certificates/acme/api/handler.go

401 lines
12 KiB
Go
Raw Normal View History

2019-05-27 00:41:10 +00:00
package api
import (
"context"
2021-03-05 07:10:46 +00:00
"crypto/tls"
2021-03-11 07:05:46 +00:00
"crypto/x509"
2021-03-05 07:10:46 +00:00
"encoding/json"
2021-03-11 07:05:46 +00:00
"encoding/pem"
2019-05-27 00:41:10 +00:00
"fmt"
2021-03-05 07:10:46 +00:00
"net"
2019-05-27 00:41:10 +00:00
"net/http"
2021-03-05 07:10:46 +00:00
"time"
2019-05-27 00:41:10 +00:00
"github.com/go-chi/chi"
2019-05-27 00:41:10 +00:00
"github.com/smallstep/certificates/acme"
"github.com/smallstep/certificates/api"
"github.com/smallstep/certificates/api/render"
2022-04-27 22:42:26 +00:00
"github.com/smallstep/certificates/authority"
2021-03-05 07:10:46 +00:00
"github.com/smallstep/certificates/authority/provisioner"
2019-05-27 00:41:10 +00:00
)
func link(url, typ string) string {
return fmt.Sprintf("<%s>;rel=%q", url, typ)
2019-05-27 00:41:10 +00:00
}
2021-03-05 07:10:46 +00:00
// Clock that returns time in UTC rounded to seconds.
2021-03-29 19:04:14 +00:00
type Clock struct{}
2021-03-05 07:10:46 +00:00
// Now returns the UTC time rounded to seconds.
func (c *Clock) Now() time.Time {
return time.Now().UTC().Truncate(time.Second)
2021-03-05 07:10:46 +00:00
}
2021-03-29 19:04:14 +00:00
var clock Clock
2021-03-05 07:10:46 +00:00
2019-05-27 00:41:10 +00:00
type payloadInfo struct {
value []byte
isPostAsGet bool
isEmptyJSON bool
}
2021-03-05 07:10:46 +00:00
// HandlerOptions required to create a new ACME API request handler.
type HandlerOptions struct {
// DB storage backend that impements the acme.DB interface.
2022-04-27 22:42:26 +00:00
//
// Deprecated: use acme.NewContex(context.Context, acme.DB)
2021-03-05 07:10:46 +00:00
DB acme.DB
2022-04-27 22:42:26 +00:00
// CA is the certificate authority interface.
//
// Deprecated: use authority.NewContext(context.Context, *authority.Authority)
CA acme.CertificateAuthority
// Backdate is the duration that the CA will substract from the current time
// to set the NotBefore in the certificate.
Backdate provisioner.Duration
2021-03-05 07:10:46 +00:00
// DNS the host used to generate accurate ACME links. By default the authority
// will use the Host from the request, so this value will only be used if
// request.Host is empty.
DNS string
2022-04-27 22:42:26 +00:00
2021-03-05 07:10:46 +00:00
// Prefix is a URL path prefix under which the ACME api is served. This
// prefix is required to generate accurate ACME links.
// E.g. https://ca.smallstep.com/acme/my-acme-provisioner/new-account --
// "acme" is the prefix from which the ACME api is accessed.
Prefix string
2022-04-27 22:42:26 +00:00
// PrerequisitesChecker checks if all prerequisites for serving ACME are
// met by the CA configuration.
PrerequisitesChecker func(ctx context.Context) (bool, error)
2022-04-27 22:42:26 +00:00
linker Linker
validateChallengeOptions *acme.ValidateChallengeOptions
}
type optionsKey struct{}
func newOptionsContext(ctx context.Context, o *HandlerOptions) context.Context {
return context.WithValue(ctx, optionsKey{}, o)
}
func optionsFromContext(ctx context.Context) *HandlerOptions {
o, ok := ctx.Value(optionsKey{}).(*HandlerOptions)
if !ok {
panic("acme options are not in the context")
2022-04-27 22:42:26 +00:00
}
return o
}
var mustAuthority = func(ctx context.Context) acme.CertificateAuthority {
return authority.MustFromContext(ctx)
}
// Handler is the ACME API request handler.
type Handler struct {
opts *HandlerOptions
}
// Route traffic and implement the Router interface.
//
// Deprecated: Use api.Route(r Router, opts *HandlerOptions)
func (h *Handler) Route(r api.Router) {
Route(r, h.opts)
2019-05-27 00:41:10 +00:00
}
2021-03-05 07:10:46 +00:00
// NewHandler returns a new ACME API handler.
2022-04-27 22:42:26 +00:00
//
// Deprecated: Use api.Route(r Router, opts *HandlerOptions)
2021-03-05 07:10:46 +00:00
func NewHandler(ops HandlerOptions) api.RouterHandler {
2022-04-27 22:42:26 +00:00
return &Handler{
opts: &ops,
}
}
// Route traffic and implement the Router interface.
func Route(r api.Router, opts *HandlerOptions) {
// by default all prerequisites are met
if opts.PrerequisitesChecker == nil {
opts.PrerequisitesChecker = func(ctx context.Context) (bool, error) {
return true, nil
}
}
transport := &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
},
}
client := http.Client{
Timeout: 30 * time.Second,
Transport: transport,
}
dialer := &net.Dialer{
Timeout: 30 * time.Second,
}
2022-04-27 22:42:26 +00:00
opts.linker = NewLinker(opts.DNS, opts.Prefix)
opts.validateChallengeOptions = &acme.ValidateChallengeOptions{
HTTPGet: client.Get,
LookupTxt: net.LookupTXT,
TLSDial: func(network, addr string, config *tls.Config) (*tls.Conn, error) {
return tls.DialWithDialer(dialer, network, addr, config)
},
2021-03-05 07:10:46 +00:00
}
2019-05-27 00:41:10 +00:00
2022-04-27 22:42:26 +00:00
withOptions := func(next nextHTTP) nextHTTP {
return func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
// For backward compatibility with NewHandler.
if ca, ok := opts.CA.(*authority.Authority); ok && ca != nil {
ctx = authority.NewContext(ctx, ca)
}
if opts.DB != nil {
ctx = acme.NewContext(ctx, opts.DB)
}
ctx = newOptionsContext(ctx, opts)
next(w, r.WithContext(ctx))
}
}
2019-05-27 00:41:10 +00:00
2021-07-02 23:56:14 +00:00
validatingMiddleware := func(next nextHTTP) nextHTTP {
2022-04-27 22:42:26 +00:00
return withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(verifyContentType(parseJWS(validateJWS(next)))))))))
2021-07-02 23:56:14 +00:00
}
2019-05-27 00:41:10 +00:00
extractPayloadByJWK := func(next nextHTTP) nextHTTP {
2022-04-27 22:42:26 +00:00
return withOptions(validatingMiddleware(extractJWK(verifyAndExtractJWSPayload(next))))
2019-05-27 00:41:10 +00:00
}
extractPayloadByKid := func(next nextHTTP) nextHTTP {
2022-04-27 22:42:26 +00:00
return withOptions(validatingMiddleware(lookupJWK(verifyAndExtractJWSPayload(next))))
2021-07-02 23:56:14 +00:00
}
extractPayloadByKidOrJWK := func(next nextHTTP) nextHTTP {
2022-04-27 22:42:26 +00:00
return withOptions(validatingMiddleware(extractOrLookupJWK(verifyAndExtractJWSPayload(next))))
}
2022-04-27 22:42:26 +00:00
getPath := opts.linker.GetUnescapedPathSuffix
// Standard ACME API
r.MethodFunc("GET", getPath(NewNonceLinkType, "{provisionerID}"),
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(GetNonce)))))))
r.MethodFunc("HEAD", getPath(NewNonceLinkType, "{provisionerID}"),
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(GetNonce)))))))
r.MethodFunc("GET", getPath(DirectoryLinkType, "{provisionerID}"),
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(GetDirectory)))))
r.MethodFunc("HEAD", getPath(DirectoryLinkType, "{provisionerID}"),
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(GetDirectory)))))
r.MethodFunc("POST", getPath(NewAccountLinkType, "{provisionerID}"),
extractPayloadByJWK(NewAccount))
r.MethodFunc("POST", getPath(AccountLinkType, "{provisionerID}", "{accID}"),
extractPayloadByKid(GetOrUpdateAccount))
r.MethodFunc("POST", getPath(KeyChangeLinkType, "{provisionerID}", "{accID}"),
extractPayloadByKid(NotImplemented))
r.MethodFunc("POST", getPath(NewOrderLinkType, "{provisionerID}"),
extractPayloadByKid(NewOrder))
r.MethodFunc("POST", getPath(OrderLinkType, "{provisionerID}", "{ordID}"),
extractPayloadByKid(isPostAsGet(GetOrder)))
r.MethodFunc("POST", getPath(OrdersByAccountLinkType, "{provisionerID}", "{accID}"),
extractPayloadByKid(isPostAsGet(GetOrdersByAccountID)))
r.MethodFunc("POST", getPath(FinalizeLinkType, "{provisionerID}", "{ordID}"),
extractPayloadByKid(FinalizeOrder))
r.MethodFunc("POST", getPath(AuthzLinkType, "{provisionerID}", "{authzID}"),
extractPayloadByKid(isPostAsGet(GetAuthorization)))
r.MethodFunc("POST", getPath(ChallengeLinkType, "{provisionerID}", "{authzID}", "{chID}"),
extractPayloadByKid(GetChallenge))
r.MethodFunc("POST", getPath(CertificateLinkType, "{provisionerID}", "{certID}"),
extractPayloadByKid(isPostAsGet(GetCertificate)))
r.MethodFunc("POST", getPath(RevokeCertLinkType, "{provisionerID}"),
extractPayloadByKidOrJWK(RevokeCert))
2019-05-27 00:41:10 +00:00
}
// GetNonce just sets the right header since a Nonce is added to each response
// by middleware by default.
2022-04-27 22:42:26 +00:00
func GetNonce(w http.ResponseWriter, r *http.Request) {
2019-05-27 00:41:10 +00:00
if r.Method == "HEAD" {
w.WriteHeader(http.StatusOK)
} else {
w.WriteHeader(http.StatusNoContent)
}
}
type Meta struct {
TermsOfService string `json:"termsOfService,omitempty"`
Website string `json:"website,omitempty"`
CaaIdentities []string `json:"caaIdentities,omitempty"`
ExternalAccountRequired bool `json:"externalAccountRequired,omitempty"`
}
2021-03-05 07:10:46 +00:00
// Directory represents an ACME directory for configuring clients.
type Directory struct {
NewNonce string `json:"newNonce"`
NewAccount string `json:"newAccount"`
NewOrder string `json:"newOrder"`
RevokeCert string `json:"revokeCert"`
KeyChange string `json:"keyChange"`
Meta Meta `json:"meta"`
2021-03-05 07:10:46 +00:00
}
// ToLog enables response logging for the Directory type.
func (d *Directory) ToLog() (interface{}, error) {
b, err := json.Marshal(d)
if err != nil {
return nil, acme.WrapErrorISE(err, "error marshaling directory for logging")
}
return string(b), nil
}
2019-05-27 00:41:10 +00:00
// GetDirectory is the ACME resource for returning a directory configuration
// for client configuration.
2022-04-27 22:42:26 +00:00
func GetDirectory(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:10:46 +00:00
ctx := r.Context()
2022-04-27 22:42:26 +00:00
o := optionsFromContext(ctx)
2021-07-22 21:48:41 +00:00
acmeProv, err := acmeProvisionerFromContext(ctx)
if err != nil {
render.Error(w, err)
return
}
render.JSON(w, &Directory{
2022-04-27 22:42:26 +00:00
NewNonce: o.linker.GetLink(ctx, NewNonceLinkType),
NewAccount: o.linker.GetLink(ctx, NewAccountLinkType),
NewOrder: o.linker.GetLink(ctx, NewOrderLinkType),
RevokeCert: o.linker.GetLink(ctx, RevokeCertLinkType),
KeyChange: o.linker.GetLink(ctx, KeyChangeLinkType),
Meta: Meta{
ExternalAccountRequired: acmeProv.RequireEAB,
},
2021-03-05 07:10:46 +00:00
})
2019-05-27 00:41:10 +00:00
}
// NotImplemented returns a 501 and is generally a placeholder for functionality which
// MAY be added at some point in the future but is not in any way a guarantee of such.
2022-04-27 22:42:26 +00:00
func NotImplemented(w http.ResponseWriter, r *http.Request) {
render.Error(w, acme.NewError(acme.ErrorNotImplementedType, "this API is not implemented"))
}
// GetAuthorization ACME api for retrieving an Authz.
2022-04-27 22:42:26 +00:00
func GetAuthorization(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:10:46 +00:00
ctx := r.Context()
2022-04-27 22:42:26 +00:00
o := optionsFromContext(ctx)
db := acme.MustFromContext(ctx)
2021-03-05 07:10:46 +00:00
acc, err := accountFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, err)
2019-05-27 00:41:10 +00:00
return
}
2022-04-27 22:42:26 +00:00
az, err := db.GetAuthorization(ctx, chi.URLParam(r, "authzID"))
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, acme.WrapErrorISE(err, "error retrieving authorization"))
2021-03-05 07:10:46 +00:00
return
}
if acc.ID != az.AccountID {
render.Error(w, acme.NewError(acme.ErrorUnauthorizedType,
2021-03-05 07:10:46 +00:00
"account '%s' does not own authorization '%s'", acc.ID, az.ID))
2019-05-27 00:41:10 +00:00
return
}
2022-04-27 22:42:26 +00:00
if err = az.UpdateStatus(ctx, db); err != nil {
render.Error(w, acme.WrapErrorISE(err, "error updating authorization status"))
2021-03-11 07:59:02 +00:00
return
2021-03-05 07:10:46 +00:00
}
2022-04-27 22:42:26 +00:00
o.linker.LinkAuthorization(ctx, az)
2019-05-27 00:41:10 +00:00
2022-04-27 22:42:26 +00:00
w.Header().Set("Location", o.linker.GetLink(ctx, AuthzLinkType, az.ID))
render.JSON(w, az)
2019-05-27 00:41:10 +00:00
}
// GetChallenge ACME api for retrieving a Challenge.
2022-04-27 22:42:26 +00:00
func GetChallenge(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:10:46 +00:00
ctx := r.Context()
2022-04-27 22:42:26 +00:00
o := optionsFromContext(ctx)
db := acme.MustFromContext(ctx)
2021-03-05 07:10:46 +00:00
acc, err := accountFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, err)
2019-05-27 00:41:10 +00:00
return
}
// Just verify that the payload was set, since we're not strictly adhering
// to ACME V2 spec for reasons specified below.
2021-03-05 07:10:46 +00:00
_, err = payloadFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, err)
2019-05-27 00:41:10 +00:00
return
}
2021-03-05 07:10:46 +00:00
// NOTE: We should be checking ^^^ that the request is either a POST-as-GET, or
2019-05-27 00:41:10 +00:00
// that the payload is an empty JSON block ({}). However, older ACME clients
// still send a vestigial body (rather than an empty JSON block) and
// strict enforcement would render these clients broken. For the time being
// we'll just ignore the body.
2021-03-05 07:10:46 +00:00
2021-03-25 07:23:57 +00:00
azID := chi.URLParam(r, "authzID")
2022-04-27 22:42:26 +00:00
ch, err := db.GetChallenge(ctx, chi.URLParam(r, "chID"), azID)
2021-03-05 07:10:46 +00:00
if err != nil {
render.Error(w, acme.WrapErrorISE(err, "error retrieving challenge"))
2021-03-05 07:10:46 +00:00
return
}
2021-03-29 19:04:14 +00:00
ch.AuthorizationID = azID
2021-03-05 07:10:46 +00:00
if acc.ID != ch.AccountID {
render.Error(w, acme.NewError(acme.ErrorUnauthorizedType,
2021-03-05 07:10:46 +00:00
"account '%s' does not own challenge '%s'", acc.ID, ch.ID))
return
}
jwk, err := jwkFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, err)
2019-05-27 00:41:10 +00:00
return
}
2022-04-27 22:42:26 +00:00
if err = ch.Validate(ctx, db, jwk, o.validateChallengeOptions); err != nil {
render.Error(w, acme.WrapErrorISE(err, "error validating challenge"))
2021-03-05 07:10:46 +00:00
return
}
2019-05-27 00:41:10 +00:00
2022-04-27 22:42:26 +00:00
o.linker.LinkChallenge(ctx, ch, azID)
2021-03-05 07:10:46 +00:00
2022-04-27 22:42:26 +00:00
w.Header().Add("Link", link(o.linker.GetLink(ctx, AuthzLinkType, azID), "up"))
w.Header().Set("Location", o.linker.GetLink(ctx, ChallengeLinkType, azID, ch.ID))
render.JSON(w, ch)
2019-05-27 00:41:10 +00:00
}
// GetCertificate ACME api for retrieving a Certificate.
2022-04-27 22:42:26 +00:00
func GetCertificate(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:10:46 +00:00
ctx := r.Context()
2022-04-27 22:42:26 +00:00
db := acme.MustFromContext(ctx)
2021-03-05 07:10:46 +00:00
acc, err := accountFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, err)
2019-05-27 00:41:10 +00:00
return
}
2021-03-05 07:10:46 +00:00
2022-04-27 22:42:26 +00:00
certID := chi.URLParam(r, "certID")
cert, err := db.GetCertificate(ctx, certID)
2019-05-27 00:41:10 +00:00
if err != nil {
render.Error(w, acme.WrapErrorISE(err, "error retrieving certificate"))
2019-05-27 00:41:10 +00:00
return
}
2021-03-05 07:10:46 +00:00
if cert.AccountID != acc.ID {
render.Error(w, acme.NewError(acme.ErrorUnauthorizedType,
2021-03-05 07:10:46 +00:00
"account '%s' does not own certificate '%s'", acc.ID, certID))
return
}
2021-03-05 07:10:46 +00:00
2021-03-11 07:05:46 +00:00
var certBytes []byte
for _, c := range append([]*x509.Certificate{cert.Leaf}, cert.Intermediates...) {
certBytes = append(certBytes, pem.EncodeToMemory(&pem.Block{
Type: "CERTIFICATE",
Bytes: c.Raw,
})...)
}
2021-03-05 07:10:46 +00:00
api.LogCertificate(w, cert.Leaf)
2019-05-27 00:41:10 +00:00
w.Header().Set("Content-Type", "application/pem-certificate-chain; charset=utf-8")
w.Write(certBytes)
}