2015-12-30 22:01:21 +00:00
|
|
|
package acme
|
|
|
|
|
|
|
|
import (
|
2018-06-11 13:45:59 +00:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
2016-01-08 09:04:57 +00:00
|
|
|
"encoding/json"
|
|
|
|
"errors"
|
2015-12-30 22:01:21 +00:00
|
|
|
"fmt"
|
|
|
|
"io"
|
2018-06-11 13:45:59 +00:00
|
|
|
"io/ioutil"
|
2017-07-17 19:57:01 +00:00
|
|
|
"net"
|
2015-12-30 22:01:21 +00:00
|
|
|
"net/http"
|
2018-06-11 13:45:59 +00:00
|
|
|
"os"
|
2015-12-30 22:01:21 +00:00
|
|
|
"runtime"
|
|
|
|
"strings"
|
2016-07-21 01:27:34 +00:00
|
|
|
"time"
|
2015-12-30 22:01:21 +00:00
|
|
|
)
|
|
|
|
|
2018-06-11 13:45:59 +00:00
|
|
|
var (
|
|
|
|
// UserAgent (if non-empty) will be tacked onto the User-Agent string in requests.
|
|
|
|
UserAgent string
|
|
|
|
|
|
|
|
// HTTPClient is an HTTP client with a reasonable timeout value and
|
|
|
|
// potentially a custom *x509.CertPool based on the caCertificatesEnvVar
|
|
|
|
// environment variable (see the `initCertPool` function)
|
|
|
|
HTTPClient = http.Client{
|
|
|
|
Transport: &http.Transport{
|
|
|
|
Proxy: http.ProxyFromEnvironment,
|
2018-06-30 22:55:57 +00:00
|
|
|
DialContext: (&net.Dialer{
|
2018-06-11 13:45:59 +00:00
|
|
|
Timeout: 30 * time.Second,
|
|
|
|
KeepAlive: 30 * time.Second,
|
2018-06-30 22:55:57 +00:00
|
|
|
}).DialContext,
|
2018-06-11 13:45:59 +00:00
|
|
|
TLSHandshakeTimeout: 15 * time.Second,
|
|
|
|
ResponseHeaderTimeout: 15 * time.Second,
|
|
|
|
ExpectContinueTimeout: 1 * time.Second,
|
|
|
|
TLSClientConfig: &tls.Config{
|
2018-06-30 23:12:36 +00:00
|
|
|
ServerName: os.Getenv(caServerNameEnvVar),
|
|
|
|
RootCAs: initCertPool(),
|
2018-06-11 13:45:59 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
)
|
2016-02-14 06:24:19 +00:00
|
|
|
|
2015-12-30 22:01:21 +00:00
|
|
|
const (
|
|
|
|
// ourUserAgent is the User-Agent of this underlying library package.
|
2018-11-15 22:02:34 +00:00
|
|
|
// NOTE: Update this with each tagged release.
|
|
|
|
ourUserAgent = "xenolf-acme/1.2.1"
|
|
|
|
|
|
|
|
// ourUserAgentComment is part of the UA comment linked to the version status of this underlying library package.
|
|
|
|
// values: detach|release
|
|
|
|
// NOTE: Update this with each tagged release.
|
|
|
|
ourUserAgentComment = "detach"
|
2018-06-11 13:45:59 +00:00
|
|
|
|
|
|
|
// caCertificatesEnvVar is the environment variable name that can be used to
|
|
|
|
// specify the path to PEM encoded CA Certificates that can be used to
|
|
|
|
// authenticate an ACME server with a HTTPS certificate not issued by a CA in
|
|
|
|
// the system-wide trusted root list.
|
|
|
|
caCertificatesEnvVar = "LEGO_CA_CERTIFICATES"
|
2018-06-30 23:12:36 +00:00
|
|
|
|
|
|
|
// caServerNameEnvVar is the environment variable name that can be used to
|
|
|
|
// specify the CA server name that can be used to
|
|
|
|
// authenticate an ACME server with a HTTPS certificate not issued by a CA in
|
|
|
|
// the system-wide trusted root list.
|
|
|
|
caServerNameEnvVar = "LEGO_CA_SERVER_NAME"
|
2015-12-30 22:01:21 +00:00
|
|
|
)
|
|
|
|
|
2018-06-11 13:45:59 +00:00
|
|
|
// initCertPool creates a *x509.CertPool populated with the PEM certificates
|
|
|
|
// found in the filepath specified in the caCertificatesEnvVar OS environment
|
|
|
|
// variable. If the caCertificatesEnvVar is not set then initCertPool will
|
|
|
|
// return nil. If there is an error creating a *x509.CertPool from the provided
|
|
|
|
// caCertificatesEnvVar value then initCertPool will panic.
|
|
|
|
func initCertPool() *x509.CertPool {
|
|
|
|
if customCACertsPath := os.Getenv(caCertificatesEnvVar); customCACertsPath != "" {
|
|
|
|
customCAs, err := ioutil.ReadFile(customCACertsPath)
|
|
|
|
if err != nil {
|
|
|
|
panic(fmt.Sprintf("error reading %s=%q: %v",
|
|
|
|
caCertificatesEnvVar, customCACertsPath, err))
|
|
|
|
}
|
|
|
|
certPool := x509.NewCertPool()
|
|
|
|
if ok := certPool.AppendCertsFromPEM(customCAs); !ok {
|
|
|
|
panic(fmt.Sprintf("error creating x509 cert pool from %s=%q: %v",
|
|
|
|
caCertificatesEnvVar, customCACertsPath, err))
|
|
|
|
}
|
|
|
|
return certPool
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2015-12-30 22:01:21 +00:00
|
|
|
// httpHead performs a HEAD request with a proper User-Agent string.
|
|
|
|
// The response body (resp.Body) is already closed when this function returns.
|
|
|
|
func httpHead(url string) (resp *http.Response, err error) {
|
2018-06-21 17:06:16 +00:00
|
|
|
req, err := http.NewRequest(http.MethodHead, url, nil)
|
2015-12-30 22:01:21 +00:00
|
|
|
if err != nil {
|
2017-02-19 04:50:21 +00:00
|
|
|
return nil, fmt.Errorf("failed to head %q: %v", url, err)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
req.Header.Set("User-Agent", userAgent())
|
|
|
|
|
2016-07-21 01:24:11 +00:00
|
|
|
resp, err = HTTPClient.Do(req)
|
2016-02-06 05:41:15 +00:00
|
|
|
if err != nil {
|
2017-02-19 04:50:21 +00:00
|
|
|
return resp, fmt.Errorf("failed to do head %q: %v", url, err)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
2016-02-06 05:41:15 +00:00
|
|
|
resp.Body.Close()
|
2015-12-30 22:01:21 +00:00
|
|
|
return resp, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// httpPost performs a POST request with a proper User-Agent string.
|
|
|
|
// Callers should close resp.Body when done reading from it.
|
|
|
|
func httpPost(url string, bodyType string, body io.Reader) (resp *http.Response, err error) {
|
2018-06-21 17:06:16 +00:00
|
|
|
req, err := http.NewRequest(http.MethodPost, url, body)
|
2015-12-30 22:01:21 +00:00
|
|
|
if err != nil {
|
2017-02-19 04:50:21 +00:00
|
|
|
return nil, fmt.Errorf("failed to post %q: %v", url, err)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
|
|
|
req.Header.Set("Content-Type", bodyType)
|
|
|
|
req.Header.Set("User-Agent", userAgent())
|
|
|
|
|
2016-07-21 01:24:11 +00:00
|
|
|
return HTTPClient.Do(req)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// httpGet performs a GET request with a proper User-Agent string.
|
|
|
|
// Callers should close resp.Body when done reading from it.
|
|
|
|
func httpGet(url string) (resp *http.Response, err error) {
|
2018-06-21 17:06:16 +00:00
|
|
|
req, err := http.NewRequest(http.MethodGet, url, nil)
|
2015-12-30 22:01:21 +00:00
|
|
|
if err != nil {
|
2017-02-19 04:50:21 +00:00
|
|
|
return nil, fmt.Errorf("failed to get %q: %v", url, err)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
|
|
|
req.Header.Set("User-Agent", userAgent())
|
|
|
|
|
2016-07-21 01:24:11 +00:00
|
|
|
return HTTPClient.Do(req)
|
2015-12-30 22:01:21 +00:00
|
|
|
}
|
|
|
|
|
2016-01-08 09:04:57 +00:00
|
|
|
// getJSON performs an HTTP GET request and parses the response body
|
|
|
|
// as JSON, into the provided respBody object.
|
|
|
|
func getJSON(uri string, respBody interface{}) (http.Header, error) {
|
|
|
|
resp, err := httpGet(uri)
|
|
|
|
if err != nil {
|
2017-02-19 04:50:21 +00:00
|
|
|
return nil, fmt.Errorf("failed to get json %q: %v", uri, err)
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
|
|
|
|
|
|
|
if resp.StatusCode >= http.StatusBadRequest {
|
|
|
|
return resp.Header, handleHTTPError(resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return resp.Header, json.NewDecoder(resp.Body).Decode(respBody)
|
|
|
|
}
|
|
|
|
|
|
|
|
// postJSON performs an HTTP POST request and parses the response body
|
|
|
|
// as JSON, into the provided respBody object.
|
|
|
|
func postJSON(j *jws, uri string, reqBody, respBody interface{}) (http.Header, error) {
|
|
|
|
jsonBytes, err := json.Marshal(reqBody)
|
|
|
|
if err != nil {
|
2018-09-24 19:07:20 +00:00
|
|
|
return nil, errors.New("failed to marshal network message")
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
|
|
|
|
2018-11-04 00:51:53 +00:00
|
|
|
resp, err := post(j, uri, jsonBytes, respBody)
|
|
|
|
if resp == nil {
|
|
|
|
return nil, err
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
2017-03-30 00:25:34 +00:00
|
|
|
|
2016-01-08 09:04:57 +00:00
|
|
|
defer resp.Body.Close()
|
|
|
|
|
2018-11-04 00:51:53 +00:00
|
|
|
return resp.Header, err
|
|
|
|
}
|
|
|
|
|
|
|
|
func postAsGet(j *jws, uri string, respBody interface{}) (*http.Response, error) {
|
|
|
|
return post(j, uri, []byte{}, respBody)
|
|
|
|
}
|
|
|
|
|
|
|
|
func post(j *jws, uri string, reqBody []byte, respBody interface{}) (*http.Response, error) {
|
|
|
|
resp, err := j.post(uri, reqBody)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to post JWS message. -> %v", err)
|
|
|
|
}
|
|
|
|
|
2016-01-08 09:04:57 +00:00
|
|
|
if resp.StatusCode >= http.StatusBadRequest {
|
2018-09-24 19:07:20 +00:00
|
|
|
err = handleHTTPError(resp)
|
2017-03-30 00:25:34 +00:00
|
|
|
switch err.(type) {
|
|
|
|
case NonceError:
|
|
|
|
// Retry once if the nonce was invalidated
|
|
|
|
|
2018-11-04 00:51:53 +00:00
|
|
|
retryResp, errP := j.post(uri, reqBody)
|
2018-09-24 19:07:20 +00:00
|
|
|
if errP != nil {
|
|
|
|
return nil, fmt.Errorf("failed to post JWS message. -> %v", errP)
|
2017-03-30 00:25:34 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if retryResp.StatusCode >= http.StatusBadRequest {
|
2018-11-04 00:51:53 +00:00
|
|
|
return retryResp, handleHTTPError(retryResp)
|
2017-03-30 00:25:34 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if respBody == nil {
|
2018-11-04 00:51:53 +00:00
|
|
|
return retryResp, nil
|
2017-03-30 00:25:34 +00:00
|
|
|
}
|
|
|
|
|
2018-11-04 00:51:53 +00:00
|
|
|
return retryResp, json.NewDecoder(retryResp.Body).Decode(respBody)
|
2017-03-30 00:25:34 +00:00
|
|
|
default:
|
2018-11-04 00:51:53 +00:00
|
|
|
return resp, err
|
2017-03-30 00:25:34 +00:00
|
|
|
}
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if respBody == nil {
|
2018-11-04 00:51:53 +00:00
|
|
|
return resp, nil
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
|
|
|
|
2018-11-04 00:51:53 +00:00
|
|
|
return resp, json.NewDecoder(resp.Body).Decode(respBody)
|
2016-01-08 09:04:57 +00:00
|
|
|
}
|
|
|
|
|
2015-12-30 22:01:21 +00:00
|
|
|
// userAgent builds and returns the User-Agent string to use in requests.
|
|
|
|
func userAgent() string {
|
2018-11-15 22:02:34 +00:00
|
|
|
ua := fmt.Sprintf("%s %s (%s; %s; %s)", UserAgent, ourUserAgent, ourUserAgentComment, runtime.GOOS, runtime.GOARCH)
|
2015-12-30 22:01:21 +00:00
|
|
|
return strings.TrimSpace(ua)
|
|
|
|
}
|