Skip to content

Commit cda0a78

Browse files
KaiserWerkKaiserWerk
committed
reworked challenge structure
1 parent e4abd33 commit cda0a78

4 files changed

Lines changed: 123 additions & 75 deletions

File tree

‎internal/entity/certificateResponse.go‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
package entity
22

33
type CertificateResponse struct {
4-
CertificatePEM string `json:"certificate_pem,omitempty"`
5-
PrivateKeyPEM string `json:"private_key_pem,omitempty"`
6-
HTTP01Challenge bool `json:"http01_challenge,omitempty"`
7-
DNS01Challenge bool `json:"dns01_challenge,omitempty"`
8-
ChallengeID string `json:"challenge_id,omitempty"`
9-
ChallengeToken string `json:"challenge_token,omitempty"`
10-
Error string `json:"error,omitempty"`
4+
CertificatePEM string `json:"certificate_pem,omitempty"`
5+
PrivateKeyPEM string `json:"private_key_pem,omitempty"`
6+
Challenges []ChallengeResponse `json:"challenges,omitempty"`
7+
Error string `json:"error,omitempty"`
8+
}
9+
10+
type ChallengeResponse struct {
11+
ChallengeType string `json:"challenge_type,omitempty"`
12+
ChallengeID string `json:"challenge_id,omitempty"`
13+
ChallengeToken string `json:"challenge_token,omitempty"`
14+
ValidUntil string `json:"valid_until,omitempty"`
1115
}

‎internal/entity/challenge.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,9 @@ type Challenge struct {
1111
gorm.Model
1212
CreatedFor uint
1313
RequestInfoID uint
14-
ChallengeID string `gorm:"index:,unique"`
14+
ChallengeID string
1515
ChallengeType string
16-
Token string
17-
ValidUntil time.Time
16+
//Domains string // Comma-separated list of domains this challenge is for
17+
Token string
18+
ValidUntil time.Time
1819
}

‎internal/handler/api.go‎

Lines changed: 107 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -77,43 +77,63 @@ func (bh *BaseHandler) APIRequestCertificateWithSimpleRequestHandler(w http.Resp
7777
return
7878
}
7979

80+
var domainsToCheck []string
81+
for _, d := range certRequest.Domains {
82+
if helper.StringSliceContains(global.DNSNamesToSkip, d) {
83+
continue
84+
}
85+
domainsToCheck = append(domainsToCheck, d)
86+
}
87+
8088
// set up response
8189
response := entity.CertificateResponse{}
8290

8391
var hasChallenge bool
84-
if httpChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableHTTP01Challenge); httpChallengeEnabled == "true" {
85-
hasChallenge = true
86-
ch := &entity.Challenge{
87-
CreatedFor: user.ID,
88-
RequestInfoID: ri.ID,
89-
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
90-
ChallengeType: "http-01",
91-
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
92-
Token: security.GenerateToken(80),
93-
}
94-
if err = bh.DBSvc.AddChallenge(ch); err != nil {
95-
logger.Infof("error inserting challenge: %s\n", err.Error())
96-
w.WriteHeader(http.StatusInternalServerError)
97-
return
98-
}
99-
response.HTTP01Challenge = true
100-
}
101-
if dnsChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableDNS01Challenge); dnsChallengeEnabled == "true" {
102-
hasChallenge = true
103-
ch := &entity.Challenge{
104-
CreatedFor: user.ID,
105-
RequestInfoID: ri.ID,
106-
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
107-
ChallengeType: "dns-01",
108-
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
109-
Token: security.GenerateToken(80),
110-
}
111-
if err = bh.DBSvc.AddChallenge(ch); err != nil {
112-
logger.Infof("error inserting challenge: %s\n", err.Error())
113-
w.WriteHeader(http.StatusInternalServerError)
114-
return
92+
if len(domainsToCheck) > 0 {
93+
if httpChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableHTTP01Challenge); httpChallengeEnabled == "true" {
94+
hasChallenge = true
95+
ch := &entity.Challenge{
96+
CreatedFor: user.ID,
97+
RequestInfoID: ri.ID,
98+
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
99+
ChallengeType: "http-01",
100+
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
101+
Token: security.GenerateToken(80),
102+
}
103+
if err = bh.DBSvc.AddChallenge(ch); err != nil {
104+
logger.Infof("error inserting challenge: %s\n", err.Error())
105+
w.WriteHeader(http.StatusInternalServerError)
106+
return
107+
}
108+
response.Challenges = append(response.Challenges, entity.ChallengeResponse{
109+
ChallengeType: ch.ChallengeType,
110+
ChallengeID: ch.ChallengeID,
111+
ChallengeToken: ch.Token,
112+
ValidUntil: ch.ValidUntil.Format(time.RFC3339),
113+
})
114+
}
115+
if dnsChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableDNS01Challenge); dnsChallengeEnabled == "true" {
116+
hasChallenge = true
117+
ch := &entity.Challenge{
118+
CreatedFor: user.ID,
119+
RequestInfoID: ri.ID,
120+
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
121+
ChallengeType: "dns-01",
122+
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
123+
Token: security.GenerateToken(80),
124+
}
125+
if err = bh.DBSvc.AddChallenge(ch); err != nil {
126+
logger.Infof("error inserting challenge: %s\n", err.Error())
127+
w.WriteHeader(http.StatusInternalServerError)
128+
return
129+
}
130+
response.Challenges = append(response.Challenges, entity.ChallengeResponse{
131+
ChallengeType: ch.ChallengeType,
132+
ChallengeID: ch.ChallengeID,
133+
ChallengeToken: ch.Token,
134+
ValidUntil: ch.ValidUntil.Format(time.RFC3339),
135+
})
115136
}
116-
response.DNS01Challenge = true
117137
}
118138

119139
if hasChallenge {
@@ -207,42 +227,65 @@ func (bh *BaseHandler) APIRequestCertificateWithCSRHandler(w http.ResponseWriter
207227
return
208228
}
209229

230+
var domainsToCheck []string
231+
for _, d := range csr.DNSNames {
232+
if helper.StringSliceContains(global.DNSNamesToSkip, d) {
233+
continue
234+
}
235+
domainsToCheck = append(domainsToCheck, d)
236+
}
237+
210238
response := entity.CertificateResponse{}
211239

212240
var hasChallenge bool
213-
if httpChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableHTTP01Challenge); httpChallengeEnabled == "true" {
214-
hasChallenge = true
215-
ch := &entity.Challenge{
216-
CreatedFor: user.ID,
217-
RequestInfoID: ri.ID,
218-
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
219-
ChallengeType: "http-01",
220-
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
221-
Token: security.GenerateToken(80),
222-
}
223-
if err = bh.DBSvc.AddChallenge(ch); err != nil {
224-
logger.Infof("error inserting challenge: %s\n", err.Error())
225-
w.WriteHeader(http.StatusInternalServerError)
226-
return
241+
if len(domainsToCheck) > 0 {
242+
challengeID := fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20))
243+
expectedToken := security.GenerateToken(80)
244+
if httpChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableHTTP01Challenge); httpChallengeEnabled == "true" {
245+
hasChallenge = true
246+
ch := &entity.Challenge{
247+
CreatedFor: user.ID,
248+
RequestInfoID: ri.ID,
249+
ChallengeID: challengeID,
250+
ChallengeType: "http-01",
251+
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
252+
Token: expectedToken,
253+
}
254+
if err = bh.DBSvc.AddChallenge(ch); err != nil {
255+
logger.Infof("error inserting challenge: %s\n", err.Error())
256+
w.WriteHeader(http.StatusInternalServerError)
257+
return
258+
}
259+
response.Challenges = append(response.Challenges, entity.ChallengeResponse{
260+
ChallengeType: ch.ChallengeType,
261+
ChallengeID: ch.ChallengeID,
262+
ChallengeToken: ch.Token,
263+
ValidUntil: ch.ValidUntil.Format(time.RFC3339),
264+
})
265+
}
266+
if dnsChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableDNS01Challenge); dnsChallengeEnabled == "true" {
267+
hasChallenge = true
268+
ch := &entity.Challenge{
269+
CreatedFor: user.ID,
270+
RequestInfoID: ri.ID,
271+
ChallengeID: challengeID,
272+
ChallengeType: "dns-01",
273+
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
274+
Token: expectedToken,
275+
}
276+
if err = bh.DBSvc.AddChallenge(ch); err != nil {
277+
logger.Infof("error inserting challenge: %s\n", err.Error())
278+
w.WriteHeader(http.StatusInternalServerError)
279+
return
280+
}
281+
response.Challenges = append(response.Challenges, entity.ChallengeResponse{
282+
ChallengeType: ch.ChallengeType,
283+
ChallengeID: ch.ChallengeID,
284+
ChallengeToken: ch.Token,
285+
ValidUntil: ch.ValidUntil.Format(time.RFC3339),
286+
})
227287
}
228-
response.HTTP01Challenge = true
229-
}
230-
if dnsChallengeEnabled := bh.DBSvc.GetSetting(global.SettingEnableDNS01Challenge); dnsChallengeEnabled == "true" {
231-
hasChallenge = true
232-
ch := &entity.Challenge{
233-
CreatedFor: user.ID,
234-
RequestInfoID: ri.ID,
235-
ChallengeID: fmt.Sprintf("%d-%s", user.ID, security.GenerateToken(20)),
236-
ChallengeType: "dns-01",
237-
ValidUntil: time.Now().Add(global.DefaultChallengeValidity),
238-
Token: security.GenerateToken(80),
239-
}
240-
if err = bh.DBSvc.AddChallenge(ch); err != nil {
241-
logger.Infof("error inserting challenge: %s\n", err.Error())
242-
w.WriteHeader(http.StatusInternalServerError)
243-
return
244-
}
245-
response.DNS01Challenge = true
288+
246289
}
247290

248291
if hasChallenge {

‎internal/middleware/api.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func (mh *MWHandler) RequireToken(next http.Handler) http.Handler {
2020
u, err := mh.DBSvc.FindUser("api_key = ?", token)
2121
if err != nil {
2222
logger.Print("could not find associated user")
23-
w.WriteHeader(http.StatusNotFound)
23+
w.WriteHeader(http.StatusUnauthorized)
2424
return
2525
}
2626

0 commit comments

Comments
 (0)