Merge pull request #25 from xenolf/add-http-01

Add the HTTP-01 challenge

acme/client.go

@@ -102,6 +102,7 @@ func NewClient(caURL string, usr User, keyBits int, optPort string) (*Client, er
 	// spec to this map. Otherwise they won`t be found.
 	solvers := make(map[string]solver)
 	solvers["simpleHttp"] = &simpleHTTPChallenge{jws: jws, optPort: optPort}
+	solvers["http-01"] = &httpChallenge{jws: jws, optPort: optPort}
 
 	return &Client{directory: dir, user: usr, jws: jws, keyBits: keyBits, solvers: solvers}, nil
 }

acme/client_test.go

@@ -43,7 +43,7 @@ func TestNewClient(t *testing.T) {
 		t.Errorf("Expected keyBits to be %d but was %d", keyBits, client.keyBits)
 	}
 
-	if expected, actual := 1, len(client.solvers); actual != expected {
+	if expected, actual := 2, len(client.solvers); actual != expected {
 		t.Fatalf("Expected %d solver(s), got %d", expected, actual)
 	}
 

acme/http_challenge.go

@@ -0,0 +1,143 @@
+package acme
+
+import (
+	"crypto"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type httpChallenge struct {
+	jws     *jws
+	optPort string
+	start   chan net.Listener
+	end     chan error
+}
+
+func (s *httpChallenge) Solve(chlng challenge, domain string) error {
+
+	logf("[INFO] acme: Trying to solve HTTP-01")
+
+	s.start = make(chan net.Listener)
+	s.end = make(chan error)
+
+	// Generate the Key Authorization for the challenge
+	key := keyAsJWK(&s.jws.privKey.PublicKey)
+	thumbBytes, err := key.Thumbprint(crypto.SHA256)
+	if err != nil {
+		return err
+	}
+
+	keyThumb := base64.URLEncoding.EncodeToString(thumbBytes)
+	index := strings.Index(keyThumb, "=")
+	if index != -1 {
+		keyThumb = keyThumb[:index]
+	}
+	keyAuth := chlng.Token + "." + keyThumb
+
+	go s.startHTTPServer(domain, chlng.Token, keyAuth)
+	var listener net.Listener
+	select {
+	case listener = <-s.start:
+		break
+	case err := <-s.end:
+		return fmt.Errorf("Could not start HTTP server for challenge -> %v", err)
+	}
+
+	// Make sure we properly close the HTTP server before we return
+	defer func() {
+		listener.Close()
+		err = <-s.end
+		close(s.start)
+		close(s.end)
+	}()
+
+	jsonBytes, err := json.Marshal(challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
+	if err != nil {
+		return errors.New("Failed to marshal network message...")
+	}
+
+	// Tell the server we handle HTTP-01
+	resp, err := s.jws.post(chlng.URI, jsonBytes)
+	if err != nil {
+		return fmt.Errorf("Failed to post JWS message. -> %v", err)
+	}
+
+	// After the path is sent, the ACME server will access our server.
+	// Repeatedly check the server for an updated status on our request.
+	var challengeResponse challenge
+Loop:
+	for {
+		if resp.StatusCode >= http.StatusBadRequest {
+			return handleHTTPError(resp)
+		}
+
+		err = json.NewDecoder(resp.Body).Decode(&challengeResponse)
+		resp.Body.Close()
+		if err != nil {
+			return err
+		}
+
+		switch challengeResponse.Status {
+		case "valid":
+			logf("The server validated our request")
+			break Loop
+		case "pending":
+			break
+		case "invalid":
+			return errors.New("The server could not validate our request.")
+		default:
+			return errors.New("The server returned an unexpected state.")
+		}
+
+		time.Sleep(1 * time.Second)
+		resp, err = http.Get(chlng.URI)
+	}
+
+	return nil
+}
+
+func (s *httpChallenge) startHTTPServer(domain string, token string, keyAuth string) {
+
+	// Allow for CLI port override
+	port := ":80"
+	if s.optPort != "" {
+		port = ":" + s.optPort
+	}
+
+	listener, err := net.Listen("tcp", domain+port)
+	if err != nil {
+		// if the domain:port bind failed, fall back to :port bind and try that instead.
+		listener, err = net.Listen("tcp", port)
+		if err != nil {
+			s.end <- err
+		}
+	}
+	// Signal successfull start
+	s.start <- listener
+
+	path := "/.well-known/acme-challenge/" + token
+
+	// The handler validates the HOST header and request type.
+	// For validation it then writes the token the server returned with the challenge
+	http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.Host, domain) && r.Method == "GET" {
+			w.Header().Add("Content-Type", "text/plain")
+			w.Write([]byte(keyAuth))
+			logf("Served Key Authentication ...")
+		} else {
+			logf("Received request for domain %s with method %s", r.Host, r.Method)
+			w.Write([]byte("TEST"))
+		}
+	})
+
+	http.Serve(listener, nil)
+
+	// Signal that the server was shut down
+	s.end <- nil
+}

acme/http_challenge_test.go

@@ -0,0 +1,264 @@
+package acme
+
+import (
+	"crypto/rsa"
+	"crypto/tls"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/square/go-jose"
+)
+
+func TestHTTPNonRootBind(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 128)
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
+
+	solver := &httpChallenge{jws: jws}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "localhost:4000", Token: "http1"}
+
+	// validate error on non-root bind to 443
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("BIND: Expected Solve to return an error but the error was nil.")
+	} else {
+		expectedError := "Could not start HTTP server for challenge -> listen tcp :80: bind: permission denied"
+		if err.Error() != expectedError {
+			t.Errorf("Expected error \"%s\" but instead got \"%s\"", expectedError, err.Error())
+		}
+	}
+}
+
+func TestHTTPShortRSA(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 128)
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
+
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "http2"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	} else {
+		expectedError := "Failed to post JWS message. -> crypto/rsa: message too long for RSA public key size"
+		if err.Error() != expectedError {
+			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
+		}
+	}
+}
+
+func TestHTTPConnectionRefusal(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), nonces: []string{"test1", "test2"}}
+
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: "http://localhost:4000", Token: "http3"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	} else {
+		reg := "/Failed to post JWS message\\. -> Post http:\\/\\/localhost:4000: dial tcp 127\\.0\\.0\\.1:4000: (getsockopt: )?connection refused/g"
+		test2 := "Failed to post JWS message. -> Post http://localhost:4000: dial tcp 127.0.0.1:4000: connection refused"
+		r, _ := regexp.Compile(reg)
+		if r.MatchString(err.Error()) && r.MatchString(test2) {
+			t.Errorf("Expected \"%s\" to match %s", err.Error(), reg)
+		}
+	}
+}
+
+func TestHTTPUnexpectedServerState(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Replay-Nonce", "12345")
+		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"what\",\"uri\":\"http://some.url\",\"token\":\"http4\"}"))
+	}))
+
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http4"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	} else {
+		expectedError := "The server returned an unexpected state."
+		if err.Error() != expectedError {
+			t.Errorf("Expected error %s but instead got %s", expectedError, err.Error())
+		}
+	}
+}
+
+func TestHTTPChallengeServerUnexpectedDomain(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey)}
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "POST" {
+			tr := &http.Transport{
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+			}
+			client := &http.Client{Transport: tr}
+			req, _ := client.Get("https://localhost:23456/.well-known/acme-challenge/" + "htto5")
+			reqBytes, _ := ioutil.ReadAll(req.Body)
+			if string(reqBytes) != "TEST" {
+				t.Error("Expected simpleHTTP server to return string TEST on unexpected domain.")
+			}
+		}
+
+		w.Header().Add("Replay-Nonce", "12345")
+		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"http5\"}"))
+	}))
+
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http5"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	}
+}
+
+func TestHTTPServerError(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "HEAD" {
+			w.Header().Add("Replay-Nonce", "12345")
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+			w.Header().Add("Replay-Nonce", "12345")
+			w.Write([]byte("{\"type\":\"urn:acme:error:unauthorized\",\"detail\":\"Error creating new authz :: Syntax error\"}"))
+		}
+	}))
+
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http6"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	} else {
+		expectedError := "acme: Error 500 - urn:acme:error:unauthorized - Error creating new authz :: Syntax error"
+		if err.Error() != expectedError {
+			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
+		}
+	}
+}
+
+func TestHTTPInvalidServerState(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Replay-Nonce", "12345")
+		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"invalid\",\"uri\":\"http://some.url\",\"token\":\"http7\"}"))
+	}))
+
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http7"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err == nil {
+		t.Error("UNEXPECTED: Expected Solve to return an error but the error was nil.")
+	} else {
+		expectedError := "The server could not validate our request."
+		if err.Error() != expectedError {
+			t.Errorf("Expected error |%s| but instead got |%s|", expectedError, err.Error())
+		}
+	}
+}
+
+func TestHTTPValidServerResponse(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Replay-Nonce", "12345")
+		w.Write([]byte("{\"type\":\"simpleHttp\",\"status\":\"valid\",\"uri\":\"http://some.url\",\"token\":\"http8\"}"))
+	}))
+
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	solver := &httpChallenge{jws: jws, optPort: "23456"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http8"}
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
+		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
+	}
+}
+
+func TestHTTPValidFull(t *testing.T) {
+	privKey, _ := generatePrivateKey(rsakey, 512)
+
+	ts := httptest.NewServer(nil)
+
+	jws := &jws{privKey: privKey.(*rsa.PrivateKey), directoryURL: ts.URL}
+	solver := &httpChallenge{jws: jws, optPort: "23457"}
+	clientChallenge := challenge{Type: "simpleHttp", Status: "pending", URI: ts.URL, Token: "http9"}
+
+	// Validate server on port 23456 which responds appropriately
+	ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var request challenge
+		w.Header().Add("Replay-Nonce", "12345")
+
+		if r.Method == "HEAD" {
+			return
+		}
+
+		clientJws, _ := ioutil.ReadAll(r.Body)
+		j, err := jose.ParseSigned(string(clientJws))
+		if err != nil {
+			t.Errorf("Client sent invalid JWS to the server.\n\t%v", err)
+			return
+		}
+		output, err := j.Verify(&privKey.(*rsa.PrivateKey).PublicKey)
+		if err != nil {
+			t.Errorf("Unable to verify client data -> %v", err)
+		}
+		json.Unmarshal(output, &request)
+
+		transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+		client := &http.Client{Transport: transport}
+
+		reqURL := "http://localhost:23457/.well-known/acme-challenge/" + clientChallenge.Token
+		t.Logf("Request URL is: %s", reqURL)
+		req, err := http.NewRequest("GET", reqURL, nil)
+		if err != nil {
+			t.Error(err)
+		}
+		req.Host = "127.0.0.1"
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Errorf("Expected the solver to listen on port 23457 -> %v", err)
+		}
+		defer resp.Body.Close()
+
+		body, _ := ioutil.ReadAll(resp.Body)
+		bodyStr := string(body)
+
+		if resp.Header.Get("Content-Type") != "text/plain" {
+			t.Errorf("Expected server to respond with content type text/plain.")
+		}
+
+		tokenRegex := regexp.MustCompile("^[\\w-]{43}$")
+		parts := strings.Split(bodyStr, ".")
+
+		if len(parts) != 2 {
+			t.Errorf("Expected server token to be a composite of two strings, seperated by a dot")
+		}
+
+		if parts[0] != clientChallenge.Token {
+			t.Errorf("Expected the first part of the server token to be the challenge token.")
+		}
+
+		if !tokenRegex.MatchString(parts[1]) {
+			t.Errorf("Expected the second part of the server token to be a properly formatted key authorization")
+		}
+
+		valid := challenge{Type: "simpleHttp", Status: "valid", URI: ts.URL, Token: "1234567812"}
+		jsonBytes, _ := json.Marshal(&valid)
+		w.Write(jsonBytes)
+	})
+
+	if err := solver.Solve(clientChallenge, "127.0.0.1"); err != nil {
+		t.Errorf("VALID: Expected Solve to return no error but the error was -> %v", err)
+	}
+}

acme/messages.go

@@ -73,12 +73,13 @@ type identifier struct {
 }
 
 type challenge struct {
-	Resource string `json:"resource,omitempty"`
-	Type     string `json:"type,omitempty"`
-	Status   string `json:"status,omitempty"`
-	URI      string `json:"uri,omitempty"`
-	Token    string `json:"token,omitempty"`
-	TLS      bool   `json:"tls,omitempty"`
+	Resource         string `json:"resource,omitempty"`
+	Type             string `json:"type,omitempty"`
+	Status           string `json:"status,omitempty"`
+	URI              string `json:"uri,omitempty"`
+	Token            string `json:"token,omitempty"`
+	KeyAuthorization string `json:"keyAuthorization,omitempty"`
+	TLS              bool   `json:"tls,omitempty"`
 }
 
 type csrMessage struct {