open-vault/builtin/logical/pki/acme_challenges.go

// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

package pki

import (
	"bytes"
	"context"
	"crypto/sha256"
	"crypto/subtle"
	"crypto/tls"
	"crypto/x509"
	"encoding/asn1"
	"encoding/base64"
	"fmt"
	"io"
	"net"
	"net/http"
	"strings"
	"time"
)

const (
	DNSChallengePrefix = "_acme-challenge."
	ALPNProtocol       = "acme-tls/1"
)

// While this should be a constant, there's no way to do a low-level test of
// ValidateTLSALPN01Challenge without spinning up a complicated Docker
// instance to build a custom responder. Because we already have a local
// toolchain, it is far easier to drive this through Go tests with a custom
// (high) port, rather than requiring permission to bind to port 443 (root-run
// tests are even worse).
var ALPNPort = "443"

// OID of the acmeIdentifier X.509 Certificate Extension.
var OIDACMEIdentifier = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}

// ValidateKeyAuthorization validates that the given keyAuthz from a challenge
// matches our expectation, returning (true, nil) if so, or (false, err) if
// not.
func ValidateKeyAuthorization(keyAuthz string, token string, thumbprint string) (bool, error) {
	parts := strings.Split(keyAuthz, ".")
	if len(parts) != 2 {
		return false, fmt.Errorf("invalid authorization: got %v parts, expected 2", len(parts))
	}

	tokenPart := parts[0]
	thumbprintPart := parts[1]

	if token != tokenPart || thumbprint != thumbprintPart {
		return false, fmt.Errorf("key authorization was invalid")
	}

	return true, nil
}

// ValidateSHA256KeyAuthorization validates that the given keyAuthz from a
// challenge matches our expectation, returning (true, nil) if so, or
// (false, err) if not.
//
// This is for use with DNS challenges, which require base64 encoding.
func ValidateSHA256KeyAuthorization(keyAuthz string, token string, thumbprint string) (bool, error) {
	authzContents := token + "." + thumbprint
	checksum := sha256.Sum256([]byte(authzContents))
	expectedAuthz := base64.RawURLEncoding.EncodeToString(checksum[:])

	if keyAuthz != expectedAuthz {
		return false, fmt.Errorf("sha256 key authorization was invalid")
	}

	return true, nil
}

// ValidateRawSHA256KeyAuthorization validates that the given keyAuthz from a
// challenge matches our expectation, returning (true, nil) if so, or
// (false, err) if not.
//
// This is for use with TLS challenges, which require the raw hash output.
func ValidateRawSHA256KeyAuthorization(keyAuthz []byte, token string, thumbprint string) (bool, error) {
	authzContents := token + "." + thumbprint
	expectedAuthz := sha256.Sum256([]byte(authzContents))

	if len(keyAuthz) != len(expectedAuthz) || subtle.ConstantTimeCompare(expectedAuthz[:], keyAuthz) != 1 {
		return false, fmt.Errorf("sha256 key authorization was invalid")
	}

	return true, nil
}

func buildResolver(config *acmeConfigEntry) (*net.Resolver, error) {
	if len(config.DNSResolver) == 0 {
		return net.DefaultResolver, nil
	}

	return &net.Resolver{
		PreferGo:     true,
		StrictErrors: false,
		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
			d := net.Dialer{
				Timeout: 10 * time.Second,
			}
			return d.DialContext(ctx, network, config.DNSResolver)
		},
	}, nil
}

func buildDialerConfig(config *acmeConfigEntry) (*net.Dialer, error) {
	resolver, err := buildResolver(config)
	if err != nil {
		return nil, fmt.Errorf("failed to build resolver: %w", err)
	}

	return &net.Dialer{
		Timeout:   10 * time.Second,
		KeepAlive: -1 * time.Second,
		Resolver:  resolver,
	}, nil
}

// Validates a given ACME http-01 challenge against the specified domain,
// per RFC 8555.
//
// We attempt to be defensive here against timeouts, extra redirects, &c.
func ValidateHTTP01Challenge(domain string, token string, thumbprint string, config *acmeConfigEntry) (bool, error) {
	path := "http://" + domain + "/.well-known/acme-challenge/" + token
	dialer, err := buildDialerConfig(config)
	if err != nil {
		return false, fmt.Errorf("failed to build dialer: %w", err)
	}

	transport := &http.Transport{
		// Only a single request is sent to this server as we do not do any
		// batching of validation attempts. There is no need to do an HTTP
		// KeepAlive as a result.
		DisableKeepAlives:   true,
		MaxIdleConns:        1,
		MaxIdleConnsPerHost: 1,
		MaxConnsPerHost:     1,
		IdleConnTimeout:     1 * time.Second,

		// We'd rather timeout and re-attempt validation later than hang
		// too many validators waiting for slow hosts.
		DialContext:           dialer.DialContext,
		ResponseHeaderTimeout: 10 * time.Second,
	}

	maxRedirects := 10
	urlLength := 2000

	client := &http.Client{
		Transport: transport,
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			if len(via)+1 >= maxRedirects {
				return fmt.Errorf("http-01: too many redirects: %v", len(via)+1)
			}

			reqUrlLen := len(req.URL.String())
			if reqUrlLen > urlLength {
				return fmt.Errorf("http-01: redirect url length too long: %v", reqUrlLen)
			}

			return nil
		},
	}

	resp, err := client.Get(path)
	if err != nil {
		return false, fmt.Errorf("http-01: failed to fetch path %v: %w", path, err)
	}

	// We provision a buffer which allows for a variable size challenge, some
	// whitespace, and a detection gap for too long of a message.
	minExpected := len(token) + 1 + len(thumbprint)
	maxExpected := 512

	defer resp.Body.Close()

	// Attempt to read the body, but don't do so infinitely.
	body, err := io.ReadAll(io.LimitReader(resp.Body, int64(maxExpected+1)))
	if err != nil {
		return false, fmt.Errorf("http-01: unexpected error while reading body: %w", err)
	}

	if len(body) > maxExpected {
		return false, fmt.Errorf("http-01: response too large: received %v > %v bytes", len(body), maxExpected)
	}

	if len(body) < minExpected {
		return false, fmt.Errorf("http-01: response too small: received %v < %v bytes", len(body), minExpected)
	}

	// Per RFC 8555 Section 8.3. HTTP Challenge:
	//
	// > The server SHOULD ignore whitespace characters at the end of the body.
	keyAuthz := string(body)
	keyAuthz = strings.TrimSpace(keyAuthz)

	// If we got here, we got no non-EOF error while reading. Try to validate
	// the token because we're bounded by a reasonable amount of length.
	return ValidateKeyAuthorization(keyAuthz, token, thumbprint)
}

func ValidateDNS01Challenge(domain string, token string, thumbprint string, config *acmeConfigEntry) (bool, error) {
	// Here, domain is the value from the post-wildcard-processed identifier.
	// Per RFC 8555, no difference in validation occurs if a wildcard entry
	// is requested or if a non-wildcard entry is requested.
	//
	// XXX: In this case the DNS server is operator controlled and is assumed
	// to be less malicious so the default resolver is used. In the future,
	// we'll want to use net.Resolver for two reasons:
	//
	// 1. To control the actual resolver via ACME configuration,
	// 2. To use a context to set stricter timeout limits.
	resolver, err := buildResolver(config)
	if err != nil {
		return false, fmt.Errorf("failed to build resolver: %w", err)
	}

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()

	name := DNSChallengePrefix + domain
	results, err := resolver.LookupTXT(ctx, name)
	if err != nil {
		return false, fmt.Errorf("dns-01: failed to lookup TXT records for domain (%v) via resolver %v: %w", name, config.DNSResolver, err)
	}

	for _, keyAuthz := range results {
		ok, _ := ValidateSHA256KeyAuthorization(keyAuthz, token, thumbprint)
		if ok {
			return true, nil
		}
	}

	return false, fmt.Errorf("dns-01: challenge failed against %v records", len(results))
}

func ValidateTLSALPN01Challenge(domain string, token string, thumbprint string, config *acmeConfigEntry) (bool, error) {
	// This RFC is defined in RFC 8737 Automated Certificate Management
	// Environment (ACME) TLS Application‑Layer Protocol Negotiation
	// (ALPN) Challenge Extension.
	//
	// This is conceptually similar to ValidateHTTP01Challenge, but
	// uses a TLS connection on port 443 with the specified ALPN
	// protocol.

	cfg := &tls.Config{
		// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
		// Negotiation (TLS ALPN) Challenge, the name of the negotiated
		// protocol is "acme-tls/1".
		NextProtos: []string{ALPNProtocol},

		// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
		// Negotiation (TLS ALPN) Challenge:
		//
		// > ... and an SNI extension containing only the domain name
		// > being validated during the TLS handshake.
		//
		// According to the Go docs, setting this option (even though
		// InsecureSkipVerify=true is also specified), allows us to
		// set the SNI extension to this value.
		ServerName: domain,

		VerifyConnection: func(connState tls.ConnectionState) error {
			// We initiated a fresh connection with no session tickets;
			// even if we did have a session ticket, we do not wish to
			// use it. Verify that the server has not inadvertently
			// reused connections between validation attempts or something.
			if connState.DidResume {
				return fmt.Errorf("server under test incorrectly reported that handshake was resumed when no session cache was provided; refusing to continue")
			}

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > The ACME server verifies that during the TLS handshake the
			// > application-layer protocol "acme-tls/1" was successfully
			// > negotiated (and that the ALPN extension contained only the
			// > value "acme-tls/1").
			if connState.NegotiatedProtocol != ALPNProtocol {
				return fmt.Errorf("server under test negotiated unexpected ALPN protocol %v", connState.NegotiatedProtocol)
			}

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > and that the certificate returned
			//
			// Because this certificate MUST be self-signed (per earlier
			// statement in RFC 8737 Section 3), there is no point in sending
			// more than one certificate, and so we will err early here if
			// we got more than one.
			if len(connState.PeerCertificates) > 1 {
				return fmt.Errorf("server under test returned multiple (%v) certificates when we expected only one", len(connState.PeerCertificates))
			}
			cert := connState.PeerCertificates[0]

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > The client prepares for validation by constructing a
			// > self-signed certificate that MUST contain an acmeIdentifier
			// > extension and a subjectAlternativeName extension [RFC5280].
			//
			// Verify that this is a self-signed certificate that isn't signed
			// by another certificate (i.e., with the same key material but
			// different issuer).
			// NOTE: Do not use cert.CheckSignatureFrom(cert) as we need to bypass the
			//       checks for the parent certificate having the IsCA basic constraint set.
			err := cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature)
			if err != nil {
				return fmt.Errorf("server under test returned a non-self-signed certificate: %v", err)
			}

			if !bytes.Equal(cert.RawSubject, cert.RawIssuer) {
				return fmt.Errorf("server under test returned a non-self-signed certificate: invalid subject (%v) <-> issuer (%v) match", cert.Subject.String(), cert.Issuer.String())
			}

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > The subjectAlternativeName extension MUST contain a single
			// > dNSName entry where the value is the domain name being
			// > validated.
			//
			// TODO: this does not validate that there are not other SANs
			// with unknown (to Go) OIDs.
			if len(cert.DNSNames) != 1 || len(cert.EmailAddresses) > 0 || len(cert.IPAddresses) > 0 || len(cert.URIs) > 0 {
				return fmt.Errorf("server under test returned a certificate with incorrect SANs")
			}

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > The comparison of dNSNames MUST be case insensitive
			// > [RFC4343]. Note that as ACME doesn't support Unicode
			// > identifiers, all dNSNames MUST be encoded using the rules
			// > of [RFC3492].
			if !strings.EqualFold(cert.DNSNames[0], domain) {
				return fmt.Errorf("server under test returned a certificate with unexpected identifier: %v", cert.DNSNames[0])
			}

			// Per above, verify that the acmeIdentifier extension is present
			// exactly once and has the correct value.
			var foundACMEId bool
			for _, ext := range cert.Extensions {
				if !ext.Id.Equal(OIDACMEIdentifier) {
					continue
				}

				// There must be only a single ACME extension.
				if foundACMEId {
					return fmt.Errorf("server under test returned a certificate with multiple acmeIdentifier extensions")
				}
				foundACMEId = true

				// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
				// Negotiation (TLS ALPN) Challenge:
				//
				// > a critical acmeIdentifier extension
				if !ext.Critical {
					return fmt.Errorf("server under test returned a certificate with an acmeIdentifier extension marked non-Critical")
				}

				var keyAuthz []byte
				remainder, err := asn1.Unmarshal(ext.Value, &keyAuthz)
				if err != nil {
					return fmt.Errorf("server under test returned a certificate with invalid acmeIdentifier extension value: %w", err)
				}
				if len(remainder) > 0 {
					return fmt.Errorf("server under test returned a certificate with invalid acmeIdentifier extension value with additional trailing data")
				}

				ok, err := ValidateRawSHA256KeyAuthorization(keyAuthz, token, thumbprint)
				if !ok || err != nil {
					return fmt.Errorf("server under test returned a certificate with an invalid key authorization (%w)", err)
				}
			}

			// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
			// Negotiation (TLS ALPN) Challenge:
			//
			// > The ACME server verifies that ... the certificate returned
			// > contains: ... a critical acmeIdentifier extension containing
			// > the expected SHA-256 digest computed in step 1.
			if !foundACMEId {
				return fmt.Errorf("server under test returned a certificate without the required acmeIdentifier extension")
			}

			// Remove the handled critical extension and validate that we
			// have no additional critical extensions left unhandled.
			var index int = -1
			for oidIndex, oid := range cert.UnhandledCriticalExtensions {
				if oid.Equal(OIDACMEIdentifier) {
					index = oidIndex
					break
				}
			}
			if index != -1 {
				// Unlike the foundACMEId case, this is not a failure; if Go
				// updates to "understand" this critical extension, we do not
				// wish to fail.
				cert.UnhandledCriticalExtensions = append(cert.UnhandledCriticalExtensions[0:index], cert.UnhandledCriticalExtensions[index+1:]...)
			}
			if len(cert.UnhandledCriticalExtensions) > 0 {
				return fmt.Errorf("server under test returned a certificate with additional unknown critical extensions (%v)", cert.UnhandledCriticalExtensions)
			}

			// All good!
			return nil
		},

		// We never want to resume a connection; do not provide session
		// cache storage.
		ClientSessionCache: nil,

		// Do not trust any system trusted certificates; we're going to be
		// manually validating the chain, so specifying a non-empty pool
		// here could only cause additional, unnecessary work.
		RootCAs: x509.NewCertPool(),

		// Do not bother validating the client's chain; we know it should be
		// self-signed. This also disables hostname verification, but we do
		// this verification as part of VerifyConnection(...) ourselves.
		//
		// Per Go docs, this option is only safe in conjunction with
		// VerifyConnection which we define above.
		InsecureSkipVerify: true,

		// RFC 8737 Section 4. acme-tls/1 Protocol Definition:
		//
		// > ACME servers that implement "acme-tls/1" MUST only negotiate
		// > TLS 1.2 [RFC5246] or higher when connecting to clients for
		// > validation.
		MinVersion: tls.VersionTLS12,

		// While RFC 8737 does not place restrictions around allowed cipher
		// suites, we wish to restrict ourselves to secure defaults. Specify
		// the Intermediate guideline from Mozilla's TLS config generator to
		// disable obviously weak ciphers.
		//
		// See also: https://ssl-config.mozilla.org/#server=go&version=1.14.4&config=intermediate&guideline=5.7
		CipherSuites: []uint16{
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
		},
	}

	// Build a dialer using our custom DNS resolver, to ensure domains get
	// resolved according to configuration.
	dialer, err := buildDialerConfig(config)
	if err != nil {
		return false, fmt.Errorf("failed to build dialer: %w", err)
	}

	// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
	// Negotiation (TLS ALPN) Challenge:
	//
	// > 2. The ACME server resolves the domain name being validated and
	// >    chooses one of the IP addresses returned for validation (the
	// >    server MAY validate against multiple addresses if more than
	// >    one is returned).
	// > 3. The ACME server initiates a TLS connection to the chosen IP
	// >    address. This connection MUST use TCP port 443.
	address := fmt.Sprintf("%v:"+ALPNPort, domain)
	conn, err := dialer.Dial("tcp", address)
	if err != nil {
		return false, fmt.Errorf("tls-alpn-01: failed to dial host: %w", err)
	}

	// Initiate the connection to the remote peer.
	client := tls.Client(conn, cfg)

	// We intentionally swallow this error as it isn't useful to the
	// underlying protocol we perform here. Notably, per RFC 8737
	// Section 4. acme-tls/1 Protocol Definition:
	//
	// > Once the handshake is completed, the client MUST NOT exchange
	// > any further data with the server and MUST immediately close the
	// > connection. ... Because of this, an ACME server MAY choose to
	// > withhold authorization if either the certificate signature is
	// > invalid or the handshake doesn't fully complete.
	defer client.Close()

	// We wish to put time bounds on the total time the handshake can
	// stall for, so build a connection context here.
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()

	// See note above about why we can allow Handshake to complete
	// successfully.
	if err := client.HandshakeContext(ctx); err != nil {
		return false, fmt.Errorf("tls-alpn-01: failed to perform handshake: %w", err)
	}
	return true, nil
}