root
/
greenlock.js
mirror of https://github.com/therootcompany/greenlock.js.git
2
0
Fork 0
Code Issues 27 Releases Wiki Activity

remove cruft

This commit is contained in:
AJ ONeal 2016-08-04 14:26:49 -04:00
parent 93228cb90f
commit 4a389606b0
3 changed files with 86 additions and 219 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
README.md
View File

@ -144,7 +144,6 @@ le.middleware() // middleware for serv
le.sniCallback(hostname, function (err, tlsContext) {}) // uses fetch (below) and formats for https.SNICallback le.sniCallback(hostname, function (err, tlsContext) {}) // uses fetch (below) and formats for https.SNICallback
le.register({ domains, email, agreeTos, ... }, cb) // registers or renews certs for a domain le.register({ domains, email, agreeTos, ... }, cb) // registers or renews certs for a domain
le.fetch({domains, email, agreeTos, ... }, cb) // fetches certs from in-memory cache, occasionally refreshes from disk le.fetch({domains, email, agreeTos, ... }, cb) // fetches certs from in-memory cache, occasionally refreshes from disk
le.validate(domains, cb) // do some sanity checks before attempting to register
le.registrationFailureCallback(err, args, certInfo, cb) // called when registration fails (not implemented yet) le.registrationFailureCallback(err, args, certInfo, cb) // called when registration fails (not implemented yet)
``` ```
@ -189,16 +188,6 @@ registration will take very little time.
This will not be called while another registration is already in progress. This will not be called while another registration is already in progress.
**SECURITY WARNING**: If you use this option with a custom `h.validate()`, make sure that `args.domains`
refers to domains you expect, otherwise an attacker will spoof SNI and cause your server to rate-limit
letsencrypt.org and get blocked. Note that `le.validate()` will check A records before attempting to
register to help prevent such possible attacks.
`h.validate(domains, cb)`
When specified this will override `le.validate()`. You will need to do this if the ip address of this
server is not one specified in the A records for your domain.
### `le.middleware()` ### `le.middleware()`
An express handler for `/.well-known/acme-challenge/<challenge>`. An express handler for `/.well-known/acme-challenge/<challenge>`.
@ -252,17 +241,6 @@ returns `true` if `hostname` is a valid ascii or punycode domain name.
(also exposed on the main exported module as `LetsEncrypt.isValidDomain()`) (also exposed on the main exported module as `LetsEncrypt.isValidDomain()`)
### `le.validate(args, cb)`
Used internally, but exposed for convenience. Checks `LetsEncrypt.isValidDomain()`
and then checks to see that the current server
Called before `backend.register()` to validate the following:
* the hostnames don't use any illegal characters
* the server's actual public ip (via api.apiify.org)
* the A records for said hostnames
### `le.fetch(args, cb)` ### `le.fetch(args, cb)`
Used internally, but exposed for convenience. Used internally, but exposed for convenience.

136
index.js
View File

@ -42,12 +42,6 @@ LE.tplConfigDir = require('./lib/common').tplConfigDir;
// backend, defaults, handlers // backend, defaults, handlers
LE.create = function (defaults, handlers, backend) { LE.create = function (defaults, handlers, backend) {
var d, b, h;
// backwards compat for <= v1.0.2
if (defaults.registerAsync || defaults.create) {
b = defaults; d = handlers; h = backend;
defaults = d; handlers = h; backend = b;
}
if (!backend) { backend = require('./lib/core'); } if (!backend) { backend = require('./lib/core'); }
if (!handlers) { handlers = {}; } if (!handlers) { handlers = {}; }
if (!handlers.lifetime) { handlers.lifetime = 90 * 24 * 60 * 60 * 1000; } if (!handlers.lifetime) { handlers.lifetime = 90 * 24 * 60 * 60 * 1000; }
@ -148,63 +142,49 @@ LE.create = function (defaults, handlers, backend) {
return jsobj; return jsobj;
} }
, validate: function (hostnames, cb) { , register: function (args, cb) {
// TODO check dns, etc if (defaults.debug || args.debug) {
if ((!hostnames.length && hostnames.every(le.isValidDomain))) { console.log('[LE] register');
cb(new Error("node-letsencrypt: invalid hostnames: " + hostnames.join(','))); }
if (!Array.isArray(args.domains)) {
cb(new Error('args.domains should be an array of domains'));
return; return;
} }
//
// IMPORTANT
//
// Before attempting a dynamic registration you need to validate that
//
// * these are hostnames that you expected to exist on the system
// * their A records currently point to this ip
// * this system's ip hasn't changed
//
// If you do not check these things, then someone could attack you
// and cause you, in return, to have your ip be rate-limit blocked
//
//console.warn("\n[TODO]: node-letsencrypt: `validate(hostnames, cb)` needs to be implemented");
//console.warn("(it'll work fine without it, but for security - and convenience - it should be implemented\n");
// UPDATE:
// it's actually probably better that we don't do this here and instead
// take care of it in the approveRegistrationCallback in letsencrypt-express
cb(null, true);
}
, _registerHelper: function (args, cb) {
var copy = LE.merge(defaults, args); var copy = LE.merge(defaults, args);
var err; var err;
if (!utils.isValidDomain(args.domains[0])) { if (!utils.isValidDomain(args.domains[0])) {
err = new Error("invalid domain"); err = new Error("invalid domain name: '" + args.domains + "'");
err.code = "INVALID_DOMAIN"; err.code = "INVALID_DOMAIN";
cb(err); cb(err);
return; return;
} }
le.validate(args.domains, function (err) { if ((!args.domains.length && args.domains.every(le.isValidDomain))) {
if (err) { // NOTE: this library can't assume to handle the http loopback
cb(err); // (or dns-01 validation may be used)
return; // so we do not check dns records or attempt a loopback here
} cb(new Error("node-letsencrypt: invalid hostnames: " + args.domains.join(',')));
return;
}
if (defaults.debug || args.debug) {
console.log("[NLE]: begin registration");
}
return backend.registerAsync(copy).then(function (pems) {
if (defaults.debug || args.debug) { if (defaults.debug || args.debug) {
console.log("[NLE]: begin registration"); console.log("[NLE]: end registration");
} }
cb(null, pems);
return backend.registerAsync(copy).then(function (pems) { //return le.fetch(args, cb);
if (defaults.debug || args.debug) { }, cb);
console.log("[NLE]: end registration");
}
cb(null, pems);
//return le.fetch(args, cb);
}, cb);
});
} }
, _fetchHelper: function (args, cb) { , fetch: function (args, cb) {
if (defaults.debug || args.debug) {
console.log('[LE] fetch');
}
return backend.fetchAsync(args).then(function (certInfo) { return backend.fetchAsync(args).then(function (certInfo) {
if (args.debug) { if (args.debug) {
console.log('[LE] raw fetch certs', certInfo && Object.keys(certInfo)); console.log('[LE] raw fetch certs', certInfo && Object.keys(certInfo));
@ -224,19 +204,6 @@ LE.create = function (defaults, handlers, backend) {
cb(null, certInfo); cb(null, certInfo);
}, cb); }, cb);
} }
, fetch: function (args, cb) {
if (defaults.debug || args.debug) {
console.log('[LE] fetch');
}
le._fetchHelper(args, cb);
}
, renew: function (args, cb) {
if (defaults.debug || args.debug) {
console.log('[LE] renew');
}
args.duplicate = false;
le.register(args, cb);
}
, getConfig: function (args, cb) { , getConfig: function (args, cb) {
if (defaults.debug || args.debug) { if (defaults.debug || args.debug) {
console.log('[LE] getConfig'); console.log('[LE] getConfig');
@ -273,55 +240,6 @@ LE.create = function (defaults, handlers, backend) {
cb(null, le.pyToJson(pyobj)); cb(null, le.pyToJson(pyobj));
}); });
} }
, register: function (args, cb) {
if (defaults.debug || args.debug) {
console.log('[LE] register');
}
if (!Array.isArray(args.domains)) {
cb(new Error('args.domains should be an array of domains'));
return;
}
// this may be run in a cluster environment
// in that case it should NOT check the cache
// but ensure that it has the most fresh copy
// before attempting a renew
le._fetchHelper(args, function (err, hit) {
var now = Date.now();
if (err) {
// had a bad day
cb(err);
return;
}
else if (hit) {
if (!args.duplicate && (now - hit.issuedAt) < ((hit.lifetime || handlers.lifetime) * 0.65)) {
console.warn("\ntried to renew a certificate with over 1/3 of its lifetime left, ignoring");
console.warn("(use --duplicate or opts.duplicate to override\n");
cb(null, hit);
return;
}
}
le._registerHelper(args, function (err/*, pems*/) {
if (err) {
cb(err);
return;
}
// Sanity Check
le._fetchHelper(args, function (err, pems) {
if (pems) {
cb(null, pems);
return;
}
// still couldn't read the certs after success... that's weird
console.error("still couldn't read certs after success... that's weird");
cb(err, null);
});
});
});
}
}; };
return le; return le;

145
lib/core.js
View File

@ -45,8 +45,12 @@ function readRenewalConfig(args) {
} }
function writeRenewalConfig(args) { function writeRenewalConfig(args) {
//console.log('args'); function log() {
//console.log(args); if (args.debug) {
console.log.apply(console, arguments);
}
}
var pyobj = args.pyobj; var pyobj = args.pyobj;
pyobj.checkpoints = parseInt(pyobj.checkpoints, 10) || 0; pyobj.checkpoints = parseInt(pyobj.checkpoints, 10) || 0;
@ -61,10 +65,7 @@ function writeRenewalConfig(args) {
//|| args.domainPrivateKeyPath || args.domainKeyPath || pyobj.keyPath //|| args.domainPrivateKeyPath || args.domainKeyPath || pyobj.keyPath
|| path.join(liveDir, 'privkey.pem'); || path.join(liveDir, 'privkey.pem');
if (args.debug) { log('[le/core.js] privkeyPath', privkeyPath);
console.log('################ privkeyPath ################');
console.log(privkeyPath);
}
var updates = { var updates = {
account: args.account.id account: args.account.id
@ -159,10 +160,14 @@ function getOrCreateRenewal(args) {
} }
function writeCertificateAsync(args, defaults, handlers) { function writeCertificateAsync(args, defaults, handlers) {
if (args.debug) { function log() {
console.log("got certificate!"); if (args.debug) {
console.log.apply(console, arguments);
}
} }
log("[le/core.js] got certificate!");
var obj = args.pyobj; var obj = args.pyobj;
var result = args.pems; var result = args.pems;
@ -178,9 +183,7 @@ function writeCertificateAsync(args, defaults, handlers) {
//|| args.domainPrivateKeyPath || args.domainKeyPath || obj.keyPath //|| args.domainPrivateKeyPath || args.domainKeyPath || obj.keyPath
|| path.join(liveDir, 'privkey.pem'); || path.join(liveDir, 'privkey.pem');
if (args.debug) { log('[le/core.js] privkeyPath', privkeyPath);
console.log('[LE] privkeyPath', privkeyPath);
}
var archiveDir = args.archiveDir || path.join(args.configDir, 'archive', args.domains[0]); var archiveDir = args.archiveDir || path.join(args.configDir, 'archive', args.domains[0]);
@ -252,39 +255,32 @@ function writeCertificateAsync(args, defaults, handlers) {
} }
function getCertificateAsync(args, defaults, handlers) { function getCertificateAsync(args, defaults, handlers) {
function log() {
if (args.debug || defaults.debug) {
console.log.apply(console, arguments);
}
}
var account = args.account; var account = args.account;
var promise; var promise;
var keypairOpts = { public: true, pem: true }; var keypairOpts = { public: true, pem: true };
if (!args.domainKeyPath) { log('[le/core.js] domainKeyPath:', args.domainKeyPath);
// TODO use default path ???
if (args.debug) {
console.log('[domainKeyPath]: none');
}
promise = RSA.generateKeypairAsync(args.rsaKeySize, 65537, keypairOpts);
}
if (args.domainKeyPath) { promise = fs.readFileAsync(args.domainKeyPath, 'ascii').then(function (pem) {
if (args.debug) { return RSA.import({ privateKeyPem: pem });
console.log('[domainKeyPath]:', args.domainKeyPath); }, function (/*err*/) {
} return RSA.generateKeypairAsync(args.rsaKeySize, 65537, keypairOpts).then(function (keypair) {
promise = fs.readFileAsync(args.domainKeyPath, 'ascii').then(function (pem) { return mkdirpAsync(path.dirname(args.domainKeyPath)).then(function () {
return RSA.import({ privateKeyPem: pem }); return fs.writeFileAsync(args.domainKeyPath, keypair.privateKeyPem, 'ascii').then(function () {
}, function (/*err*/) { return keypair;
return RSA.generateKeypairAsync(args.rsaKeySize, 65537, keypairOpts).then(function (keypair) {
return mkdirpAsync(path.dirname(args.domainKeyPath)).then(function () {
return fs.writeFileAsync(args.domainKeyPath, keypair.privateKeyPem, 'ascii').then(function () {
return keypair;
});
}); });
}); });
}); });
} });
return promise.then(function (domainKeypair) { return promise.then(function (domainKeypair) {
if (args.debug) { log("[le/core.js] get certificate");
console.log("[letsencrypt/lib/core.js] get certificate");
}
args.domainKeypair = domainKeypair; args.domainKeypair = domainKeypair;
//args.registration = domainKey; //args.registration = domainKey;
@ -346,35 +342,37 @@ function getCertificateAsync(args, defaults, handlers) {
} }
function getOrCreateDomainCertificate(args, defaults, handlers) { function getOrCreateDomainCertificate(args, defaults, handlers) {
if (args.duplicate) {
// we're forcing a refresh via 'dupliate: true'
return getCertificateAsync(args, defaults, handlers);
}
return fetchFromConfigLiveDir(args).then(function (certs) { return fetchFromConfigLiveDir(args).then(function (certs) {
// if nothing, register and save var halfLife = (certs.expiresAt - certs.issuedAt) / 2;
// if something, check date (don't register unless 30+ days)
// if good, don't bother registering if (!certs || (Date.now() - certs.issuedAt) > halfLife) {
// (but if we get to the point that we're actually calling // There is no cert available
// this function, that shouldn't be the case, right?) // Or the cert is more than half-expired
//console.log(certs);
if (!certs) {
// no certs, seems like a good time to get some
return getCertificateAsync(args, defaults, handlers); return getCertificateAsync(args, defaults, handlers);
} }
else if ((Date.now() - certs.issuedAt) > (27 * 24 * 60 * 60 * 1000)) {
// cert is at least 27 days old we can renew that return PromiseA.reject(new Error(
return getCertificateAsync(args, defaults, handlers); "[ERROR] Certificate issued at '"
} + new Date(certs.issuedAt).toISOString() + "' and expires at '"
else if (args.duplicate) { + new Date(certs.expiresAt).toISOString() + "'. Ignoring renewal attempt until half-life at '"
// YOLO! I be gettin' fresh certs 'erday! Yo! + new Date(certs.issuedA + halfLife).toISOString() + "'. Set { duplicate: true } to force."
return getCertificateAsync(args, defaults, handlers); ));
}
else {
console.warn('[WARN] Ignoring renewal attempt for certificate less than 27 days old. Use args.duplicate to force.');
// We're happy with what we have
return certs;
}
}); });
} }
// returns 'account' from lib/accounts { meta, regr, keypair, accountId (id) } // returns 'account' from lib/accounts { meta, regr, keypair, accountId (id) }
function getOrCreateAcmeAccount(args, defaults, handlers) { function getOrCreateAcmeAccount(args, defaults, handlers) {
function log() {
if (args.debug) {
console.log.apply(console, arguments);
}
}
var pyconf = PromiseA.promisifyAll(require('pyconf')); var pyconf = PromiseA.promisifyAll(require('pyconf'));
return pyconf.readFileAsync(args.renewalPath).then(function (renewal) { return pyconf.readFileAsync(args.renewalPath).then(function (renewal) {
@ -384,9 +382,7 @@ function getOrCreateAcmeAccount(args, defaults, handlers) {
return accountId; return accountId;
}, function (err) { }, function (err) {
if ("ENOENT" === err.code) { if ("ENOENT" === err.code) {
if (args.debug) { log("[le/core.js] try email");
console.log("[LE] try email");
}
return Accounts.getAccountIdByEmail(args, handlers); return Accounts.getAccountIdByEmail(args, handlers);
} }
@ -398,15 +394,12 @@ function getOrCreateAcmeAccount(args, defaults, handlers) {
args._acmeUrls = urls; args._acmeUrls = urls;
if (accountId) { if (accountId) {
if (args.debug) { log('[le/core.js] use account');
console.log('[LE] use account');
}
args.accountId = accountId; args.accountId = accountId;
return Accounts.getAccount(args, handlers); return Accounts.getAccount(args, handlers);
} else { } else {
if (args.debug) { log('[le/core.js] create account');
console.log('[LE] create account');
}
return Accounts.createAccount(args, handlers); return Accounts.createAccount(args, handlers);
} }
}); });
@ -417,9 +410,7 @@ function getOrCreateAcmeAccount(args, defaults, handlers) {
return; return;
} }
*/ */
if (args.debug) { log('[le/core.js] created account');
console.log('[LE] created account');
}
return account; return account;
}); });
/* /*
@ -448,10 +439,6 @@ module.exports.create = function (defaults, handlers) {
copy = merge(args, defaults); copy = merge(args, defaults);
tplCopy(copy); tplCopy(copy);
if (copy.debug) {
console.log('[LE DEBUG] reg domains', args.domains);
}
var url = require('url'); var url = require('url');
var acmeLocation = url.parse(copy.server); var acmeLocation = url.parse(copy.server);
var acmeHostpath = path.join(acmeLocation.hostname, acmeLocation.pathname); var acmeHostpath = path.join(acmeLocation.hostname, acmeLocation.pathname);
@ -469,8 +456,6 @@ module.exports.create = function (defaults, handlers) {
}).then(function (result) { }).then(function (result) {
return result; return result;
}, function (err) { }, function (err) {
console.error('[DEBUG le/lib/core.js] registeryAsync err');
console.error(err && err.stack || err);
return PromiseA.reject(err); return PromiseA.reject(err);
}); });
} }
@ -478,9 +463,6 @@ module.exports.create = function (defaults, handlers) {
var copy = merge(args, defaults); var copy = merge(args, defaults);
tplCopy(copy); tplCopy(copy);
if (args.debug) {
console.log('[LE DEBUG] fetch domains', copy);
}
return fetchFromConfigLiveDir(copy, defaults); return fetchFromConfigLiveDir(copy, defaults);
} }
, configureAsync: function (hargs) { , configureAsync: function (hargs) {
@ -488,9 +470,6 @@ module.exports.create = function (defaults, handlers) {
var copy = merge(hargs, defaults); var copy = merge(hargs, defaults);
tplCopy(copy); tplCopy(copy);
//console.log('[LE] configureAsync copy');
//console.log(hargs);
//console.log(copy);
return getOrCreateAcmeAccount(copy, defaults, handlers).then(function (account) { return getOrCreateAcmeAccount(copy, defaults, handlers).then(function (account) {
copy.account = account; copy.account = account;
return getOrCreateRenewal(copy); return getOrCreateRenewal(copy);
@ -503,10 +482,6 @@ module.exports.create = function (defaults, handlers) {
var copy = merge(hargs, defaults); var copy = merge(hargs, defaults);
tplCopy(copy); tplCopy(copy);
if (copy.debug) {
console.log('[LE DEBUG] get configs', copy);
}
return readRenewalConfig(copy).then(function (pyobj) { return readRenewalConfig(copy).then(function (pyobj) {
var exists = pyobj.checkpoints >= 0; var exists = pyobj.checkpoints >= 0;
if (!exists) { if (!exists) {
@ -524,10 +499,6 @@ module.exports.create = function (defaults, handlers) {
var copy = merge(hargs, defaults); var copy = merge(hargs, defaults);
tplCopy(copy); tplCopy(copy);
if (copy.debug) {
console.log('[LE DEBUG] get configs', copy);
}
return fs.readdirAsync(copy.renewalDir).then(function (nodes) { return fs.readdirAsync(copy.renewalDir).then(function (nodes) {
nodes = nodes.filter(function (node) { nodes = nodes.filter(function (node) {
return /^[a-z0-9]+.*\.conf$/.test(node); return /^[a-z0-9]+.*\.conf$/.test(node);