diff --git a/acme/client.go b/acme/client.go index fbc33e11..d0f0ea19 100644 --- a/acme/client.go +++ b/acme/client.go @@ -51,7 +51,7 @@ type Client struct { // NewClient creates a new client for the set user. func NewClient(caURL string, usr User, keyBits int, optPort string) *Client { if err := usr.GetPrivateKey().Validate(); err != nil { - logger().Fatalf("Could not validate the private account key of %s -> %v", usr.GetEmail(), err) + logger().Fatalf("Could not validate the private account key of %s\n\t%v", usr.GetEmail(), err) } jws := &jws{privKey: usr.GetPrivateKey()} @@ -60,7 +60,7 @@ func NewClient(caURL string, usr User, keyBits int, optPort string) *Client { // Add all available solvers with the right index as per ACME // spec to this map. Otherwise they won`t be found. solvers := make(map[string]solver) - solvers["simpleHttps"] = &simpleHTTPChallenge{jws: jws, optPort: optPort} + solvers["simpleHttp"] = &simpleHTTPChallenge{jws: jws, optPort: optPort} return &Client{regURL: caURL, user: usr, jws: jws, keyBits: keyBits, solvers: solvers} } @@ -68,7 +68,7 @@ func NewClient(caURL string, usr User, keyBits int, optPort string) *Client { // Register the current account to the ACME server. func (c *Client) Register() (*RegistrationResource, error) { logger().Print("Registering account ... ") - jsonBytes, err := json.Marshal(registrationMessage{Contact: []string{"mailto:" + c.user.GetEmail()}}) + jsonBytes, err := json.Marshal(registrationMessage{Resource: "new-reg", Contact: []string{"mailto:" + c.user.GetEmail()}}) if err != nil { return nil, err } @@ -111,6 +111,7 @@ func (c *Client) Register() (*RegistrationResource, error) { // the server. func (c *Client) AgreeToTos() error { c.user.GetRegistration().Body.Agreement = c.user.GetRegistration().TosURL + c.user.GetRegistration().Body.Resource = "reg" jsonBytes, err := json.Marshal(&c.user.GetRegistration().Body) if err != nil { return err @@ -193,7 +194,7 @@ func (c *Client) getChallenges(domains []string) []*authorizationResource { for _, domain := range domains { go func(domain string) { - jsonBytes, err := json.Marshal(authorization{Identifier: identifier{Type: "dns", Value: domain}}) + jsonBytes, err := json.Marshal(authorization{Resource: "new-authz", Identifier: identifier{Type: "dns", Value: domain}}) if err != nil { errc <- err return @@ -259,7 +260,7 @@ func (c *Client) requestCertificates(challenges []*authorizationResource) ([]Cer return nil, err } csrString := base64.URLEncoding.EncodeToString(csr) - jsonBytes, err := json.Marshal(csrMessage{Csr: csrString, Authorizations: []string{authz.AuthURL}}) + jsonBytes, err := json.Marshal(csrMessage{Resource: "new-cert", Csr: csrString, Authorizations: []string{authz.AuthURL}}) if err != nil { return nil, err } @@ -269,8 +270,6 @@ func (c *Client) requestCertificates(challenges []*authorizationResource) ([]Cer return nil, err } - logResponseHeaders(resp) - if resp.Header.Get("Content-Type") != "application/pkix-cert" { return nil, fmt.Errorf("The server returned an unexpected content-type header: %s - expected %s", resp.Header.Get("Content-Type"), "application/pkix-cert") } diff --git a/acme/client_test.go b/acme/client_test.go index 0c2e8c1e..690d2cb8 100644 --- a/acme/client_test.go +++ b/acme/client_test.go @@ -38,7 +38,7 @@ func TestNewClient(t *testing.T) { t.Fatal("Expected %d solver(s), got %d", expected, actual) } - simphttp, ok := client.solvers["simpleHttps"].(*simpleHTTPChallenge) + simphttp, ok := client.solvers["simpleHttp"].(*simpleHTTPChallenge) if !ok { t.Fatal("Expected simpleHttps solver to be simpleHTTPChallenge type") } diff --git a/acme/jws.go b/acme/jws.go index 3f85b5b1..e0eec145 100644 --- a/acme/jws.go +++ b/acme/jws.go @@ -3,33 +3,80 @@ package acme import ( "bytes" "crypto/rsa" + "fmt" "net/http" - "github.com/square/go-jose" + "github.com/letsencrypt/go-jose" ) type jws struct { privKey *rsa.PrivateKey + nonces []string } // Posts a JWS signed message to the specified URL func (j *jws) post(url string, content []byte) (*http.Response, error) { + if len(j.nonces) == 0 { + err := j.getNonce(url) + if err != nil { + return nil, fmt.Errorf("Could not get a nonce for request: %s\n\t\tError: %v", url, err) + } + } + + signedContent, err := j.signContent(content) + if err != nil { + return nil, err + } + + resp, err := http.Post(url, "application/json", bytes.NewBuffer([]byte(signedContent.FullSerialize()))) + if err != nil { + return nil, err + } + + j.getNonceFromResponse(resp) + + return resp, err +} + +func (j *jws) signContent(content []byte) (*jose.JsonWebSignature, error) { // TODO: support other algorithms - RS512 signer, err := jose.NewSigner(jose.RS256, j.privKey) if err != nil { return nil, err } - signed, err := signer.Sign(content) + signed, err := signer.Sign(content, j.consumeNonce()) if err != nil { return nil, err } - signedContent := signed.FullSerialize() - - resp, err := http.Post(url, "application/json", bytes.NewBuffer([]byte(signedContent))) - if err != nil { - return nil, err - } - - return resp, err + return signed, nil +} + +func (j *jws) getNonceFromResponse(resp *http.Response) error { + nonce := resp.Header.Get("Replay-Nonce") + if nonce == "" { + return fmt.Errorf("Server did not respond with a proper nonce header.") + } + + j.nonces = append(j.nonces, nonce) + return nil +} + +func (j *jws) getNonce(url string) error { + resp, err := http.Head(url) + if err != nil { + return err + } + + return j.getNonceFromResponse(resp) +} + +func (j *jws) consumeNonce() string { + nonce := "" + if len(j.nonces) == 0 { + return nonce + } + + nonce, j.nonces = j.nonces[len(j.nonces)-1], j.nonces[:len(j.nonces)-1] + return nonce } diff --git a/acme/messages.go b/acme/messages.go index 1ee1377a..037bd207 100644 --- a/acme/messages.go +++ b/acme/messages.go @@ -3,21 +3,24 @@ package acme import "time" type registrationMessage struct { - Contact []string `json:"contact"` + Resource string `json:"resource"` + Contact []string `json:"contact"` } // Registration is returned by the ACME server after the registration // The client implementation should save this registration somewhere. type Registration struct { - ID int `json:"id"` - Key struct { + Resource string `json:"resource,omitempty"` + ID int `json:"id"` + Key struct { Kty string `json:"kty"` N string `json:"n"` E string `json:"e"` } `json:"key"` - Recoverytoken string `json:"recoveryToken"` - Contact []string `json:"contact"` - Agreement string `json:"agreement,omitempty"` + Contact []string `json:"contact"` + Agreement string `json:"agreement,omitempty"` + Authorizations string `json:"authorizations,omitempty"` + Certificates string `json:"certificates,omitempty"` } // RegistrationResource represents all important informations about a registration @@ -37,6 +40,7 @@ type authorizationResource struct { } type authorization struct { + Resource string `json:"resource,omitempty"` Identifier identifier `json:"identifier"` Status string `json:"status,omitempty"` Expires time.Time `json:"expires,omitempty"` @@ -50,14 +54,16 @@ type identifier struct { } type challenge struct { - Type string `json:"type,omitempty"` - Status string `json:"status,omitempty"` - URI string `json:"uri,omitempty"` - Token string `json:"token,omitempty"` - Path string `json:"path,omitempty"` + Resource string `json:"resource,omitempty"` + Type string `json:"type,omitempty"` + Status string `json:"status,omitempty"` + URI string `json:"uri,omitempty"` + Token string `json:"token,omitempty"` + Tls bool `json:"tls,omitempty"` } type csrMessage struct { + Resource string `json:"resource,omitempty"` Csr string `json:"csr"` Authorizations []string `json:"authorizations"` } diff --git a/acme/simple_http_challenge.go b/acme/simple_http_challenge.go index 7713d762..099d5e78 100644 --- a/acme/simple_http_challenge.go +++ b/acme/simple_http_challenge.go @@ -25,6 +25,7 @@ type simpleHTTPChallenge struct { // SimpleHTTPS checks for DNS, public IP and port bindings func (s *simpleHTTPChallenge) CanSolve(domain string) bool { + // determine public ip resp, err := http.Get("https://icanhazip.com/") if err != nil { @@ -54,24 +55,23 @@ func (s *simpleHTTPChallenge) CanSolve(domain string) bool { } } - logger().Printf("SimpleHTTPS: Domain %s does not resolve to the public ip of this server. Determined ip: %s", domain, ipStr) + logger().Printf("SimpleHTTP: Domain %s does not resolve to the public ip of this server. Determined IP: %s Resolved IP: %s", domain, ipStr, resolvedIPs[0]) return false } func (s *simpleHTTPChallenge) Solve(chlng challenge, domain string) error { - logger().Print("Trying to solve SimpleHTTPS") + logger().Print("Trying to solve SimpleHTTP") // Generate random string for the path. The acme server will // access this path on the server in order to validate the request - responseToken := getRandomString(15) - listener, err := s.startHTTPSServer(domain, chlng.Token, responseToken) + listener, err := s.startHTTPSServer(domain, chlng.Token) if err != nil { return fmt.Errorf("Could not start HTTPS server for challenge -> %v", err) } // Tell the server about the generated random path - jsonBytes, err := json.Marshal(challenge{Type: chlng.Type, Path: responseToken}) + jsonBytes, err := json.Marshal(challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token}) if err != nil { return errors.New("Failed to marshal network message...") } @@ -98,9 +98,11 @@ loop: break case "invalid": listener.Close() + logger().Print("The server could not validate our request.") return errors.New("The server could not validate our request.") default: listener.Close() + logger().Print("The server returned an unexpected state.") return errors.New("The server returned an unexpected state.") } @@ -113,7 +115,7 @@ loop: // Starts a temporary HTTPS server on port 443. As soon as the challenge passed validation, // this server will get shut down. The certificate generated here is only held in memory. -func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string, responseToken string) (net.Listener, error) { +func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string) (net.Listener, error) { // Generate a new RSA key and a self-signed certificate. tempPrivKey, err := generatePrivateKey(2048) @@ -135,7 +137,7 @@ func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string, resp tlsConf := new(tls.Config) tlsConf.Certificates = []tls.Certificate{tempKeyPair} - path := "/.well-known/acme-challenge/" + responseToken + path := "/.well-known/acme-challenge/" + token // Allow for CLI override port := ":443" @@ -148,11 +150,29 @@ func (s *simpleHTTPChallenge) startHTTPSServer(domain string, token string, resp return nil, fmt.Errorf("Could not start HTTP listener! -> %v", err) } + jsonBytes, err := json.Marshal(challenge{Type: "simpleHttp", Token: token, Tls: true}) + if err != nil { + return nil, errors.New("startHTTPSServer: Failed to marshal network message...") + } + signed, err := s.jws.signContent(jsonBytes) + if err != nil { + return nil, errors.New("startHTTPSServer: Failed to sign message...") + } + signedCompact := signed.FullSerialize() + if err != nil { + return nil, errors.New("startHTTPSServer: Failed to serialize message...") + } + // The handler validates the HOST header and request type. // For validation it then writes the token the server returned with the challenge http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) { - if r.Host == domain && r.Method == "GET" { - w.Write([]byte(token)) + if strings.HasPrefix(r.Host, domain) && r.Method == "GET" { + w.Header().Add("Content-Type", "application/jose+json") + w.Write([]byte(signedCompact)) + logger().Print("Served JWS payload...") + } else { + logger().Printf("Received request for domain %s with method %s", r.Host, r.Method) + w.Write([]byte("TEST")) } }) diff --git a/acme/simple_http_challenge_test.go b/acme/simple_http_challenge_test.go index 36a76536..eef8b161 100644 --- a/acme/simple_http_challenge_test.go +++ b/acme/simple_http_challenge_test.go @@ -45,10 +45,11 @@ func TestSimpleHTTP(t *testing.T) { jws := &jws{privKey: privKey} ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Add("Replay-Nonce", "12345") })) solver := &simpleHTTPChallenge{jws: jws} - clientChallenge := challenge{Type: "simpleHttps", Status: "pending", URI: ts.URL, Token: "123456789"} + clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "123456789"} // validate error on non-root bind to 443 if err = solver.Solve(clientChallenge, "test.domain"); err == nil { @@ -63,32 +64,43 @@ func TestSimpleHTTP(t *testing.T) { // Validate error on invalid status ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - failed := challenge{Type: "simpleHttps", Status: "invalid", URI: ts.URL, Token: "123456789"} + w.Header().Add("Replay-Nonce", "12345") + failed := challenge{Type: "simpleHttp", Status: "invalid", URI: ts.URL, Token: "1234567810"} jsonBytes, _ := json.Marshal(&failed) w.Write(jsonBytes) }) + clientChallenge.Token = "1234567810" if err = solver.Solve(clientChallenge, "test.domain"); err == nil { t.Error("FAILED: Expected Solve to return an error but the error was nil.") } // Validate no error on valid response ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - valid := challenge{Type: "simpleHttps", Status: "valid", URI: ts.URL, Token: "123456789"} + w.Header().Add("Replay-Nonce", "12345") + valid := challenge{Type: "simpleHttp", Status: "valid", URI: ts.URL, Token: "1234567811"} jsonBytes, _ := json.Marshal(&valid) w.Write(jsonBytes) }) + clientChallenge.Token = "1234567811" if err = solver.Solve(clientChallenge, "test.domain"); err != nil { t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err) } // Validate server on port 8080 which responds appropriately + clientChallenge.Token = "1234567812" ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { var request challenge + w.Header().Add("Replay-Nonce", "12345") + + if r.Method == "HEAD" { + return + } clientJws, _ := ioutil.ReadAll(r.Body) j, err := jose.ParseSigned(string(clientJws)) if err != nil { - t.Errorf("Client sent invalid JWS to the server. -> %v", err) + t.Errorf("Client sent invalid JWS to the server.\n\t%v", err) + return } output, err := j.Verify(&privKey.PublicKey) if err != nil { @@ -99,7 +111,7 @@ func TestSimpleHTTP(t *testing.T) { transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} client := &http.Client{Transport: transport} - reqURL := "https://localhost:8080/.well-known/acme-challenge/" + request.Path + reqURL := "https://localhost:8080/.well-known/acme-challenge/" + clientChallenge.Token t.Logf("Request URL is: %s", reqURL) req, _ := http.NewRequest("GET", reqURL, nil) req.Host = "test.domain" @@ -110,11 +122,17 @@ func TestSimpleHTTP(t *testing.T) { body, _ := ioutil.ReadAll(resp.Body) bodyStr := string(body) - if bodyStr != "123456789" { - t.Errorf("Expected the solver to return the token %s but instead returned '%s'", "123456789", bodyStr) + clientResponse, err := jose.ParseSigned(bodyStr) + if err != nil { + t.Errorf("Client answered with invalid JWS.\n\t%v", err) + return + } + _, err = clientResponse.Verify(&privKey.PublicKey) + if err != nil { + t.Errorf("Unable to verify client data -> %v", err) } - valid := challenge{Type: "simpleHttps", Status: "valid", URI: ts.URL, Token: "123456789"} + valid := challenge{Type: "simpleHttp", Status: "valid", URI: ts.URL, Token: "1234567812"} jsonBytes, _ := json.Marshal(&valid) w.Write(jsonBytes) }) diff --git a/cli_handlers.go b/cli_handlers.go index fb60bf8a..718cfc79 100644 --- a/cli_handlers.go +++ b/cli_handlers.go @@ -36,7 +36,7 @@ func run(c *cli.Context) { if acc.Registration == nil { reg, err := client.Register() if err != nil { - logger().Fatalf("Could not complete registration -> %v", err) + logger().Fatalf("Could not complete registration\n\t%v", err) } acc.Registration = reg @@ -49,12 +49,7 @@ func run(c *cli.Context) { You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained from Let's Encrypt so making regular - backups of this folder is ideal. - - If you lose your account credentials, you can recover - them using the token - "%s". - You must write that down and put it in a safe place.`, c.GlobalString("config-dir"), reg.Body.Recoverytoken) + backups of this folder is ideal.`, c.GlobalString("config-dir")) } @@ -96,7 +91,7 @@ func run(c *cli.Context) { certs, err := client.ObtainCertificates(c.GlobalStringSlice("domains")) if err != nil { - logger().Fatalf("Could not obtain certificates -> %v", err) + logger().Fatalf("Could not obtain certificates\n\t%v", err) } err = checkFolder(conf.CertPath()) @@ -110,12 +105,12 @@ func run(c *cli.Context) { err = ioutil.WriteFile(certOut, certRes.Certificate, 0700) if err != nil { - logger().Printf("Unable to save Certificate for domain %s -> %v", certRes.Domain, err) + logger().Printf("Unable to save Certificate for domain %s\n\t%v", certRes.Domain, err) } err = ioutil.WriteFile(privOut, certRes.PrivateKey, 0700) if err != nil { - logger().Printf("Unable to save PrivateKey for domain %s -> %v", certRes.Domain, err) + logger().Printf("Unable to save PrivateKey for domain %s\n\t%v", certRes.Domain, err) } }