Remove simpleHTTP - Update README

README.md

@@ -18,11 +18,10 @@ Current features:
 - [x] Revoking Certificates
 - [ ] Initiating account recovery
 - Identifier validation challenges
-  - [x] SimpleHTTP Challenge (Scheduled for removal on Nov 19th)
   - [x] HTTP (http-01)
   - [ ] TLS with Server Name Indication (tls-sni-01)
   - [ ] Proof of Possession of a Prior Key (proofOfPossession-01)
-  - [ ] DNS (dns-01)
+  - [ ] DNS (dns-01) - Implemented in branch, blocked by upstream.
 - [x] Certificate bundling
 - [x] Library support for OCSP
 

acme/client.go

@@ -101,7 +101,6 @@ func NewClient(caURL string, usr User, keyBits int, optPort string) (*Client, er
 	// Add all available solvers with the right index as per ACME
 	// spec to this map. Otherwise they won`t be found.
 	solvers := make(map[string]solver)
-	solvers["simpleHttp"] = &simpleHTTPChallenge{jws: jws, optPort: optPort}
 	solvers["http-01"] = &httpChallenge{jws: jws, optPort: optPort}
 
 	return &Client{directory: dir, user: usr, jws: jws, keyBits: keyBits, solvers: solvers}, nil

acme/client_test.go

@@ -47,15 +47,15 @@ func TestNewClient(t *testing.T) {
 		t.Fatalf("Expected %d solver(s), got %d", expected, actual)
 	}
 
-	simphttp, ok := client.solvers["simpleHttp"].(*simpleHTTPChallenge)
+	httpSolver, ok := client.solvers["http-01"].(*httpChallenge)
 	if !ok {
 		t.Fatal("Expected simpleHttps solver to be simpleHTTPChallenge type")
 	}
-	if simphttp.jws != client.jws {
+	if httpSolver.jws != client.jws {
 		t.Error("Expected simpleHTTPChallenge to have same jws as client")
 	}
-	if simphttp.optPort != optPort {
+	if httpSolver.optPort != optPort {
-		t.Errorf("Expected simpleHTTPChallenge to have optPort %s but was %s", optPort, simphttp.optPort)
+		t.Errorf("Expected simpleHTTPChallenge to have optPort %s but was %s", optPort, httpSolver.optPort)
 	}
 }
 

acme/simple_http_challenge.go

@@ -1,165 +0,0 @@
-package acme
-
-import (
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// OnSimpleHTTPStart hook will get called BEFORE SimpleHTTP starts to listen on a port.
-var OnSimpleHTTPStart func(string)
-
-// OnSimpleHTTPEnd hook will get called AFTER SimpleHTTP determined the status of the domain.
-var OnSimpleHTTPEnd func(bool)
-
-type simpleHTTPChallenge struct {
-	jws     *jws
-	optPort string
-}
-
-func (s *simpleHTTPChallenge) Solve(chlng challenge, domain string) error {
-
-	logf("Trying to solve SimpleHTTP")
-
-	// Generate random string for the path. The acme server will
-	// access this path on the server in order to validate the request
-	listener, err := s.startHTTPSServer(domain, chlng.Token)
-	if err != nil {
-		return fmt.Errorf("Could not start HTTPS server for challenge -> %v", err)
-	}
-	defer listener.Close()
-
-	// Tell the server about the generated random path
-	jsonBytes, err := json.Marshal(challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token})
-	if err != nil {
-		return errors.New("Failed to marshal network message...")
-	}
-
-	resp, err := s.jws.post(chlng.URI, jsonBytes)
-	if err != nil {
-		return fmt.Errorf("Failed to post JWS message. -> %v", err)
-	}
-
-	// After the path is sent, the ACME server will access our server.
-	// Repeatedly check the server for an updated status on our request.
-	var challengeResponse challenge
-Loop:
-	for {
-		if resp.StatusCode >= http.StatusBadRequest {
-			return handleHTTPError(resp)
-		}
-
-		err = json.NewDecoder(resp.Body).Decode(&challengeResponse)
-		resp.Body.Close()
-		if err != nil {
-			return err
-		}
-
-		switch challengeResponse.Status {
-		case "valid":
-			if OnSimpleHTTPEnd != nil {
-				OnSimpleHTTPEnd(true)
-			}
-			logf("The server validated our request")
-			break Loop
-		case "pending":
-			break
-		case "invalid":
-			if OnSimpleHTTPEnd != nil {
-				OnSimpleHTTPEnd(false)
-			}
-			return errors.New("The server could not validate our request.")
-		default:
-			return errors.New("The server returned an unexpected state.")
-		}
-
-		time.Sleep(1 * time.Second)
-		resp, err = http.Get(chlng.URI)
-	}
-
-	return nil
-}
-
-// Starts a temporary HTTPS server on port 443. As soon as the challenge passed validation,
-// this server will get shut down. The certificate generated here is only held in memory.
-func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string) (net.Listener, error) {
-
-	// Generate a new RSA key and a self-signed certificate.
-	tempPrivKey, err := generatePrivateKey(rsakey, 2048)
-	rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
-	if err != nil {
-		return nil, err
-	}
-	tempCertPEM, err := generatePemCert(rsaPrivKey, domain)
-	if err != nil {
-		return nil, err
-	}
-	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(rsaPrivKey)})
-	tempKeyPair, err := tls.X509KeyPair(
-		tempCertPEM,
-		pemBytes)
-	if err != nil {
-		return nil, err
-	}
-
-	tlsConf := new(tls.Config)
-	tlsConf.Certificates = []tls.Certificate{tempKeyPair}
-
-	path := "/.well-known/acme-challenge/" + token
-	if OnSimpleHTTPStart != nil {
-		OnSimpleHTTPStart(path)
-	}
-
-	// Allow for CLI override
-	port := ":443"
-	if s.optPort != "" {
-		port = ":" + s.optPort
-	}
-
-	tlsListener, err := tls.Listen("tcp", domain+port, tlsConf)
-	if err != nil {
-		// if the domain:port bind failed, fall back to :port bind and try that instead.
-		tlsListener, err = tls.Listen("tcp", port, tlsConf)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	jsonBytes, err := json.Marshal(challenge{Type: "simpleHttp", Token: token, TLS: true})
-	if err != nil {
-		return nil, errors.New("startHTTPSServer: Failed to marshal network message")
-	}
-	signed, err := s.jws.signContent(jsonBytes)
-	if err != nil {
-		return nil, fmt.Errorf("startHTTPSServer: Failed to sign message. %s", err)
-	}
-	signedCompact := signed.FullSerialize()
-	if err != nil {
-		return nil, errors.New("startHTTPSServer: Failed to serialize message")
-	}
-
-	// The handler validates the HOST header and request type.
-	// For validation it then writes the token the server returned with the challenge
-	http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasPrefix(r.Host, domain) && r.Method == "GET" {
-			w.Header().Add("Content-Type", "application/jose+json")
-			w.Write([]byte(signedCompact))
-			logf("Served JWS payload...")
-		} else {
-			logf("Received request for domain %s with method %s", r.Host, r.Method)
-			w.Write([]byte("TEST"))
-		}
-	})
-
-	go http.Serve(tlsListener, nil)
-
-	return tlsListener, nil
-}

acme/simple_http_challenge_test.go

@@ -1,251 +0,0 @@
-package acme
-
-import (
-	"crypto/rsa"
-	"crypto/tls"
-	"encoding/json"
-	"io/ioutil"
-	"net/http"
-	"net/http/httptest"
-	"regexp"
-	"testing"
-
-	"github.com/square/go-jose"
-)
-
-func TestSimpleHTTPNonRootBind(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 128)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
-	solver := &simpleHTTPChallenge{jws: jws}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "localhost:4000", Token: "1"}
-
-	// validate error on non-root bind to 443
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("BIND: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "Could not start HTTPS server for challenge -> listen tcp :443: bind: permission denied"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error \"%s\" but instead got \"%s\"", expectedError, err.Error())
-		}
-	}
-}
-
-func TestSimpleHTTPShortRSA(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 128)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
-
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "2"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "Could not start HTTPS server for challenge -> startHTTPSServer: Failed to sign message. crypto/rsa: message too long for RSA public key size"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
-		}
-	}
-}
-
-func TestSimpleHTTPConnectionRefusal(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
-
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "3"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		reg := "/Failed to post JWS message\\. -> Post http:\\/\\/localhost:4000: dial tcp 127\\.0\\.0\\.1:4000: (getsockopt: )?connection refused/g"
-		test2 := "Failed to post JWS message. -> Post http://localhost:4000: dial tcp 127.0.0.1:4000: connection refused"
-		r, _ := regexp.Compile(reg)
-		if r.MatchString(err.Error()) && r.MatchString(test2) {
-			t.Errorf("Expected \"%s\" to match %s", err.Error(), reg)
-		}
-	}
-}
-
-func TestSimpleHTTPUnexpectedServerState(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"what\",\"uri\":\"http://some.url\",\"token\":\"4\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "4"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "The server returned an unexpected state."
-		if err.Error() != expectedError {
-			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
-		}
-	}
-}
-
-func TestSimpleHTTPChallengeServerUnexpectedDomain(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "POST" {
-			tr := &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-			}
-			client := &http.Client{Transport: tr}
-			req, _ := client.Get("https://localhost:23456/.well-known/acme-challenge/" + "5")
-			reqBytes, _ := ioutil.ReadAll(req.Body)
-			if string(reqBytes) != "TEST" {
-				t.Error("Expected simpleHTTP server to return string TEST on unexpected domain.")
-			}
-		}
-
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"5\"}"))
-	}))
-
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "5"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	}
-}
-
-func TestSimpleHTTPServerError(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "HEAD" {
-			w.Header().Add("Replay-Nonce", "12345")
-		} else {
-			w.WriteHeader(http.StatusInternalServerError)
-			w.Header().Add("Replay-Nonce", "12345")
-			w.Write([]byte("{\"type\":\"urn:acme:error:unauthorized\",\"detail\":\"Error creating new authz :: Syntax error\"}"))
-		}
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "6"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "acme: Error 500 - urn:acme:error:unauthorized - Error creating new authz :: Syntax error"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
-		}
-	}
-}
-
-func TestSimpleHTTPInvalidServerState(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"7\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "7"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
-		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
-	} else {
-		expectedError := "The server could not validate our request."
-		if err.Error() != expectedError {
-			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
-		}
-	}
-}
-
-func TestSimpleHTTPValidServerResponse(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("Replay-Nonce", "12345")
-		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"valid\",\"uri\":\"http://some.url\",\"token\":\"8\"}"))
-	}))
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "8"}
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
-		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
-	}
-}
-
-func TestSimpleHTTPValidFull(t *testing.T) {
-	privKey, _ := generatePrivateKey(rsakey, 512)
-
-	ts := httptest.NewServer(nil)
-
-	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
-	solver := &simpleHTTPChallenge{jws: jws, optPort: "23456"}
-	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "9"}
-
-	// Validate server on port 23456 which responds appropriately
-	clientChallenge.Token = "1234567812"
-	ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var request challenge
-		w.Header().Add("Replay-Nonce", "12345")
-
-		if r.Method == "HEAD" {
-			return
-		}
-
-		clientJws, _ := ioutil.ReadAll(r.Body)
-		j, err := jose.ParseSigned(string(clientJws))
-		if err != nil {
-			t.Errorf("Client sent invalid JWS to the server.\n\t%v", err)
-			return
-		}
-		output, err := j.Verify(&privKey.(*rsa.PrivateKey).PublicKey)
-		if err != nil {
-			t.Errorf("Unable to verify client data -> %v", err)
-		}
-		json.Unmarshal(output, &request)
-
-		transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
-		client := &http.Client{Transport: transport}
-
-		reqURL := "https://localhost:23456/.well-known/acme-challenge/" + clientChallenge.Token
-		t.Logf("Request URL is: %s", reqURL)
-		req, _ := http.NewRequest("GET", reqURL, nil)
-		req.Host = "127.0.0.1"
-		resp, err := client.Do(req)
-		if err != nil {
-			t.Errorf("Expected the solver to listen on port 23456 -> %v", err)
-		}
-		defer resp.Body.Close()
-
-		body, _ := ioutil.ReadAll(resp.Body)
-		bodyStr := string(body)
-		clientResponse, err := jose.ParseSigned(bodyStr)
-		if err != nil {
-			t.Errorf("Client answered with invalid JWS.\n\t%v", err)
-			return
-		}
-		_, err = clientResponse.Verify(&privKey.(*rsa.PrivateKey).PublicKey)
-		if err != nil {
-			t.Errorf("Unable to verify client data -> %v", err)
-		}
-
-		valid := challenge{Type: "simpleHttp", Status: "valid", URI: ts.URL, Token: "1234567812"}
-		jsonBytes, _ := json.Marshal(&valid)
-		w.Write(jsonBytes)
-	})
-
-	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
-		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
-	}
-}