info "Adding record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
     return 1
   fi
+
   _debug _domain "$_domain"
   _debug _host "$_host"
   _debug _domainid "$_domainid"
@@ -81,7 +85,7 @@ set_record() {
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
-    _err "Error createing record $_record_string"
+    _err "Error creating record $_record_string"
     return 1
   fi
 
@@ -89,9 +93,9 @@ set_record() {
 }
 
 rm_record() {
-  _info "Remove record"
   fulldomain=$1
   new_challenge="$2"
+  _info "Remove record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
@@ -110,18 +114,18 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error delteting record $fulldomain"
+        _err "Error deleting record $host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error delteting record $fulldomain"
+      _err "Error deleting record $host from domain $fulldomain"
       return 1
     fi
   else
     _info "Record not found, nothing to remove"
   fi
 
-  return 0
+  return 0  
 }
 
 ####################  Private functions below ##################################
@@ -173,6 +177,7 @@ _opns_rest() {
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
+  _debug2 "Try to call api: https://${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
     export _H1="Content-Type: application/json"
@@ -227,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -236,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then
@@ -245,23 +250,23 @@ _opns_check_auth() {
   export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    _err "You don't specify OPNsense api key id."
-    _err "Please set you OPNs_Key and try again."
+    _err "you have not specified your OPNsense api key id."
+    _err "Please set OPNs_Key and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    _err "You don't specify OPNsense token."
-    _err "Please create you OPNs_Token and try again."
+    _err "you have not specified your OPNsense token."
+    _err "Please create OPNs_Token and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
   if ! _opns_rest "GET" "/general/get"; then
-    _err "Can't Access OPNsense"
+    _err "Call to OPNsense API interface failed. Unable to access OPNsense API."
     return 1
   fi
   return 0

From 0c76890572932edc06bf3fb39c9e329b2ceec326 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:52:10 +0100
Subject: [PATCH 12/13] whitespace fix

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 4fbe9447..9e4af15f 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -125,7 +125,7 @@ rm_record() {
     _info "Record not found, nothing to remove"
   fi
 
-  return 0  
+  return 0
 }
 
 ####################  Private functions below ##################################
@@ -232,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -241,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then

From 9cb328966c63d86565276e3ccc7d7e53d5101514 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:58:51 +0100
Subject: [PATCH 13/13] typo

---
 dnsapi/dns_opnsense.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 9e4af15f..b2a3746f 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -114,11 +114,11 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error deleting record $host from domain $fulldomain"
+        _err "Error deleting record $_host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error deleting record $host from domain $fulldomain"
+      _err "Error deleting record $_host from domain $fulldomain"
       return 1
     fi
   else