2015-06-11 00:12:46 +02:00
|
|
|
package acme
|
2015-11-17 00:57:41 +02:00
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/sha256"
|
2016-01-01 15:36:30 +02:00
|
|
|
"encoding/base64"
|
2015-11-17 00:57:41 +02:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
2016-01-15 06:06:25 +02:00
|
|
|
"log"
|
2016-02-03 06:03:03 +02:00
|
|
|
"net"
|
2016-01-01 15:36:30 +02:00
|
|
|
"strings"
|
2016-01-22 02:38:15 +02:00
|
|
|
|
|
|
|
"github.com/miekg/dns"
|
2016-02-28 22:09:05 +02:00
|
|
|
"golang.org/x/net/publicsuffix"
|
2015-11-17 00:57:41 +02:00
|
|
|
)
|
|
|
|
|
2016-02-10 16:52:53 +02:00
|
|
|
type preCheckDNSFunc func(fqdn, value string) (bool, error)
|
2016-01-22 02:38:15 +02:00
|
|
|
|
2016-02-28 22:09:05 +02:00
|
|
|
var (
|
|
|
|
preCheckDNS preCheckDNSFunc = checkDNSPropagation
|
2016-02-29 09:46:15 +02:00
|
|
|
fqdnToZone = map[string]string{}
|
2016-02-28 22:09:05 +02:00
|
|
|
)
|
2016-01-22 02:38:15 +02:00
|
|
|
|
2016-02-28 22:09:05 +02:00
|
|
|
var recursiveNameserver = "google-public-dns-a.google.com:53"
|
2016-01-22 02:38:15 +02:00
|
|
|
|
2016-01-15 06:06:25 +02:00
|
|
|
// DNS01Record returns a DNS record which will fulfill the `dns-01` challenge
|
|
|
|
func DNS01Record(domain, keyAuth string) (fqdn string, value string, ttl int) {
|
|
|
|
keyAuthShaBytes := sha256.Sum256([]byte(keyAuth))
|
|
|
|
// base64URL encoding without padding
|
|
|
|
keyAuthSha := base64.URLEncoding.EncodeToString(keyAuthShaBytes[:sha256.Size])
|
|
|
|
value = strings.TrimRight(keyAuthSha, "=")
|
|
|
|
ttl = 120
|
|
|
|
fqdn = fmt.Sprintf("_acme-challenge.%s.", domain)
|
|
|
|
return
|
2015-12-03 22:01:46 +02:00
|
|
|
}
|
2015-11-17 00:57:41 +02:00
|
|
|
|
|
|
|
// dnsChallenge implements the dns-01 challenge according to ACME 7.5
|
|
|
|
type dnsChallenge struct {
|
2015-12-03 22:01:46 +02:00
|
|
|
jws *jws
|
2016-01-25 01:23:21 +02:00
|
|
|
validate validateFunc
|
2016-01-15 06:06:25 +02:00
|
|
|
provider ChallengeProvider
|
2015-11-17 00:57:41 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *dnsChallenge) Solve(chlng challenge, domain string) error {
|
2016-01-30 23:17:41 +02:00
|
|
|
logf("[INFO][%s] acme: Trying to solve DNS-01", domain)
|
2015-11-17 00:57:41 +02:00
|
|
|
|
2016-01-15 06:06:25 +02:00
|
|
|
if s.provider == nil {
|
|
|
|
return errors.New("No DNS Provider configured")
|
|
|
|
}
|
|
|
|
|
2015-11-17 00:57:41 +02:00
|
|
|
// Generate the Key Authorization for the challenge
|
2016-01-27 03:01:39 +02:00
|
|
|
keyAuth, err := getKeyAuthorization(chlng.Token, s.jws.privKey)
|
2015-11-17 00:57:41 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2016-01-15 06:06:25 +02:00
|
|
|
err = s.provider.Present(domain, chlng.Token, keyAuth)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error presenting token %s", err)
|
2015-12-03 22:01:46 +02:00
|
|
|
}
|
2016-01-15 06:06:25 +02:00
|
|
|
defer func() {
|
|
|
|
err := s.provider.CleanUp(domain, chlng.Token, keyAuth)
|
|
|
|
if err != nil {
|
|
|
|
log.Printf("Error cleaning up %s %v ", domain, err)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
fqdn, value, _ := DNS01Record(domain, keyAuth)
|
2015-11-17 00:57:41 +02:00
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
logf("[INFO][%s] Checking DNS record propagation...", domain)
|
|
|
|
|
2016-03-11 04:20:25 +02:00
|
|
|
err = WaitFor(30, 2, func() (bool, error) {
|
2016-02-10 16:52:53 +02:00
|
|
|
return preCheckDNS(fqdn, value)
|
|
|
|
})
|
|
|
|
if err != nil {
|
2016-02-03 06:03:03 +02:00
|
|
|
return err
|
|
|
|
}
|
2016-01-22 02:38:15 +02:00
|
|
|
|
2016-01-25 01:32:47 +02:00
|
|
|
return s.validate(s.jws, domain, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
|
2015-11-17 00:57:41 +02:00
|
|
|
}
|
2016-01-22 03:25:27 +02:00
|
|
|
|
2016-02-14 08:24:19 +02:00
|
|
|
// checkDNSPropagation checks if the expected TXT record has been propagated to all authoritative nameservers.
|
|
|
|
func checkDNSPropagation(fqdn, value string) (bool, error) {
|
2016-02-10 16:52:53 +02:00
|
|
|
// Initial attempt to resolve at the recursive NS
|
|
|
|
r, err := dnsQuery(fqdn, dns.TypeTXT, recursiveNameserver, true)
|
2016-01-22 03:25:27 +02:00
|
|
|
if err != nil {
|
2016-02-10 16:52:53 +02:00
|
|
|
return false, err
|
|
|
|
}
|
2016-02-19 10:14:26 +02:00
|
|
|
if r.Rcode == dns.RcodeSuccess {
|
|
|
|
// If we see a CNAME here then use the alias
|
|
|
|
for _, rr := range r.Answer {
|
|
|
|
if cn, ok := rr.(*dns.CNAME); ok {
|
|
|
|
if cn.Hdr.Name == fqdn {
|
|
|
|
fqdn = cn.Target
|
|
|
|
break
|
|
|
|
}
|
2016-02-10 16:52:53 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
authoritativeNss, err := lookupNameservers(fqdn)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
|
|
|
|
2016-02-10 16:52:53 +02:00
|
|
|
return checkAuthoritativeNss(fqdn, value, authoritativeNss)
|
2016-02-03 06:03:03 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// checkAuthoritativeNss queries each of the given nameservers for the expected TXT record.
|
|
|
|
func checkAuthoritativeNss(fqdn, value string, nameservers []string) (bool, error) {
|
|
|
|
for _, ns := range nameservers {
|
2016-02-28 22:09:05 +02:00
|
|
|
r, err := dnsQuery(fqdn, dns.TypeTXT, net.JoinHostPort(ns, "53"), false)
|
2016-01-22 03:25:27 +02:00
|
|
|
if err != nil {
|
2016-02-03 06:03:03 +02:00
|
|
|
return false, err
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
if r.Rcode != dns.RcodeSuccess {
|
2016-02-10 16:52:53 +02:00
|
|
|
return false, fmt.Errorf("NS %s returned %s for %s", ns, dns.RcodeToString[r.Rcode], fqdn)
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
var found bool
|
|
|
|
for _, rr := range r.Answer {
|
|
|
|
if txt, ok := rr.(*dns.TXT); ok {
|
|
|
|
if strings.Join(txt.Txt, "") == value {
|
|
|
|
found = true
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
if !found {
|
2016-02-10 16:52:53 +02:00
|
|
|
return false, fmt.Errorf("NS %s did not return the expected TXT record", ns)
|
2016-02-03 06:03:03 +02:00
|
|
|
}
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// dnsQuery sends a DNS query to the given nameserver.
|
2016-02-28 22:09:05 +02:00
|
|
|
// The nameserver should include a port, to facilitate testing where we talk to a mock dns server.
|
2016-02-03 06:03:03 +02:00
|
|
|
func dnsQuery(fqdn string, rtype uint16, nameserver string, recursive bool) (in *dns.Msg, err error) {
|
|
|
|
m := new(dns.Msg)
|
|
|
|
m.SetQuestion(fqdn, rtype)
|
|
|
|
m.SetEdns0(4096, false)
|
2016-02-10 16:52:53 +02:00
|
|
|
|
2016-02-03 06:03:03 +02:00
|
|
|
if !recursive {
|
|
|
|
m.RecursionDesired = false
|
|
|
|
}
|
|
|
|
|
2016-02-28 22:09:05 +02:00
|
|
|
in, err = dns.Exchange(m, nameserver)
|
2016-02-03 06:03:03 +02:00
|
|
|
if err == dns.ErrTruncated {
|
|
|
|
tcp := &dns.Client{Net: "tcp"}
|
|
|
|
in, _, err = tcp.Exchange(m, nameserver)
|
|
|
|
}
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-02-10 16:52:53 +02:00
|
|
|
// lookupNameservers returns the authoritative nameservers for the given fqdn.
|
2016-02-03 06:03:03 +02:00
|
|
|
func lookupNameservers(fqdn string) ([]string, error) {
|
|
|
|
var authoritativeNss []string
|
|
|
|
|
2016-03-11 04:20:25 +02:00
|
|
|
zone, err := FindZoneByFqdn(fqdn, recursiveNameserver)
|
2016-02-28 22:09:05 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
r, err := dnsQuery(zone, dns.TypeNS, recursiveNameserver, true)
|
2016-02-03 06:03:03 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, rr := range r.Answer {
|
2016-02-10 16:52:53 +02:00
|
|
|
if ns, ok := rr.(*dns.NS); ok {
|
|
|
|
authoritativeNss = append(authoritativeNss, strings.ToLower(ns.Ns))
|
2016-02-03 06:03:03 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-02-10 16:52:53 +02:00
|
|
|
if len(authoritativeNss) > 0 {
|
|
|
|
return authoritativeNss, nil
|
|
|
|
}
|
2016-02-28 22:09:05 +02:00
|
|
|
return nil, fmt.Errorf("Could not determine authoritative nameservers")
|
|
|
|
}
|
2016-02-10 16:52:53 +02:00
|
|
|
|
2016-03-11 04:20:25 +02:00
|
|
|
// FindZoneByFqdn determines the zone of the given fqdn
|
|
|
|
func FindZoneByFqdn(fqdn, nameserver string) (string, error) {
|
2016-02-28 22:09:05 +02:00
|
|
|
// Do we have it cached?
|
2016-02-29 09:46:15 +02:00
|
|
|
if zone, ok := fqdnToZone[fqdn]; ok {
|
2016-02-28 22:09:05 +02:00
|
|
|
return zone, nil
|
2016-02-03 06:03:03 +02:00
|
|
|
}
|
2016-02-10 16:52:53 +02:00
|
|
|
|
2016-02-28 22:09:05 +02:00
|
|
|
// Query the authorative nameserver for a hopefully non-existing SOA record,
|
|
|
|
// in the authority section of the reply it will have the SOA of the
|
|
|
|
// containing zone. rfc2308 has this to say on the subject:
|
|
|
|
// Name servers authoritative for a zone MUST include the SOA record of
|
|
|
|
// the zone in the authority section of the response when reporting an
|
|
|
|
// NXDOMAIN or indicating that no data (NODATA) of the requested type exists
|
|
|
|
in, err := dnsQuery(fqdn, dns.TypeSOA, nameserver, true)
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
if in.Rcode != dns.RcodeNameError {
|
|
|
|
if in.Rcode != dns.RcodeSuccess {
|
|
|
|
return "", fmt.Errorf("NS %s returned %s for %s", nameserver, dns.RcodeToString[in.Rcode], fqdn)
|
|
|
|
}
|
|
|
|
// We have a success, so one of the answers has to be a SOA RR
|
|
|
|
for _, ans := range in.Answer {
|
|
|
|
if soa, ok := ans.(*dns.SOA); ok {
|
|
|
|
zone := soa.Hdr.Name
|
|
|
|
// If we ended up on one of the TLDs, it means the domain did not exist.
|
2016-03-11 04:20:25 +02:00
|
|
|
publicsuffix, _ := publicsuffix.PublicSuffix(UnFqdn(zone))
|
|
|
|
if publicsuffix == UnFqdn(zone) {
|
2016-02-29 09:46:15 +02:00
|
|
|
return "", fmt.Errorf("Could not determine zone authoritatively")
|
2016-02-28 22:09:05 +02:00
|
|
|
}
|
2016-02-29 09:46:15 +02:00
|
|
|
fqdnToZone[fqdn] = zone
|
2016-02-28 22:09:05 +02:00
|
|
|
return zone, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// Or it is NODATA, fall through to NXDOMAIN
|
|
|
|
}
|
|
|
|
// Search the authority section for our precious SOA RR
|
|
|
|
for _, ns := range in.Ns {
|
|
|
|
if soa, ok := ns.(*dns.SOA); ok {
|
|
|
|
zone := soa.Hdr.Name
|
|
|
|
// If we ended up on one of the TLDs, it means the domain did not exist.
|
2016-03-11 04:20:25 +02:00
|
|
|
publicsuffix, _ := publicsuffix.PublicSuffix(UnFqdn(zone))
|
|
|
|
if publicsuffix == UnFqdn(zone) {
|
2016-02-29 09:46:15 +02:00
|
|
|
return "", fmt.Errorf("Could not determine zone authoritatively")
|
2016-02-28 22:09:05 +02:00
|
|
|
}
|
2016-02-29 09:46:15 +02:00
|
|
|
fqdnToZone[fqdn] = zone
|
2016-02-28 22:09:05 +02:00
|
|
|
return zone, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return "", fmt.Errorf("NS %s did not return the expected SOA record in the authority section", nameserver)
|
2016-01-22 03:25:27 +02:00
|
|
|
}
|
2016-01-26 17:37:50 +02:00
|
|
|
|
2016-03-11 04:46:09 +02:00
|
|
|
// ClearFqdnCache clears the cache of fqdn to zone mappings. Primarily used in testing.
|
|
|
|
func ClearFqdnCache() {
|
2016-02-29 09:46:15 +02:00
|
|
|
fqdnToZone = map[string]string{}
|
|
|
|
}
|
|
|
|
|
2016-03-11 04:20:25 +02:00
|
|
|
// ToFqdn converts the name into a fqdn appending a trailing dot.
|
|
|
|
func ToFqdn(name string) string {
|
|
|
|
n := len(name)
|
|
|
|
if n == 0 || name[n-1] == '.' {
|
|
|
|
return name
|
|
|
|
}
|
|
|
|
return name + "."
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnFqdn converts the fqdn into a name removing the trailing dot.
|
|
|
|
func UnFqdn(name string) string {
|
|
|
|
n := len(name)
|
|
|
|
if n != 0 && name[n-1] == '.' {
|
|
|
|
return name[:n-1]
|
|
|
|
}
|
|
|
|
return name
|
|
|
|
}
|