traefik/vendor/github.com/xenolf/lego/acme/jws.go

132 lines
2.7 KiB
Go
Raw Normal View History

2017-02-07 21:33:23 +00:00
package acme
import (
"bytes"
"crypto"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rsa"
"fmt"
"net/http"
"sync"
"gopkg.in/square/go-jose.v1"
)
type jws struct {
directoryURL string
privKey crypto.PrivateKey
2017-04-07 09:53:39 +00:00
nonces nonceManager
2017-02-07 21:33:23 +00:00
}
func keyAsJWK(key interface{}) *jose.JsonWebKey {
switch k := key.(type) {
case *ecdsa.PublicKey:
return &jose.JsonWebKey{Key: k, Algorithm: "EC"}
case *rsa.PublicKey:
return &jose.JsonWebKey{Key: k, Algorithm: "RSA"}
default:
return nil
}
}
2017-04-07 09:53:39 +00:00
// Posts a JWS signed message to the specified URL.
// It does NOT close the response body, so the caller must
// do that if no error was returned.
2017-02-07 21:33:23 +00:00
func (j *jws) post(url string, content []byte) (*http.Response, error) {
signedContent, err := j.signContent(content)
if err != nil {
2017-04-07 09:53:39 +00:00
return nil, fmt.Errorf("Failed to sign content -> %s", err.Error())
2017-02-07 21:33:23 +00:00
}
resp, err := httpPost(url, "application/jose+json", bytes.NewBuffer([]byte(signedContent.FullSerialize())))
if err != nil {
2017-04-07 09:53:39 +00:00
return nil, fmt.Errorf("Failed to HTTP POST to %s -> %s", url, err.Error())
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
nonce, nonceErr := getNonceFromResponse(resp)
if nonceErr == nil {
j.nonces.Push(nonce)
}
2017-02-07 21:33:23 +00:00
2017-04-07 09:53:39 +00:00
return resp, nil
2017-02-07 21:33:23 +00:00
}
func (j *jws) signContent(content []byte) (*jose.JsonWebSignature, error) {
var alg jose.SignatureAlgorithm
switch k := j.privKey.(type) {
case *rsa.PrivateKey:
alg = jose.RS256
case *ecdsa.PrivateKey:
if k.Curve == elliptic.P256() {
alg = jose.ES256
} else if k.Curve == elliptic.P384() {
alg = jose.ES384
}
}
signer, err := jose.NewSigner(alg, j.privKey)
if err != nil {
2017-04-07 09:53:39 +00:00
return nil, fmt.Errorf("Failed to create jose signer -> %s", err.Error())
2017-02-07 21:33:23 +00:00
}
signer.SetNonceSource(j)
signed, err := signer.Sign(content)
if err != nil {
2017-04-07 09:53:39 +00:00
return nil, fmt.Errorf("Failed to sign content -> %s", err.Error())
2017-02-07 21:33:23 +00:00
}
return signed, nil
}
2017-04-07 09:53:39 +00:00
func (j *jws) Nonce() (string, error) {
if nonce, ok := j.nonces.Pop(); ok {
return nonce, nil
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
return getNonce(j.directoryURL)
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
type nonceManager struct {
nonces []string
sync.Mutex
}
func (n *nonceManager) Pop() (string, bool) {
n.Lock()
defer n.Unlock()
if len(n.nonces) == 0 {
return "", false
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
nonce := n.nonces[len(n.nonces)-1]
n.nonces = n.nonces[:len(n.nonces)-1]
return nonce, true
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
func (n *nonceManager) Push(nonce string) {
n.Lock()
defer n.Unlock()
n.nonces = append(n.nonces, nonce)
}
func getNonce(url string) (string, error) {
resp, err := httpHead(url)
if err != nil {
return "", fmt.Errorf("Failed to get nonce from HTTP HEAD -> %s", err.Error())
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
return getNonceFromResponse(resp)
}
func getNonceFromResponse(resp *http.Response) (string, error) {
nonce := resp.Header.Get("Replay-Nonce")
if nonce == "" {
return "", fmt.Errorf("Server did not respond with a proper nonce header.")
2017-02-07 21:33:23 +00:00
}
2017-04-07 09:53:39 +00:00
2017-02-07 21:33:23 +00:00
return nonce, nil
}