1
0
mirror of https://github.com/go-acme/lego.git synced 2024-12-15 22:37:32 +02:00
lego/acme/dns_challenge.go

225 lines
5.5 KiB
Go
Raw Normal View History

package acme
2015-11-17 00:57:41 +02:00
import (
"crypto/sha256"
2016-01-01 15:36:30 +02:00
"encoding/base64"
2015-11-17 00:57:41 +02:00
"errors"
"fmt"
"log"
"net"
2016-01-01 15:36:30 +02:00
"strings"
2015-11-17 00:57:41 +02:00
"time"
"github.com/miekg/dns"
2015-11-17 00:57:41 +02:00
)
type preCheckDNSFunc func(fqdn, value string) (bool, error)
var preCheckDNS preCheckDNSFunc = checkDNSPropagation
var recursiveNameserver = "google-public-dns-a.google.com"
// DNS01Record returns a DNS record which will fulfill the `dns-01` challenge
func DNS01Record(domain, keyAuth string) (fqdn string, value string, ttl int) {
keyAuthShaBytes := sha256.Sum256([]byte(keyAuth))
// base64URL encoding without padding
keyAuthSha := base64.URLEncoding.EncodeToString(keyAuthShaBytes[:sha256.Size])
value = strings.TrimRight(keyAuthSha, "=")
ttl = 120
fqdn = fmt.Sprintf("_acme-challenge.%s.", domain)
return
}
2015-11-17 00:57:41 +02:00
// dnsChallenge implements the dns-01 challenge according to ACME 7.5
type dnsChallenge struct {
jws *jws
validate validateFunc
provider ChallengeProvider
2015-11-17 00:57:41 +02:00
}
func (s *dnsChallenge) Solve(chlng challenge, domain string) error {
Add missing domain name for consistency Before the change: 2016/01/30 00:23:37 [INFO][simonecarletti.com, foo1.simonecarletti.com, foo2.simonecarletti.com, foo3.simonecarletti.com] acme: Obtaining bundled SAN certificate 2016/01/30 00:23:38 [INFO][simonecarletti.com] acme: Could not find solver for: tls-sni-01 2016/01/30 00:23:38 [INFO] acme: Trying to solve DNS-01 2016/01/30 00:23:42 [INFO][simonecarletti.com] The server validated our request 2016/01/30 00:23:44 [INFO] acme: Trying to solve DNS-01 2016/01/30 00:23:47 [INFO][foo1.simonecarletti.com] The server validated our request 2016/01/30 00:23:49 [INFO][foo2.simonecarletti.com] acme: Could not find solver for: tls-sni-01 2016/01/30 00:23:49 [INFO][foo2.simonecarletti.com] acme: Could not find solver for: http-01 2016/01/30 00:23:49 [INFO] acme: Trying to solve DNS-01 2016/01/30 00:23:53 [INFO][foo3.simonecarletti.com] acme: Could not find solver for: http-01 2016/01/30 00:23:53 [INFO] acme: Trying to solve DNS-01 2016/01/30 00:23:56 [INFO][foo3.simonecarletti.com] The server validated our request After the change: 2016/01/30 00:27:58 [INFO][simonecarletti.com, foo1.simonecarletti.com, foo2.simonecarletti.com, foo3.simonecarletti.com] acme: Obtaining bundled SAN certificate 2016/01/30 00:27:59 [INFO][simonecarletti.com] acme: Could not find solver for: http-01 2016/01/30 00:27:59 [INFO][simonecarletti.com] acme: Trying to solve DNS-01 2016/01/30 00:28:12 [INFO][simonecarletti.com] The server validated our request 2016/01/30 00:28:14 [INFO][foo1.simonecarletti.com] acme: Could not find solver for: http-01 2016/01/30 00:28:14 [INFO][foo1.simonecarletti.com] acme: Trying to solve DNS-01 2016/01/30 00:28:19 [INFO][foo2.simonecarletti.com] acme: Could not find solver for: http-01 2016/01/30 00:28:19 [INFO][foo2.simonecarletti.com] acme: Could not find solver for: tls-sni-01 2016/01/30 00:28:19 [INFO][foo2.simonecarletti.com] acme: Trying to solve DNS-01 2016/01/30 00:28:22 [INFO][foo1.simonecarletti.com] The server validated our request
2016-01-30 23:17:41 +02:00
logf("[INFO][%s] acme: Trying to solve DNS-01", domain)
2015-11-17 00:57:41 +02:00
if s.provider == nil {
return errors.New("No DNS Provider configured")
}
2015-11-17 00:57:41 +02:00
// Generate the Key Authorization for the challenge
keyAuth, err := getKeyAuthorization(chlng.Token, &s.jws.privKey.PublicKey)
if err != nil {
return err
}
err = s.provider.Present(domain, chlng.Token, keyAuth)
if err != nil {
return fmt.Errorf("Error presenting token %s", err)
}
defer func() {
err := s.provider.CleanUp(domain, chlng.Token, keyAuth)
if err != nil {
log.Printf("Error cleaning up %s %v ", domain, err)
}
}()
fqdn, value, _ := DNS01Record(domain, keyAuth)
2015-11-17 00:57:41 +02:00
logf("[INFO][%s] Checking DNS record propagation...", domain)
err = waitFor(30, 2, func() (bool, error) {
return preCheckDNS(fqdn, value)
})
if err != nil {
return err
}
2016-01-25 01:32:47 +02:00
return s.validate(s.jws, domain, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
2015-11-17 00:57:41 +02:00
}
2016-01-22 03:25:27 +02:00
// checkDNSPropagation checks if the expected TXT record has been propagated to all authoritative nameservers.
func checkDNSPropagation(fqdn, value string) (bool, error) {
// Initial attempt to resolve at the recursive NS
r, err := dnsQuery(fqdn, dns.TypeTXT, recursiveNameserver, true)
2016-01-22 03:25:27 +02:00
if err != nil {
return false, err
}
if r.Rcode != dns.RcodeSuccess {
return false, fmt.Errorf("Could not resolve %s -> %s", fqdn, dns.RcodeToString[r.Rcode])
2016-01-22 03:25:27 +02:00
}
// If we see a CNAME here then use the alias
for _, rr := range r.Answer {
if cn, ok := rr.(*dns.CNAME); ok {
if cn.Hdr.Name == fqdn {
fqdn = cn.Target
break
}
}
}
authoritativeNss, err := lookupNameservers(fqdn)
if err != nil {
return false, err
2016-01-22 03:25:27 +02:00
}
return checkAuthoritativeNss(fqdn, value, authoritativeNss)
}
// checkAuthoritativeNss queries each of the given nameservers for the expected TXT record.
func checkAuthoritativeNss(fqdn, value string, nameservers []string) (bool, error) {
for _, ns := range nameservers {
r, err := dnsQuery(fqdn, dns.TypeTXT, ns, false)
2016-01-22 03:25:27 +02:00
if err != nil {
return false, err
2016-01-22 03:25:27 +02:00
}
if r.Rcode != dns.RcodeSuccess {
return false, fmt.Errorf("NS %s returned %s for %s", ns, dns.RcodeToString[r.Rcode], fqdn)
2016-01-22 03:25:27 +02:00
}
var found bool
for _, rr := range r.Answer {
if txt, ok := rr.(*dns.TXT); ok {
if strings.Join(txt.Txt, "") == value {
found = true
break
}
}
2016-01-22 03:25:27 +02:00
}
if !found {
return false, fmt.Errorf("NS %s did not return the expected TXT record", ns)
}
2016-01-22 03:25:27 +02:00
}
return true, nil
}
// dnsQuery sends a DNS query to the given nameserver.
func dnsQuery(fqdn string, rtype uint16, nameserver string, recursive bool) (in *dns.Msg, err error) {
m := new(dns.Msg)
m.SetQuestion(fqdn, rtype)
m.SetEdns0(4096, false)
if !recursive {
m.RecursionDesired = false
}
in, err = dns.Exchange(m, net.JoinHostPort(nameserver, "53"))
if err == dns.ErrTruncated {
tcp := &dns.Client{Net: "tcp"}
in, _, err = tcp.Exchange(m, nameserver)
}
return
}
// lookupNameservers returns the authoritative nameservers for the given fqdn.
func lookupNameservers(fqdn string) ([]string, error) {
var authoritativeNss []string
r, err := dnsQuery(fqdn, dns.TypeNS, recursiveNameserver, true)
if err != nil {
return nil, err
}
for _, rr := range r.Answer {
if ns, ok := rr.(*dns.NS); ok {
authoritativeNss = append(authoritativeNss, strings.ToLower(ns.Ns))
}
}
if len(authoritativeNss) > 0 {
return authoritativeNss, nil
}
// Strip of the left most label to get the parent domain.
offset, _ := dns.NextLabel(fqdn, 0)
next := fqdn[offset:]
if dns.CountLabel(next) < 2 {
return nil, fmt.Errorf("Could not determine authoritative nameservers")
}
return lookupNameservers(next)
2016-01-22 03:25:27 +02:00
}
// toFqdn converts the name into a fqdn appending a trailing dot.
func toFqdn(name string) string {
n := len(name)
if n == 0 || name[n-1] == '.' {
return name
}
return name + "."
}
// unFqdn converts the fqdn into a name removing the trailing dot.
func unFqdn(name string) string {
n := len(name)
if n != 0 && name[n-1] == '.' {
return name[:n-1]
}
return name
}
// waitFor polls the given function 'f', once every 'interval' seconds, up to 'timeout' seconds.
func waitFor(timeout, interval int, f func() (bool, error)) error {
var lastErr string
timeup := time.After(time.Duration(timeout) * time.Second)
for {
select {
case <-timeup:
return fmt.Errorf("Time limit exceeded. Last error: %s", lastErr)
default:
}
stop, err := f()
if stop {
return nil
}
if err != nil {
lastErr = err.Error()
}
time.Sleep(time.Duration(interval) * time.Second)
}
}