add letsencrypt to Gitea (#4189)
Fluf
7 years ago
committed by
techknowlogick
parent
6c1a31ffaa
commit
b82c14b3d2
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,962 @@ |
|||||||
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// Package autocert provides automatic access to certificates from Let's Encrypt
|
||||||
|
// and any other ACME-based CA.
|
||||||
|
//
|
||||||
|
// This package is a work in progress and makes no API stability promises.
|
||||||
|
package autocert |
||||||
|
|
||||||
|
import ( |
||||||
|
"bytes" |
||||||
|
"context" |
||||||
|
"crypto" |
||||||
|
"crypto/ecdsa" |
||||||
|
"crypto/elliptic" |
||||||
|
"crypto/rand" |
||||||
|
"crypto/rsa" |
||||||
|
"crypto/tls" |
||||||
|
"crypto/x509" |
||||||
|
"crypto/x509/pkix" |
||||||
|
"encoding/pem" |
||||||
|
"errors" |
||||||
|
"fmt" |
||||||
|
"io" |
||||||
|
mathrand "math/rand" |
||||||
|
"net" |
||||||
|
"net/http" |
||||||
|
"path" |
||||||
|
"strings" |
||||||
|
"sync" |
||||||
|
"time" |
||||||
|
|
||||||
|
"golang.org/x/crypto/acme" |
||||||
|
) |
||||||
|
|
||||||
|
// createCertRetryAfter is how much time to wait before removing a failed state
|
||||||
|
// entry due to an unsuccessful createCert call.
|
||||||
|
// This is a variable instead of a const for testing.
|
||||||
|
// TODO: Consider making it configurable or an exp backoff?
|
||||||
|
var createCertRetryAfter = time.Minute |
||||||
|
|
||||||
|
// pseudoRand is safe for concurrent use.
|
||||||
|
var pseudoRand *lockedMathRand |
||||||
|
|
||||||
|
func init() { |
||||||
|
src := mathrand.NewSource(timeNow().UnixNano()) |
||||||
|
pseudoRand = &lockedMathRand{rnd: mathrand.New(src)} |
||||||
|
} |
||||||
|
|
||||||
|
// AcceptTOS is a Manager.Prompt function that always returns true to
|
||||||
|
// indicate acceptance of the CA's Terms of Service during account
|
||||||
|
// registration.
|
||||||
|
func AcceptTOS(tosURL string) bool { return true } |
||||||
|
|
||||||
|
// HostPolicy specifies which host names the Manager is allowed to respond to.
|
||||||
|
// It returns a non-nil error if the host should be rejected.
|
||||||
|
// The returned error is accessible via tls.Conn.Handshake and its callers.
|
||||||
|
// See Manager's HostPolicy field and GetCertificate method docs for more details.
|
||||||
|
type HostPolicy func(ctx context.Context, host string) error |
||||||
|
|
||||||
|
// HostWhitelist returns a policy where only the specified host names are allowed.
|
||||||
|
// Only exact matches are currently supported. Subdomains, regexp or wildcard
|
||||||
|
// will not match.
|
||||||
|
func HostWhitelist(hosts ...string) HostPolicy { |
||||||
|
whitelist := make(map[string]bool, len(hosts)) |
||||||
|
for _, h := range hosts { |
||||||
|
whitelist[h] = true |
||||||
|
} |
||||||
|
return func(_ context.Context, host string) error { |
||||||
|
if !whitelist[host] { |
||||||
|
return errors.New("acme/autocert: host not configured") |
||||||
|
} |
||||||
|
return nil |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// defaultHostPolicy is used when Manager.HostPolicy is not set.
|
||||||
|
func defaultHostPolicy(context.Context, string) error { |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
// Manager is a stateful certificate manager built on top of acme.Client.
|
||||||
|
// It obtains and refreshes certificates automatically using "tls-sni-01",
|
||||||
|
// "tls-sni-02" and "http-01" challenge types, as well as providing them
|
||||||
|
// to a TLS server via tls.Config.
|
||||||
|
//
|
||||||
|
// You must specify a cache implementation, such as DirCache,
|
||||||
|
// to reuse obtained certificates across program restarts.
|
||||||
|
// Otherwise your server is very likely to exceed the certificate
|
||||||
|
// issuer's request rate limits.
|
||||||
|
type Manager struct { |
||||||
|
// Prompt specifies a callback function to conditionally accept a CA's Terms of Service (TOS).
|
||||||
|
// The registration may require the caller to agree to the CA's TOS.
|
||||||
|
// If so, Manager calls Prompt with a TOS URL provided by the CA. Prompt should report
|
||||||
|
// whether the caller agrees to the terms.
|
||||||
|
//
|
||||||
|
// To always accept the terms, the callers can use AcceptTOS.
|
||||||
|
Prompt func(tosURL string) bool |
||||||
|
|
||||||
|
// Cache optionally stores and retrieves previously-obtained certificates.
|
||||||
|
// If nil, certs will only be cached for the lifetime of the Manager.
|
||||||
|
//
|
||||||
|
// Manager passes the Cache certificates data encoded in PEM, with private/public
|
||||||
|
// parts combined in a single Cache.Put call, private key first.
|
||||||
|
Cache Cache |
||||||
|
|
||||||
|
// HostPolicy controls which domains the Manager will attempt
|
||||||
|
// to retrieve new certificates for. It does not affect cached certs.
|
||||||
|
//
|
||||||
|
// If non-nil, HostPolicy is called before requesting a new cert.
|
||||||
|
// If nil, all hosts are currently allowed. This is not recommended,
|
||||||
|
// as it opens a potential attack where clients connect to a server
|
||||||
|
// by IP address and pretend to be asking for an incorrect host name.
|
||||||
|
// Manager will attempt to obtain a certificate for that host, incorrectly,
|
||||||
|
// eventually reaching the CA's rate limit for certificate requests
|
||||||
|
// and making it impossible to obtain actual certificates.
|
||||||
|
//
|
||||||
|
// See GetCertificate for more details.
|
||||||
|
HostPolicy HostPolicy |
||||||
|
|
||||||
|
// RenewBefore optionally specifies how early certificates should
|
||||||
|
// be renewed before they expire.
|
||||||
|
//
|
||||||
|
// If zero, they're renewed 30 days before expiration.
|
||||||
|
RenewBefore time.Duration |
||||||
|
|
||||||
|
// Client is used to perform low-level operations, such as account registration
|
||||||
|
// and requesting new certificates.
|
||||||
|
// If Client is nil, a zero-value acme.Client is used with acme.LetsEncryptURL
|
||||||
|
// directory endpoint and a newly-generated ECDSA P-256 key.
|
||||||
|
//
|
||||||
|
// Mutating the field after the first call of GetCertificate method will have no effect.
|
||||||
|
Client *acme.Client |
||||||
|
|
||||||
|
// Email optionally specifies a contact email address.
|
||||||
|
// This is used by CAs, such as Let's Encrypt, to notify about problems
|
||||||
|
// with issued certificates.
|
||||||
|
//
|
||||||
|
// If the Client's account key is already registered, Email is not used.
|
||||||
|
Email string |
||||||
|
|
||||||
|
// ForceRSA makes the Manager generate certificates with 2048-bit RSA keys.
|
||||||
|
//
|
||||||
|
// If false, a default is used. Currently the default
|
||||||
|
// is EC-based keys using the P-256 curve.
|
||||||
|
ForceRSA bool |
||||||
|
|
||||||
|
clientMu sync.Mutex |
||||||
|
client *acme.Client // initialized by acmeClient method
|
||||||
|
|
||||||
|
stateMu sync.Mutex |
||||||
|
state map[string]*certState // keyed by domain name
|
||||||
|
|
||||||
|
// renewal tracks the set of domains currently running renewal timers.
|
||||||
|
// It is keyed by domain name.
|
||||||
|
renewalMu sync.Mutex |
||||||
|
renewal map[string]*domainRenewal |
||||||
|
|
||||||
|
// tokensMu guards the rest of the fields: tryHTTP01, certTokens and httpTokens.
|
||||||
|
tokensMu sync.RWMutex |
||||||
|
// tryHTTP01 indicates whether the Manager should try "http-01" challenge type
|
||||||
|
// during the authorization flow.
|
||||||
|
tryHTTP01 bool |
||||||
|
// httpTokens contains response body values for http-01 challenges
|
||||||
|
// and is keyed by the URL path at which a challenge response is expected
|
||||||
|
// to be provisioned.
|
||||||
|
// The entries are stored for the duration of the authorization flow.
|
||||||
|
httpTokens map[string][]byte |
||||||
|
// certTokens contains temporary certificates for tls-sni challenges
|
||||||
|
// and is keyed by token domain name, which matches server name of ClientHello.
|
||||||
|
// Keys always have ".acme.invalid" suffix.
|
||||||
|
// The entries are stored for the duration of the authorization flow.
|
||||||
|
certTokens map[string]*tls.Certificate |
||||||
|
} |
||||||
|
|
||||||
|
// GetCertificate implements the tls.Config.GetCertificate hook.
|
||||||
|
// It provides a TLS certificate for hello.ServerName host, including answering
|
||||||
|
// *.acme.invalid (TLS-SNI) challenges. All other fields of hello are ignored.
|
||||||
|
//
|
||||||
|
// If m.HostPolicy is non-nil, GetCertificate calls the policy before requesting
|
||||||
|
// a new cert. A non-nil error returned from m.HostPolicy halts TLS negotiation.
|
||||||
|
// The error is propagated back to the caller of GetCertificate and is user-visible.
|
||||||
|
// This does not affect cached certs. See HostPolicy field description for more details.
|
||||||
|
func (m *Manager) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) { |
||||||
|
if m.Prompt == nil { |
||||||
|
return nil, errors.New("acme/autocert: Manager.Prompt not set") |
||||||
|
} |
||||||
|
|
||||||
|
name := hello.ServerName |
||||||
|
if name == "" { |
||||||
|
return nil, errors.New("acme/autocert: missing server name") |
||||||
|
} |
||||||
|
if !strings.Contains(strings.Trim(name, "."), ".") { |
||||||
|
return nil, errors.New("acme/autocert: server name component count invalid") |
||||||
|
} |
||||||
|
if strings.ContainsAny(name, `/\`) { |
||||||
|
return nil, errors.New("acme/autocert: server name contains invalid character") |
||||||
|
} |
||||||
|
|
||||||
|
// In the worst-case scenario, the timeout needs to account for caching, host policy,
|
||||||
|
// domain ownership verification and certificate issuance.
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute) |
||||||
|
defer cancel() |
||||||
|
|
||||||
|
// check whether this is a token cert requested for TLS-SNI challenge
|
||||||
|
if strings.HasSuffix(name, ".acme.invalid") { |
||||||
|
m.tokensMu.RLock() |
||||||
|
defer m.tokensMu.RUnlock() |
||||||
|
if cert := m.certTokens[name]; cert != nil { |
||||||
|
return cert, nil |
||||||
|
} |
||||||
|
if cert, err := m.cacheGet(ctx, name); err == nil { |
||||||
|
return cert, nil |
||||||
|
} |
||||||
|
// TODO: cache error results?
|
||||||
|
return nil, fmt.Errorf("acme/autocert: no token cert for %q", name) |
||||||
|
} |
||||||
|
|
||||||
|
// regular domain
|
||||||
|
name = strings.TrimSuffix(name, ".") // golang.org/issue/18114
|
||||||
|
cert, err := m.cert(ctx, name) |
||||||
|
if err == nil { |
||||||
|
return cert, nil |
||||||
|
} |
||||||
|
if err != ErrCacheMiss { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// first-time
|
||||||
|
if err := m.hostPolicy()(ctx, name); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
cert, err = m.createCert(ctx, name) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
m.cachePut(ctx, name, cert) |
||||||
|
return cert, nil |
||||||
|
} |
||||||
|
|
||||||
|
// HTTPHandler configures the Manager to provision ACME "http-01" challenge responses.
|
||||||
|
// It returns an http.Handler that responds to the challenges and must be
|
||||||
|
// running on port 80. If it receives a request that is not an ACME challenge,
|
||||||
|
// it delegates the request to the optional fallback handler.
|
||||||
|
//
|
||||||
|
// If fallback is nil, the returned handler redirects all GET and HEAD requests
|
||||||
|
// to the default TLS port 443 with 302 Found status code, preserving the original
|
||||||
|
// request path and query. It responds with 400 Bad Request to all other HTTP methods.
|
||||||
|
// The fallback is not protected by the optional HostPolicy.
|
||||||
|
//
|
||||||
|
// Because the fallback handler is run with unencrypted port 80 requests,
|
||||||
|
// the fallback should not serve TLS-only requests.
|
||||||
|
//
|
||||||
|
// If HTTPHandler is never called, the Manager will only use TLS SNI
|
||||||
|
// challenges for domain verification.
|
||||||
|
func (m *Manager) HTTPHandler(fallback http.Handler) http.Handler { |
||||||
|
m.tokensMu.Lock() |
||||||
|
defer m.tokensMu.Unlock() |
||||||
|
m.tryHTTP01 = true |
||||||
|
|
||||||
|
if fallback == nil { |
||||||
|
fallback = http.HandlerFunc(handleHTTPRedirect) |
||||||
|
} |
||||||
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
||||||
|
if !strings.HasPrefix(r.URL.Path, "/.well-known/acme-challenge/") { |
||||||
|
fallback.ServeHTTP(w, r) |
||||||
|
return |
||||||
|
} |
||||||
|
// A reasonable context timeout for cache and host policy only,
|
||||||
|
// because we don't wait for a new certificate issuance here.
|
||||||
|
ctx, cancel := context.WithTimeout(r.Context(), time.Minute) |
||||||
|
defer cancel() |
||||||
|
if err := m.hostPolicy()(ctx, r.Host); err != nil { |
||||||
|
http.Error(w, err.Error(), http.StatusForbidden) |
||||||
|
return |
||||||
|
} |
||||||
|
data, err := m.httpToken(ctx, r.URL.Path) |
||||||
|
if err != nil { |
||||||
|
http.Error(w, err.Error(), http.StatusNotFound) |
||||||
|
return |
||||||
|
} |
||||||
|
w.Write(data) |
||||||
|
}) |
||||||
|
} |
||||||
|
|
||||||
|
func handleHTTPRedirect(w http.ResponseWriter, r *http.Request) { |
||||||
|
if r.Method != "GET" && r.Method != "HEAD" { |
||||||
|
http.Error(w, "Use HTTPS", http.StatusBadRequest) |
||||||
|
return |
||||||
|
} |
||||||
|
target := "https://" + stripPort(r.Host) + r.URL.RequestURI() |
||||||
|
http.Redirect(w, r, target, http.StatusFound) |
||||||
|
} |
||||||
|
|
||||||
|
func stripPort(hostport string) string { |
||||||
|
host, _, err := net.SplitHostPort(hostport) |
||||||
|
if err != nil { |
||||||
|
return hostport |
||||||
|
} |
||||||
|
return net.JoinHostPort(host, "443") |
||||||
|
} |
||||||
|
|
||||||
|
// cert returns an existing certificate either from m.state or cache.
|
||||||
|
// If a certificate is found in cache but not in m.state, the latter will be filled
|
||||||
|
// with the cached value.
|
||||||
|
func (m *Manager) cert(ctx context.Context, name string) (*tls.Certificate, error) { |
||||||
|
m.stateMu.Lock() |
||||||
|
if s, ok := m.state[name]; ok { |
||||||
|
m.stateMu.Unlock() |
||||||
|
s.RLock() |
||||||
|
defer s.RUnlock() |
||||||
|
return s.tlscert() |
||||||
|
} |
||||||
|
defer m.stateMu.Unlock() |
||||||
|
cert, err := m.cacheGet(ctx, name) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
signer, ok := cert.PrivateKey.(crypto.Signer) |
||||||
|
if !ok { |
||||||
|
return nil, errors.New("acme/autocert: private key cannot sign") |
||||||
|
} |
||||||
|
if m.state == nil { |
||||||
|
m.state = make(map[string]*certState) |
||||||
|
} |
||||||
|
s := &certState{ |
||||||
|
key: signer, |
||||||
|
cert: cert.Certificate, |
||||||
|
leaf: cert.Leaf, |
||||||
|
} |
||||||
|
m.state[name] = s |
||||||
|
go m.renew(name, s.key, s.leaf.NotAfter) |
||||||
|
return cert, nil |
||||||
|
} |
||||||
|
|
||||||
|
// cacheGet always returns a valid certificate, or an error otherwise.
|
||||||
|
// If a cached certficate exists but is not valid, ErrCacheMiss is returned.
|
||||||
|
func (m *Manager) cacheGet(ctx context.Context, domain string) (*tls.Certificate, error) { |
||||||
|
if m.Cache == nil { |
||||||
|
return nil, ErrCacheMiss |
||||||
|
} |
||||||
|
data, err := m.Cache.Get(ctx, domain) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// private
|
||||||
|
priv, pub := pem.Decode(data) |
||||||
|
if priv == nil || !strings.Contains(priv.Type, "PRIVATE") { |
||||||
|
return nil, ErrCacheMiss |
||||||
|
} |
||||||
|
privKey, err := parsePrivateKey(priv.Bytes) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// public
|
||||||
|
var pubDER [][]byte |
||||||
|
for len(pub) > 0 { |
||||||
|
var b *pem.Block |
||||||
|
b, pub = pem.Decode(pub) |
||||||
|
if b == nil { |
||||||
|
break |
||||||
|
} |
||||||
|
pubDER = append(pubDER, b.Bytes) |
||||||
|
} |
||||||
|
if len(pub) > 0 { |
||||||
|
// Leftover content not consumed by pem.Decode. Corrupt. Ignore.
|
||||||
|
return nil, ErrCacheMiss |
||||||
|
} |
||||||
|
|
||||||
|
// verify and create TLS cert
|
||||||
|
leaf, err := validCert(domain, pubDER, privKey) |
||||||
|
if err != nil { |
||||||
|
return nil, ErrCacheMiss |
||||||
|
} |
||||||
|
tlscert := &tls.Certificate{ |
||||||
|
Certificate: pubDER, |
||||||
|
PrivateKey: privKey, |
||||||
|
Leaf: leaf, |
||||||
|
} |
||||||
|
return tlscert, nil |
||||||
|
} |
||||||
|
|
||||||
|
func (m *Manager) cachePut(ctx context.Context, domain string, tlscert *tls.Certificate) error { |
||||||
|
if m.Cache == nil { |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
// contains PEM-encoded data
|
||||||
|
var buf bytes.Buffer |
||||||
|
|
||||||
|
// private
|
||||||
|
switch key := tlscert.PrivateKey.(type) { |
||||||
|
case *ecdsa.PrivateKey: |
||||||
|
if err := encodeECDSAKey(&buf, key); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
case *rsa.PrivateKey: |
||||||
|
b := x509.MarshalPKCS1PrivateKey(key) |
||||||
|
pb := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: b} |
||||||
|
if err := pem.Encode(&buf, pb); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
default: |
||||||
|
return errors.New("acme/autocert: unknown private key type") |
||||||
|
} |
||||||
|
|
||||||
|
// public
|
||||||
|
for _, b := range tlscert.Certificate { |
||||||
|
pb := &pem.Block{Type: "CERTIFICATE", Bytes: b} |
||||||
|
if err := pem.Encode(&buf, pb); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
return m.Cache.Put(ctx, domain, buf.Bytes()) |
||||||
|
} |
||||||
|
|
||||||
|
func encodeECDSAKey(w io.Writer, key *ecdsa.PrivateKey) error { |
||||||
|
b, err := x509.MarshalECPrivateKey(key) |
||||||
|
if err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
pb := &pem.Block{Type: "EC PRIVATE KEY", Bytes: b} |
||||||
|
return pem.Encode(w, pb) |
||||||
|
} |
||||||
|
|
||||||
|
// createCert starts the domain ownership verification and returns a certificate
|
||||||
|
// for that domain upon success.
|
||||||
|
//
|
||||||
|
// If the domain is already being verified, it waits for the existing verification to complete.
|
||||||
|
// Either way, createCert blocks for the duration of the whole process.
|
||||||
|
func (m *Manager) createCert(ctx context.Context, domain string) (*tls.Certificate, error) { |
||||||
|
// TODO: maybe rewrite this whole piece using sync.Once
|
||||||
|
state, err := m.certState(domain) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
// state may exist if another goroutine is already working on it
|
||||||
|
// in which case just wait for it to finish
|
||||||
|
if !state.locked { |
||||||
|
state.RLock() |
||||||
|
defer state.RUnlock() |
||||||
|
return state.tlscert() |
||||||
|
} |
||||||
|
|
||||||
|
// We are the first; state is locked.
|
||||||
|
// Unblock the readers when domain ownership is verified
|
||||||
|
// and we got the cert or the process failed.
|
||||||
|
defer state.Unlock() |
||||||
|
state.locked = false |
||||||
|
|
||||||
|
der, leaf, err := m.authorizedCert(ctx, state.key, domain) |
||||||
|
if err != nil { |
||||||
|
// Remove the failed state after some time,
|
||||||
|
// making the manager call createCert again on the following TLS hello.
|
||||||
|
time.AfterFunc(createCertRetryAfter, func() { |
||||||
|
defer testDidRemoveState(domain) |
||||||
|
m.stateMu.Lock() |
||||||
|
defer m.stateMu.Unlock() |
||||||
|
// Verify the state hasn't changed and it's still invalid
|
||||||
|
// before deleting.
|
||||||
|
s, ok := m.state[domain] |
||||||
|
if !ok { |
||||||
|
return |
||||||
|
} |
||||||
|
if _, err := validCert(domain, s.cert, s.key); err == nil { |
||||||
|
return |
||||||
|
} |
||||||
|
delete(m.state, domain) |
||||||
|
}) |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
state.cert = der |
||||||
|
state.leaf = leaf |
||||||
|
go m.renew(domain, state.key, state.leaf.NotAfter) |
||||||
|
return state.tlscert() |
||||||
|
} |
||||||
|
|
||||||
|
// certState returns a new or existing certState.
|
||||||
|
// If a new certState is returned, state.exist is false and the state is locked.
|
||||||
|
// The returned error is non-nil only in the case where a new state could not be created.
|
||||||
|
func (m *Manager) certState(domain string) (*certState, error) { |
||||||
|
m.stateMu.Lock() |
||||||
|
defer m.stateMu.Unlock() |
||||||
|
if m.state == nil { |
||||||
|
m.state = make(map[string]*certState) |
||||||
|
} |
||||||
|
// existing state
|
||||||
|
if state, ok := m.state[domain]; ok { |
||||||
|
return state, nil |
||||||
|
} |
||||||
|
|
||||||
|
// new locked state
|
||||||
|
var ( |
||||||
|
err error |
||||||
|
key crypto.Signer |
||||||
|
) |
||||||
|
if m.ForceRSA { |
||||||
|
key, err = rsa.GenerateKey(rand.Reader, 2048) |
||||||
|
} else { |
||||||
|
key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
||||||
|
} |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
state := &certState{ |
||||||
|
key: key, |
||||||
|
locked: true, |
||||||
|
} |
||||||
|
state.Lock() // will be unlocked by m.certState caller
|
||||||
|
m.state[domain] = state |
||||||
|
return state, nil |
||||||
|
} |
||||||
|
|
||||||
|
// authorizedCert starts the domain ownership verification process and requests a new cert upon success.
|
||||||
|
// The key argument is the certificate private key.
|
||||||
|
func (m *Manager) authorizedCert(ctx context.Context, key crypto.Signer, domain string) (der [][]byte, leaf *x509.Certificate, err error) { |
||||||
|
client, err := m.acmeClient(ctx) |
||||||
|
if err != nil { |
||||||
|
return nil, nil, err |
||||||
|
} |
||||||
|
|
||||||
|
if err := m.verify(ctx, client, domain); err != nil { |
||||||
|
return nil, nil, err |
||||||
|
} |
||||||
|
csr, err := certRequest(key, domain) |
||||||
|
if err != nil { |
||||||
|
return nil, nil, err |
||||||
|
} |
||||||
|
der, _, err = client.CreateCert(ctx, csr, 0, true) |
||||||
|
if err != nil { |
||||||
|
return nil, nil, err |
||||||
|
} |
||||||
|
leaf, err = validCert(domain, der, key) |
||||||
|
if err != nil { |
||||||
|
return nil, nil, err |
||||||
|
} |
||||||
|
return der, leaf, nil |
||||||
|
} |
||||||
|
|
||||||
|
// verify runs the identifier (domain) authorization flow
|
||||||
|
// using each applicable ACME challenge type.
|
||||||
|
func (m *Manager) verify(ctx context.Context, client *acme.Client, domain string) error { |
||||||
|
// The list of challenge types we'll try to fulfill
|
||||||
|
// in this specific order.
|
||||||
|
challengeTypes := []string{"tls-sni-02", "tls-sni-01"} |
||||||
|
m.tokensMu.RLock() |
||||||
|
if m.tryHTTP01 { |
||||||
|
challengeTypes = append(challengeTypes, "http-01") |
||||||
|
} |
||||||
|
m.tokensMu.RUnlock() |
||||||
|
|
||||||
|
var nextTyp int // challengeType index of the next challenge type to try
|
||||||
|
for { |
||||||
|
// Start domain authorization and get the challenge.
|
||||||
|
authz, err := client.Authorize(ctx, domain) |
||||||
|
if err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
// No point in accepting challenges if the authorization status
|
||||||
|
// is in a final state.
|
||||||
|
switch authz.Status { |
||||||
|
case acme.StatusValid: |
||||||
|
return nil // already authorized
|
||||||
|
case acme.StatusInvalid: |
||||||
|
return fmt.Errorf("acme/autocert: invalid authorization %q", authz.URI) |
||||||
|
} |
||||||
|
|
||||||
|
// Pick the next preferred challenge.
|
||||||
|
var chal *acme.Challenge |
||||||
|
for chal == nil && nextTyp < len(challengeTypes) { |
||||||
|
chal = pickChallenge(challengeTypes[nextTyp], authz.Challenges) |
||||||
|
nextTyp++ |
||||||
|
} |
||||||
|
if chal == nil { |
||||||
|
return fmt.Errorf("acme/autocert: unable to authorize %q; tried %q", domain, challengeTypes) |
||||||
|
} |
||||||
|
cleanup, err := m.fulfill(ctx, client, chal) |
||||||
|
if err != nil { |
||||||
|
continue |
||||||
|
} |
||||||
|
defer cleanup() |
||||||
|
if _, err := client.Accept(ctx, chal); err != nil { |
||||||
|
continue |
||||||
|
} |
||||||
|
|
||||||
|
// A challenge is fulfilled and accepted: wait for the CA to validate.
|
||||||
|
if _, err := client.WaitAuthorization(ctx, authz.URI); err == nil { |
||||||
|
return nil |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// fulfill provisions a response to the challenge chal.
|
||||||
|
// The cleanup is non-nil only if provisioning succeeded.
|
||||||
|
func (m *Manager) fulfill(ctx context.Context, client *acme.Client, chal *acme.Challenge) (cleanup func(), err error) { |
||||||
|
switch chal.Type { |
||||||
|
case "tls-sni-01": |
||||||
|
cert, name, err := client.TLSSNI01ChallengeCert(chal.Token) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
m.putCertToken(ctx, name, &cert) |
||||||
|
return func() { go m.deleteCertToken(name) }, nil |
||||||
|
case "tls-sni-02": |
||||||
|
cert, name, err := client.TLSSNI02ChallengeCert(chal.Token) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
m.putCertToken(ctx, name, &cert) |
||||||
|
return func() { go m.deleteCertToken(name) }, nil |
||||||
|
case "http-01": |
||||||
|
resp, err := client.HTTP01ChallengeResponse(chal.Token) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
p := client.HTTP01ChallengePath(chal.Token) |
||||||
|
m.putHTTPToken(ctx, p, resp) |
||||||
|
return func() { go m.deleteHTTPToken(p) }, nil |
||||||
|
} |
||||||
|
return nil, fmt.Errorf("acme/autocert: unknown challenge type %q", chal.Type) |
||||||
|
} |
||||||
|
|
||||||
|
func pickChallenge(typ string, chal []*acme.Challenge) *acme.Challenge { |
||||||
|
for _, c := range chal { |
||||||
|
if c.Type == typ { |
||||||
|
return c |
||||||
|
} |
||||||
|
} |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
// putCertToken stores the cert under the named key in both m.certTokens map
|
||||||
|
// and m.Cache.
|
||||||
|
func (m *Manager) putCertToken(ctx context.Context, name string, cert *tls.Certificate) { |
||||||
|
m.tokensMu.Lock() |
||||||
|
defer m.tokensMu.Unlock() |
||||||
|
if m.certTokens == nil { |
||||||
|
m.certTokens = make(map[string]*tls.Certificate) |
||||||
|
} |
||||||
|
m.certTokens[name] = cert |
||||||
|
m.cachePut(ctx, name, cert) |
||||||
|
} |
||||||
|
|
||||||
|
// deleteCertToken removes the token certificate for the specified domain name
|
||||||
|
// from both m.certTokens map and m.Cache.
|
||||||
|
func (m *Manager) deleteCertToken(name string) { |
||||||
|
m.tokensMu.Lock() |
||||||
|
defer m.tokensMu.Unlock() |
||||||
|
delete(m.certTokens, name) |
||||||
|
if m.Cache != nil { |
||||||
|
m.Cache.Delete(context.Background(), name) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// httpToken retrieves an existing http-01 token value from an in-memory map
|
||||||
|
// or the optional cache.
|
||||||
|
func (m *Manager) httpToken(ctx context.Context, tokenPath string) ([]byte, error) { |
||||||
|
m.tokensMu.RLock() |
||||||
|
defer m.tokensMu.RUnlock() |
||||||
|
if v, ok := m.httpTokens[tokenPath]; ok { |
||||||
|
return v, nil |
||||||
|
} |
||||||
|
if m.Cache == nil { |
||||||
|
return nil, fmt.Errorf("acme/autocert: no token at %q", tokenPath) |
||||||
|
} |
||||||
|
return m.Cache.Get(ctx, httpTokenCacheKey(tokenPath)) |
||||||
|
} |
||||||
|
|
||||||
|
// putHTTPToken stores an http-01 token value using tokenPath as key
|
||||||
|
// in both in-memory map and the optional Cache.
|
||||||
|
//
|
||||||
|
// It ignores any error returned from Cache.Put.
|
||||||
|
func (m *Manager) putHTTPToken(ctx context.Context, tokenPath, val string) { |
||||||
|
m.tokensMu.Lock() |
||||||
|
defer m.tokensMu.Unlock() |
||||||
|
if m.httpTokens == nil { |
||||||
|
m.httpTokens = make(map[string][]byte) |
||||||
|
} |
||||||
|
b := []byte(val) |
||||||
|
m.httpTokens[tokenPath] = b |
||||||
|
if m.Cache != nil { |
||||||
|
m.Cache.Put(ctx, httpTokenCacheKey(tokenPath), b) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// deleteHTTPToken removes an http-01 token value from both in-memory map
|
||||||
|
// and the optional Cache, ignoring any error returned from the latter.
|
||||||
|
//
|
||||||
|
// If m.Cache is non-nil, it blocks until Cache.Delete returns without a timeout.
|
||||||
|
func (m *Manager) deleteHTTPToken(tokenPath string) { |
||||||
|
m.tokensMu.Lock() |
||||||
|
defer m.tokensMu.Unlock() |
||||||
|
delete(m.httpTokens, tokenPath) |
||||||
|
if m.Cache != nil { |
||||||
|
m.Cache.Delete(context.Background(), httpTokenCacheKey(tokenPath)) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// httpTokenCacheKey returns a key at which an http-01 token value may be stored
|
||||||
|
// in the Manager's optional Cache.
|
||||||
|
func httpTokenCacheKey(tokenPath string) string { |
||||||
|
return "http-01-" + path.Base(tokenPath) |
||||||
|
} |
||||||
|
|
||||||
|
// renew starts a cert renewal timer loop, one per domain.
|
||||||
|
//
|
||||||
|
// The loop is scheduled in two cases:
|
||||||
|
// - a cert was fetched from cache for the first time (wasn't in m.state)
|
||||||
|
// - a new cert was created by m.createCert
|
||||||
|
//
|
||||||
|
// The key argument is a certificate private key.
|
||||||
|
// The exp argument is the cert expiration time (NotAfter).
|
||||||
|
func (m *Manager) renew(domain string, key crypto.Signer, exp time.Time) { |
||||||
|
m.renewalMu.Lock() |
||||||
|
defer m.renewalMu.Unlock() |
||||||
|
if m.renewal[domain] != nil { |
||||||
|
// another goroutine is already on it
|
||||||
|
return |
||||||
|
} |
||||||
|
if m.renewal == nil { |
||||||
|
m.renewal = make(map[string]*domainRenewal) |
||||||
|
} |
||||||
|
dr := &domainRenewal{m: m, domain: domain, key: key} |
||||||
|
m.renewal[domain] = dr |
||||||
|
dr.start(exp) |
||||||
|
} |
||||||
|
|
||||||
|
// stopRenew stops all currently running cert renewal timers.
|
||||||
|
// The timers are not restarted during the lifetime of the Manager.
|
||||||
|
func (m *Manager) stopRenew() { |
||||||
|
m.renewalMu.Lock() |
||||||
|
defer m.renewalMu.Unlock() |
||||||
|
for name, dr := range m.renewal { |
||||||
|
delete(m.renewal, name) |
||||||
|
dr.stop() |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func (m *Manager) accountKey(ctx context.Context) (crypto.Signer, error) { |
||||||
|
const keyName = "acme_account.key" |
||||||
|
|
||||||
|
genKey := func() (*ecdsa.PrivateKey, error) { |
||||||
|
return ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
||||||
|
} |
||||||
|
|
||||||
|
if m.Cache == nil { |
||||||
|
return genKey() |
||||||
|
} |
||||||
|
|
||||||
|
data, err := m.Cache.Get(ctx, keyName) |
||||||
|
if err == ErrCacheMiss { |
||||||
|
key, err := genKey() |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
var buf bytes.Buffer |
||||||
|
if err := encodeECDSAKey(&buf, key); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
if err := m.Cache.Put(ctx, keyName, buf.Bytes()); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
return key, nil |
||||||
|
} |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
priv, _ := pem.Decode(data) |
||||||
|
if priv == nil || !strings.Contains(priv.Type, "PRIVATE") { |
||||||
|
return nil, errors.New("acme/autocert: invalid account key found in cache") |
||||||
|
} |
||||||
|
return parsePrivateKey(priv.Bytes) |
||||||
|
} |
||||||
|
|
||||||
|
func (m *Manager) acmeClient(ctx context.Context) (*acme.Client, error) { |
||||||
|
m.clientMu.Lock() |
||||||
|
defer m.clientMu.Unlock() |
||||||
|
if m.client != nil { |
||||||
|
return m.client, nil |
||||||
|
} |
||||||
|
|
||||||
|
client := m.Client |
||||||
|
if client == nil { |
||||||
|
client = &acme.Client{DirectoryURL: acme.LetsEncryptURL} |
||||||
|
} |
||||||
|
if client.Key == nil { |
||||||
|
var err error |
||||||
|
client.Key, err = m.accountKey(ctx) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
} |
||||||
|
var contact []string |
||||||
|
if m.Email != "" { |
||||||
|
contact = []string{"mailto:" + m.Email} |
||||||
|
} |
||||||
|
a := &acme.Account{Contact: contact} |
||||||
|
_, err := client.Register(ctx, a, m.Prompt) |
||||||
|
if ae, ok := err.(*acme.Error); err == nil || ok && ae.StatusCode == http.StatusConflict { |
||||||
|
// conflict indicates the key is already registered
|
||||||
|
m.client = client |
||||||
|
err = nil |
||||||
|
} |
||||||
|
return m.client, err |
||||||
|
} |
||||||
|
|
||||||
|
func (m *Manager) hostPolicy() HostPolicy { |
||||||
|
if m.HostPolicy != nil { |
||||||
|
return m.HostPolicy |
||||||
|
} |
||||||
|
return defaultHostPolicy |
||||||
|
} |
||||||
|
|
||||||
|
func (m *Manager) renewBefore() time.Duration { |
||||||
|
if m.RenewBefore > renewJitter { |
||||||
|
return m.RenewBefore |
||||||
|
} |
||||||
|
return 720 * time.Hour // 30 days
|
||||||
|
} |
||||||
|
|
||||||
|
// certState is ready when its mutex is unlocked for reading.
|
||||||
|
type certState struct { |
||||||
|
sync.RWMutex |
||||||
|
locked bool // locked for read/write
|
||||||
|
key crypto.Signer // private key for cert
|
||||||
|
cert [][]byte // DER encoding
|
||||||
|
leaf *x509.Certificate // parsed cert[0]; always non-nil if cert != nil
|
||||||
|
} |
||||||
|
|
||||||
|
// tlscert creates a tls.Certificate from s.key and s.cert.
|
||||||
|
// Callers should wrap it in s.RLock() and s.RUnlock().
|
||||||
|
func (s *certState) tlscert() (*tls.Certificate, error) { |
||||||
|
if s.key == nil { |
||||||
|
return nil, errors.New("acme/autocert: missing signer") |
||||||
|
} |
||||||
|
if len(s.cert) == 0 { |
||||||
|
return nil, errors.New("acme/autocert: missing certificate") |
||||||
|
} |
||||||
|
return &tls.Certificate{ |
||||||
|
PrivateKey: s.key, |
||||||
|
Certificate: s.cert, |
||||||
|
Leaf: s.leaf, |
||||||
|
}, nil |
||||||
|
} |
||||||
|
|
||||||
|
// certRequest creates a certificate request for the given common name cn
|
||||||
|
// and optional SANs.
|
||||||
|
func certRequest(key crypto.Signer, cn string, san ...string) ([]byte, error) { |
||||||
|
req := &x509.CertificateRequest{ |
||||||
|
Subject: pkix.Name{CommonName: cn}, |
||||||
|
DNSNames: san, |
||||||
|
} |
||||||
|
return x509.CreateCertificateRequest(rand.Reader, req, key) |
||||||
|
} |
||||||
|
|
||||||
|
// Attempt to parse the given private key DER block. OpenSSL 0.9.8 generates
|
||||||
|
// PKCS#1 private keys by default, while OpenSSL 1.0.0 generates PKCS#8 keys.
|
||||||
|
// OpenSSL ecparam generates SEC1 EC private keys for ECDSA. We try all three.
|
||||||
|
//
|
||||||
|
// Inspired by parsePrivateKey in crypto/tls/tls.go.
|
||||||
|
func parsePrivateKey(der []byte) (crypto.Signer, error) { |
||||||
|
if key, err := x509.ParsePKCS1PrivateKey(der); err == nil { |
||||||
|
return key, nil |
||||||
|
} |
||||||
|
if key, err := x509.ParsePKCS8PrivateKey(der); err == nil { |
||||||
|
switch key := key.(type) { |
||||||
|
case *rsa.PrivateKey: |
||||||
|
return key, nil |
||||||
|
case *ecdsa.PrivateKey: |
||||||
|
return key, nil |
||||||
|
default: |
||||||
|
return nil, errors.New("acme/autocert: unknown private key type in PKCS#8 wrapping") |
||||||
|
} |
||||||
|
} |
||||||
|
if key, err := x509.ParseECPrivateKey(der); err == nil { |
||||||
|
return key, nil |
||||||
|
} |
||||||
|
|
||||||
|
return nil, errors.New("acme/autocert: failed to parse private key") |
||||||
|
} |
||||||
|
|
||||||
|
// validCert parses a cert chain provided as der argument and verifies the leaf, der[0],
|
||||||
|
// corresponds to the private key, as well as the domain match and expiration dates.
|
||||||
|
// It doesn't do any revocation checking.
|
||||||
|
//
|
||||||
|
// The returned value is the verified leaf cert.
|
||||||
|
func validCert(domain string, der [][]byte, key crypto.Signer) (leaf *x509.Certificate, err error) { |
||||||
|
// parse public part(s)
|
||||||
|
var n int |
||||||
|
for _, b := range der { |
||||||
|
n += len(b) |
||||||
|
} |
||||||
|
pub := make([]byte, n) |
||||||
|
n = 0 |
||||||
|
for _, b := range der { |
||||||
|
n += copy(pub[n:], b) |
||||||
|
} |
||||||
|
x509Cert, err := x509.ParseCertificates(pub) |
||||||
|
if len(x509Cert) == 0 { |
||||||
|
return nil, errors.New("acme/autocert: no public key found") |
||||||
|
} |
||||||
|
// verify the leaf is not expired and matches the domain name
|
||||||
|
leaf = x509Cert[0] |
||||||
|
now := timeNow() |
||||||
|
if now.Before(leaf.NotBefore) { |
||||||
|
return nil, errors.New("acme/autocert: certificate is not valid yet") |
||||||
|
} |
||||||
|
if now.After(leaf.NotAfter) { |
||||||
|
return nil, errors.New("acme/autocert: expired certificate") |
||||||
|
} |
||||||
|
if err := leaf.VerifyHostname(domain); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
// ensure the leaf corresponds to the private key
|
||||||
|
switch pub := leaf.PublicKey.(type) { |
||||||
|
case *rsa.PublicKey: |
||||||
|
prv, ok := key.(*rsa.PrivateKey) |
||||||
|
if !ok { |
||||||
|
return nil, errors.New("acme/autocert: private key type does not match public key type") |
||||||
|
} |
||||||
|
if pub.N.Cmp(prv.N) != 0 { |
||||||
|
return nil, errors.New("acme/autocert: private key does not match public key") |
||||||
|
} |
||||||
|
case *ecdsa.PublicKey: |
||||||
|
prv, ok := key.(*ecdsa.PrivateKey) |
||||||
|
if !ok { |
||||||
|
return nil, errors.New("acme/autocert: private key type does not match public key type") |
||||||
|
} |
||||||
|
if pub.X.Cmp(prv.X) != 0 || pub.Y.Cmp(prv.Y) != 0 { |
||||||
|
return nil, errors.New("acme/autocert: private key does not match public key") |
||||||
|
} |
||||||
|
default: |
||||||
|
return nil, errors.New("acme/autocert: unknown public key algorithm") |
||||||
|
} |
||||||
|
return leaf, nil |
||||||
|
} |
||||||
|
|
||||||
|
type lockedMathRand struct { |
||||||
|
sync.Mutex |
||||||
|
rnd *mathrand.Rand |
||||||
|
} |
||||||
|
|
||||||
|
func (r *lockedMathRand) int63n(max int64) int64 { |
||||||
|
r.Lock() |
||||||
|
n := r.rnd.Int63n(max) |
||||||
|
r.Unlock() |
||||||
|
return n |
||||||
|
} |
||||||
|
|
||||||
|
// For easier testing.
|
||||||
|
var ( |
||||||
|
timeNow = time.Now |
||||||
|
|
||||||
|
// Called when a state is removed.
|
||||||
|
testDidRemoveState = func(domain string) {} |
||||||
|
) |
||||||
@ -0,0 +1,130 @@ |
|||||||
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package autocert |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"errors" |
||||||
|
"io/ioutil" |
||||||
|
"os" |
||||||
|
"path/filepath" |
||||||
|
) |
||||||
|
|
||||||
|
// ErrCacheMiss is returned when a certificate is not found in cache.
|
||||||
|
var ErrCacheMiss = errors.New("acme/autocert: certificate cache miss") |
||||||
|
|
||||||
|
// Cache is used by Manager to store and retrieve previously obtained certificates
|
||||||
|
// as opaque data.
|
||||||
|
//
|
||||||
|
// The key argument of the methods refers to a domain name but need not be an FQDN.
|
||||||
|
// Cache implementations should not rely on the key naming pattern.
|
||||||
|
type Cache interface { |
||||||
|
// Get returns a certificate data for the specified key.
|
||||||
|
// If there's no such key, Get returns ErrCacheMiss.
|
||||||
|
Get(ctx context.Context, key string) ([]byte, error) |
||||||
|
|
||||||
|
// Put stores the data in the cache under the specified key.
|
||||||
|
// Underlying implementations may use any data storage format,
|
||||||
|
// as long as the reverse operation, Get, results in the original data.
|
||||||
|
Put(ctx context.Context, key string, data []byte) error |
||||||
|
|
||||||
|
// Delete removes a certificate data from the cache under the specified key.
|
||||||
|
// If there's no such key in the cache, Delete returns nil.
|
||||||
|
Delete(ctx context.Context, key string) error |
||||||
|
} |
||||||
|
|
||||||
|
// DirCache implements Cache using a directory on the local filesystem.
|
||||||
|
// If the directory does not exist, it will be created with 0700 permissions.
|
||||||
|
type DirCache string |
||||||
|
|
||||||
|
// Get reads a certificate data from the specified file name.
|
||||||
|
func (d DirCache) Get(ctx context.Context, name string) ([]byte, error) { |
||||||
|
name = filepath.Join(string(d), name) |
||||||
|
var ( |
||||||
|
data []byte |
||||||
|
err error |
||||||
|
done = make(chan struct{}) |
||||||
|
) |
||||||
|
go func() { |
||||||
|
data, err = ioutil.ReadFile(name) |
||||||
|
close(done) |
||||||
|
}() |
||||||
|
select { |
||||||
|
case <-ctx.Done(): |
||||||
|
return nil, ctx.Err() |
||||||
|
case <-done: |
||||||
|
} |
||||||
|
if os.IsNotExist(err) { |
||||||
|
return nil, ErrCacheMiss |
||||||
|
} |
||||||
|
return data, err |
||||||
|
} |
||||||
|
|
||||||
|
// Put writes the certificate data to the specified file name.
|
||||||
|
// The file will be created with 0600 permissions.
|
||||||
|
func (d DirCache) Put(ctx context.Context, name string, data []byte) error { |
||||||
|
if err := os.MkdirAll(string(d), 0700); err != nil { |
||||||
|
return err |
||||||
|
} |
||||||
|
|
||||||
|
done := make(chan struct{}) |
||||||
|
var err error |
||||||
|
go func() { |
||||||
|
defer close(done) |
||||||
|
var tmp string |
||||||
|
if tmp, err = d.writeTempFile(name, data); err != nil { |
||||||
|
return |
||||||
|
} |
||||||
|
select { |
||||||
|
case <-ctx.Done(): |
||||||
|
// Don't overwrite the file if the context was canceled.
|
||||||
|
default: |
||||||
|
newName := filepath.Join(string(d), name) |
||||||
|
err = os.Rename(tmp, newName) |
||||||
|
} |
||||||
|
}() |
||||||
|
select { |
||||||
|
case <-ctx.Done(): |
||||||
|
return ctx.Err() |
||||||
|
case <-done: |
||||||
|
} |
||||||
|
return err |
||||||
|
} |
||||||
|
|
||||||
|
// Delete removes the specified file name.
|
||||||
|
func (d DirCache) Delete(ctx context.Context, name string) error { |
||||||
|
name = filepath.Join(string(d), name) |
||||||
|
var ( |
||||||
|
err error |
||||||
|
done = make(chan struct{}) |
||||||
|
) |
||||||
|
go func() { |
||||||
|
err = os.Remove(name) |
||||||
|
close(done) |
||||||
|
}() |
||||||
|
select { |
||||||
|
case <-ctx.Done(): |
||||||
|
return ctx.Err() |
||||||
|
case <-done: |
||||||
|
} |
||||||
|
if err != nil && !os.IsNotExist(err) { |
||||||
|
return err |
||||||
|
} |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
// writeTempFile writes b to a temporary file, closes the file and returns its path.
|
||||||
|
func (d DirCache) writeTempFile(prefix string, b []byte) (string, error) { |
||||||
|
// TempFile uses 0600 permissions
|
||||||
|
f, err := ioutil.TempFile(string(d), prefix) |
||||||
|
if err != nil { |
||||||
|
return "", err |
||||||
|
} |
||||||
|
if _, err := f.Write(b); err != nil { |
||||||
|
f.Close() |
||||||
|
return "", err |
||||||
|
} |
||||||
|
return f.Name(), f.Close() |
||||||
|
} |
||||||
@ -0,0 +1,160 @@ |
|||||||
|
// Copyright 2017 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package autocert |
||||||
|
|
||||||
|
import ( |
||||||
|
"crypto/tls" |
||||||
|
"log" |
||||||
|
"net" |
||||||
|
"os" |
||||||
|
"path/filepath" |
||||||
|
"runtime" |
||||||
|
"time" |
||||||
|
) |
||||||
|
|
||||||
|
// NewListener returns a net.Listener that listens on the standard TLS
|
||||||
|
// port (443) on all interfaces and returns *tls.Conn connections with
|
||||||
|
// LetsEncrypt certificates for the provided domain or domains.
|
||||||
|
//
|
||||||
|
// It enables one-line HTTPS servers:
|
||||||
|
//
|
||||||
|
// log.Fatal(http.Serve(autocert.NewListener("example.com"), handler))
|
||||||
|
//
|
||||||
|
// NewListener is a convenience function for a common configuration.
|
||||||
|
// More complex or custom configurations can use the autocert.Manager
|
||||||
|
// type instead.
|
||||||
|
//
|
||||||
|
// Use of this function implies acceptance of the LetsEncrypt Terms of
|
||||||
|
// Service. If domains is not empty, the provided domains are passed
|
||||||
|
// to HostWhitelist. If domains is empty, the listener will do
|
||||||
|
// LetsEncrypt challenges for any requested domain, which is not
|
||||||
|
// recommended.
|
||||||
|
//
|
||||||
|
// Certificates are cached in a "golang-autocert" directory under an
|
||||||
|
// operating system-specific cache or temp directory. This may not
|
||||||
|
// be suitable for servers spanning multiple machines.
|
||||||
|
//
|
||||||
|
// The returned listener uses a *tls.Config that enables HTTP/2, and
|
||||||
|
// should only be used with servers that support HTTP/2.
|
||||||
|
//
|
||||||
|
// The returned Listener also enables TCP keep-alives on the accepted
|
||||||
|
// connections. The returned *tls.Conn are returned before their TLS
|
||||||
|
// handshake has completed.
|
||||||
|
func NewListener(domains ...string) net.Listener { |
||||||
|
m := &Manager{ |
||||||
|
Prompt: AcceptTOS, |
||||||
|
} |
||||||
|
if len(domains) > 0 { |
||||||
|
m.HostPolicy = HostWhitelist(domains...) |
||||||
|
} |
||||||
|
dir := cacheDir() |
||||||
|
if err := os.MkdirAll(dir, 0700); err != nil { |
||||||
|
log.Printf("warning: autocert.NewListener not using a cache: %v", err) |
||||||
|
} else { |
||||||
|
m.Cache = DirCache(dir) |
||||||
|
} |
||||||
|
return m.Listener() |
||||||
|
} |
||||||
|
|
||||||
|
// Listener listens on the standard TLS port (443) on all interfaces
|
||||||
|
// and returns a net.Listener returning *tls.Conn connections.
|
||||||
|
//
|
||||||
|
// The returned listener uses a *tls.Config that enables HTTP/2, and
|
||||||
|
// should only be used with servers that support HTTP/2.
|
||||||
|
//
|
||||||
|
// The returned Listener also enables TCP keep-alives on the accepted
|
||||||
|
// connections. The returned *tls.Conn are returned before their TLS
|
||||||
|
// handshake has completed.
|
||||||
|
//
|
||||||
|
// Unlike NewListener, it is the caller's responsibility to initialize
|
||||||
|
// the Manager m's Prompt, Cache, HostPolicy, and other desired options.
|
||||||
|
func (m *Manager) Listener() net.Listener { |
||||||
|
ln := &listener{ |
||||||
|
m: m, |
||||||
|
conf: &tls.Config{ |
||||||
|
GetCertificate: m.GetCertificate, // bonus: panic on nil m
|
||||||
|
NextProtos: []string{"h2", "http/1.1"}, // Enable HTTP/2
|
||||||
|
}, |
||||||
|
} |
||||||
|
ln.tcpListener, ln.tcpListenErr = net.Listen("tcp", ":443") |
||||||
|
return ln |
||||||
|
} |
||||||
|
|
||||||
|
type listener struct { |
||||||
|
m *Manager |
||||||
|
conf *tls.Config |
||||||
|
|
||||||
|
tcpListener net.Listener |
||||||
|
tcpListenErr error |
||||||
|
} |
||||||
|
|
||||||
|
func (ln *listener) Accept() (net.Conn, error) { |
||||||
|
if ln.tcpListenErr != nil { |
||||||
|
return nil, ln.tcpListenErr |
||||||
|
} |
||||||
|
conn, err := ln.tcpListener.Accept() |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
tcpConn := conn.(*net.TCPConn) |
||||||
|
|
||||||
|
// Because Listener is a convenience function, help out with
|
||||||
|
// this too. This is not possible for the caller to set once
|
||||||
|
// we return a *tcp.Conn wrapping an inaccessible net.Conn.
|
||||||
|
// If callers don't want this, they can do things the manual
|
||||||
|
// way and tweak as needed. But this is what net/http does
|
||||||
|
// itself, so copy that. If net/http changes, we can change
|
||||||
|
// here too.
|
||||||
|
tcpConn.SetKeepAlive(true) |
||||||
|
tcpConn.SetKeepAlivePeriod(3 * time.Minute) |
||||||
|
|
||||||
|
return tls.Server(tcpConn, ln.conf), nil |
||||||
|
} |
||||||
|
|
||||||
|
func (ln *listener) Addr() net.Addr { |
||||||
|
if ln.tcpListener != nil { |
||||||
|
return ln.tcpListener.Addr() |
||||||
|
} |
||||||
|
// net.Listen failed. Return something non-nil in case callers
|
||||||
|
// call Addr before Accept:
|
||||||
|
return &net.TCPAddr{IP: net.IP{0, 0, 0, 0}, Port: 443} |
||||||
|
} |
||||||
|
|
||||||
|
func (ln *listener) Close() error { |
||||||
|
if ln.tcpListenErr != nil { |
||||||
|
return ln.tcpListenErr |
||||||
|
} |
||||||
|
return ln.tcpListener.Close() |
||||||
|
} |
||||||
|
|
||||||
|
func homeDir() string { |
||||||
|
if runtime.GOOS == "windows" { |
||||||
|
return os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH") |
||||||
|
} |
||||||
|
if h := os.Getenv("HOME"); h != "" { |
||||||
|
return h |
||||||
|
} |
||||||
|
return "/" |
||||||
|
} |
||||||
|
|
||||||
|
func cacheDir() string { |
||||||
|
const base = "golang-autocert" |
||||||
|
switch runtime.GOOS { |
||||||
|
case "darwin": |
||||||
|
return filepath.Join(homeDir(), "Library", "Caches", base) |
||||||
|
case "windows": |
||||||
|
for _, ev := range []string{"APPDATA", "CSIDL_APPDATA", "TEMP", "TMP"} { |
||||||
|
if v := os.Getenv(ev); v != "" { |
||||||
|
return filepath.Join(v, base) |
||||||
|
} |
||||||
|
} |
||||||
|
// Worst case:
|
||||||
|
return filepath.Join(homeDir(), base) |
||||||
|
} |
||||||
|
if xdg := os.Getenv("XDG_CACHE_HOME"); xdg != "" { |
||||||
|
return filepath.Join(xdg, base) |
||||||
|
} |
||||||
|
return filepath.Join(homeDir(), ".cache", base) |
||||||
|
} |
||||||
@ -0,0 +1,141 @@ |
|||||||
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package autocert |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"crypto" |
||||||
|
"sync" |
||||||
|
"time" |
||||||
|
) |
||||||
|
|
||||||
|
// renewJitter is the maximum deviation from Manager.RenewBefore.
|
||||||
|
const renewJitter = time.Hour |
||||||
|
|
||||||
|
// domainRenewal tracks the state used by the periodic timers
|
||||||
|
// renewing a single domain's cert.
|
||||||
|
type domainRenewal struct { |
||||||
|
m *Manager |
||||||
|
domain string |
||||||
|
key crypto.Signer |
||||||
|
|
||||||
|
timerMu sync.Mutex |
||||||
|
timer *time.Timer |
||||||
|
} |
||||||
|
|
||||||
|
// start starts a cert renewal timer at the time
|
||||||
|
// defined by the certificate expiration time exp.
|
||||||
|
//
|
||||||
|
// If the timer is already started, calling start is a noop.
|
||||||
|
func (dr *domainRenewal) start(exp time.Time) { |
||||||
|
dr.timerMu.Lock() |
||||||
|
defer dr.timerMu.Unlock() |
||||||
|
if dr.timer != nil { |
||||||
|
return |
||||||
|
} |
||||||
|
dr.timer = time.AfterFunc(dr.next(exp), dr.renew) |
||||||
|
} |
||||||
|
|
||||||
|
// stop stops the cert renewal timer.
|
||||||
|
// If the timer is already stopped, calling stop is a noop.
|
||||||
|
func (dr *domainRenewal) stop() { |
||||||
|
dr.timerMu.Lock() |
||||||
|
defer dr.timerMu.Unlock() |
||||||
|
if dr.timer == nil { |
||||||
|
return |
||||||
|
} |
||||||
|
dr.timer.Stop() |
||||||
|
dr.timer = nil |
||||||
|
} |
||||||
|
|
||||||
|
// renew is called periodically by a timer.
|
||||||
|
// The first renew call is kicked off by dr.start.
|
||||||
|
func (dr *domainRenewal) renew() { |
||||||
|
dr.timerMu.Lock() |
||||||
|
defer dr.timerMu.Unlock() |
||||||
|
if dr.timer == nil { |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute) |
||||||
|
defer cancel() |
||||||
|
// TODO: rotate dr.key at some point?
|
||||||
|
next, err := dr.do(ctx) |
||||||
|
if err != nil { |
||||||
|
next = renewJitter / 2 |
||||||
|
next += time.Duration(pseudoRand.int63n(int64(next))) |
||||||
|
} |
||||||
|
dr.timer = time.AfterFunc(next, dr.renew) |
||||||
|
testDidRenewLoop(next, err) |
||||||
|
} |
||||||
|
|
||||||
|
// updateState locks and replaces the relevant Manager.state item with the given
|
||||||
|
// state. It additionally updates dr.key with the given state's key.
|
||||||
|
func (dr *domainRenewal) updateState(state *certState) { |
||||||
|
dr.m.stateMu.Lock() |
||||||
|
defer dr.m.stateMu.Unlock() |
||||||
|
dr.key = state.key |
||||||
|
dr.m.state[dr.domain] = state |
||||||
|
} |
||||||
|
|
||||||
|
// do is similar to Manager.createCert but it doesn't lock a Manager.state item.
|
||||||
|
// Instead, it requests a new certificate independently and, upon success,
|
||||||
|
// replaces dr.m.state item with a new one and updates cache for the given domain.
|
||||||
|
//
|
||||||
|
// It may lock and update the Manager.state if the expiration date of the currently
|
||||||
|
// cached cert is far enough in the future.
|
||||||
|
//
|
||||||
|
// The returned value is a time interval after which the renewal should occur again.
|
||||||
|
func (dr *domainRenewal) do(ctx context.Context) (time.Duration, error) { |
||||||
|
// a race is likely unavoidable in a distributed environment
|
||||||
|
// but we try nonetheless
|
||||||
|
if tlscert, err := dr.m.cacheGet(ctx, dr.domain); err == nil { |
||||||
|
next := dr.next(tlscert.Leaf.NotAfter) |
||||||
|
if next > dr.m.renewBefore()+renewJitter { |
||||||
|
signer, ok := tlscert.PrivateKey.(crypto.Signer) |
||||||
|
if ok { |
||||||
|
state := &certState{ |
||||||
|
key: signer, |
||||||
|
cert: tlscert.Certificate, |
||||||
|
leaf: tlscert.Leaf, |
||||||
|
} |
||||||
|
dr.updateState(state) |
||||||
|
return next, nil |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
der, leaf, err := dr.m.authorizedCert(ctx, dr.key, dr.domain) |
||||||
|
if err != nil { |
||||||
|
return 0, err |
||||||
|
} |
||||||
|
state := &certState{ |
||||||
|
key: dr.key, |
||||||
|
cert: der, |
||||||
|
leaf: leaf, |
||||||
|
} |
||||||
|
tlscert, err := state.tlscert() |
||||||
|
if err != nil { |
||||||
|
return 0, err |
||||||
|
} |
||||||
|
if err := dr.m.cachePut(ctx, dr.domain, tlscert); err != nil { |
||||||
|
return 0, err |
||||||
|
} |
||||||
|
dr.updateState(state) |
||||||
|
return dr.next(leaf.NotAfter), nil |
||||||
|
} |
||||||
|
|
||||||
|
func (dr *domainRenewal) next(expiry time.Time) time.Duration { |
||||||
|
d := expiry.Sub(timeNow()) - dr.m.renewBefore() |
||||||
|
// add a bit of randomness to renew deadline
|
||||||
|
n := pseudoRand.int63n(int64(renewJitter)) |
||||||
|
d -= time.Duration(n) |
||||||
|
if d < 0 { |
||||||
|
return 0 |
||||||
|
} |
||||||
|
return d |
||||||
|
} |
||||||
|
|
||||||
|
var testDidRenewLoop = func(next time.Duration, err error) {} |
||||||
@ -0,0 +1,153 @@ |
|||||||
|
// Copyright 2015 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package acme |
||||||
|
|
||||||
|
import ( |
||||||
|
"crypto" |
||||||
|
"crypto/ecdsa" |
||||||
|
"crypto/rand" |
||||||
|
"crypto/rsa" |
||||||
|
"crypto/sha256" |
||||||
|
_ "crypto/sha512" // need for EC keys
|
||||||
|
"encoding/base64" |
||||||
|
"encoding/json" |
||||||
|
"fmt" |
||||||
|
"math/big" |
||||||
|
) |
||||||
|
|
||||||
|
// jwsEncodeJSON signs claimset using provided key and a nonce.
|
||||||
|
// The result is serialized in JSON format.
|
||||||
|
// See https://tools.ietf.org/html/rfc7515#section-7.
|
||||||
|
func jwsEncodeJSON(claimset interface{}, key crypto.Signer, nonce string) ([]byte, error) { |
||||||
|
jwk, err := jwkEncode(key.Public()) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
alg, sha := jwsHasher(key) |
||||||
|
if alg == "" || !sha.Available() { |
||||||
|
return nil, ErrUnsupportedKey |
||||||
|
} |
||||||
|
phead := fmt.Sprintf(`{"alg":%q,"jwk":%s,"nonce":%q}`, alg, jwk, nonce) |
||||||
|
phead = base64.RawURLEncoding.EncodeToString([]byte(phead)) |
||||||
|
cs, err := json.Marshal(claimset) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
payload := base64.RawURLEncoding.EncodeToString(cs) |
||||||
|
hash := sha.New() |
||||||
|
hash.Write([]byte(phead + "." + payload)) |
||||||
|
sig, err := jwsSign(key, sha, hash.Sum(nil)) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
enc := struct { |
||||||
|
Protected string `json:"protected"` |
||||||
|
Payload string `json:"payload"` |
||||||
|
Sig string `json:"signature"` |
||||||
|
}{ |
||||||
|
Protected: phead, |
||||||
|
Payload: payload, |
||||||
|
Sig: base64.RawURLEncoding.EncodeToString(sig), |
||||||
|
} |
||||||
|
return json.Marshal(&enc) |
||||||
|
} |
||||||
|
|
||||||
|
// jwkEncode encodes public part of an RSA or ECDSA key into a JWK.
|
||||||
|
// The result is also suitable for creating a JWK thumbprint.
|
||||||
|
// https://tools.ietf.org/html/rfc7517
|
||||||
|
func jwkEncode(pub crypto.PublicKey) (string, error) { |
||||||
|
switch pub := pub.(type) { |
||||||
|
case *rsa.PublicKey: |
||||||
|
// https://tools.ietf.org/html/rfc7518#section-6.3.1
|
||||||
|
n := pub.N |
||||||
|
e := big.NewInt(int64(pub.E)) |
||||||
|
// Field order is important.
|
||||||
|
// See https://tools.ietf.org/html/rfc7638#section-3.3 for details.
|
||||||
|
return fmt.Sprintf(`{"e":"%s","kty":"RSA","n":"%s"}`, |
||||||
|
base64.RawURLEncoding.EncodeToString(e.Bytes()), |
||||||
|
base64.RawURLEncoding.EncodeToString(n.Bytes()), |
||||||
|
), nil |
||||||
|
case *ecdsa.PublicKey: |
||||||
|
// https://tools.ietf.org/html/rfc7518#section-6.2.1
|
||||||
|
p := pub.Curve.Params() |
||||||
|
n := p.BitSize / 8 |
||||||
|
if p.BitSize%8 != 0 { |
||||||
|
n++ |
||||||
|
} |
||||||
|
x := pub.X.Bytes() |
||||||
|
if n > len(x) { |
||||||
|
x = append(make([]byte, n-len(x)), x...) |
||||||
|
} |
||||||
|
y := pub.Y.Bytes() |
||||||
|
if n > len(y) { |
||||||
|
y = append(make([]byte, n-len(y)), y...) |
||||||
|
} |
||||||
|
// Field order is important.
|
||||||
|
// See https://tools.ietf.org/html/rfc7638#section-3.3 for details.
|
||||||
|
return fmt.Sprintf(`{"crv":"%s","kty":"EC","x":"%s","y":"%s"}`, |
||||||
|
p.Name, |
||||||
|
base64.RawURLEncoding.EncodeToString(x), |
||||||
|
base64.RawURLEncoding.EncodeToString(y), |
||||||
|
), nil |
||||||
|
} |
||||||
|
return "", ErrUnsupportedKey |
||||||
|
} |
||||||
|
|
||||||
|
// jwsSign signs the digest using the given key.
|
||||||
|
// It returns ErrUnsupportedKey if the key type is unknown.
|
||||||
|
// The hash is used only for RSA keys.
|
||||||
|
func jwsSign(key crypto.Signer, hash crypto.Hash, digest []byte) ([]byte, error) { |
||||||
|
switch key := key.(type) { |
||||||
|
case *rsa.PrivateKey: |
||||||
|
return key.Sign(rand.Reader, digest, hash) |
||||||
|
case *ecdsa.PrivateKey: |
||||||
|
r, s, err := ecdsa.Sign(rand.Reader, key, digest) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
rb, sb := r.Bytes(), s.Bytes() |
||||||
|
size := key.Params().BitSize / 8 |
||||||
|
if size%8 > 0 { |
||||||
|
size++ |
||||||
|
} |
||||||
|
sig := make([]byte, size*2) |
||||||
|
copy(sig[size-len(rb):], rb) |
||||||
|
copy(sig[size*2-len(sb):], sb) |
||||||
|
return sig, nil |
||||||
|
} |
||||||
|
return nil, ErrUnsupportedKey |
||||||
|
} |
||||||
|
|
||||||
|
// jwsHasher indicates suitable JWS algorithm name and a hash function
|
||||||
|
// to use for signing a digest with the provided key.
|
||||||
|
// It returns ("", 0) if the key is not supported.
|
||||||
|
func jwsHasher(key crypto.Signer) (string, crypto.Hash) { |
||||||
|
switch key := key.(type) { |
||||||
|
case *rsa.PrivateKey: |
||||||
|
return "RS256", crypto.SHA256 |
||||||
|
case *ecdsa.PrivateKey: |
||||||
|
switch key.Params().Name { |
||||||
|
case "P-256": |
||||||
|
return "ES256", crypto.SHA256 |
||||||
|
case "P-384": |
||||||
|
return "ES384", crypto.SHA384 |
||||||
|
case "P-521": |
||||||
|
return "ES512", crypto.SHA512 |
||||||
|
} |
||||||
|
} |
||||||
|
return "", 0 |
||||||
|
} |
||||||
|
|
||||||
|
// JWKThumbprint creates a JWK thumbprint out of pub
|
||||||
|
// as specified in https://tools.ietf.org/html/rfc7638.
|
||||||
|
func JWKThumbprint(pub crypto.PublicKey) (string, error) { |
||||||
|
jwk, err := jwkEncode(pub) |
||||||
|
if err != nil { |
||||||
|
return "", err |
||||||
|
} |
||||||
|
b := sha256.Sum256([]byte(jwk)) |
||||||
|
return base64.RawURLEncoding.EncodeToString(b[:]), nil |
||||||
|
} |
||||||
@ -0,0 +1,329 @@ |
|||||||
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package acme |
||||||
|
|
||||||
|
import ( |
||||||
|
"crypto" |
||||||
|
"crypto/x509" |
||||||
|
"errors" |
||||||
|
"fmt" |
||||||
|
"net/http" |
||||||
|
"strings" |
||||||
|
"time" |
||||||
|
) |
||||||
|
|
||||||
|
// ACME server response statuses used to describe Authorization and Challenge states.
|
||||||
|
const ( |
||||||
|
StatusUnknown = "unknown" |
||||||
|
StatusPending = "pending" |
||||||
|
StatusProcessing = "processing" |
||||||
|
StatusValid = "valid" |
||||||
|
StatusInvalid = "invalid" |
||||||
|
StatusRevoked = "revoked" |
||||||
|
) |
||||||
|
|
||||||
|
// CRLReasonCode identifies the reason for a certificate revocation.
|
||||||
|
type CRLReasonCode int |
||||||
|
|
||||||
|
// CRL reason codes as defined in RFC 5280.
|
||||||
|
const ( |
||||||
|
CRLReasonUnspecified CRLReasonCode = 0 |
||||||
|
CRLReasonKeyCompromise CRLReasonCode = 1 |
||||||
|
CRLReasonCACompromise CRLReasonCode = 2 |
||||||
|
CRLReasonAffiliationChanged CRLReasonCode = 3 |
||||||
|
CRLReasonSuperseded CRLReasonCode = 4 |
||||||
|
CRLReasonCessationOfOperation CRLReasonCode = 5 |
||||||
|
CRLReasonCertificateHold CRLReasonCode = 6 |
||||||
|
CRLReasonRemoveFromCRL CRLReasonCode = 8 |
||||||
|
CRLReasonPrivilegeWithdrawn CRLReasonCode = 9 |
||||||
|
CRLReasonAACompromise CRLReasonCode = 10 |
||||||
|
) |
||||||
|
|
||||||
|
// ErrUnsupportedKey is returned when an unsupported key type is encountered.
|
||||||
|
var ErrUnsupportedKey = errors.New("acme: unknown key type; only RSA and ECDSA are supported") |
||||||
|
|
||||||
|
// Error is an ACME error, defined in Problem Details for HTTP APIs doc
|
||||||
|
// http://tools.ietf.org/html/draft-ietf-appsawg-http-problem.
|
||||||
|
type Error struct { |
||||||
|
// StatusCode is The HTTP status code generated by the origin server.
|
||||||
|
StatusCode int |
||||||
|
// ProblemType is a URI reference that identifies the problem type,
|
||||||
|
// typically in a "urn:acme:error:xxx" form.
|
||||||
|
ProblemType string |
||||||
|
// Detail is a human-readable explanation specific to this occurrence of the problem.
|
||||||
|
Detail string |
||||||
|
// Header is the original server error response headers.
|
||||||
|
// It may be nil.
|
||||||
|
Header http.Header |
||||||
|
} |
||||||
|
|
||||||
|
func (e *Error) Error() string { |
||||||
|
return fmt.Sprintf("%d %s: %s", e.StatusCode, e.ProblemType, e.Detail) |
||||||
|
} |
||||||
|
|
||||||
|
// AuthorizationError indicates that an authorization for an identifier
|
||||||
|
// did not succeed.
|
||||||
|
// It contains all errors from Challenge items of the failed Authorization.
|
||||||
|
type AuthorizationError struct { |
||||||
|
// URI uniquely identifies the failed Authorization.
|
||||||
|
URI string |
||||||
|
|
||||||
|
// Identifier is an AuthzID.Value of the failed Authorization.
|
||||||
|
Identifier string |
||||||
|
|
||||||
|
// Errors is a collection of non-nil error values of Challenge items
|
||||||
|
// of the failed Authorization.
|
||||||
|
Errors []error |
||||||
|
} |
||||||
|
|
||||||
|
func (a *AuthorizationError) Error() string { |
||||||
|
e := make([]string, len(a.Errors)) |
||||||
|
for i, err := range a.Errors { |
||||||
|
e[i] = err.Error() |
||||||
|
} |
||||||
|
return fmt.Sprintf("acme: authorization error for %s: %s", a.Identifier, strings.Join(e, "; ")) |
||||||
|
} |
||||||
|
|
||||||
|
// RateLimit reports whether err represents a rate limit error and
|
||||||
|
// any Retry-After duration returned by the server.
|
||||||
|
//
|
||||||
|
// See the following for more details on rate limiting:
|
||||||
|
// https://tools.ietf.org/html/draft-ietf-acme-acme-05#section-5.6
|
||||||
|
func RateLimit(err error) (time.Duration, bool) { |
||||||
|
e, ok := err.(*Error) |
||||||
|
if !ok { |
||||||
|
return 0, false |
||||||
|
} |
||||||
|
// Some CA implementations may return incorrect values.
|
||||||
|
// Use case-insensitive comparison.
|
||||||
|
if !strings.HasSuffix(strings.ToLower(e.ProblemType), ":ratelimited") { |
||||||
|
return 0, false |
||||||
|
} |
||||||
|
if e.Header == nil { |
||||||
|
return 0, true |
||||||
|
} |
||||||
|
return retryAfter(e.Header.Get("Retry-After"), 0), true |
||||||
|
} |
||||||
|
|
||||||
|
// Account is a user account. It is associated with a private key.
|
||||||
|
type Account struct { |
||||||
|
// URI is the account unique ID, which is also a URL used to retrieve
|
||||||
|
// account data from the CA.
|
||||||
|
URI string |
||||||
|
|
||||||
|
// Contact is a slice of contact info used during registration.
|
||||||
|
Contact []string |
||||||
|
|
||||||
|
// The terms user has agreed to.
|
||||||
|
// A value not matching CurrentTerms indicates that the user hasn't agreed
|
||||||
|
// to the actual Terms of Service of the CA.
|
||||||
|
AgreedTerms string |
||||||
|
|
||||||
|
// Actual terms of a CA.
|
||||||
|
CurrentTerms string |
||||||
|
|
||||||
|
// Authz is the authorization URL used to initiate a new authz flow.
|
||||||
|
Authz string |
||||||
|
|
||||||
|
// Authorizations is a URI from which a list of authorizations
|
||||||
|
// granted to this account can be fetched via a GET request.
|
||||||
|
Authorizations string |
||||||
|
|
||||||
|
// Certificates is a URI from which a list of certificates
|
||||||
|
// issued for this account can be fetched via a GET request.
|
||||||
|
Certificates string |
||||||
|
} |
||||||
|
|
||||||
|
// Directory is ACME server discovery data.
|
||||||
|
type Directory struct { |
||||||
|
// RegURL is an account endpoint URL, allowing for creating new
|
||||||
|
// and modifying existing accounts.
|
||||||
|
RegURL string |
||||||
|
|
||||||
|
// AuthzURL is used to initiate Identifier Authorization flow.
|
||||||
|
AuthzURL string |
||||||
|
|
||||||
|
// CertURL is a new certificate issuance endpoint URL.
|
||||||
|
CertURL string |
||||||
|
|
||||||
|
// RevokeURL is used to initiate a certificate revocation flow.
|
||||||
|
RevokeURL string |
||||||
|
|
||||||
|
// Term is a URI identifying the current terms of service.
|
||||||
|
Terms string |
||||||
|
|
||||||
|
// Website is an HTTP or HTTPS URL locating a website
|
||||||
|
// providing more information about the ACME server.
|
||||||
|
Website string |
||||||
|
|
||||||
|
// CAA consists of lowercase hostname elements, which the ACME server
|
||||||
|
// recognises as referring to itself for the purposes of CAA record validation
|
||||||
|
// as defined in RFC6844.
|
||||||
|
CAA []string |
||||||
|
} |
||||||
|
|
||||||
|
// Challenge encodes a returned CA challenge.
|
||||||
|
// Its Error field may be non-nil if the challenge is part of an Authorization
|
||||||
|
// with StatusInvalid.
|
||||||
|
type Challenge struct { |
||||||
|
// Type is the challenge type, e.g. "http-01", "tls-sni-02", "dns-01".
|
||||||
|
Type string |
||||||
|
|
||||||
|
// URI is where a challenge response can be posted to.
|
||||||
|
URI string |
||||||
|
|
||||||
|
// Token is a random value that uniquely identifies the challenge.
|
||||||
|
Token string |
||||||
|
|
||||||
|
// Status identifies the status of this challenge.
|
||||||
|
Status string |
||||||
|
|
||||||
|
// Error indicates the reason for an authorization failure
|
||||||
|
// when this challenge was used.
|
||||||
|
// The type of a non-nil value is *Error.
|
||||||
|
Error error |
||||||
|
} |
||||||
|
|
||||||
|
// Authorization encodes an authorization response.
|
||||||
|
type Authorization struct { |
||||||
|
// URI uniquely identifies a authorization.
|
||||||
|
URI string |
||||||
|
|
||||||
|
// Status identifies the status of an authorization.
|
||||||
|
Status string |
||||||
|
|
||||||
|
// Identifier is what the account is authorized to represent.
|
||||||
|
Identifier AuthzID |
||||||
|
|
||||||
|
// Challenges that the client needs to fulfill in order to prove possession
|
||||||
|
// of the identifier (for pending authorizations).
|
||||||
|
// For final authorizations, the challenges that were used.
|
||||||
|
Challenges []*Challenge |
||||||
|
|
||||||
|
// A collection of sets of challenges, each of which would be sufficient
|
||||||
|
// to prove possession of the identifier.
|
||||||
|
// Clients must complete a set of challenges that covers at least one set.
|
||||||
|
// Challenges are identified by their indices in the challenges array.
|
||||||
|
// If this field is empty, the client needs to complete all challenges.
|
||||||
|
Combinations [][]int |
||||||
|
} |
||||||
|
|
||||||
|
// AuthzID is an identifier that an account is authorized to represent.
|
||||||
|
type AuthzID struct { |
||||||
|
Type string // The type of identifier, e.g. "dns".
|
||||||
|
Value string // The identifier itself, e.g. "example.org".
|
||||||
|
} |
||||||
|
|
||||||
|
// wireAuthz is ACME JSON representation of Authorization objects.
|
||||||
|
type wireAuthz struct { |
||||||
|
Status string |
||||||
|
Challenges []wireChallenge |
||||||
|
Combinations [][]int |
||||||
|
Identifier struct { |
||||||
|
Type string |
||||||
|
Value string |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func (z *wireAuthz) authorization(uri string) *Authorization { |
||||||
|
a := &Authorization{ |
||||||
|
URI: uri, |
||||||
|
Status: z.Status, |
||||||
|
Identifier: AuthzID{Type: z.Identifier.Type, Value: z.Identifier.Value}, |
||||||
|
Combinations: z.Combinations, // shallow copy
|
||||||
|
Challenges: make([]*Challenge, len(z.Challenges)), |
||||||
|
} |
||||||
|
for i, v := range z.Challenges { |
||||||
|
a.Challenges[i] = v.challenge() |
||||||
|
} |
||||||
|
return a |
||||||
|
} |
||||||
|
|
||||||
|
func (z *wireAuthz) error(uri string) *AuthorizationError { |
||||||
|
err := &AuthorizationError{ |
||||||
|
URI: uri, |
||||||
|
Identifier: z.Identifier.Value, |
||||||
|
} |
||||||
|
for _, raw := range z.Challenges { |
||||||
|
if raw.Error != nil { |
||||||
|
err.Errors = append(err.Errors, raw.Error.error(nil)) |
||||||
|
} |
||||||
|
} |
||||||
|
return err |
||||||
|
} |
||||||
|
|
||||||
|
// wireChallenge is ACME JSON challenge representation.
|
||||||
|
type wireChallenge struct { |
||||||
|
URI string `json:"uri"` |
||||||
|
Type string |
||||||
|
Token string |
||||||
|
Status string |
||||||
|
Error *wireError |
||||||
|
} |
||||||
|
|
||||||
|
func (c *wireChallenge) challenge() *Challenge { |
||||||
|
v := &Challenge{ |
||||||
|
URI: c.URI, |
||||||
|
Type: c.Type, |
||||||
|
Token: c.Token, |
||||||
|
Status: c.Status, |
||||||
|
} |
||||||
|
if v.Status == "" { |
||||||
|
v.Status = StatusPending |
||||||
|
} |
||||||
|
if c.Error != nil { |
||||||
|
v.Error = c.Error.error(nil) |
||||||
|
} |
||||||
|
return v |
||||||
|
} |
||||||
|
|
||||||
|
// wireError is a subset of fields of the Problem Details object
|
||||||
|
// as described in https://tools.ietf.org/html/rfc7807#section-3.1.
|
||||||
|
type wireError struct { |
||||||
|
Status int |
||||||
|
Type string |
||||||
|
Detail string |
||||||
|
} |
||||||
|
|
||||||
|
func (e *wireError) error(h http.Header) *Error { |
||||||
|
return &Error{ |
||||||
|
StatusCode: e.Status, |
||||||
|
ProblemType: e.Type, |
||||||
|
Detail: e.Detail, |
||||||
|
Header: h, |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// CertOption is an optional argument type for the TLSSNIxChallengeCert methods for
|
||||||
|
// customizing a temporary certificate for TLS-SNI challenges.
|
||||||
|
type CertOption interface { |
||||||
|
privateCertOpt() |
||||||
|
} |
||||||
|
|
||||||
|
// WithKey creates an option holding a private/public key pair.
|
||||||
|
// The private part signs a certificate, and the public part represents the signee.
|
||||||
|
func WithKey(key crypto.Signer) CertOption { |
||||||
|
return &certOptKey{key} |
||||||
|
} |
||||||
|
|
||||||
|
type certOptKey struct { |
||||||
|
key crypto.Signer |
||||||
|
} |
||||||
|
|
||||||
|
func (*certOptKey) privateCertOpt() {} |
||||||
|
|
||||||
|
// WithTemplate creates an option for specifying a certificate template.
|
||||||
|
// See x509.CreateCertificate for template usage details.
|
||||||
|
//
|
||||||
|
// In TLSSNIxChallengeCert methods, the template is also used as parent,
|
||||||
|
// resulting in a self-signed certificate.
|
||||||
|
// The DNSNames field of t is always overwritten for tls-sni challenge certs.
|
||||||
|
func WithTemplate(t *x509.Certificate) CertOption { |
||||||
|
return (*certOptTemplate)(t) |
||||||
|
} |
||||||
|
|
||||||
|
type certOptTemplate x509.Certificate |
||||||
|
|
||||||
|
func (*certOptTemplate) privateCertOpt() {} |
||||||
@ -0,0 +1,223 @@ |
|||||||
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// Package ChaCha20 implements the core ChaCha20 function as specified
|
||||||
|
// in https://tools.ietf.org/html/rfc7539#section-2.3.
|
||||||
|
package chacha20 |
||||||
|
|
||||||
|
import ( |
||||||
|
"crypto/cipher" |
||||||
|
"encoding/binary" |
||||||
|
) |
||||||
|
|
||||||
|
// assert that *Cipher implements cipher.Stream
|
||||||
|
var _ cipher.Stream = (*Cipher)(nil) |
||||||
|
|
||||||
|
// Cipher is a stateful instance of ChaCha20 using a particular key
|
||||||
|
// and nonce. A *Cipher implements the cipher.Stream interface.
|
||||||
|
type Cipher struct { |
||||||
|
key [8]uint32 |
||||||
|
nonce [3]uint32 |
||||||
|
counter uint32 // incremented after each block
|
||||||
|
buf [64]byte // buffer for unused keystream bytes
|
||||||
|
len int // number of unused keystream bytes at end of buf
|
||||||
|
} |
||||||
|
|
||||||
|
// New creates a new ChaCha20 stream cipher with the given key and nonce.
|
||||||
|
// The initial counter value is set to 0.
|
||||||
|
func New(key [8]uint32, nonce [3]uint32) *Cipher { |
||||||
|
return &Cipher{key: key, nonce: nonce} |
||||||
|
} |
||||||
|
|
||||||
|
// XORKeyStream XORs each byte in the given slice with a byte from the
|
||||||
|
// cipher's key stream. Dst and src must overlap entirely or not at all.
|
||||||
|
//
|
||||||
|
// If len(dst) < len(src), XORKeyStream will panic. It is acceptable
|
||||||
|
// to pass a dst bigger than src, and in that case, XORKeyStream will
|
||||||
|
// only update dst[:len(src)] and will not touch the rest of dst.
|
||||||
|
//
|
||||||
|
// Multiple calls to XORKeyStream behave as if the concatenation of
|
||||||
|
// the src buffers was passed in a single run. That is, Cipher
|
||||||
|
// maintains state and does not reset at each XORKeyStream call.
|
||||||
|
func (s *Cipher) XORKeyStream(dst, src []byte) { |
||||||
|
// xor src with buffered keystream first
|
||||||
|
if s.len != 0 { |
||||||
|
buf := s.buf[len(s.buf)-s.len:] |
||||||
|
if len(src) < len(buf) { |
||||||
|
buf = buf[:len(src)] |
||||||
|
} |
||||||
|
td, ts := dst[:len(buf)], src[:len(buf)] // BCE hint
|
||||||
|
for i, b := range buf { |
||||||
|
td[i] = ts[i] ^ b |
||||||
|
} |
||||||
|
s.len -= len(buf) |
||||||
|
if s.len != 0 { |
||||||
|
return |
||||||
|
} |
||||||
|
s.buf = [len(s.buf)]byte{} // zero the empty buffer
|
||||||
|
src = src[len(buf):] |
||||||
|
dst = dst[len(buf):] |
||||||
|
} |
||||||
|
|
||||||
|
if len(src) == 0 { |
||||||
|
return |
||||||
|
} |
||||||
|
|
||||||
|
// set up a 64-byte buffer to pad out the final block if needed
|
||||||
|
// (hoisted out of the main loop to avoid spills)
|
||||||
|
rem := len(src) % 64 // length of final block
|
||||||
|
fin := len(src) - rem // index of final block
|
||||||
|
if rem > 0 { |
||||||
|
copy(s.buf[len(s.buf)-64:], src[fin:]) |
||||||
|
} |
||||||
|
|
||||||
|
// qr calculates a quarter round
|
||||||
|
qr := func(a, b, c, d uint32) (uint32, uint32, uint32, uint32) { |
||||||
|
a += b |
||||||
|
d ^= a |
||||||
|
d = (d << 16) | (d >> 16) |
||||||
|
c += d |
||||||
|
b ^= c |
||||||
|
b = (b << 12) | (b >> 20) |
||||||
|
a += b |
||||||
|
d ^= a |
||||||
|
d = (d << 8) | (d >> 24) |
||||||
|
c += d |
||||||
|
b ^= c |
||||||
|
b = (b << 7) | (b >> 25) |
||||||
|
return a, b, c, d |
||||||
|
} |
||||||
|
|
||||||
|
// ChaCha20 constants
|
||||||
|
const ( |
||||||
|
j0 = 0x61707865 |
||||||
|
j1 = 0x3320646e |
||||||
|
j2 = 0x79622d32 |
||||||
|
j3 = 0x6b206574 |
||||||
|
) |
||||||
|
|
||||||
|
// pre-calculate most of the first round
|
||||||
|
s1, s5, s9, s13 := qr(j1, s.key[1], s.key[5], s.nonce[0]) |
||||||
|
s2, s6, s10, s14 := qr(j2, s.key[2], s.key[6], s.nonce[1]) |
||||||
|
s3, s7, s11, s15 := qr(j3, s.key[3], s.key[7], s.nonce[2]) |
||||||
|
|
||||||
|
n := len(src) |
||||||
|
src, dst = src[:n:n], dst[:n:n] // BCE hint
|
||||||
|
for i := 0; i < n; i += 64 { |
||||||
|
// calculate the remainder of the first round
|
||||||
|
s0, s4, s8, s12 := qr(j0, s.key[0], s.key[4], s.counter) |
||||||
|
|
||||||
|
// execute the second round
|
||||||
|
x0, x5, x10, x15 := qr(s0, s5, s10, s15) |
||||||
|
x1, x6, x11, x12 := qr(s1, s6, s11, s12) |
||||||
|
x2, x7, x8, x13 := qr(s2, s7, s8, s13) |
||||||
|
x3, x4, x9, x14 := qr(s3, s4, s9, s14) |
||||||
|
|
||||||
|
// execute the remaining 18 rounds
|
||||||
|
for i := 0; i < 9; i++ { |
||||||
|
x0, x4, x8, x12 = qr(x0, x4, x8, x12) |
||||||
|
x1, x5, x9, x13 = qr(x1, x5, x9, x13) |
||||||
|
x2, x6, x10, x14 = qr(x2, x6, x10, x14) |
||||||
|
x3, x7, x11, x15 = qr(x3, x7, x11, x15) |
||||||
|
|
||||||
|
x0, x5, x10, x15 = qr(x0, x5, x10, x15) |
||||||
|
x1, x6, x11, x12 = qr(x1, x6, x11, x12) |
||||||
|
x2, x7, x8, x13 = qr(x2, x7, x8, x13) |
||||||
|
x3, x4, x9, x14 = qr(x3, x4, x9, x14) |
||||||
|
} |
||||||
|
|
||||||
|
x0 += j0 |
||||||
|
x1 += j1 |
||||||
|
x2 += j2 |
||||||
|
x3 += j3 |
||||||
|
|
||||||
|
x4 += s.key[0] |
||||||
|
x5 += s.key[1] |
||||||
|
x6 += s.key[2] |
||||||
|
x7 += s.key[3] |
||||||
|
x8 += s.key[4] |
||||||
|
x9 += s.key[5] |
||||||
|
x10 += s.key[6] |
||||||
|
x11 += s.key[7] |
||||||
|
|
||||||
|
x12 += s.counter |
||||||
|
x13 += s.nonce[0] |
||||||
|
x14 += s.nonce[1] |
||||||
|
x15 += s.nonce[2] |
||||||
|
|
||||||
|
// increment the counter
|
||||||
|
s.counter += 1 |
||||||
|
if s.counter == 0 { |
||||||
|
panic("chacha20: counter overflow") |
||||||
|
} |
||||||
|
|
||||||
|
// pad to 64 bytes if needed
|
||||||
|
in, out := src[i:], dst[i:] |
||||||
|
if i == fin { |
||||||
|
// src[fin:] has already been copied into s.buf before
|
||||||
|
// the main loop
|
||||||
|
in, out = s.buf[len(s.buf)-64:], s.buf[len(s.buf)-64:] |
||||||
|
} |
||||||
|
in, out = in[:64], out[:64] // BCE hint
|
||||||
|
|
||||||
|
// XOR the key stream with the source and write out the result
|
||||||
|
xor(out[0:], in[0:], x0) |
||||||
|
xor(out[4:], in[4:], x1) |
||||||
|
xor(out[8:], in[8:], x2) |
||||||
|
xor(out[12:], in[12:], x3) |
||||||
|
xor(out[16:], in[16:], x4) |
||||||
|
xor(out[20:], in[20:], x5) |
||||||
|
xor(out[24:], in[24:], x6) |
||||||
|
xor(out[28:], in[28:], x7) |
||||||
|
xor(out[32:], in[32:], x8) |
||||||
|
xor(out[36:], in[36:], x9) |
||||||
|
xor(out[40:], in[40:], x10) |
||||||
|
xor(out[44:], in[44:], x11) |
||||||
|
xor(out[48:], in[48:], x12) |
||||||
|
xor(out[52:], in[52:], x13) |
||||||
|
xor(out[56:], in[56:], x14) |
||||||
|
xor(out[60:], in[60:], x15) |
||||||
|
} |
||||||
|
// copy any trailing bytes out of the buffer and into dst
|
||||||
|
if rem != 0 { |
||||||
|
s.len = 64 - rem |
||||||
|
copy(dst[fin:], s.buf[len(s.buf)-64:]) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// Advance discards bytes in the key stream until the next 64 byte block
|
||||||
|
// boundary is reached and updates the counter accordingly. If the key
|
||||||
|
// stream is already at a block boundary no bytes will be discarded and
|
||||||
|
// the counter will be unchanged.
|
||||||
|
func (s *Cipher) Advance() { |
||||||
|
s.len -= s.len % 64 |
||||||
|
if s.len == 0 { |
||||||
|
s.buf = [len(s.buf)]byte{} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// XORKeyStream crypts bytes from in to out using the given key and counters.
|
||||||
|
// In and out must overlap entirely or not at all. Counter contains the raw
|
||||||
|
// ChaCha20 counter bytes (i.e. block counter followed by nonce).
|
||||||
|
func XORKeyStream(out, in []byte, counter *[16]byte, key *[32]byte) { |
||||||
|
s := Cipher{ |
||||||
|
key: [8]uint32{ |
||||||
|
binary.LittleEndian.Uint32(key[0:4]), |
||||||
|
binary.LittleEndian.Uint32(key[4:8]), |
||||||
|
binary.LittleEndian.Uint32(key[8:12]), |
||||||
|
binary.LittleEndian.Uint32(key[12:16]), |
||||||
|
binary.LittleEndian.Uint32(key[16:20]), |
||||||
|
binary.LittleEndian.Uint32(key[20:24]), |
||||||
|
binary.LittleEndian.Uint32(key[24:28]), |
||||||
|
binary.LittleEndian.Uint32(key[28:32]), |
||||||
|
}, |
||||||
|
nonce: [3]uint32{ |
||||||
|
binary.LittleEndian.Uint32(counter[4:8]), |
||||||
|
binary.LittleEndian.Uint32(counter[8:12]), |
||||||
|
binary.LittleEndian.Uint32(counter[12:16]), |
||||||
|
}, |
||||||
|
counter: binary.LittleEndian.Uint32(counter[0:4]), |
||||||
|
} |
||||||
|
s.XORKeyStream(out, in) |
||||||
|
} |
||||||
@ -0,0 +1,43 @@ |
|||||||
|
// Copyright 2018 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found src the LICENSE file.
|
||||||
|
|
||||||
|
package chacha20 |
||||||
|
|
||||||
|
import ( |
||||||
|
"runtime" |
||||||
|
) |
||||||
|
|
||||||
|
// Platforms that have fast unaligned 32-bit little endian accesses.
|
||||||
|
const unaligned = runtime.GOARCH == "386" || |
||||||
|
runtime.GOARCH == "amd64" || |
||||||
|
runtime.GOARCH == "arm64" || |
||||||
|
runtime.GOARCH == "ppc64le" || |
||||||
|
runtime.GOARCH == "s390x" |
||||||
|
|
||||||
|
// xor reads a little endian uint32 from src, XORs it with u and
|
||||||
|
// places the result in little endian byte order in dst.
|
||||||
|
func xor(dst, src []byte, u uint32) { |
||||||
|
_, _ = src[3], dst[3] // eliminate bounds checks
|
||||||
|
if unaligned { |
||||||
|
// The compiler should optimize this code into
|
||||||
|
// 32-bit unaligned little endian loads and stores.
|
||||||
|
// TODO: delete once the compiler does a reliably
|
||||||
|
// good job with the generic code below.
|
||||||
|
// See issue #25111 for more details.
|
||||||
|
v := uint32(src[0]) |
||||||
|
v |= uint32(src[1]) << 8 |
||||||
|
v |= uint32(src[2]) << 16 |
||||||
|
v |= uint32(src[3]) << 24 |
||||||
|
v ^= u |
||||||
|
dst[0] = byte(v) |
||||||
|
dst[1] = byte(v >> 8) |
||||||
|
dst[2] = byte(v >> 16) |
||||||
|
dst[3] = byte(v >> 24) |
||||||
|
} else { |
||||||
|
dst[0] = src[0] ^ byte(u) |
||||||
|
dst[1] = src[1] ^ byte(u>>8) |
||||||
|
dst[2] = src[2] ^ byte(u>>16) |
||||||
|
dst[3] = src[3] ^ byte(u>>24) |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,33 @@ |
|||||||
|
// Copyright 2012 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
/* |
||||||
|
Package poly1305 implements Poly1305 one-time message authentication code as |
||||||
|
specified in https://cr.yp.to/mac/poly1305-20050329.pdf.
|
||||||
|
|
||||||
|
Poly1305 is a fast, one-time authentication function. It is infeasible for an |
||||||
|
attacker to generate an authenticator for a message without the key. However, a |
||||||
|
key must only be used for a single message. Authenticating two different |
||||||
|
messages with the same key allows an attacker to forge authenticators for other |
||||||
|
messages with the same key. |
||||||
|
|
||||||
|
Poly1305 was originally coupled with AES in order to make Poly1305-AES. AES was |
||||||
|
used with a fixed key in order to generate one-time keys from an nonce. |
||||||
|
However, in this package AES isn't used and the one-time key is specified |
||||||
|
directly. |
||||||
|
*/ |
||||||
|
package poly1305 // import "golang.org/x/crypto/poly1305"
|
||||||
|
|
||||||
|
import "crypto/subtle" |
||||||
|
|
||||||
|
// TagSize is the size, in bytes, of a poly1305 authenticator.
|
||||||
|
const TagSize = 16 |
||||||
|
|
||||||
|
// Verify returns true if mac is a valid authenticator for m with the given
|
||||||
|
// key.
|
||||||
|
func Verify(mac *[16]byte, m []byte, key *[32]byte) bool { |
||||||
|
var tmp [16]byte |
||||||
|
Sum(&tmp, m, key) |
||||||
|
return subtle.ConstantTimeCompare(tmp[:], mac[:]) == 1 |
||||||
|
} |
||||||
@ -0,0 +1,22 @@ |
|||||||
|
// Copyright 2012 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// +build amd64,!gccgo,!appengine
|
||||||
|
|
||||||
|
package poly1305 |
||||||
|
|
||||||
|
// This function is implemented in sum_amd64.s
|
||||||
|
//go:noescape
|
||||||
|
func poly1305(out *[16]byte, m *byte, mlen uint64, key *[32]byte) |
||||||
|
|
||||||
|
// Sum generates an authenticator for m using a one-time key and puts the
|
||||||
|
// 16-byte result into out. Authenticating two different messages with the same
|
||||||
|
// key allows an attacker to forge messages at will.
|
||||||
|
func Sum(out *[16]byte, m []byte, key *[32]byte) { |
||||||
|
var mPtr *byte |
||||||
|
if len(m) > 0 { |
||||||
|
mPtr = &m[0] |
||||||
|
} |
||||||
|
poly1305(out, mPtr, uint64(len(m)), key) |
||||||
|
} |
||||||
@ -0,0 +1,125 @@ |
|||||||
|
// Copyright 2012 The Go Authors. All rights reserved. |
||||||
|
// Use of this source code is governed by a BSD-style |
||||||
|
// license that can be found in the LICENSE file. |
||||||
|
|
||||||
|
// +build amd64,!gccgo,!appengine |
||||||
|
|
||||||
|
#include "textflag.h" |
||||||
|
|
||||||
|
#define POLY1305_ADD(msg, h0, h1, h2) \ |
||||||
|
ADDQ 0(msg), h0; \
|
||||||
|
ADCQ 8(msg), h1; \
|
||||||
|
ADCQ $1, h2; \
|
||||||
|
LEAQ 16(msg), msg |
||||||
|
|
||||||
|
#define POLY1305_MUL(h0, h1, h2, r0, r1, t0, t1, t2, t3) \ |
||||||
|
MOVQ r0, AX; \
|
||||||
|
MULQ h0; \
|
||||||
|
MOVQ AX, t0; \
|
||||||
|
MOVQ DX, t1; \
|
||||||
|
MOVQ r0, AX; \
|
||||||
|
MULQ h1; \
|
||||||
|
ADDQ AX, t1; \
|
||||||
|
ADCQ $0, DX; \
|
||||||
|
MOVQ r0, t2; \
|
||||||
|
IMULQ h2, t2; \
|
||||||
|
ADDQ DX, t2; \
|
||||||
|
\ |
||||||
|
MOVQ r1, AX; \
|
||||||
|
MULQ h0; \
|
||||||
|
ADDQ AX, t1; \
|
||||||
|
ADCQ $0, DX; \
|
||||||
|
MOVQ DX, h0; \
|
||||||
|
MOVQ r1, t3; \
|
||||||
|
IMULQ h2, t3; \
|
||||||
|
MOVQ r1, AX; \
|
||||||
|
MULQ h1; \
|
||||||
|
ADDQ AX, t2; \
|
||||||
|
ADCQ DX, t3; \
|
||||||
|
ADDQ h0, t2; \
|
||||||
|
ADCQ $0, t3; \
|
||||||
|
\ |
||||||
|
MOVQ t0, h0; \
|
||||||
|
MOVQ t1, h1; \
|
||||||
|
MOVQ t2, h2; \
|
||||||
|
ANDQ $3, h2; \
|
||||||
|
MOVQ t2, t0; \
|
||||||
|
ANDQ $0xFFFFFFFFFFFFFFFC, t0; \
|
||||||
|
ADDQ t0, h0; \
|
||||||
|
ADCQ t3, h1; \
|
||||||
|
ADCQ $0, h2; \
|
||||||
|
SHRQ $2, t3, t2; \
|
||||||
|
SHRQ $2, t3; \
|
||||||
|
ADDQ t2, h0; \
|
||||||
|
ADCQ t3, h1; \
|
||||||
|
ADCQ $0, h2 |
||||||
|
|
||||||
|
DATA ·poly1305Mask<>+0x00(SB)/8, $0x0FFFFFFC0FFFFFFF |
||||||
|
DATA ·poly1305Mask<>+0x08(SB)/8, $0x0FFFFFFC0FFFFFFC |
||||||
|
GLOBL ·poly1305Mask<>(SB), RODATA, $16 |
||||||
|
|
||||||
|
// func poly1305(out *[16]byte, m *byte, mlen uint64, key *[32]key) |
||||||
|
TEXT ·poly1305(SB), $0-32 |
||||||
|
MOVQ out+0(FP), DI |
||||||
|
MOVQ m+8(FP), SI |
||||||
|
MOVQ mlen+16(FP), R15 |
||||||
|
MOVQ key+24(FP), AX |
||||||
|
|
||||||
|
MOVQ 0(AX), R11 |
||||||
|
MOVQ 8(AX), R12 |
||||||
|
ANDQ ·poly1305Mask<>(SB), R11 // r0 |
||||||
|
ANDQ ·poly1305Mask<>+8(SB), R12 // r1 |
||||||
|
XORQ R8, R8 // h0 |
||||||
|
XORQ R9, R9 // h1 |
||||||
|
XORQ R10, R10 // h2 |
||||||
|
|
||||||
|
CMPQ R15, $16 |
||||||
|
JB bytes_between_0_and_15 |
||||||
|
|
||||||
|
loop: |
||||||
|
POLY1305_ADD(SI, R8, R9, R10) |
||||||
|
|
||||||
|
multiply: |
||||||
|
POLY1305_MUL(R8, R9, R10, R11, R12, BX, CX, R13, R14) |
||||||
|
SUBQ $16, R15 |
||||||
|
CMPQ R15, $16 |
||||||
|
JAE loop |
||||||
|
|
||||||
|
bytes_between_0_and_15: |
||||||
|
TESTQ R15, R15 |
||||||
|
JZ done |
||||||
|
MOVQ $1, BX |
||||||
|
XORQ CX, CX |
||||||
|
XORQ R13, R13 |
||||||
|
ADDQ R15, SI |
||||||
|
|
||||||
|
flush_buffer: |
||||||
|
SHLQ $8, BX, CX |
||||||
|
SHLQ $8, BX |
||||||
|
MOVB -1(SI), R13 |
||||||
|
XORQ R13, BX |
||||||
|
DECQ SI |
||||||
|
DECQ R15 |
||||||
|
JNZ flush_buffer |
||||||
|
|
||||||
|
ADDQ BX, R8 |
||||||
|
ADCQ CX, R9 |
||||||
|
ADCQ $0, R10 |
||||||
|
MOVQ $16, R15 |
||||||
|
JMP multiply |
||||||
|
|
||||||
|
done: |
||||||
|
MOVQ R8, AX |
||||||
|
MOVQ R9, BX |
||||||
|
SUBQ $0xFFFFFFFFFFFFFFFB, AX |
||||||
|
SBBQ $0xFFFFFFFFFFFFFFFF, BX |
||||||
|
SBBQ $3, R10 |
||||||
|
CMOVQCS R8, AX |
||||||
|
CMOVQCS R9, BX |
||||||
|
MOVQ key+24(FP), R8 |
||||||
|
ADDQ 16(R8), AX |
||||||
|
ADCQ 24(R8), BX |
||||||
|
|
||||||
|
MOVQ AX, 0(DI) |
||||||
|
MOVQ BX, 8(DI) |
||||||
|
RET |
||||||
@ -0,0 +1,22 @@ |
|||||||
|
// Copyright 2015 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// +build arm,!gccgo,!appengine,!nacl
|
||||||
|
|
||||||
|
package poly1305 |
||||||
|
|
||||||
|
// This function is implemented in sum_arm.s
|
||||||
|
//go:noescape
|
||||||
|
func poly1305_auth_armv6(out *[16]byte, m *byte, mlen uint32, key *[32]byte) |
||||||
|
|
||||||
|
// Sum generates an authenticator for m using a one-time key and puts the
|
||||||
|
// 16-byte result into out. Authenticating two different messages with the same
|
||||||
|
// key allows an attacker to forge messages at will.
|
||||||
|
func Sum(out *[16]byte, m []byte, key *[32]byte) { |
||||||
|
var mPtr *byte |
||||||
|
if len(m) > 0 { |
||||||
|
mPtr = &m[0] |
||||||
|
} |
||||||
|
poly1305_auth_armv6(out, mPtr, uint32(len(m)), key) |
||||||
|
} |
||||||
@ -0,0 +1,427 @@ |
|||||||
|
// Copyright 2015 The Go Authors. All rights reserved. |
||||||
|
// Use of this source code is governed by a BSD-style |
||||||
|
// license that can be found in the LICENSE file. |
||||||
|
|
||||||
|
// +build arm,!gccgo,!appengine,!nacl |
||||||
|
|
||||||
|
#include "textflag.h" |
||||||
|
|
||||||
|
// This code was translated into a form compatible with 5a from the public |
||||||
|
// domain source by Andrew Moon: github.com/floodyberry/poly1305-opt/blob/master/app/extensions/poly1305. |
||||||
|
|
||||||
|
DATA ·poly1305_init_constants_armv6<>+0x00(SB)/4, $0x3ffffff |
||||||
|
DATA ·poly1305_init_constants_armv6<>+0x04(SB)/4, $0x3ffff03 |
||||||
|
DATA ·poly1305_init_constants_armv6<>+0x08(SB)/4, $0x3ffc0ff |
||||||
|
DATA ·poly1305_init_constants_armv6<>+0x0c(SB)/4, $0x3f03fff |
||||||
|
DATA ·poly1305_init_constants_armv6<>+0x10(SB)/4, $0x00fffff |
||||||
|
GLOBL ·poly1305_init_constants_armv6<>(SB), 8, $20 |
||||||
|
|
||||||
|
// Warning: the linker may use R11 to synthesize certain instructions. Please |
||||||
|
// take care and verify that no synthetic instructions use it. |
||||||
|
|
||||||
|
TEXT poly1305_init_ext_armv6<>(SB), NOSPLIT, $0 |
||||||
|
// Needs 16 bytes of stack and 64 bytes of space pointed to by R0. (It |
||||||
|
// might look like it's only 60 bytes of space but the final four bytes |
||||||
|
// will be written by another function.) We need to skip over four |
||||||
|
// bytes of stack because that's saving the value of 'g'. |
||||||
|
ADD $4, R13, R8 |
||||||
|
MOVM.IB [R4-R7], (R8) |
||||||
|
MOVM.IA.W (R1), [R2-R5] |
||||||
|
MOVW $·poly1305_init_constants_armv6<>(SB), R7 |
||||||
|
MOVW R2, R8 |
||||||
|
MOVW R2>>26, R9 |
||||||
|
MOVW R3>>20, g |
||||||
|
MOVW R4>>14, R11 |
||||||
|
MOVW R5>>8, R12 |
||||||
|
ORR R3<<6, R9, R9 |
||||||
|
ORR R4<<12, g, g |
||||||
|
ORR R5<<18, R11, R11 |
||||||
|
MOVM.IA (R7), [R2-R6] |
||||||
|
AND R8, R2, R2 |
||||||
|
AND R9, R3, R3 |
||||||
|
AND g, R4, R4 |
||||||
|
AND R11, R5, R5 |
||||||
|
AND R12, R6, R6 |
||||||
|
MOVM.IA.W [R2-R6], (R0) |
||||||
|
EOR R2, R2, R2 |
||||||
|
EOR R3, R3, R3 |
||||||
|
EOR R4, R4, R4 |
||||||
|
EOR R5, R5, R5 |
||||||
|
EOR R6, R6, R6 |
||||||
|
MOVM.IA.W [R2-R6], (R0) |
||||||
|
MOVM.IA.W (R1), [R2-R5] |
||||||
|
MOVM.IA [R2-R6], (R0) |
||||||
|
ADD $20, R13, R0 |
||||||
|
MOVM.DA (R0), [R4-R7] |
||||||
|
RET |
||||||
|
|
||||||
|
#define MOVW_UNALIGNED(Rsrc, Rdst, Rtmp, offset) \ |
||||||
|
MOVBU (offset+0)(Rsrc), Rtmp; \
|
||||||
|
MOVBU Rtmp, (offset+0)(Rdst); \
|
||||||
|
MOVBU (offset+1)(Rsrc), Rtmp; \
|
||||||
|
MOVBU Rtmp, (offset+1)(Rdst); \
|
||||||
|
MOVBU (offset+2)(Rsrc), Rtmp; \
|
||||||
|
MOVBU Rtmp, (offset+2)(Rdst); \
|
||||||
|
MOVBU (offset+3)(Rsrc), Rtmp; \
|
||||||
|
MOVBU Rtmp, (offset+3)(Rdst) |
||||||
|
|
||||||
|
TEXT poly1305_blocks_armv6<>(SB), NOSPLIT, $0 |
||||||
|
// Needs 24 bytes of stack for saved registers and then 88 bytes of |
||||||
|
// scratch space after that. We assume that 24 bytes at (R13) have |
||||||
|
// already been used: four bytes for the link register saved in the |
||||||
|
// prelude of poly1305_auth_armv6, four bytes for saving the value of g |
||||||
|
// in that function and 16 bytes of scratch space used around |
||||||
|
// poly1305_finish_ext_armv6_skip1. |
||||||
|
ADD $24, R13, R12 |
||||||
|
MOVM.IB [R4-R8, R14], (R12) |
||||||
|
MOVW R0, 88(R13) |
||||||
|
MOVW R1, 92(R13) |
||||||
|
MOVW R2, 96(R13) |
||||||
|
MOVW R1, R14 |
||||||
|
MOVW R2, R12 |
||||||
|
MOVW 56(R0), R8 |
||||||
|
WORD $0xe1180008 // TST R8, R8 not working see issue 5921 |
||||||
|
EOR R6, R6, R6 |
||||||
|
MOVW.EQ $(1<<24), R6 |
||||||
|
MOVW R6, 84(R13) |
||||||
|
ADD $116, R13, g |
||||||
|
MOVM.IA (R0), [R0-R9] |
||||||
|
MOVM.IA [R0-R4], (g) |
||||||
|
CMP $16, R12 |
||||||
|
BLO poly1305_blocks_armv6_done |
||||||
|
|
||||||
|
poly1305_blocks_armv6_mainloop: |
||||||
|
WORD $0xe31e0003 // TST R14, #3 not working see issue 5921 |
||||||
|
BEQ poly1305_blocks_armv6_mainloop_aligned |
||||||
|
ADD $100, R13, g |
||||||
|
MOVW_UNALIGNED(R14, g, R0, 0) |
||||||
|
MOVW_UNALIGNED(R14, g, R0, 4) |
||||||
|
MOVW_UNALIGNED(R14, g, R0, 8) |
||||||
|
MOVW_UNALIGNED(R14, g, R0, 12) |
||||||
|
MOVM.IA (g), [R0-R3] |
||||||
|
ADD $16, R14 |
||||||
|
B poly1305_blocks_armv6_mainloop_loaded |
||||||
|
|
||||||
|
poly1305_blocks_armv6_mainloop_aligned: |
||||||
|
MOVM.IA.W (R14), [R0-R3] |
||||||
|
|
||||||
|
poly1305_blocks_armv6_mainloop_loaded: |
||||||
|
MOVW R0>>26, g |
||||||
|
MOVW R1>>20, R11 |
||||||
|
MOVW R2>>14, R12 |
||||||
|
MOVW R14, 92(R13) |
||||||
|
MOVW R3>>8, R4 |
||||||
|
ORR R1<<6, g, g |
||||||
|
ORR R2<<12, R11, R11 |
||||||
|
ORR R3<<18, R12, R12 |
||||||
|
BIC $0xfc000000, R0, R0 |
||||||
|
BIC $0xfc000000, g, g |
||||||
|
MOVW 84(R13), R3 |
||||||
|
BIC $0xfc000000, R11, R11 |
||||||
|
BIC $0xfc000000, R12, R12 |
||||||
|
ADD R0, R5, R5 |
||||||
|
ADD g, R6, R6 |
||||||
|
ORR R3, R4, R4 |
||||||
|
ADD R11, R7, R7 |
||||||
|
ADD $116, R13, R14 |
||||||
|
ADD R12, R8, R8 |
||||||
|
ADD R4, R9, R9 |
||||||
|
MOVM.IA (R14), [R0-R4] |
||||||
|
MULLU R4, R5, (R11, g) |
||||||
|
MULLU R3, R5, (R14, R12) |
||||||
|
MULALU R3, R6, (R11, g) |
||||||
|
MULALU R2, R6, (R14, R12) |
||||||
|
MULALU R2, R7, (R11, g) |
||||||
|
MULALU R1, R7, (R14, R12) |
||||||
|
ADD R4<<2, R4, R4 |
||||||
|
ADD R3<<2, R3, R3 |
||||||
|
MULALU R1, R8, (R11, g) |
||||||
|
MULALU R0, R8, (R14, R12) |
||||||
|
MULALU R0, R9, (R11, g) |
||||||
|
MULALU R4, R9, (R14, R12) |
||||||
|
MOVW g, 76(R13) |
||||||
|
MOVW R11, 80(R13) |
||||||
|
MOVW R12, 68(R13) |
||||||
|
MOVW R14, 72(R13) |
||||||
|
MULLU R2, R5, (R11, g) |
||||||
|
MULLU R1, R5, (R14, R12) |
||||||
|
MULALU R1, R6, (R11, g) |
||||||
|
MULALU R0, R6, (R14, R12) |
||||||
|
MULALU R0, R7, (R11, g) |
||||||
|
MULALU R4, R7, (R14, R12) |
||||||
|
ADD R2<<2, R2, R2 |
||||||
|
ADD R1<<2, R1, R1 |
||||||
|
MULALU R4, R8, (R11, g) |
||||||
|
MULALU R3, R8, (R14, R12) |
||||||
|
MULALU R3, R9, (R11, g) |
||||||
|
MULALU R2, R9, (R14, R12) |
||||||
|
MOVW g, 60(R13) |
||||||
|
MOVW R11, 64(R13) |
||||||
|
MOVW R12, 52(R13) |
||||||
|
MOVW R14, 56(R13) |
||||||
|
MULLU R0, R5, (R11, g) |
||||||
|
MULALU R4, R6, (R11, g) |
||||||
|
MULALU R3, R7, (R11, g) |
||||||
|
MULALU R2, R8, (R11, g) |
||||||
|
MULALU R1, R9, (R11, g) |
||||||
|
ADD $52, R13, R0 |
||||||
|
MOVM.IA (R0), [R0-R7] |
||||||
|
MOVW g>>26, R12 |
||||||
|
MOVW R4>>26, R14 |
||||||
|
ORR R11<<6, R12, R12 |
||||||
|
ORR R5<<6, R14, R14 |
||||||
|
BIC $0xfc000000, g, g |
||||||
|
BIC $0xfc000000, R4, R4 |
||||||
|
ADD.S R12, R0, R0 |
||||||
|
ADC $0, R1, R1 |
||||||
|
ADD.S R14, R6, R6 |
||||||
|
ADC $0, R7, R7 |
||||||
|
MOVW R0>>26, R12 |
||||||
|
MOVW R6>>26, R14 |
||||||
|
ORR R1<<6, R12, R12 |
||||||
|
ORR R7<<6, R14, R14 |
||||||
|
BIC $0xfc000000, R0, R0 |
||||||
|
BIC $0xfc000000, R6, R6 |
||||||
|
ADD R14<<2, R14, R14 |
||||||
|
ADD.S R12, R2, R2 |
||||||
|
ADC $0, R3, R3 |
||||||
|
ADD R14, g, g |
||||||
|
MOVW R2>>26, R12 |
||||||
|
MOVW g>>26, R14 |
||||||
|
ORR R3<<6, R12, R12 |
||||||
|
BIC $0xfc000000, g, R5 |
||||||
|
BIC $0xfc000000, R2, R7 |
||||||
|
ADD R12, R4, R4 |
||||||
|
ADD R14, R0, R0 |
||||||
|
MOVW R4>>26, R12 |
||||||
|
BIC $0xfc000000, R4, R8 |
||||||
|
ADD R12, R6, R9 |
||||||
|
MOVW 96(R13), R12 |
||||||
|
MOVW 92(R13), R14 |
||||||
|
MOVW R0, R6 |
||||||
|
CMP $32, R12 |
||||||
|
SUB $16, R12, R12 |
||||||
|
MOVW R12, 96(R13) |
||||||
|
BHS poly1305_blocks_armv6_mainloop |
||||||
|
|
||||||
|
poly1305_blocks_armv6_done: |
||||||
|
MOVW 88(R13), R12 |
||||||
|
MOVW R5, 20(R12) |
||||||
|
MOVW R6, 24(R12) |
||||||
|
MOVW R7, 28(R12) |
||||||
|
MOVW R8, 32(R12) |
||||||
|
MOVW R9, 36(R12) |
||||||
|
ADD $48, R13, R0 |
||||||
|
MOVM.DA (R0), [R4-R8, R14] |
||||||
|
RET |
||||||
|
|
||||||
|
#define MOVHUP_UNALIGNED(Rsrc, Rdst, Rtmp) \ |
||||||
|
MOVBU.P 1(Rsrc), Rtmp; \
|
||||||
|
MOVBU.P Rtmp, 1(Rdst); \
|
||||||
|
MOVBU.P 1(Rsrc), Rtmp; \
|
||||||
|
MOVBU.P Rtmp, 1(Rdst) |
||||||
|
|
||||||
|
#define MOVWP_UNALIGNED(Rsrc, Rdst, Rtmp) \ |
||||||
|
MOVHUP_UNALIGNED(Rsrc, Rdst, Rtmp); \
|
||||||
|
MOVHUP_UNALIGNED(Rsrc, Rdst, Rtmp) |
||||||
|
|
||||||
|
// func poly1305_auth_armv6(out *[16]byte, m *byte, mlen uint32, key *[32]key) |
||||||
|
TEXT ·poly1305_auth_armv6(SB), $196-16 |
||||||
|
// The value 196, just above, is the sum of 64 (the size of the context |
||||||
|
// structure) and 132 (the amount of stack needed). |
||||||
|
// |
||||||
|
// At this point, the stack pointer (R13) has been moved down. It |
||||||
|
// points to the saved link register and there's 196 bytes of free |
||||||
|
// space above it. |
||||||
|
// |
||||||
|
// The stack for this function looks like: |
||||||
|
// |
||||||
|
// +--------------------- |
||||||
|
// | |
||||||
|
// | 64 bytes of context structure |
||||||
|
// | |
||||||
|
// +--------------------- |
||||||
|
// | |
||||||
|
// | 112 bytes for poly1305_blocks_armv6 |
||||||
|
// | |
||||||
|
// +--------------------- |
||||||
|
// | 16 bytes of final block, constructed at |
||||||
|
// | poly1305_finish_ext_armv6_skip8 |
||||||
|
// +--------------------- |
||||||
|
// | four bytes of saved 'g' |
||||||
|
// +--------------------- |
||||||
|
// | lr, saved by prelude <- R13 points here |
||||||
|
// +--------------------- |
||||||
|
MOVW g, 4(R13) |
||||||
|
|
||||||
|
MOVW out+0(FP), R4 |
||||||
|
MOVW m+4(FP), R5 |
||||||
|
MOVW mlen+8(FP), R6 |
||||||
|
MOVW key+12(FP), R7 |
||||||
|
|
||||||
|
ADD $136, R13, R0 // 136 = 4 + 4 + 16 + 112 |
||||||
|
MOVW R7, R1 |
||||||
|
|
||||||
|
// poly1305_init_ext_armv6 will write to the stack from R13+4, but |
||||||
|
// that's ok because none of the other values have been written yet. |
||||||
|
BL poly1305_init_ext_armv6<>(SB) |
||||||
|
BIC.S $15, R6, R2 |
||||||
|
BEQ poly1305_auth_armv6_noblocks |
||||||
|
ADD $136, R13, R0 |
||||||
|
MOVW R5, R1 |
||||||
|
ADD R2, R5, R5 |
||||||
|
SUB R2, R6, R6 |
||||||
|
BL poly1305_blocks_armv6<>(SB) |
||||||
|
|
||||||
|
poly1305_auth_armv6_noblocks: |
||||||
|
ADD $136, R13, R0 |
||||||
|
MOVW R5, R1 |
||||||
|
MOVW R6, R2 |
||||||
|
MOVW R4, R3 |
||||||
|
|
||||||
|
MOVW R0, R5 |
||||||
|
MOVW R1, R6 |
||||||
|
MOVW R2, R7 |
||||||
|
MOVW R3, R8 |
||||||
|
AND.S R2, R2, R2 |
||||||
|
BEQ poly1305_finish_ext_armv6_noremaining |
||||||
|
EOR R0, R0 |
||||||
|
ADD $8, R13, R9 // 8 = offset to 16 byte scratch space |
||||||
|
MOVW R0, (R9) |
||||||
|
MOVW R0, 4(R9) |
||||||
|
MOVW R0, 8(R9) |
||||||
|
MOVW R0, 12(R9) |
||||||
|
WORD $0xe3110003 // TST R1, #3 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_aligned |
||||||
|
WORD $0xe3120008 // TST R2, #8 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip8 |
||||||
|
MOVWP_UNALIGNED(R1, R9, g) |
||||||
|
MOVWP_UNALIGNED(R1, R9, g) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip8: |
||||||
|
WORD $0xe3120004 // TST $4, R2 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip4 |
||||||
|
MOVWP_UNALIGNED(R1, R9, g) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip4: |
||||||
|
WORD $0xe3120002 // TST $2, R2 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip2 |
||||||
|
MOVHUP_UNALIGNED(R1, R9, g) |
||||||
|
B poly1305_finish_ext_armv6_skip2 |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_aligned: |
||||||
|
WORD $0xe3120008 // TST R2, #8 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip8_aligned |
||||||
|
MOVM.IA.W (R1), [g-R11] |
||||||
|
MOVM.IA.W [g-R11], (R9) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip8_aligned: |
||||||
|
WORD $0xe3120004 // TST $4, R2 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip4_aligned |
||||||
|
MOVW.P 4(R1), g |
||||||
|
MOVW.P g, 4(R9) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip4_aligned: |
||||||
|
WORD $0xe3120002 // TST $2, R2 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip2 |
||||||
|
MOVHU.P 2(R1), g |
||||||
|
MOVH.P g, 2(R9) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip2: |
||||||
|
WORD $0xe3120001 // TST $1, R2 not working see issue 5921 |
||||||
|
BEQ poly1305_finish_ext_armv6_skip1 |
||||||
|
MOVBU.P 1(R1), g |
||||||
|
MOVBU.P g, 1(R9) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_skip1: |
||||||
|
MOVW $1, R11 |
||||||
|
MOVBU R11, 0(R9) |
||||||
|
MOVW R11, 56(R5) |
||||||
|
MOVW R5, R0 |
||||||
|
ADD $8, R13, R1 |
||||||
|
MOVW $16, R2 |
||||||
|
BL poly1305_blocks_armv6<>(SB) |
||||||
|
|
||||||
|
poly1305_finish_ext_armv6_noremaining: |
||||||
|
MOVW 20(R5), R0 |
||||||
|
MOVW 24(R5), R1 |
||||||
|
MOVW 28(R5), R2 |
||||||
|
MOVW 32(R5), R3 |
||||||
|
MOVW 36(R5), R4 |
||||||
|
MOVW R4>>26, R12 |
||||||
|
BIC $0xfc000000, R4, R4 |
||||||
|
ADD R12<<2, R12, R12 |
||||||
|
ADD R12, R0, R0 |
||||||
|
MOVW R0>>26, R12 |
||||||
|
BIC $0xfc000000, R0, R0 |
||||||
|
ADD R12, R1, R1 |
||||||
|
MOVW R1>>26, R12 |
||||||
|
BIC $0xfc000000, R1, R1 |
||||||
|
ADD R12, R2, R2 |
||||||
|
MOVW R2>>26, R12 |
||||||
|
BIC $0xfc000000, R2, R2 |
||||||
|
ADD R12, R3, R3 |
||||||
|
MOVW R3>>26, R12 |
||||||
|
BIC $0xfc000000, R3, R3 |
||||||
|
ADD R12, R4, R4 |
||||||
|
ADD $5, R0, R6 |
||||||
|
MOVW R6>>26, R12 |
||||||
|
BIC $0xfc000000, R6, R6 |
||||||
|
ADD R12, R1, R7 |
||||||
|
MOVW R7>>26, R12 |
||||||
|
BIC $0xfc000000, R7, R7 |
||||||
|
ADD R12, R2, g |
||||||
|
MOVW g>>26, R12 |
||||||
|
BIC $0xfc000000, g, g |
||||||
|
ADD R12, R3, R11 |
||||||
|
MOVW $-(1<<26), R12 |
||||||
|
ADD R11>>26, R12, R12 |
||||||
|
BIC $0xfc000000, R11, R11 |
||||||
|
ADD R12, R4, R9 |
||||||
|
MOVW R9>>31, R12 |
||||||
|
SUB $1, R12 |
||||||
|
AND R12, R6, R6 |
||||||
|
AND R12, R7, R7 |
||||||
|
AND R12, g, g |
||||||
|
AND R12, R11, R11 |
||||||
|
AND R12, R9, R9 |
||||||
|
MVN R12, R12 |
||||||
|
AND R12, R0, R0 |
||||||
|
AND R12, R1, R1 |
||||||
|
AND R12, R2, R2 |
||||||
|
AND R12, R3, R3 |
||||||
|
AND R12, R4, R4 |
||||||
|
ORR R6, R0, R0 |
||||||
|
ORR R7, R1, R1 |
||||||
|
ORR g, R2, R2 |
||||||
|
ORR R11, R3, R3 |
||||||
|
ORR R9, R4, R4 |
||||||
|
ORR R1<<26, R0, R0 |
||||||
|
MOVW R1>>6, R1 |
||||||
|
ORR R2<<20, R1, R1 |
||||||
|
MOVW R2>>12, R2 |
||||||
|
ORR R3<<14, R2, R2 |
||||||
|
MOVW R3>>18, R3 |
||||||
|
ORR R4<<8, R3, R3 |
||||||
|
MOVW 40(R5), R6 |
||||||
|
MOVW 44(R5), R7 |
||||||
|
MOVW 48(R5), g |
||||||
|
MOVW 52(R5), R11 |
||||||
|
ADD.S R6, R0, R0 |
||||||
|
ADC.S R7, R1, R1 |
||||||
|
ADC.S g, R2, R2 |
||||||
|
ADC.S R11, R3, R3 |
||||||
|
MOVM.IA [R0-R3], (R8) |
||||||
|
MOVW R5, R12 |
||||||
|
EOR R0, R0, R0 |
||||||
|
EOR R1, R1, R1 |
||||||
|
EOR R2, R2, R2 |
||||||
|
EOR R3, R3, R3 |
||||||
|
EOR R4, R4, R4 |
||||||
|
EOR R5, R5, R5 |
||||||
|
EOR R6, R6, R6 |
||||||
|
EOR R7, R7, R7 |
||||||
|
MOVM.IA.W [R0-R7], (R12) |
||||||
|
MOVM.IA [R0-R7], (R12) |
||||||
|
MOVW 4(R13), g |
||||||
|
RET |
||||||
@ -0,0 +1,141 @@ |
|||||||
|
// Copyright 2012 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// +build !amd64,!arm gccgo appengine nacl
|
||||||
|
|
||||||
|
package poly1305 |
||||||
|
|
||||||
|
import "encoding/binary" |
||||||
|
|
||||||
|
// Sum generates an authenticator for msg using a one-time key and puts the
|
||||||
|
// 16-byte result into out. Authenticating two different messages with the same
|
||||||
|
// key allows an attacker to forge messages at will.
|
||||||
|
func Sum(out *[TagSize]byte, msg []byte, key *[32]byte) { |
||||||
|
var ( |
||||||
|
h0, h1, h2, h3, h4 uint32 // the hash accumulators
|
||||||
|
r0, r1, r2, r3, r4 uint64 // the r part of the key
|
||||||
|
) |
||||||
|
|
||||||
|
r0 = uint64(binary.LittleEndian.Uint32(key[0:]) & 0x3ffffff) |
||||||
|
r1 = uint64((binary.LittleEndian.Uint32(key[3:]) >> 2) & 0x3ffff03) |
||||||
|
r2 = uint64((binary.LittleEndian.Uint32(key[6:]) >> 4) & 0x3ffc0ff) |
||||||
|
r3 = uint64((binary.LittleEndian.Uint32(key[9:]) >> 6) & 0x3f03fff) |
||||||
|
r4 = uint64((binary.LittleEndian.Uint32(key[12:]) >> 8) & 0x00fffff) |
||||||
|
|
||||||
|
R1, R2, R3, R4 := r1*5, r2*5, r3*5, r4*5 |
||||||
|
|
||||||
|
for len(msg) >= TagSize { |
||||||
|
// h += msg
|
||||||
|
h0 += binary.LittleEndian.Uint32(msg[0:]) & 0x3ffffff |
||||||
|
h1 += (binary.LittleEndian.Uint32(msg[3:]) >> 2) & 0x3ffffff |
||||||
|
h2 += (binary.LittleEndian.Uint32(msg[6:]) >> 4) & 0x3ffffff |
||||||
|
h3 += (binary.LittleEndian.Uint32(msg[9:]) >> 6) & 0x3ffffff |
||||||
|
h4 += (binary.LittleEndian.Uint32(msg[12:]) >> 8) | (1 << 24) |
||||||
|
|
||||||
|
// h *= r
|
||||||
|
d0 := (uint64(h0) * r0) + (uint64(h1) * R4) + (uint64(h2) * R3) + (uint64(h3) * R2) + (uint64(h4) * R1) |
||||||
|
d1 := (d0 >> 26) + (uint64(h0) * r1) + (uint64(h1) * r0) + (uint64(h2) * R4) + (uint64(h3) * R3) + (uint64(h4) * R2) |
||||||
|
d2 := (d1 >> 26) + (uint64(h0) * r2) + (uint64(h1) * r1) + (uint64(h2) * r0) + (uint64(h3) * R4) + (uint64(h4) * R3) |
||||||
|
d3 := (d2 >> 26) + (uint64(h0) * r3) + (uint64(h1) * r2) + (uint64(h2) * r1) + (uint64(h3) * r0) + (uint64(h4) * R4) |
||||||
|
d4 := (d3 >> 26) + (uint64(h0) * r4) + (uint64(h1) * r3) + (uint64(h2) * r2) + (uint64(h3) * r1) + (uint64(h4) * r0) |
||||||
|
|
||||||
|
// h %= p
|
||||||
|
h0 = uint32(d0) & 0x3ffffff |
||||||
|
h1 = uint32(d1) & 0x3ffffff |
||||||
|
h2 = uint32(d2) & 0x3ffffff |
||||||
|
h3 = uint32(d3) & 0x3ffffff |
||||||
|
h4 = uint32(d4) & 0x3ffffff |
||||||
|
|
||||||
|
h0 += uint32(d4>>26) * 5 |
||||||
|
h1 += h0 >> 26 |
||||||
|
h0 = h0 & 0x3ffffff |
||||||
|
|
||||||
|
msg = msg[TagSize:] |
||||||
|
} |
||||||
|
|
||||||
|
if len(msg) > 0 { |
||||||
|
var block [TagSize]byte |
||||||
|
off := copy(block[:], msg) |
||||||
|
block[off] = 0x01 |
||||||
|
|
||||||
|
// h += msg
|
||||||
|
h0 += binary.LittleEndian.Uint32(block[0:]) & 0x3ffffff |
||||||
|
h1 += (binary.LittleEndian.Uint32(block[3:]) >> 2) & 0x3ffffff |
||||||
|
h2 += (binary.LittleEndian.Uint32(block[6:]) >> 4) & 0x3ffffff |
||||||
|
h3 += (binary.LittleEndian.Uint32(block[9:]) >> 6) & 0x3ffffff |
||||||
|
h4 += (binary.LittleEndian.Uint32(block[12:]) >> 8) |
||||||
|
|
||||||
|
// h *= r
|
||||||
|
d0 := (uint64(h0) * r0) + (uint64(h1) * R4) + (uint64(h2) * R3) + (uint64(h3) * R2) + (uint64(h4) * R1) |
||||||
|
d1 := (d0 >> 26) + (uint64(h0) * r1) + (uint64(h1) * r0) + (uint64(h2) * R4) + (uint64(h3) * R3) + (uint64(h4) * R2) |
||||||
|
d2 := (d1 >> 26) + (uint64(h0) * r2) + (uint64(h1) * r1) + (uint64(h2) * r0) + (uint64(h3) * R4) + (uint64(h4) * R3) |
||||||
|
d3 := (d2 >> 26) + (uint64(h0) * r3) + (uint64(h1) * r2) + (uint64(h2) * r1) + (uint64(h3) * r0) + (uint64(h4) * R4) |
||||||
|
d4 := (d3 >> 26) + (uint64(h0) * r4) + (uint64(h1) * r3) + (uint64(h2) * r2) + (uint64(h3) * r1) + (uint64(h4) * r0) |
||||||
|
|
||||||
|
// h %= p
|
||||||
|
h0 = uint32(d0) & 0x3ffffff |
||||||
|
h1 = uint32(d1) & 0x3ffffff |
||||||
|
h2 = uint32(d2) & 0x3ffffff |
||||||
|
h3 = uint32(d3) & 0x3ffffff |
||||||
|
h4 = uint32(d4) & 0x3ffffff |
||||||
|
|
||||||
|
h0 += uint32(d4>>26) * 5 |
||||||
|
h1 += h0 >> 26 |
||||||
|
h0 = h0 & 0x3ffffff |
||||||
|
} |
||||||
|
|
||||||
|
// h %= p reduction
|
||||||
|
h2 += h1 >> 26 |
||||||
|
h1 &= 0x3ffffff |
||||||
|
h3 += h2 >> 26 |
||||||
|
h2 &= 0x3ffffff |
||||||
|
h4 += h3 >> 26 |
||||||
|
h3 &= 0x3ffffff |
||||||
|
h0 += 5 * (h4 >> 26) |
||||||
|
h4 &= 0x3ffffff |
||||||
|
h1 += h0 >> 26 |
||||||
|
h0 &= 0x3ffffff |
||||||
|
|
||||||
|
// h - p
|
||||||
|
t0 := h0 + 5 |
||||||
|
t1 := h1 + (t0 >> 26) |
||||||
|
t2 := h2 + (t1 >> 26) |
||||||
|
t3 := h3 + (t2 >> 26) |
||||||
|
t4 := h4 + (t3 >> 26) - (1 << 26) |
||||||
|
t0 &= 0x3ffffff |
||||||
|
t1 &= 0x3ffffff |
||||||
|
t2 &= 0x3ffffff |
||||||
|
t3 &= 0x3ffffff |
||||||
|
|
||||||
|
// select h if h < p else h - p
|
||||||
|
t_mask := (t4 >> 31) - 1 |
||||||
|
h_mask := ^t_mask |
||||||
|
h0 = (h0 & h_mask) | (t0 & t_mask) |
||||||
|
h1 = (h1 & h_mask) | (t1 & t_mask) |
||||||
|
h2 = (h2 & h_mask) | (t2 & t_mask) |
||||||
|
h3 = (h3 & h_mask) | (t3 & t_mask) |
||||||
|
h4 = (h4 & h_mask) | (t4 & t_mask) |
||||||
|
|
||||||
|
// h %= 2^128
|
||||||
|
h0 |= h1 << 26 |
||||||
|
h1 = ((h1 >> 6) | (h2 << 20)) |
||||||
|
h2 = ((h2 >> 12) | (h3 << 14)) |
||||||
|
h3 = ((h3 >> 18) | (h4 << 8)) |
||||||
|
|
||||||
|
// s: the s part of the key
|
||||||
|
// tag = (h + s) % (2^128)
|
||||||
|
t := uint64(h0) + uint64(binary.LittleEndian.Uint32(key[16:])) |
||||||
|
h0 = uint32(t) |
||||||
|
t = uint64(h1) + uint64(binary.LittleEndian.Uint32(key[20:])) + (t >> 32) |
||||||
|
h1 = uint32(t) |
||||||
|
t = uint64(h2) + uint64(binary.LittleEndian.Uint32(key[24:])) + (t >> 32) |
||||||
|
h2 = uint32(t) |
||||||
|
t = uint64(h3) + uint64(binary.LittleEndian.Uint32(key[28:])) + (t >> 32) |
||||||
|
h3 = uint32(t) |
||||||
|
|
||||||
|
binary.LittleEndian.PutUint32(out[0:], h0) |
||||||
|
binary.LittleEndian.PutUint32(out[4:], h1) |
||||||
|
binary.LittleEndian.PutUint32(out[8:], h2) |
||||||
|
binary.LittleEndian.PutUint32(out[12:], h3) |
||||||
|
} |
||||||
Loading…
Reference in new issue