Remove old imply

This commit is contained in:
xenolf 2015-06-13 04:46:52 +02:00
parent b3294a57c4
commit 29c0c63633

View file

@ -1,361 +0,0 @@
package cli
import (
"bytes"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/rsa"
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/base64"
"encoding/json"
"encoding/pem"
"flag"
"io/ioutil"
"log"
"math/big"
"net/http"
"os"
"strings"
"time"
"github.com/square/go-jose"
)
var (
newReg = flag.String("new-reg", "http://192.168.10.22:4000/acme/new-reg", "New Registration URL")
accountKeyFile = flag.String("certKey", "account.key", "Private key file. Created if it does not exist.")
accountTmpCrtFile = flag.String("acc-crt-file", "account-tmp.pem", "Temporary self signed certificate for challenges.")
email = flag.String("email", "", "Email address used for certificate retrieval.")
domain = flag.String("domain", "", "The domain to request a certificate for")
ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to generate a key. Valid values are P224, P256, P384, P521")
bits = flag.Int("bits", 2048, "The size of the RSA keys in bits. Default 4096")
)
// Logger is used to log errors; if nil, the default log.Logger is used.
var Logger *log.Logger
// logger is an helper function to retrieve the available logger
func logger() *log.Logger {
if Logger == nil {
Logger = log.New(os.Stderr, "", log.LstdFlags)
}
return Logger
}
type Registration struct {
Contact []string `json:"contact"`
}
type Tos struct {
Agreement string `json:"agreement"`
}
type GetChallenges struct {
Identifier `json:"identifier"`
}
type Identifier struct {
Type string `json:"type"`
Value string `json:"value"`
}
type ChallengesResponse struct {
Identifier `json:"identifier"`
Status string `json:"status"`
Expires time.Time `json:"expires"`
Challenges []Challenge `json:"challenges"`
Combinations [][]int `json:"combinations"`
}
type Challenge struct {
Type string `json:"type"`
Status string `json:"status"`
URI string `json:"uri"`
Token string `json:"token"`
}
type SimpleHttpsMessage struct {
Path string `json:"path"`
}
type CsrMessage struct {
Csr string `json:"csr"`
Authorizations []string `json:"authorizations"`
}
func execute() {
flag.Parse()
accountKey := generateKeyPair(*accountKeyFile).(*rsa.PrivateKey)
jsonBytes, _ := json.Marshal(Registration{Contact: []string{"mailto:" + *email}})
logger().Printf("Posting registration to %s", *newReg)
resp, _ := jwsPost(*newReg, jsonBytes)
links := parseLinks(resp.Header["Link"])
if links["next"] == "" {
logger().Fatalln("The server did not provide enough information to proceed.")
}
logger().Printf("Got agreement URL: %s", links["terms-of-service"])
logger().Printf("Got new auth URL: %s", links["next"])
jsonBytes, _ = json.Marshal(Tos{Agreement: links["terms-of-service"]})
logger().Printf("Posting agreement to %s", resp.Header.Get("Location"))
resp, _ = jwsPost(resp.Header.Get("Location"), jsonBytes)
logResponse(resp)
jsonBytes, _ = json.Marshal(GetChallenges{Identifier{Type: "dns", Value: *domain}})
logger().Printf("Getting challenges for type %s and domain %s", "dns", *domain)
resp, _ = jwsPost(links["next"], jsonBytes)
logResponse(resp)
links = parseLinks(resp.Header["Link"])
if links["next"] == "" {
logger().Fatalln("The server did not provide enough information to proceed.")
}
logger().Printf("Got new cert URL: %s", links["next"])
logger().Printf("Got new authorization URL: %s", resp.Header.Get("Location"))
newCertUrl := links["next"]
authUrl := resp.Header.Get("Location")
body, _ := ioutil.ReadAll(resp.Body)
var challenges ChallengesResponse
_ = json.Unmarshal(body, &challenges)
for _, challenge := range challenges.Challenges {
logger().Printf("Got challenge %s", challenge.Type)
}
logger().Printf("Challenge combinations are: %v", challenges.Combinations)
logger().Printf("Choosing first challenge combination and starting with %s", challenges.Challenges[challenges.Combinations[0][0]].Type)
firstChallenge := challenges.Challenges[challenges.Combinations[0][0]]
if firstChallenge.Type == "simpleHttps" {
generateSelfSignedCert(accountKey)
path := getRandomString(8) + ".txt"
challengePath := "/.well-known/acme-challenge/" + path
startChallengeTlsServer(challengePath, firstChallenge.Token)
logger().Print("Waiting for domain validation...")
jsonBytes, _ = json.Marshal(SimpleHttpsMessage{Path: path})
logger().Printf("Sending challenge response for path %s", path)
resp, _ = jwsPost(firstChallenge.URI, jsonBytes)
logResponse(resp)
// Loop until status is verified or error.
var challengeResponse Challenge
loop:
for {
decoder := json.NewDecoder(resp.Body)
decoder.Decode(&challengeResponse)
switch challengeResponse.Status {
case "valid":
logger().Print("The CA validated our credentials. Continue...")
break loop
case "pending":
logger().Print("The data is still being validated. Please stand by...")
case "invalid":
logger().Fatalf("The CA could not validate the provided file. - %v", challengeResponse)
default:
logger().Fatalf("The CA returned an unexpected state. - %v", challengeResponse)
}
time.Sleep(1000 * time.Millisecond)
resp, _ = http.Get(authUrl)
}
}
logger().Print("Getting certificate...")
privateSslKey := generateKeyPair("ssl-priv.key")
csr := generateCsr(privateSslKey)
csrString := base64.URLEncoding.EncodeToString(csr)
jsonBytes, _ = json.Marshal(CsrMessage{Csr: csrString, Authorizations: []string{authUrl}})
resp, _ = jwsPost(newCertUrl, jsonBytes)
logResponse(resp)
body, _ = ioutil.ReadAll(resp.Body)
ioutil.WriteFile("ssl-crt.crt", body, 0644)
}
func startChallengeTlsServer(path string, token string) {
cert, err := tls.LoadX509KeyPair(*accountTmpCrtFile, *accountKeyFile)
tlsConf := new(tls.Config)
tlsConf.Certificates = []tls.Certificate{cert}
tlsListener, err := tls.Listen("tcp", ":443", tlsConf)
if err != nil {
logger().Fatalf("Could not start TLS listener on %s for challenge handling! - %v", ":443", err)
}
http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
if r.Host == *domain && r.Method == "GET" {
w.Write([]byte(token))
tlsListener.Close()
}
})
srv := http.Server{Addr: ":443", Handler: nil}
go func() {
srv.Serve(tlsListener)
logger().Print("TLS Server exited.")
}()
}
func getRandomString(length int) string {
const alphanum = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
var bytes = make([]byte, length)
rand.Read(bytes)
for i, b := range bytes {
bytes[i] = alphanum[b%byte(len(alphanum))]
}
return string(bytes)
}
func logResponse(resp *http.Response) {
logger().Println(resp.Status)
for k, v := range resp.Header {
logger().Printf("-- %s: %s", k, v)
}
}
func jwsPost(url string, content []byte) (*http.Response, error) {
url = strings.Replace(url, "localhost", "192.168.10.22", -1)
privKeyBytes, err := ioutil.ReadFile(*accountKeyFile)
key, err := jose.LoadPrivateKey(privKeyBytes)
if err != nil {
panic(err)
}
signer, err := jose.NewSigner(jose.RS256, key)
if err != nil {
panic(err)
}
signed, err := signer.Sign(content)
if err != nil {
panic(err)
}
signedContent := signed.FullSerialize()
resp, err := http.Post(url, "application/json", bytes.NewBuffer([]byte(signedContent)))
if err != nil {
logger().Fatalf("Error posting content: %s", err)
}
return resp, err
}
func generateCsr(privateKey interface{}) []byte {
template := x509.CertificateRequest{
Subject: pkix.Name{
CommonName: *domain,
},
EmailAddresses: []string{*email},
}
csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &template, privateKey)
csrOut, err := os.Create("csr.pem")
if err != nil {
logger().Fatalf("Could not create certificate request file: %s", err)
}
pem.Encode(csrOut, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
return csrBytes
}
func generateKeyPair(fileName string) interface{} {
logger().Println("Generating key pair ...")
var privateKey interface{}
var err error
switch *ecdsaCurve {
case "":
privateKey, err = rsa.GenerateKey(rand.Reader, *bits)
case "P224":
privateKey, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
case "P256":
privateKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
case "P384":
privateKey, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
case "P521":
privateKey, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
}
if err != nil {
logger().Fatalf("Failed to generate private key: %s", err)
}
var pemKey pem.Block
switch key := privateKey.(type) {
case *rsa.PrivateKey:
pemKey = pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
case *ecdsa.PrivateKey:
privateBytes, err := x509.MarshalECPrivateKey(key)
if err != nil {
logger().Fatalf("Could not marshal ECDSA private key: %v", err)
}
pemKey = pem.Block{Type: "EC PRIVATE KEY", Bytes: privateBytes}
}
certOut, err := os.Create(fileName)
if err != nil {
logger().Fatalf("Could not create private key file: %s", err)
}
pem.Encode(certOut, &pemKey)
certOut.Close()
return privateKey
}
func generateSelfSignedCert(privKey *rsa.PrivateKey) {
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
log.Fatalf("failed to generate serial number: %s", err)
}
template := x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{
CommonName: *email,
Organization: []string{*domain},
},
NotBefore: time.Now(),
NotAfter: time.Now().Add(365),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
BasicConstraintsValid: true,
DNSNames: []string{*domain},
IsCA: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privKey.PublicKey, privKey)
if err != nil {
log.Fatalf("Failed to create certificate: %s", err)
}
certOut, err := os.Create(*accountTmpCrtFile)
if err != nil {
log.Fatalf("failed to open cert.pem for writing: %s", err)
}
pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
certOut.Close()
}