diff --git a/README.md b/README.md index f36ebd29..c3a53175 100644 --- a/README.md +++ b/README.md @@ -18,11 +18,10 @@ Current features: - [x] Revoking Certificates - [ ] Initiating account recovery - Identifier validation challenges - - [x] SimpleHTTP Challenge (Scheduled for removal on Nov 19th) - [x] HTTP (http-01) - [ ] TLS with Server Name Indication (tls-sni-01) - [ ] Proof of Possession of a Prior Key (proofOfPossession-01) - - [ ] DNS (dns-01) + - [ ] DNS (dns-01) - Implemented in branch, blocked by upstream. - [x] Certificate bundling - [x] Library support for OCSP diff --git a/acme/client.go b/acme/client.go index f5ff3b65..ef9e5710 100644 --- a/acme/client.go +++ b/acme/client.go @@ -101,7 +101,6 @@ func NewClient(caURL string, usr User, keyBits int, optPort string) (*Client, er // Add all available solvers with the right index as per ACME // spec to this map. Otherwise they won`t be found. solvers := make(map[string]solver) - solvers["simpleHttp"] = &simpleHTTPChallenge{jws: jws, optPort: optPort} solvers["http-01"] = &httpChallenge{jws: jws, optPort: optPort} return &Client{directory: dir, user: usr, jws: jws, keyBits: keyBits, solvers: solvers}, nil diff --git a/acme/client_test.go b/acme/client_test.go index 45be02dd..7a835cee 100644 --- a/acme/client_test.go +++ b/acme/client_test.go @@ -47,15 +47,15 @@ func TestNewClient(t *testing.T) { t.Fatalf("Expected %d solver(s), got %d", expected, actual) } - simphttp, ok := client.solvers["simpleHttp"].(*simpleHTTPChallenge) + httpSolver, ok := client.solvers["http-01"].(*httpChallenge) if !ok { t.Fatal("Expected simpleHttps solver to be simpleHTTPChallenge type") } - if simphttp.jws != client.jws { + if httpSolver.jws != client.jws { t.Error("Expected simpleHTTPChallenge to have same jws as client") } - if simphttp.optPort != optPort { - t.Errorf("Expected simpleHTTPChallenge to have optPort %s but was %s", optPort, simphttp.optPort) + if httpSolver.optPort != optPort { + t.Errorf("Expected simpleHTTPChallenge to have optPort %s but was %s", optPort, httpSolver.optPort) } } diff --git a/acme/simple_http_challenge.go b/acme/simple_http_challenge.go deleted file mode 100644 index cf6ddafb..00000000 --- a/acme/simple_http_challenge.go +++ /dev/null @@ -1,165 +0,0 @@ -package acme - -import ( - "crypto/rsa" - "crypto/tls" - "crypto/x509" - "encoding/json" - "encoding/pem" - "errors" - "fmt" - "net" - "net/http" - "strings" - "time" -) - -// OnSimpleHTTPStart hook will get called BEFORE SimpleHTTP starts to listen on a port. -var OnSimpleHTTPStart func(string) - -// OnSimpleHTTPEnd hook will get called AFTER SimpleHTTP determined the status of the domain. -var OnSimpleHTTPEnd func(bool) - -type simpleHTTPChallenge struct { - jws *jws - optPort string -} - -func (s *simpleHTTPChallenge) Solve(chlng challenge, domain string) error { - - logf("Trying to solve SimpleHTTP") - - // Generate random string for the path. The acme server will - // access this path on the server in order to validate the request - listener, err := s.startHTTPSServer(domain, chlng.Token) - if err != nil { - return fmt.Errorf("Could not start HTTPS server for challenge -> %v", err) - } - defer listener.Close() - - // Tell the server about the generated random path - jsonBytes, err := json.Marshal(challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token}) - if err != nil { - return errors.New("Failed to marshal network message...") - } - - resp, err := s.jws.post(chlng.URI, jsonBytes) - if err != nil { - return fmt.Errorf("Failed to post JWS message. -> %v", err) - } - - // After the path is sent, the ACME server will access our server. - // Repeatedly check the server for an updated status on our request. - var challengeResponse challenge -Loop: - for { - if resp.StatusCode >= http.StatusBadRequest { - return handleHTTPError(resp) - } - - err = json.NewDecoder(resp.Body).Decode(&challengeResponse) - resp.Body.Close() - if err != nil { - return err - } - - switch challengeResponse.Status { - case "valid": - if OnSimpleHTTPEnd != nil { - OnSimpleHTTPEnd(true) - } - logf("The server validated our request") - break Loop - case "pending": - break - case "invalid": - if OnSimpleHTTPEnd != nil { - OnSimpleHTTPEnd(false) - } - return errors.New("The server could not validate our request.") - default: - return errors.New("The server returned an unexpected state.") - } - - time.Sleep(1 * time.Second) - resp, err = http.Get(chlng.URI) - } - - return nil -} - -// Starts a temporary HTTPS server on port 443. As soon as the challenge passed validation, -// this server will get shut down. The certificate generated here is only held in memory. -func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string) (net.Listener, error) { - - // Generate a new RSA key and a self-signed certificate. - tempPrivKey, err := generatePrivateKey(rsakey, 2048) - rsaPrivKey := tempPrivKey.(*rsa.PrivateKey) - if err != nil { - return nil, err - } - tempCertPEM, err := generatePemCert(rsaPrivKey, domain) - if err != nil { - return nil, err - } - pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(rsaPrivKey)}) - tempKeyPair, err := tls.X509KeyPair( - tempCertPEM, - pemBytes) - if err != nil { - return nil, err - } - - tlsConf := new(tls.Config) - tlsConf.Certificates = []tls.Certificate{tempKeyPair} - - path := "/.well-known/acme-challenge/" + token - if OnSimpleHTTPStart != nil { - OnSimpleHTTPStart(path) - } - - // Allow for CLI override - port := ":443" - if s.optPort != "" { - port = ":" + s.optPort - } - - tlsListener, err := tls.Listen("tcp", domain+port, tlsConf) - if err != nil { - // if the domain:port bind failed, fall back to :port bind and try that instead. - tlsListener, err = tls.Listen("tcp", port, tlsConf) - if err != nil { - return nil, err - } - } - - jsonBytes, err := json.Marshal(challenge{Type: "simpleHttp", Token: token, TLS: true}) - if err != nil { - return nil, errors.New("startHTTPSServer: Failed to marshal network message") - } - signed, err := s.jws.signContent(jsonBytes) - if err != nil { - return nil, fmt.Errorf("startHTTPSServer: Failed to sign message. %s", err) - } - signedCompact := signed.FullSerialize() - if err != nil { - return nil, errors.New("startHTTPSServer: Failed to serialize message") - } - - // The handler validates the HOST header and request type. - // For validation it then writes the token the server returned with the challenge - http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) { - if strings.HasPrefix(r.Host, domain) && r.Method == "GET" { - w.Header().Add("Content-Type", "application/jose+json") - w.Write([]byte(signedCompact)) - logf("Served JWS payload...") - } else { - logf("Received request for domain %s with method %s", r.Host, r.Method) - w.Write([]byte("TEST")) - } - }) - - go http.Serve(tlsListener, nil) - - return tlsListener, nil -} diff --git a/acme/simple_http_challenge_test.go b/acme/simple_http_challenge_test.go deleted file mode 100644 index 541d4e29..00000000 --- a/acme/simple_http_challenge_test.go +++ /dev/null @@ -1,251 +0,0 @@ -package acme - -import ( - "crypto/rsa" - "crypto/tls" - "encoding/json" - "io/ioutil" - "net/http" - "net/http/httptest" - "regexp" - "testing" - - "github.com/square/go-jose" -) - -func TestSimpleHTTPNonRootBind(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 128) - jws := &jws{privKey: privKey.(*rsa.PrivateKey)} - - solver := &simpleHTTPChallenge{jws: jws} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "localhost:4000", Token: "1"} - - // validate error on non-root bind to 443 - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("BIND: Expected Solve to return an error but the error was nil.") - } else { - expectedError := "Could not start HTTPS server for challenge -> listen tcp :443: bind: permission denied" - if err.Error() != expectedError { - t.Errorf("Expected error \"%s\" but instead got \"%s\"", expectedError, err.Error()) - } - } -} - -func TestSimpleHTTPShortRSA(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 128) - jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}} - - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "2"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } else { - expectedError := "Could not start HTTPS server for challenge -> startHTTPSServer: Failed to sign message. crypto/rsa: message too long for RSA public key size" - if err.Error() != expectedError { - t.Errorf("Expected error %s but instead got %s", expectedError, err.Error()) - } - } -} - -func TestSimpleHTTPConnectionRefusal(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}} - - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "3"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } else { - reg := "/Failed to post JWS message\\. -> Post http:\\/\\/localhost:4000: dial tcp 127\\.0\\.0\\.1:4000: (getsockopt: )?connection refused/g" - test2 := "Failed to post JWS message. -> Post http://localhost:4000: dial tcp 127.0.0.1:4000: connection refused" - r, _ := regexp.Compile(reg) - if r.MatchString(err.Error()) && r.MatchString(test2) { - t.Errorf("Expected \"%s\" to match %s", err.Error(), reg) - } - } -} - -func TestSimpleHTTPUnexpectedServerState(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - - ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Add("Replay-Nonce", "12345") - w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"what\",\"uri\":\"http://some.url\",\"token\":\"4\"}")) - })) - - jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL} - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "4"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } else { - expectedError := "The server returned an unexpected state." - if err.Error() != expectedError { - t.Errorf("Expected error %s but instead got %s", expectedError, err.Error()) - } - } -} - -func TestSimpleHTTPChallengeServerUnexpectedDomain(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - jws := &jws{privKey: privKey.(*rsa.PrivateKey)} - - ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.Method == "POST" { - tr := &http.Transport{ - TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, - } - client := &http.Client{Transport: tr} - req, _ := client.Get("https://localhost:23456/.well-known/acme-challenge/" + "5") - reqBytes, _ := ioutil.ReadAll(req.Body) - if string(reqBytes) != "TEST" { - t.Error("Expected simpleHTTP server to return string TEST on unexpected domain.") - } - } - - w.Header().Add("Replay-Nonce", "12345") - w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"5\"}")) - })) - - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "5"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } -} - -func TestSimpleHTTPServerError(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - - ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.Method == "HEAD" { - w.Header().Add("Replay-Nonce", "12345") - } else { - w.WriteHeader(http.StatusInternalServerError) - w.Header().Add("Replay-Nonce", "12345") - w.Write([]byte("{\"type\":\"urn:acme:error:unauthorized\",\"detail\":\"Error creating new authz :: Syntax error\"}")) - } - })) - - jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL} - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "6"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } else { - expectedError := "acme: Error 500 - urn:acme:error:unauthorized - Error creating new authz :: Syntax error" - if err.Error() != expectedError { - t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error()) - } - } -} - -func TestSimpleHTTPInvalidServerState(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - - ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Add("Replay-Nonce", "12345") - w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"7\"}")) - })) - - jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL} - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "7"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil { - t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.") - } else { - expectedError := "The server could not validate our request." - if err.Error() != expectedError { - t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error()) - } - } -} - -func TestSimpleHTTPValidServerResponse(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - - ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Add("Replay-Nonce", "12345") - w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"valid\",\"uri\":\"http://some.url\",\"token\":\"8\"}")) - })) - - jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL} - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "8"} - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil { - t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err) - } -} - -func TestSimpleHTTPValidFull(t *testing.T) { - privKey, _ := generatePrivateKey(rsakey, 512) - - ts := httptest.NewServer(nil) - - jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL} - solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"} - clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "9"} - - // Validate server on port 23456 which responds appropriately - clientChallenge.Token = "1234567812" - ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - var request challenge - w.Header().Add("Replay-Nonce", "12345") - - if r.Method == "HEAD" { - return - } - - clientJws, _ := ioutil.ReadAll(r.Body) - j, err := jose.ParseSigned(string(clientJws)) - if err != nil { - t.Errorf("Client sent invalid JWS to the server.\n\t%v", err) - return - } - output, err := j.Verify(&privKey.(*rsa.PrivateKey).PublicKey) - if err != nil { - t.Errorf("Unable to verify client data -> %v", err) - } - json.Unmarshal(output, &request) - - transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} - client := &http.Client{Transport: transport} - - reqURL := "https://localhost:23456/.well-known/acme-challenge/" + clientChallenge.Token - t.Logf("Request URL is: %s", reqURL) - req, _ := http.NewRequest("GET", reqURL, nil) - req.Host = "127.0.0.1" - resp, err := client.Do(req) - if err != nil { - t.Errorf("Expected the solver to listen on port 23456 -> %v", err) - } - defer resp.Body.Close() - - body, _ := ioutil.ReadAll(resp.Body) - bodyStr := string(body) - clientResponse, err := jose.ParseSigned(bodyStr) - if err != nil { - t.Errorf("Client answered with invalid JWS.\n\t%v", err) - return - } - _, err = clientResponse.Verify(&privKey.(*rsa.PrivateKey).PublicKey) - if err != nil { - t.Errorf("Unable to verify client data -> %v", err) - } - - valid := challenge{Type: "simpleHttp", Status: "valid", URI: ts.URL, Token: "1234567812"} - jsonBytes, _ := json.Marshal(&valid) - w.Write(jsonBytes) - }) - - if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil { - t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err) - } -}