Fix SNI lock, update deps, ESM refactor
This commit is contained in:
Wildan M
parent
88662b49bc
commit
447b1b735d
13 changed files with 1204 additions and 1144 deletions
|
|
@ -1,5 +1,10 @@
|
|||
# CHANGES
|
||||
|
||||
## v2.4 (2023-04-21)
|
||||
|
||||
+ Fix global service lock when a website is verificating certs.
|
||||
+ Update code deps, refactor imports to ESM.
|
||||
|
||||
## v2.3 (2022-08-16)
|
||||
|
||||
+ Add stat API `s.forwarddomain.net`, separate node script.
|
||||
|
|
|
|||
12
app.js
12
app.js
|
|
@ -1,13 +1,13 @@
|
|||
import { config } from "dotenv";
|
||||
import https from "https";
|
||||
import app from "./index.js";
|
||||
import listener from "./src/client.js";
|
||||
import { SniPrepare, SniListener } from "./src/sni.js";
|
||||
// production endpoint (use pm2/phusion/whatever)
|
||||
config();
|
||||
|
||||
require('dotenv').config()
|
||||
const https = require("https");
|
||||
const app = require("./index.js");
|
||||
const listener = require("./src/client.js");
|
||||
const { SniPrepare, SniListener } = require("./src/sni.js");
|
||||
const port80 = parseInt(process.env.HTTP_PORT || "80");
|
||||
const port443 = parseInt(process.env.HTTPS_PORT || "443");
|
||||
|
||||
const main = async () => {
|
||||
await SniPrepare();
|
||||
const httpsServer = https.createServer({
|
||||
|
|
|
|||
20
index.js
20
index.js
|
|
@ -1,17 +1,17 @@
|
|||
import { config } from "dotenv";
|
||||
import http from "http";
|
||||
import listener from "./src/client.js";
|
||||
import { fileURLToPath } from "url";
|
||||
|
||||
// development endpoint (use ngrok)
|
||||
|
||||
require('dotenv').config()
|
||||
const http = require('http');
|
||||
const listener = require('./src/client');
|
||||
|
||||
|
||||
const server = http.createServer(listener);
|
||||
const port = parseInt(process.env.HTTP_PORT || "3000");
|
||||
|
||||
if (require.main === module) {
|
||||
if (process.argv[1] === fileURLToPath(import.meta.url)) {
|
||||
config();
|
||||
const port = parseInt(process.env.HTTP_PORT || "3000");
|
||||
server.listen(port, function () {
|
||||
console.log(`server start at port ${port}`);
|
||||
});
|
||||
} else {
|
||||
module.exports = server
|
||||
}
|
||||
|
||||
export default server;
|
||||
|
|
|
|||
935
package-lock.json
generated
935
package-lock.json
generated
File diff suppressed because it is too large
Load diff
19
package.json
19
package.json
|
|
@ -2,7 +2,11 @@
|
|||
"name": "forward-domain",
|
||||
"version": "1.0.0",
|
||||
"description": "Public service to forward domain for free",
|
||||
"main": "index.js",
|
||||
"main": "app.js",
|
||||
"type": "module",
|
||||
"engines": {
|
||||
"node": ">=16.0.0"
|
||||
},
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "pm2 start app.js",
|
||||
|
|
@ -13,13 +17,14 @@
|
|||
"author": "Wildan Mubarok",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"await-lock": "^2.1.0",
|
||||
"axios": "^0.21.1",
|
||||
"dotenv": "^16.0.1",
|
||||
"jose-node-cjs-runtime": "^3.12.2",
|
||||
"pem": "^1.14.4"
|
||||
"async-lock": "^1.4.0",
|
||||
"await-lock": "^2.2.2",
|
||||
"axios": "^1.3.6",
|
||||
"dotenv": "^16.0.3",
|
||||
"jose": "^3.20.4",
|
||||
"pem": "^1.14.7"
|
||||
},
|
||||
"devDependencies": {
|
||||
"pm2": "^5.1.1"
|
||||
"pm2": "^5.3.0"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,494 +1,388 @@
|
|||
const fs = require('fs')
|
||||
const path = require('path')
|
||||
const {
|
||||
promisify
|
||||
} = require('util')
|
||||
const {
|
||||
fromKeyLike
|
||||
} = require('jose-node-cjs-runtime/jwk/from_key_like')
|
||||
const {
|
||||
generateKeyPair
|
||||
} = require('jose-node-cjs-runtime/util/generate_key_pair')
|
||||
const {
|
||||
calculateThumbprint
|
||||
} = require('jose-node-cjs-runtime/jwk/thumbprint')
|
||||
const {
|
||||
SignJWT
|
||||
} = require('jose-node-cjs-runtime/jwt/sign')
|
||||
const {
|
||||
CompactSign
|
||||
} = require('jose-node-cjs-runtime/jws/compact/sign')
|
||||
const pem = require('pem')
|
||||
const common = require('./common')
|
||||
const request = require('./request')
|
||||
|
||||
const createCsr = promisify(pem.createCSR)
|
||||
|
||||
import fs from "fs";
|
||||
import path from "path";
|
||||
import { promisify } from "util";
|
||||
import fromKeyLike from "jose/jwk/from_key_like";
|
||||
import generateKeyPair from "jose/util/generate_key_pair";
|
||||
import calculateThumbprint from "jose/jwk/thumbprint";
|
||||
import SignJWT from "jose/jwt/sign";
|
||||
import CompactSign from "jose/jws/compact/sign";
|
||||
import pem from "pem";
|
||||
import * as common from "./common.js";
|
||||
import request from "./request.js";
|
||||
const createCsr = promisify(pem.createCSR);
|
||||
/**
|
||||
* Represents a Let's Encrypt account and
|
||||
* sends requests to get valid TLS certificates.
|
||||
*/
|
||||
class Client {
|
||||
/**
|
||||
* @param {String} [directoryUrl]
|
||||
*/
|
||||
constructor(directoryUrl = common.DIRECTORY_URL) {
|
||||
this.accountPrivateJwk = null
|
||||
/** @type {import('crypto').KeyObject} */
|
||||
this.accountPrivateKey = null
|
||||
this.accountPublicJwk = null
|
||||
/** @type {import('crypto').KeyObject} */
|
||||
this.accountPublicKey = null
|
||||
this.directoryUrl = directoryUrl
|
||||
this.challengeCallbacks = null
|
||||
this.hasDirectory = false
|
||||
this.myAccountUrl = ''
|
||||
this.newAccountUrl = ''
|
||||
this.newNonceUrl = ''
|
||||
this.newOrderUrl = ''
|
||||
this.replayNonce = ''
|
||||
this.thumbprint = ''
|
||||
}
|
||||
|
||||
/**
|
||||
* Export account public and private keys to a directory.
|
||||
*
|
||||
* @param {String} dirname - name of directory to write key files to
|
||||
* @param {String} [passphrase] - optional passphrase to encrypt private key with
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
exportAccountKeyPair(dirname, passphrase) {
|
||||
const privateKeyFile = path.join(dirname, 'privateKey.pem')
|
||||
const publicKeyFile = path.join(dirname, 'publicKey.pem')
|
||||
|
||||
return Promise.all([
|
||||
common.writeKeyToFile(privateKeyFile, this.accountPrivateKey, passphrase),
|
||||
common.writeKeyToFile(publicKeyFile, this.accountPublicKey)
|
||||
])
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate new account public and private keys.
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async generateAccountKeyPair() {
|
||||
const {
|
||||
privateKey,
|
||||
publicKey
|
||||
} = await generateKeyPair(common.ACCOUNT_KEY_ALGORITHM)
|
||||
|
||||
// @ts-ignore
|
||||
this.accountPrivateKey = privateKey
|
||||
// @ts-ignore
|
||||
this.accountPublicKey = publicKey
|
||||
|
||||
await this.initAccountJwks()
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a certificate from Let's Encrypt for your domain.
|
||||
*
|
||||
* @param {String} domain - the domain you want a certificate for
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async generateCertificate(domain) {
|
||||
await this.directory()
|
||||
await this.newNonce()
|
||||
if (!this.myAccountUrl)
|
||||
await this.newAccount()
|
||||
|
||||
const {
|
||||
authzUrls,
|
||||
finalizeUrl
|
||||
} = await this.newOrder(domain)
|
||||
const {
|
||||
challenge
|
||||
} = await this.authz(authzUrls[0])
|
||||
|
||||
await this.completeChallenge(challenge, domain)
|
||||
await this.pollAuthz(authzUrls[0])
|
||||
const {
|
||||
certificate,
|
||||
privateKeyData
|
||||
} = await this.finalizeOrder(finalizeUrl, domain)
|
||||
|
||||
return {
|
||||
certificate,
|
||||
privateKeyData
|
||||
/**
|
||||
* @param {String} [directoryUrl]
|
||||
*/
|
||||
constructor(directoryUrl = common.DIRECTORY_URL) {
|
||||
this.accountPrivateJwk = null;
|
||||
/** @type {import('crypto').KeyObject|null} */
|
||||
this.accountPrivateKey = null;
|
||||
/** @type {import("jose/types.js").JWK | undefined} */
|
||||
this.accountPublicJwk = undefined;
|
||||
/** @type {import('crypto').KeyObject|null} */
|
||||
this.accountPublicKey = null;
|
||||
this.directoryUrl = directoryUrl;
|
||||
this.challengeCallbacks = null;
|
||||
this.hasDirectory = false;
|
||||
this.myAccountUrl = '';
|
||||
this.newAccountUrl = '';
|
||||
this.newNonceUrl = '';
|
||||
this.newOrderUrl = '';
|
||||
this.replayNonce = '';
|
||||
this.thumbprint = '';
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Import account public and private keys from a directory.
|
||||
*
|
||||
* @param {String} dirname - name of directory to read key files from
|
||||
* @param {String} [passphrase] - optional passphrase to decrypt private key with
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async importAccountKeyPair(dirname, passphrase) {
|
||||
const [privateKeyData, publicKeyData] = await Promise.all([
|
||||
fs.promises.readFile(path.join(dirname, 'privateKey.pem'), 'utf8'),
|
||||
fs.promises.readFile(path.join(dirname, 'publicKey.pem'), 'utf8')
|
||||
])
|
||||
|
||||
this.accountPrivateKey = common.importPrivateKey(privateKeyData, passphrase)
|
||||
this.accountPublicKey = common.importPublicKey(publicKeyData)
|
||||
|
||||
await this.initAccountJwks()
|
||||
}
|
||||
|
||||
async authz(authzUrl) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: authzUrl
|
||||
})
|
||||
|
||||
const res = await request(authzUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`authz() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
/**
|
||||
* Export account public and private keys to a directory.
|
||||
*
|
||||
* @param {String} dirname - name of directory to write key files to
|
||||
* @param {String} [passphrase] - optional passphrase to encrypt private key with
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
exportAccountKeyPair(dirname, passphrase) {
|
||||
if (this.accountPrivateKey == null || this.accountPublicKey == null) {
|
||||
return Promise.reject(new Error('Account key pair not generated'));
|
||||
}
|
||||
const privateKeyFile = path.join(dirname, 'privateKey.pem');
|
||||
const publicKeyFile = path.join(dirname, 'publicKey.pem');
|
||||
return Promise.all([
|
||||
common.writeKeyToFile(privateKeyFile, this.accountPrivateKey, passphrase),
|
||||
common.writeKeyToFile(publicKeyFile, this.accountPublicKey)
|
||||
]);
|
||||
}
|
||||
|
||||
const {
|
||||
challenges,
|
||||
identifier,
|
||||
...rest
|
||||
} = res.data
|
||||
const challenge = challenges.find(({
|
||||
type
|
||||
}) => type === 'http-01')
|
||||
|
||||
return {
|
||||
challenge,
|
||||
domain: identifier.value,
|
||||
...rest
|
||||
/**
|
||||
* Generate new account public and private keys.
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async generateAccountKeyPair() {
|
||||
const { privateKey, publicKey } = await generateKeyPair(common.ACCOUNT_KEY_ALGORITHM);
|
||||
// @ts-ignore
|
||||
this.accountPrivateKey = privateKey;
|
||||
// @ts-ignore
|
||||
this.accountPublicKey = publicKey;
|
||||
await this.initAccountJwks();
|
||||
}
|
||||
}
|
||||
|
||||
async completeChallenge(challenge, domain) {
|
||||
await this.readyChallenge(challenge)
|
||||
await this.receiveServerRequest(challenge, domain)
|
||||
}
|
||||
|
||||
async directory() {
|
||||
if (this.hasDirectory) return false
|
||||
|
||||
const res = await request(this.directoryUrl)
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`directory() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
/**
|
||||
* Generate a certificate from Let's Encrypt for your domain.
|
||||
*
|
||||
* @param {String} domain - the domain you want a certificate for
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async generateCertificate(domain) {
|
||||
await this.directory();
|
||||
await this.newNonce();
|
||||
if (!this.myAccountUrl)
|
||||
await this.newAccount();
|
||||
const { authzUrls, finalizeUrl } = await this.newOrder(domain);
|
||||
const { challenge } = await this.authz(authzUrls[0]);
|
||||
await this.completeChallenge(challenge, domain);
|
||||
await this.pollAuthz(authzUrls[0]);
|
||||
const { certificate, privateKeyData } = await this.finalizeOrder(finalizeUrl, domain);
|
||||
return {
|
||||
certificate,
|
||||
privateKeyData
|
||||
};
|
||||
}
|
||||
|
||||
this.hasDirectory = true
|
||||
this.newAccountUrl = res.data.newAccount
|
||||
this.newNonceUrl = res.data.newNonce
|
||||
this.newOrderUrl = res.data.newOrder
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
async fetchCertificate(certificateUrl) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: certificateUrl
|
||||
})
|
||||
|
||||
const res = await request(certificateUrl, {
|
||||
method: 'POST',
|
||||
|
||||
headers: {
|
||||
accept: 'application/pem-certificate-chain',
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`fetchCertificate() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
/**
|
||||
* Import account public and private keys from a directory.
|
||||
*
|
||||
* @param {String} dirname - name of directory to read key files from
|
||||
* @param {String} [passphrase] - optional passphrase to decrypt private key with
|
||||
*
|
||||
* @return {Promise}
|
||||
*/
|
||||
async importAccountKeyPair(dirname, passphrase) {
|
||||
const [privateKeyData, publicKeyData] = await Promise.all([
|
||||
fs.promises.readFile(path.join(dirname, 'privateKey.pem'), 'utf8'),
|
||||
fs.promises.readFile(path.join(dirname, 'publicKey.pem'), 'utf8')
|
||||
]);
|
||||
this.accountPrivateKey = common.importPrivateKey(privateKeyData, passphrase);
|
||||
this.accountPublicKey = common.importPublicKey(publicKeyData);
|
||||
await this.initAccountJwks();
|
||||
}
|
||||
|
||||
return res.data
|
||||
}
|
||||
|
||||
async finalizeOrder(finalizeUrl, domain) {
|
||||
const {
|
||||
privateKey
|
||||
} = await generateKeyPair(common.CERTIFICATE_KEY_ALGORITHM)
|
||||
// @ts-ignore
|
||||
const clientKey = common.exportPrivateKey(privateKey)
|
||||
let {
|
||||
csr
|
||||
// @ts-ignore
|
||||
} = await createCsr({
|
||||
clientKey,
|
||||
commonName: domain,
|
||||
})
|
||||
|
||||
// "The CSR is sent in the base64url-encoded version of the DER format.
|
||||
// (Note: Because this field uses base64url, and does not include headers,
|
||||
// it is different from PEM.)"
|
||||
csr = csr
|
||||
.split('\n')
|
||||
.filter(Boolean)
|
||||
.slice(1, -1)
|
||||
.join('')
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=/g, '')
|
||||
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: finalizeUrl
|
||||
}, {
|
||||
csr
|
||||
})
|
||||
|
||||
const res = await request(finalizeUrl, {
|
||||
method: 'POST',
|
||||
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`finalizeOrder() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
async authz(authzUrl) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: authzUrl
|
||||
});
|
||||
const res = await request(authzUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`authz() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
const { challenges, identifier, ...rest } = res.data;
|
||||
const challenge = challenges.find(({ type }) => type === 'http-01');
|
||||
return {
|
||||
challenge,
|
||||
domain: identifier.value,
|
||||
...rest
|
||||
};
|
||||
}
|
||||
|
||||
const certificate = await this.fetchCertificate(res.data.certificate)
|
||||
|
||||
return {
|
||||
certificate,
|
||||
privateKeyData: clientKey
|
||||
async completeChallenge(challenge, domain) {
|
||||
await this.readyChallenge(challenge);
|
||||
await this.receiveServerRequest(challenge, domain);
|
||||
}
|
||||
}
|
||||
|
||||
async initAccountJwks() {
|
||||
const [publicJwk, accountPrivateJwk] = await Promise.all([
|
||||
fromKeyLike(this.accountPublicKey),
|
||||
fromKeyLike(this.accountPrivateKey)
|
||||
])
|
||||
|
||||
this.accountPublicJwk = publicJwk
|
||||
this.accountPrivateJwk = accountPrivateJwk
|
||||
this.thumbprint = await calculateThumbprint(publicJwk)
|
||||
}
|
||||
|
||||
async newAccount(...emails) {
|
||||
const data = await this.sign({
|
||||
jwk: this.accountPublicJwk,
|
||||
nonce: this.replayNonce,
|
||||
url: this.newAccountUrl
|
||||
}, {
|
||||
termsOfServiceAgreed: true
|
||||
})
|
||||
|
||||
const res = await request(this.newAccountUrl, {
|
||||
method: 'POST',
|
||||
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (![200, 201].includes(res.statusCode)) {
|
||||
throw new Error(`newAccount() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
async directory() {
|
||||
if (this.hasDirectory)
|
||||
return false;
|
||||
const res = await request(this.directoryUrl);
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`directory() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
this.hasDirectory = true;
|
||||
this.newAccountUrl = res.data.newAccount;
|
||||
this.newNonceUrl = res.data.newNonce;
|
||||
this.newOrderUrl = res.data.newOrder;
|
||||
return true;
|
||||
}
|
||||
|
||||
this.myAccountUrl = res.headers.location
|
||||
|
||||
return res.statusCode === 201
|
||||
}
|
||||
|
||||
async newNonce() {
|
||||
if (this.replayNonce) return false
|
||||
|
||||
const res = await request(this.newNonceUrl, {
|
||||
method: 'HEAD'
|
||||
})
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`newNonce() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
async fetchCertificate(certificateUrl) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: certificateUrl
|
||||
});
|
||||
const res = await request(certificateUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
accept: 'application/pem-certificate-chain',
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`fetchCertificate() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
return res.data;
|
||||
}
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
async newOrder(...domains) {
|
||||
const identifiers = domains.map(domain => ({
|
||||
type: 'dns',
|
||||
value: domain
|
||||
}))
|
||||
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: this.newOrderUrl
|
||||
}, {
|
||||
identifiers
|
||||
})
|
||||
|
||||
const res = await request(this.newOrderUrl, {
|
||||
method: 'POST',
|
||||
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (res.statusCode !== 201) {
|
||||
throw new Error(`newOrder() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
async finalizeOrder(finalizeUrl, domain) {
|
||||
const { privateKey } = await generateKeyPair(common.CERTIFICATE_KEY_ALGORITHM);
|
||||
// @ts-ignore
|
||||
const clientKey = common.exportPrivateKey(privateKey);
|
||||
let { csr
|
||||
// @ts-ignore
|
||||
} = await createCsr({
|
||||
clientKey,
|
||||
commonName: domain,
|
||||
});
|
||||
// "The CSR is sent in the base64url-encoded version of the DER format.
|
||||
// (Note: Because this field uses base64url, and does not include headers,
|
||||
// it is different from PEM.)"
|
||||
csr = csr
|
||||
.split('\n')
|
||||
.filter(Boolean)
|
||||
.slice(1, -1)
|
||||
.join('')
|
||||
.replace(/\+/g, '-')
|
||||
.replace(/\//g, '_')
|
||||
.replace(/=/g, '');
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: finalizeUrl
|
||||
}, {
|
||||
csr
|
||||
});
|
||||
const res = await request(finalizeUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`finalizeOrder() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
const certificate = await this.fetchCertificate(res.data.certificate);
|
||||
return {
|
||||
certificate,
|
||||
privateKeyData: clientKey
|
||||
};
|
||||
}
|
||||
|
||||
const orderUrl = res.headers.location
|
||||
const {
|
||||
authorizations: authzUrls,
|
||||
finalize: finalizeUrl
|
||||
} = res.data
|
||||
|
||||
return {
|
||||
authzUrls,
|
||||
domains,
|
||||
finalizeUrl,
|
||||
orderUrl
|
||||
async initAccountJwks() {
|
||||
if (this.accountPrivateKey == null || this.accountPublicKey == null) {
|
||||
return Promise.reject(new Error('Account key pair not generated'));
|
||||
}
|
||||
const [publicJwk, accountPrivateJwk] = await Promise.all([
|
||||
fromKeyLike(this.accountPublicKey),
|
||||
fromKeyLike(this.accountPrivateKey)
|
||||
]);
|
||||
this.accountPublicJwk = publicJwk;
|
||||
this.accountPrivateJwk = accountPrivateJwk;
|
||||
this.thumbprint = await calculateThumbprint(publicJwk);
|
||||
}
|
||||
}
|
||||
|
||||
async pollAuthz(authzUrl) {
|
||||
for (let i = 0; i < 10; i++) {
|
||||
const result = await this.authz(authzUrl)
|
||||
|
||||
if (result.status === 'pending') {
|
||||
await new Promise(resolve => setTimeout(resolve, 1e3))
|
||||
continue
|
||||
}
|
||||
|
||||
if (result.status === 'invalid') {
|
||||
throw new Error('pollAuthz() authorization is invalid: ' + JSON.stringify(result, null, 2))
|
||||
}
|
||||
|
||||
return result
|
||||
async newAccount(...emails) {
|
||||
const data = await this.sign({
|
||||
jwk: this.accountPublicJwk,
|
||||
nonce: this.replayNonce,
|
||||
url: this.newAccountUrl
|
||||
}, {
|
||||
termsOfServiceAgreed: true
|
||||
});
|
||||
const res = await request(this.newAccountUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (![200, 201].includes(res.statusCode)) {
|
||||
throw new Error(`newAccount() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
this.myAccountUrl = res.headers.location;
|
||||
return res.statusCode === 201;
|
||||
}
|
||||
|
||||
throw new Error('pollAuthz() timed out')
|
||||
}
|
||||
|
||||
async readyChallenge(challenge) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: challenge.url
|
||||
}, {})
|
||||
|
||||
const res = await request(challenge.url, {
|
||||
method: 'POST',
|
||||
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
|
||||
data
|
||||
})
|
||||
|
||||
this.setReplayNonce(res)
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`readyChallenge() Status Code: ${res.statusCode} Data: ${res.data}`)
|
||||
async newNonce() {
|
||||
if (this.replayNonce)
|
||||
return false;
|
||||
const res = await request(this.newNonceUrl, {
|
||||
method: 'HEAD'
|
||||
});
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`newNonce() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
this.setReplayNonce(res);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
receiveServerRequest(challenge, domain) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const time = setTimeout(() => {
|
||||
reject(new Error('Timed out waiting for server request'))
|
||||
}, 10e3);
|
||||
let hasResolved = false;
|
||||
this.challengeCallbacks = () => {
|
||||
if (!hasResolved)
|
||||
setTimeout(resolve, 100);
|
||||
else
|
||||
return challenge.token + '.' + this.thumbprint;
|
||||
hasResolved = true;
|
||||
clearTimeout(time);
|
||||
// wanted to clear callbacks here but LE does the call multiple times.
|
||||
// remember we're in mutex lock so no worries for racing.
|
||||
return challenge.token + '.' + this.thumbprint;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
setReplayNonce(res) {
|
||||
const replayNonce = (res.headers['replay-nonce'] || '').trim()
|
||||
|
||||
if (!replayNonce) {
|
||||
throw new Error('No Replay-Nonce header in response')
|
||||
async newOrder(...domains) {
|
||||
const identifiers = domains.map(domain => ({
|
||||
type: 'dns',
|
||||
value: domain
|
||||
}));
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: this.newOrderUrl
|
||||
}, {
|
||||
identifiers
|
||||
});
|
||||
const res = await request(this.newOrderUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (res.statusCode !== 201) {
|
||||
throw new Error(`newOrder() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
const orderUrl = res.headers.location;
|
||||
const { authorizations: authzUrls, finalize: finalizeUrl } = res.data;
|
||||
return {
|
||||
authzUrls,
|
||||
domains,
|
||||
finalizeUrl,
|
||||
orderUrl
|
||||
};
|
||||
}
|
||||
|
||||
this.replayNonce = replayNonce
|
||||
}
|
||||
|
||||
async sign(header, payload) {
|
||||
let data
|
||||
|
||||
if (payload) {
|
||||
data = await new SignJWT(payload)
|
||||
.setProtectedHeader({
|
||||
alg: common.ACCOUNT_KEY_ALGORITHM,
|
||||
...header
|
||||
})
|
||||
.sign(this.accountPrivateKey)
|
||||
} else {
|
||||
// SignJWT constructor only accepts object but RFC8555 requires empty payload
|
||||
// Workaround: manually pass empty Uint8Array to CompactSign constructor
|
||||
const sig = new CompactSign(new Uint8Array())
|
||||
sig.setProtectedHeader({
|
||||
alg: common.ACCOUNT_KEY_ALGORITHM,
|
||||
...header
|
||||
})
|
||||
data = await sig.sign(this.accountPrivateKey)
|
||||
async pollAuthz(authzUrl) {
|
||||
for (let i = 0; i < 10; i++) {
|
||||
const result = await this.authz(authzUrl);
|
||||
if (result.status === 'pending') {
|
||||
await new Promise(resolve => setTimeout(resolve, 1e3));
|
||||
continue;
|
||||
}
|
||||
if (result.status === 'invalid') {
|
||||
throw new Error('pollAuthz() authorization is invalid: ' + JSON.stringify(result, null, 2));
|
||||
}
|
||||
return result;
|
||||
}
|
||||
throw new Error('pollAuthz() timed out');
|
||||
}
|
||||
async readyChallenge(challenge) {
|
||||
const data = await this.sign({
|
||||
kid: this.myAccountUrl,
|
||||
nonce: this.replayNonce,
|
||||
url: challenge.url
|
||||
}, {});
|
||||
const res = await request(challenge.url, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/jose+json'
|
||||
},
|
||||
data
|
||||
});
|
||||
this.setReplayNonce(res);
|
||||
if (res.statusCode !== 200) {
|
||||
throw new Error(`readyChallenge() Status Code: ${res.statusCode} Data: ${res.data}`);
|
||||
}
|
||||
}
|
||||
receiveServerRequest(challenge, domain) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const time = setTimeout(() => {
|
||||
reject(new Error('Timed out waiting for server request'));
|
||||
}, 10e3);
|
||||
let hasResolved = false;
|
||||
this.challengeCallbacks = () => {
|
||||
if (!hasResolved)
|
||||
setTimeout(resolve, 100);
|
||||
else
|
||||
return challenge.token + '.' + this.thumbprint;
|
||||
hasResolved = true;
|
||||
clearTimeout(time);
|
||||
// wanted to clear callbacks here but LE does the call multiple times.
|
||||
// remember we're in mutex lock so no worries for racing.
|
||||
return challenge.token + '.' + this.thumbprint;
|
||||
};
|
||||
});
|
||||
}
|
||||
setReplayNonce(res) {
|
||||
const replayNonce = (res.headers['replay-nonce'] || '').trim();
|
||||
if (!replayNonce) {
|
||||
throw new Error('No Replay-Nonce header in response');
|
||||
}
|
||||
this.replayNonce = replayNonce;
|
||||
}
|
||||
/**
|
||||
* @param {import("jose/types.js").JWSHeaderParameters} header
|
||||
* @param {import("jose/types.js").JWTPayload | undefined} [payload]
|
||||
*/
|
||||
async sign(header, payload) {
|
||||
if (this.accountPrivateKey == null) {
|
||||
return Promise.reject(new Error('Account key pair not generated'));
|
||||
}
|
||||
let data;
|
||||
if (payload) {
|
||||
data = await new SignJWT(payload)
|
||||
.setProtectedHeader({
|
||||
alg: common.ACCOUNT_KEY_ALGORITHM,
|
||||
...header
|
||||
})
|
||||
.sign(this.accountPrivateKey);
|
||||
}
|
||||
else {
|
||||
// SignJWT constructor only accepts object but RFC8555 requires empty payload
|
||||
// Workaround: manually pass empty Uint8Array to CompactSign constructor
|
||||
const sig = new CompactSign(new Uint8Array());
|
||||
sig.setProtectedHeader({
|
||||
alg: common.ACCOUNT_KEY_ALGORITHM,
|
||||
...header
|
||||
});
|
||||
data = await sig.sign(this.accountPrivateKey);
|
||||
}
|
||||
const [b64Header, b64Payload, b64Signature] = data.split('.');
|
||||
return JSON.stringify({
|
||||
protected: b64Header,
|
||||
payload: b64Payload,
|
||||
signature: b64Signature
|
||||
});
|
||||
}
|
||||
|
||||
const [b64Header, b64Payload, b64Signature] = data.split('.')
|
||||
|
||||
return JSON.stringify({
|
||||
protected: b64Header,
|
||||
payload: b64Payload,
|
||||
signature: b64Signature
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = Client
|
||||
export default Client;
|
||||
|
|
|
|||
|
|
@ -1,55 +1,45 @@
|
|||
const crypto = require('crypto')
|
||||
const fs = require('fs')
|
||||
|
||||
const ACCOUNT_KEY_ALGORITHM = 'ES256'
|
||||
const CERTIFICATE_KEY_ALGORITHM = 'RS256'
|
||||
|
||||
const env = (process.env.NODE_ENV || '').trim().toLowerCase()
|
||||
|
||||
import crypto from "crypto";
|
||||
import fs from "fs";
|
||||
const ACCOUNT_KEY_ALGORITHM = 'ES256';
|
||||
const CERTIFICATE_KEY_ALGORITHM = 'RS256';
|
||||
const env = (process.env.NODE_ENV || '').trim().toLowerCase();
|
||||
const DIRECTORY_URL = ['development', 'test'].includes(env)
|
||||
? 'https://acme-staging-v02.api.letsencrypt.org/directory'
|
||||
: 'https://acme-v02.api.letsencrypt.org/directory'
|
||||
|
||||
const PRIVATE_KEY_CIPHER = 'aes-256-cbc'
|
||||
const PRIVATE_KEY_FORMAT = 'pem'
|
||||
const PRIVATE_KEY_PERMISSIONS = 0o600
|
||||
const PRIVATE_KEY_TYPE = 'pkcs8'
|
||||
|
||||
const PUBLIC_KEY_FORMAT = 'pem'
|
||||
const PUBLIC_KEY_PERMISSIONS = 0o666
|
||||
const PUBLIC_KEY_TYPE = 'spki'
|
||||
|
||||
? 'https://acme-staging-v02.api.letsencrypt.org/directory'
|
||||
: 'https://acme-v02.api.letsencrypt.org/directory';
|
||||
const PRIVATE_KEY_CIPHER = 'aes-256-cbc';
|
||||
const PRIVATE_KEY_FORMAT = 'pem';
|
||||
const PRIVATE_KEY_PERMISSIONS = 0o600;
|
||||
const PRIVATE_KEY_TYPE = 'pkcs8';
|
||||
const PUBLIC_KEY_FORMAT = 'pem';
|
||||
const PUBLIC_KEY_PERMISSIONS = 0o666;
|
||||
const PUBLIC_KEY_TYPE = 'spki';
|
||||
/**
|
||||
* @param {crypto.KeyObject} privateKey
|
||||
* @param {String} [passphrase]
|
||||
*
|
||||
*/
|
||||
const exportPrivateKey = (privateKey, passphrase) => {
|
||||
/** @type {crypto.KeyExportOptions<'pem'>} */
|
||||
const privateKeyOpts = {
|
||||
type: PRIVATE_KEY_TYPE,
|
||||
format: PRIVATE_KEY_FORMAT
|
||||
}
|
||||
|
||||
if (passphrase) {
|
||||
privateKeyOpts.cipher = PRIVATE_KEY_CIPHER
|
||||
privateKeyOpts.passphrase = passphrase
|
||||
}
|
||||
|
||||
return privateKey.export(privateKeyOpts)
|
||||
}
|
||||
|
||||
/** @type {crypto.KeyExportOptions<'pem'>} */
|
||||
const privateKeyOpts = {
|
||||
type: PRIVATE_KEY_TYPE,
|
||||
format: PRIVATE_KEY_FORMAT
|
||||
};
|
||||
if (passphrase) {
|
||||
privateKeyOpts.cipher = PRIVATE_KEY_CIPHER;
|
||||
privateKeyOpts.passphrase = passphrase;
|
||||
}
|
||||
return privateKey.export(privateKeyOpts);
|
||||
};
|
||||
/**
|
||||
* @param {crypto.KeyObject} publicKey
|
||||
*/
|
||||
const exportPublicKey = publicKey => {
|
||||
/** @type {crypto.KeyExportOptions<'pem'>} */
|
||||
return publicKey.export({
|
||||
type: PUBLIC_KEY_TYPE,
|
||||
format: PUBLIC_KEY_FORMAT
|
||||
})
|
||||
}
|
||||
|
||||
/** @type {crypto.KeyExportOptions<'pem'>} */
|
||||
return publicKey.export({
|
||||
type: PUBLIC_KEY_TYPE,
|
||||
format: PUBLIC_KEY_FORMAT
|
||||
});
|
||||
};
|
||||
/**
|
||||
* @param {String} privateKeyData
|
||||
* @param {String} [passphrase]
|
||||
|
|
@ -57,41 +47,39 @@ const exportPublicKey = publicKey => {
|
|||
* @return {crypto.KeyObject}
|
||||
*/
|
||||
const importPrivateKey = (privateKeyData, passphrase) => {
|
||||
/** @type {crypto.KeyExportOptions<'pem'>} */
|
||||
const privateKeyOpts = {
|
||||
key: privateKeyData,
|
||||
format: PRIVATE_KEY_FORMAT,
|
||||
type: PRIVATE_KEY_TYPE
|
||||
}
|
||||
|
||||
if (passphrase) {
|
||||
privateKeyOpts.passphrase = passphrase
|
||||
}
|
||||
|
||||
try {
|
||||
return crypto.createPrivateKey(privateKeyOpts)
|
||||
} catch {
|
||||
throw new Error('Failed to import private key')
|
||||
}
|
||||
}
|
||||
|
||||
/** @type {crypto.PrivateKeyInput} */
|
||||
const privateKeyOpts = {
|
||||
key: privateKeyData,
|
||||
format: PRIVATE_KEY_FORMAT,
|
||||
type: PRIVATE_KEY_TYPE
|
||||
};
|
||||
if (passphrase) {
|
||||
privateKeyOpts.passphrase = passphrase;
|
||||
}
|
||||
try {
|
||||
return crypto.createPrivateKey(privateKeyOpts);
|
||||
}
|
||||
catch {
|
||||
throw new Error('Failed to import private key');
|
||||
}
|
||||
};
|
||||
/**
|
||||
* @param {String} publicKeyData
|
||||
*
|
||||
* @return {crypto.KeyObject}
|
||||
*/
|
||||
const importPublicKey = publicKeyData => {
|
||||
try {
|
||||
return crypto.createPublicKey({
|
||||
key: publicKeyData,
|
||||
format: PUBLIC_KEY_FORMAT,
|
||||
type: PUBLIC_KEY_TYPE
|
||||
})
|
||||
} catch {
|
||||
throw new Error('Failed to import public key')
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
return crypto.createPublicKey({
|
||||
key: publicKeyData,
|
||||
format: PUBLIC_KEY_FORMAT,
|
||||
type: PUBLIC_KEY_TYPE
|
||||
});
|
||||
}
|
||||
catch {
|
||||
throw new Error('Failed to import public key');
|
||||
}
|
||||
};
|
||||
/**
|
||||
* @param {String} filename
|
||||
* @param {crypto.KeyObject|string} key
|
||||
|
|
@ -100,40 +88,19 @@ const importPublicKey = publicKeyData => {
|
|||
* @return {Promise}
|
||||
*/
|
||||
const writeKeyToFile = async (filename, key, passphrase) => {
|
||||
if (typeof key === 'string') {
|
||||
key = key.includes('PRIVATE KEY')
|
||||
? importPrivateKey(key, passphrase)
|
||||
: importPublicKey(key)
|
||||
} else if (!(key instanceof crypto.KeyObject)) {
|
||||
throw new Error('Expected "key" to be crypto.KeyObject or string')
|
||||
}
|
||||
|
||||
const isPrivateKey = key.type === 'private'
|
||||
|
||||
const keyData = isPrivateKey
|
||||
? exportPrivateKey(key, passphrase)
|
||||
: exportPublicKey(key)
|
||||
|
||||
const mode = isPrivateKey ? PRIVATE_KEY_PERMISSIONS : PUBLIC_KEY_PERMISSIONS
|
||||
|
||||
await fs.promises.writeFile(filename, keyData, { mode })
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
ACCOUNT_KEY_ALGORITHM,
|
||||
CERTIFICATE_KEY_ALGORITHM,
|
||||
DIRECTORY_URL,
|
||||
PRIVATE_KEY_CIPHER,
|
||||
PRIVATE_KEY_FORMAT,
|
||||
PRIVATE_KEY_PERMISSIONS,
|
||||
PRIVATE_KEY_TYPE,
|
||||
PUBLIC_KEY_FORMAT,
|
||||
PUBLIC_KEY_PERMISSIONS,
|
||||
PUBLIC_KEY_TYPE,
|
||||
env,
|
||||
exportPrivateKey,
|
||||
exportPublicKey,
|
||||
importPrivateKey,
|
||||
importPublicKey,
|
||||
writeKeyToFile
|
||||
}
|
||||
if (typeof key === 'string') {
|
||||
key = key.includes('PRIVATE KEY')
|
||||
? importPrivateKey(key, passphrase)
|
||||
: importPublicKey(key);
|
||||
}
|
||||
else if (!(key instanceof crypto.KeyObject)) {
|
||||
throw new Error('Expected "key" to be crypto.KeyObject or string');
|
||||
}
|
||||
const isPrivateKey = key.type === 'private';
|
||||
const keyData = isPrivateKey
|
||||
? exportPrivateKey(key, passphrase)
|
||||
: exportPublicKey(key);
|
||||
const mode = isPrivateKey ? PRIVATE_KEY_PERMISSIONS : PUBLIC_KEY_PERMISSIONS;
|
||||
await fs.promises.writeFile(filename, keyData, { mode });
|
||||
};
|
||||
export { ACCOUNT_KEY_ALGORITHM, CERTIFICATE_KEY_ALGORITHM, DIRECTORY_URL, PRIVATE_KEY_CIPHER, PRIVATE_KEY_FORMAT, PRIVATE_KEY_PERMISSIONS, PRIVATE_KEY_TYPE, PUBLIC_KEY_FORMAT, PUBLIC_KEY_PERMISSIONS, PUBLIC_KEY_TYPE, env, exportPrivateKey, exportPublicKey, importPrivateKey, importPublicKey, writeKeyToFile };
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
module.exports = {
|
||||
...require('./common'),
|
||||
Client: require('./client')
|
||||
}
|
||||
import Client from './client.js';
|
||||
export * from './common.js';
|
||||
export { Client };
|
||||
|
|
|
|||
|
|
@ -1,46 +1,40 @@
|
|||
const https = require('https')
|
||||
|
||||
import https from "https";
|
||||
const request = (/** @type {string | import("url").URL} */ url, /** @type {https.RequestOptions&{data?: string}} */ { data = '', ...options } = {}, /** @type {() => any} */ cb) => {
|
||||
return new Promise((resolve, reject) => {
|
||||
try {
|
||||
url = new URL(url)
|
||||
} catch (err) {
|
||||
return reject(err)
|
||||
}
|
||||
|
||||
https.request(url, options, res => {
|
||||
const { statusCode, headers } = res
|
||||
|
||||
let data = ''
|
||||
|
||||
res
|
||||
.on('data', chunk => {
|
||||
data += chunk
|
||||
return new Promise((resolve, reject) => {
|
||||
try {
|
||||
url = new URL(url);
|
||||
}
|
||||
catch (err) {
|
||||
return reject(err);
|
||||
}
|
||||
https.request(url, options, res => {
|
||||
const { statusCode, headers } = res;
|
||||
let data = '';
|
||||
res
|
||||
.on('data', chunk => {
|
||||
data += chunk;
|
||||
})
|
||||
.once('end', () => {
|
||||
if (headers['content-type']?.includes('application/json')) {
|
||||
try {
|
||||
data = JSON.parse(data);
|
||||
}
|
||||
catch (err) {
|
||||
reject(err);
|
||||
return;
|
||||
}
|
||||
}
|
||||
resolve({ data, headers, statusCode });
|
||||
})
|
||||
.once('error', reject);
|
||||
})
|
||||
.once('end', () => {
|
||||
if (headers['content-type']?.includes('application/json')) {
|
||||
try {
|
||||
data = JSON.parse(data)
|
||||
} catch (err) {
|
||||
reject(err)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
resolve({ data, headers, statusCode })
|
||||
})
|
||||
.once('error', reject)
|
||||
})
|
||||
.once('error', reject)
|
||||
.end(data)
|
||||
|
||||
setTimeout(() => {
|
||||
const method = options.method || 'GET'
|
||||
reject(new Error(`${method} request to "${url}" timed out`))
|
||||
}, 10e3)
|
||||
|
||||
cb && cb()
|
||||
})
|
||||
}
|
||||
|
||||
module.exports = request
|
||||
.once('error', reject)
|
||||
.end(data);
|
||||
setTimeout(() => {
|
||||
const method = options.method || 'GET';
|
||||
reject(new Error(`${method} request to "${url}" timed out`));
|
||||
}, 10e3);
|
||||
cb && cb();
|
||||
});
|
||||
};
|
||||
export default request;
|
||||
|
|
|
|||
|
|
@ -1,18 +1,21 @@
|
|||
import { client } from "./sni.js";
|
||||
import { findTxtRecord, isHostBlacklisted, combineURLs } from "./util.js";
|
||||
const record_prefix = 'forward-domain=';
|
||||
const {
|
||||
client
|
||||
} = require('./sni');
|
||||
const {
|
||||
findTxtRecord,
|
||||
isHostBlacklisted
|
||||
} = require('./util');
|
||||
const combineURLs = require('axios/lib/helpers/combineURLs');
|
||||
|
||||
/**
|
||||
* @type {Object<string, {expire: number, expand: boolean, url: string}>}
|
||||
* @typedef {Object} Cache
|
||||
* @property {string} url
|
||||
* @property {boolean} expand
|
||||
* @property {boolean} blacklisted
|
||||
* @property {number} expire
|
||||
*/
|
||||
/**
|
||||
* @type {Object<string, Cache>}
|
||||
*/
|
||||
const resolveCache = {};
|
||||
|
||||
/**
|
||||
* @param {string} host
|
||||
* @returns {Promise<Cache>}
|
||||
*/
|
||||
async function buildCache(host) {
|
||||
let expand = false;
|
||||
let url = await findTxtRecord(host, record_prefix);
|
||||
|
|
@ -30,28 +33,36 @@ async function buildCache(host) {
|
|||
expire: Date.now() + 86400 * 1000,
|
||||
};
|
||||
}
|
||||
|
||||
const acme_prefix = '/.well-known/acme-challenge/';
|
||||
|
||||
const listener = async function ( /** @type {import('http').IncomingMessage} */ req, /** @type {import('http').ServerResponse} */ res) {
|
||||
/**
|
||||
* @type {import('http').RequestListener}
|
||||
*/
|
||||
const listener = async function (req, res) {
|
||||
try {
|
||||
if (req.url.startsWith(acme_prefix)) {
|
||||
const url = req.url || '';
|
||||
if (url.startsWith(acme_prefix)) {
|
||||
if (client.challengeCallbacks) {
|
||||
res.writeHead(200, {
|
||||
// This is important :)
|
||||
'content-type': 'application/octet-stream'
|
||||
});
|
||||
res.write(client.challengeCallbacks());
|
||||
} else {
|
||||
res.writeHead(404)
|
||||
}
|
||||
else {
|
||||
res.writeHead(404);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
let cache = resolveCache[req.headers.host];
|
||||
const host = (req.headers.host || '').toLowerCase();
|
||||
if (!host) {
|
||||
res.writeHead(400);
|
||||
res.write('Host header is required');
|
||||
return;
|
||||
}
|
||||
let cache = resolveCache[host];
|
||||
if (!cache || (Date.now() > cache.expire)) {
|
||||
cache = await buildCache(req.headers.host);
|
||||
resolveCache[req.headers.host] = cache;
|
||||
cache = await buildCache(host);
|
||||
resolveCache[host] = cache;
|
||||
}
|
||||
if (cache.blacklisted) {
|
||||
res.writeHead(301, {
|
||||
|
|
@ -60,15 +71,16 @@ const listener = async function ( /** @type {import('http').IncomingMessage} */
|
|||
return;
|
||||
}
|
||||
res.writeHead(301, {
|
||||
'Location': cache.expand ? combineURLs(cache.url, req.url) : cache.url,
|
||||
'Location': cache.expand ? combineURLs(cache.url, url) : cache.url,
|
||||
});
|
||||
return;
|
||||
} catch (error) {
|
||||
}
|
||||
catch (error) {
|
||||
res.writeHead(400);
|
||||
res.write(error.message || 'Unknown error');
|
||||
} finally {
|
||||
}
|
||||
finally {
|
||||
res.end();
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = listener;
|
||||
};
|
||||
export default listener;
|
||||
|
|
|
|||
107
src/sni.js
107
src/sni.js
|
|
@ -1,28 +1,36 @@
|
|||
const tls = require('tls');
|
||||
const certnode = require('./certnode/lib');
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const {
|
||||
md5,
|
||||
ensureDir,
|
||||
} = require('./util');
|
||||
const {
|
||||
default: AwaitLock
|
||||
} = require('await-lock');
|
||||
import tls from "tls";
|
||||
import { Client, writeKeyToFile } from "./certnode/lib/index.js";
|
||||
import fs from "fs";
|
||||
import path from "path";
|
||||
import { md5, ensureDir } from "./util.js";
|
||||
import AsyncLock from 'async-lock';
|
||||
|
||||
const lock = new AsyncLock();
|
||||
const __dirname = new URL('.', import.meta.url).pathname;
|
||||
const certsDir = path.join(__dirname, '../.certs');
|
||||
const accountDir = path.join(__dirname, '../.certs/account');
|
||||
const client = new certnode.Client();
|
||||
const client = new Client();
|
||||
|
||||
/**
|
||||
* @type {Object<string, {cert: any, key: any, expire: number}>}
|
||||
* @typedef {Object} Cache
|
||||
* @property {string} cert
|
||||
* @property {string} key
|
||||
* @property {number} expire
|
||||
*
|
||||
*/
|
||||
|
||||
/**
|
||||
* @type {Object<string, Cache>}
|
||||
*/
|
||||
const resolveCache = {};
|
||||
|
||||
/**
|
||||
* @param {string} host
|
||||
*/
|
||||
function getCertCachePath(host) {
|
||||
const hash = md5(host);
|
||||
return path.join(certsDir, hash.substr(0, 2), hash.substr(2), host);
|
||||
return path.join(certsDir, hash.substring(0, 2), hash.substring(2), host);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} host
|
||||
*/
|
||||
|
|
@ -40,19 +48,17 @@ async function buildCache(host) {
|
|||
if (Date.now() > expire)
|
||||
throw new Error('expired'); // expired
|
||||
const cert = await fs.promises.readFile(certP, 'utf8');
|
||||
const key = await fs.promises.readFile(keyP, 'utf8')
|
||||
const key = await fs.promises.readFile(keyP, 'utf8');
|
||||
return {
|
||||
cert,
|
||||
key,
|
||||
expire
|
||||
};
|
||||
} catch (error) {
|
||||
const {
|
||||
certificate,
|
||||
privateKeyData
|
||||
} = await client.generateCertificate(host);
|
||||
}
|
||||
catch (error) {
|
||||
const { certificate, privateKeyData } = await client.generateCertificate(host);
|
||||
await fs.promises.writeFile(certP, certificate);
|
||||
await certnode.writeKeyToFile(keyP, privateKeyData, '');
|
||||
await writeKeyToFile(keyP, privateKeyData, '');
|
||||
const expire = (Date.now() + 45 * 86400 * 1000);
|
||||
await fs.promises.writeFile(extP, expire.toString());
|
||||
return {
|
||||
|
|
@ -61,61 +67,60 @@ async function buildCache(host) {
|
|||
expire
|
||||
};
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} servername
|
||||
* @param {AsyncLock} lock
|
||||
*/
|
||||
async function getKeyCert(servername) {
|
||||
async function getKeyCert(servername, lock) {
|
||||
// Had to use lock because the best authenticator
|
||||
// library seems don't yet fully stateless.
|
||||
servername = servername.toLowerCase();
|
||||
let cache = resolveCache[servername];
|
||||
await ensureDir(certsDir);
|
||||
if (!cache || (Date.now() > cache.expire)) {
|
||||
cache = await buildCache(servername);
|
||||
resolveCache[servername] = cache;
|
||||
cache = await lock.acquire(servername, (cb) => {
|
||||
if (!resolveCache[servername] || (Date.now() > resolveCache[servername].expire)) {
|
||||
buildCache(servername).then((cache) => {
|
||||
resolveCache[servername] = cache;
|
||||
cb(null, cache);
|
||||
}).catch((error) => {
|
||||
cb(error, undefined);
|
||||
});
|
||||
} else {
|
||||
cb(null, resolveCache[servername]);
|
||||
}
|
||||
});
|
||||
}
|
||||
return {
|
||||
key: cache.key,
|
||||
cert: cache.cert,
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
let lock = new AwaitLock();
|
||||
|
||||
/**
|
||||
* @param {string} servername
|
||||
* @param {(err: any, cb: tls.SecureContext) => void} ctx
|
||||
* @param {(err: any, cb: tls.SecureContext|undefined) => void} ctx
|
||||
*/
|
||||
async function SniListener(servername, ctx) {
|
||||
// Had to use lock because the best authenticator
|
||||
// library seems don't yet fully stateless.
|
||||
// Generate fresh account keys for Let's Encrypt
|
||||
await lock.acquireAsync();
|
||||
try {
|
||||
ctx(null, tls.createSecureContext(await getKeyCert(servername)));
|
||||
} catch (error) {
|
||||
console.log(JSON.stringify(error));
|
||||
ctx(error, null);
|
||||
} finally {
|
||||
lock.release();
|
||||
ctx(null, tls.createSecureContext(await getKeyCert(servername, lock)));
|
||||
}
|
||||
catch (error) {
|
||||
console.log(error);
|
||||
ctx(error, undefined);
|
||||
}
|
||||
}
|
||||
|
||||
const SniPrepare = async () => {
|
||||
await ensureDir(certsDir);
|
||||
await ensureDir(accountDir);
|
||||
|
||||
if (fs.existsSync(path.join(accountDir, 'privateKey.pem')) &&
|
||||
fs.existsSync(path.join(accountDir, 'publicKey.pem'))) {
|
||||
await client.importAccountKeyPair(accountDir, '');
|
||||
} else {
|
||||
}
|
||||
else {
|
||||
await client.generateAccountKeyPair();
|
||||
await client.exportAccountKeyPair(accountDir, '');
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
SniListener,
|
||||
SniPrepare,
|
||||
client,
|
||||
}
|
||||
};
|
||||
export { SniListener, SniPrepare, client };
|
||||
|
|
|
|||
35
src/util.js
35
src/util.js
|
|
@ -1,18 +1,20 @@
|
|||
const {
|
||||
default: axios
|
||||
} = require('axios');
|
||||
var crypto = require('crypto');
|
||||
const fs = require('fs');
|
||||
import { default as axios } from "axios";
|
||||
import crypto from "crypto";
|
||||
import fs from "fs";
|
||||
|
||||
const blacklistURL = (process.env.BLACKLIST_HOSTS || "").split(',').reduce((acc, host) => {
|
||||
acc[host] = true;
|
||||
return acc;
|
||||
}, {});
|
||||
|
||||
function md5(str) {
|
||||
/**
|
||||
* @param {crypto.BinaryLike} str
|
||||
*/
|
||||
export function md5(str) {
|
||||
return crypto.createHash('md5').update(str).digest('hex');
|
||||
}
|
||||
|
||||
function isHostBlacklisted(domain = '') {
|
||||
export function isHostBlacklisted(domain = '') {
|
||||
if (domain.length > 6) {
|
||||
let p = domain.lastIndexOf('.', domain.length - 6);
|
||||
if (p > 0) {
|
||||
|
|
@ -22,10 +24,14 @@ function isHostBlacklisted(domain = '') {
|
|||
return blacklistURL[domain];
|
||||
}
|
||||
|
||||
async function ensureDir(dir) {
|
||||
/**
|
||||
* @param {fs.PathLike} dir
|
||||
*/
|
||||
export async function ensureDir(dir) {
|
||||
try {
|
||||
await fs.promises.access(dir, fs.constants.W_OK | fs.constants.O_DIRECTORY);
|
||||
} catch (error) {
|
||||
}
|
||||
catch (error) {
|
||||
await fs.promises.mkdir(dir, {
|
||||
recursive: true
|
||||
});
|
||||
|
|
@ -36,7 +42,7 @@ async function ensureDir(dir) {
|
|||
* @param {string} host
|
||||
* @param {string} prefix
|
||||
*/
|
||||
async function findTxtRecord(host, prefix, required = true) {
|
||||
export async function findTxtRecord(host, prefix, required = true) {
|
||||
const resolve = await axios(`https://dns.google/resolve?name=_.${encodeURIComponent(host)}&type=TXT`);
|
||||
if (resolve.data.Answer) {
|
||||
for (const head of resolve.data.Answer) {
|
||||
|
|
@ -51,9 +57,8 @@ async function findTxtRecord(host, prefix, required = true) {
|
|||
return null;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
md5,
|
||||
ensureDir,
|
||||
findTxtRecord,
|
||||
isHostBlacklisted,
|
||||
export function combineURLs(baseURL, relativeURL) {
|
||||
return relativeURL
|
||||
? baseURL.replace(/\/+$/, '') + '/' + relativeURL.replace(/^\/+/, '')
|
||||
: baseURL;
|
||||
}
|
||||
31
stat.js
31
stat.js
|
|
@ -1,8 +1,7 @@
|
|||
// separate stat endpoint
|
||||
|
||||
require('dotenv').config()
|
||||
const { execSync } = require('child_process');
|
||||
const http = require('http');
|
||||
import { config } from "dotenv";
|
||||
import { execSync } from "child_process";
|
||||
import http from "http";
|
||||
import { fileURLToPath } from "url";
|
||||
|
||||
const updateStat = function () {
|
||||
// run npm stat
|
||||
|
|
@ -12,13 +11,13 @@ const updateStat = function () {
|
|||
domains: parseInt(lines[lines.length - 1]),
|
||||
iat: Date.now(),
|
||||
exp: Date.now() + 1000 * 60 * 60 * 24,
|
||||
}
|
||||
};
|
||||
return stat;
|
||||
}
|
||||
};
|
||||
|
||||
let cacheStat = updateStat();
|
||||
|
||||
const listener = async function ( /** @type {import('http').IncomingMessage} */ req, /** @type {import('http').ServerResponse} */ res) {
|
||||
const listener = async function (/** @type {import('http').IncomingMessage} */ req, /** @type {import('http').ServerResponse} */ res) {
|
||||
try {
|
||||
// handle CORS
|
||||
res.setHeader('Access-Control-Allow-Origin', '*');
|
||||
|
|
@ -29,7 +28,6 @@ const listener = async function ( /** @type {import('http').IncomingMessage} */
|
|||
res.statusCode = 204;
|
||||
return;
|
||||
}
|
||||
|
||||
switch (req.url) {
|
||||
case '/':
|
||||
if (cacheStat.exp < Date.now()) {
|
||||
|
|
@ -48,21 +46,24 @@ const listener = async function ( /** @type {import('http').IncomingMessage} */
|
|||
break;
|
||||
}
|
||||
return;
|
||||
} catch (error) {
|
||||
}
|
||||
catch (error) {
|
||||
res.writeHead(400);
|
||||
res.write(error.message || 'Unknown error');
|
||||
} finally {
|
||||
}
|
||||
finally {
|
||||
res.end();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const server = http.createServer(listener);
|
||||
|
||||
if (require.main === module) {
|
||||
if (process.argv[1] === fileURLToPath(import.meta.url)) {
|
||||
config();
|
||||
const port = parseInt(process.env.STAT_PORT || "3000");
|
||||
server.listen(port, function () {
|
||||
console.log(`server start at port ${port}`);
|
||||
});
|
||||
} else {
|
||||
module.exports = server
|
||||
}
|
||||
|
||||
export default server;
|
||||
|
|
|
|||
Loading…
Add table
editor.link_modal.header
Reference in a new issue