I have a script that tries to update the Google DDNS record with my public IP using the Google's API as described here. The idea is to replicate this HTML query:
Example HTTP query:
POST /nic/update?hostname=subdomain.yourdomain.com&myip=1.2.3.4 HTTP/1.1
Host: domains.google.com
Authorization: Basic base64-encoded-auth-string User-Agent: Chrome/41.0 your_email@yourdomain.com
The full API url is https://domains.google.com/nic/update. Here is my python script
def pub_ip(url='https://domains.google.com/checkip'):
r = get(url)
if not r.ok:
raise Exception('GET failed with code {}'.format(r.status_code))
return r.text
def change_ddns_ip(ip):
print('Setting new DDNS IP to {}'.format(ip))
AUTH = 'Basic {}'.format(str(b64encode(b'user:pass'))[2:-1])
HOSTNAME = 'sub.domain.com'
POST_URL = 'https://domains.google.com/nic/update?hostname={}&myip={}'.format(HOSTNAME, ip)
headers = {
'User-Agent': 'DDNS Update Python Script',
'From': 'email@dm.com',
'Host': 'domains.google.com',
"Authorization": AUTH
}
r = post(POST_URL, headers=headers)
if not r.ok:
raise Exception('POST failed with code {}'.format(r.status_code))
return r.text
def process_text(text):
status, ip = text.split(' ')
print(status)
if status != 'good':
raise Exception(text)
return ip
ip = pub_ip()
text = change_ddns_ip(ip)
_ip = process_text(text)
while True:
ip = pub_ip()
if _ip != ip:
text = change_ddns_ip(ip)
_ip = process_text(text)
sleep(5)
My main concern is the POST request done in change_ddns_ip(ip). Did I make it securely? The url in it looks like url?param=val which makes me nervous because I thought POST did not send data in the url? Could someone clarify why does then the url above look like it does?
Since there is sensitive information being sent here, I'll really appreciate if someone took a look and told me if there are any security flaws anywhere in the script? It is meant to run as a daemon. Here are the import statements that I omitted from above.
from requests import get, post
from base64 import b64encode
from time import sleep
