From: Raphaël Gertz <git@rapsys.eu>
Date: Wed, 21 Sep 2016 00:32:59 +0000 (+0200)
Subject: Add caching of challenges
X-Git-Tag: 2.0.3~42
X-Git-Url: https://git.rapsys.eu/acme/commitdiff_plain/16f7acab036cbe9ba660eb0ff867551b866030b9

Add caching of challenges
---

diff --git a/acme.pm b/acme.pm
index e44c341..dcfabf3 100644
--- a/acme.pm
+++ b/acme.pm
@@ -11,9 +11,12 @@ our @ISA = qw(Exporter);
 
 # Load dependancies
 use Carp qw(carp confess);
+use Date::Parse qw(str2time);
+use DateTime;
 use Digest::SHA qw(sha256_base64);
 use Email::Valid;
 use File::Path qw(make_path);
+use File::Slurp qw(read_file write_file);
 use File::Temp; # qw( :seekable );
 use IPC::System::Simple qw(capturex);
 use JSON qw(encode_json decode_json);
@@ -37,6 +40,7 @@ use constant {
 
 	CERT_DIR => 'cert',
 	KEY_DIR => 'key',
+	PENDING_DIR => 'pending',
 
 	ACCOUNT_KEY => 'account.pem',
 	ACCOUNT_PUB => 'account.pub',
@@ -147,8 +151,10 @@ sub new {
 
 # Prepare environement
 sub prepare {
+	my ($self) = @_;
+
 	# Create all paths
-	make_path(CERT_DIR, KEY_DIR, {error => \my $err});
+	make_path(CERT_DIR, KEY_DIR, PENDING_DIR.'/'.$self->{mail}, {error => \my $err});
 	if (@$err) {
 		map {
 			my ($file, $msg) = %$_;
@@ -386,33 +392,58 @@ sub authorize {
 
 	# Create request for each domain
 	map {
-		# Post new-authz request
-		my $res = $self->_post($self->{'new-authz'}, {resource => 'new-authz', identifier => {type => 'dns', value => $_}, existing => 'accept'});
+		# Init content
+		my $content = undef;
+
+		# Init file
+		my $file = PENDING_DIR.'/'.$self->{mail}.'/'.$_;
+
+		# Load in content domain data or post a new authz request
+		#TODO: add check on cache file ???
+		if (
+			#XXX: use eval to workaround a fatal in decode_json
+			! defined eval {
+				# Check that file exists
+				-f $file &&
+				# Read it
+				($content = read_file($file)) &&
+				# Decode it
+				($content = decode_json($content)) &&
+				# Check expiration
+				(DateTime->from_epoch(epoch => str2time($content->{expires})) >= DateTime->now()->add(hours => 1))
+			}
+		) {
+			# Post new-authz request
+			my $res = $self->_post($self->{'new-authz'}, {resource => 'new-authz', identifier => {type => 'dns', value => $_}, existing => 'accept'});
 
-		# Handle error
-		unless ($res->is_success) {
-			confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
-		}
+			# Handle error
+			unless ($res->is_success) {
+				confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
+			}
 
-		# Decode content
-		my $content = decode_json($res->content);
+			# Decode content
+			$content = decode_json($res->content);
 
-		# Check domain
-		unless (defined $content->{identifier}{value} && $content->{identifier}{value} eq $_) {
-			confess 'domain matching '.$content->{identifier}{value}.' for '.$_.' failed: '.$res->status_line;
-		}
+			# Check domain
+			unless (defined $content->{identifier}{value} && $content->{identifier}{value} eq $_) {
+				confess 'domain matching '.$content->{identifier}{value}.' for '.$_.' failed: '.$res->status_line;
+			}
 
-		# Check status
-		unless ($content->{status} eq 'valid' or $content->{status} eq 'pending') {
-			confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
+			# Check status
+			unless ($content->{status} eq 'valid' or $content->{status} eq 'pending') {
+				confess 'POST '.$self->{'new-authz'}.' for '.$_.' failed: '.$res->status_line;
+			}
+
+			# Write to file
+			write_file($file, encode_json($content));
 		}
 
 		# Add challenge
 		%{$self->{challenges}{$_}} = (
 			status => undef,
 			expires => undef,
-			#dns_uri => undef,
-			#dns_token => undef,
+			dns_uri => undef,
+			dns_token => undef,
 			http_uri => undef,
 			http_token => undef,
 			http_challenge => undef
@@ -423,14 +454,17 @@ sub authorize {
 
 		# Save pending data
 		if ($content->{status} eq 'pending') {
+			#XXX: debug
+			print Dumper($content);
+
 			# Exctract validation data
 			foreach my $challenge (@{$content->{challenges}}) {
 				if ($challenge->{type} eq 'http-01') {
 					$self->{challenges}{$_}{http_uri} = $challenge->{uri};
 					$self->{challenges}{$_}{http_token} = $challenge->{token};
-				#} elsif ($challenge->{type} eq 'dns-01') {
-				#	$self->{challenges}{$_}{dns_uri} = $challenge->{uri};
-				#	$self->{challenges}{$_}{dns_token} = $challenge->{token};
+				} elsif ($challenge->{type} eq 'dns-01') {
+					$self->{challenges}{$_}{dns_uri} = $challenge->{uri};
+					$self->{challenges}{$_}{dns_token} = $challenge->{token};
 				}
 			}
 
@@ -439,41 +473,44 @@ sub authorize {
 			#$self->_dnsCheck('_acme-challenge.'.$_.'.', $self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint});
 
 			# Check http challenge
-			if ($self->_httpCheck(
-				# Well known uri
-				'http://'.$_.'/.well-known/acme-challenge/'.$self->{challenges}{$_}{http_token},
-				# token.thumbprint
-				$self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}
-			)) {
-				# Post challenge request
-				my $res = $self->_post($self->{challenges}{$_}{http_uri}, {resource => 'challenge', keyAuthorization => $self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}});
-
-				# Handle error
-				unless ($res->is_success) {
-					confess 'POST '.$self->{challenges}{$_}{http_uri}.' failed: '.$res->status_line;
-				}
-
-				# Extract content
-				my $content = decode_json($res->content);
-
-				# Save status
-				$self->{challenges}{$_}{status} = $content->{status};
-
-				# Add challenge uri to poll
-				#XXX: in case it is still pending
-				if ($content->{status} eq 'pending') {
-					$self->{challenges}{$_}{http_challenge} = $content->{uri};
-				}
-			} else {
-				# Set failed status
-				$self->{challenges}{$_}{status} = 'invalid';
-
-				# Display challenge to fix
-				print STDERR 'Makes http://'.$_.'/.well-known/acme-challenge/'.$self->{challenges}{$_}{http_token}.' return '.$self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}."\n";
-			}
+#			if ($self->_httpCheck(
+#				# Well known uri
+#				'http://'.$_.'/.well-known/acme-challenge/'.$self->{challenges}{$_}{http_token},
+#				# token.thumbprint
+#				$self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}
+#			)) {
+#				# Post challenge request
+#				my $res = $self->_post($self->{challenges}{$_}{http_uri}, {resource => 'challenge', keyAuthorization => $self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}});
+#
+#				# Handle error
+#				unless ($res->is_success) {
+#					confess 'POST '.$self->{challenges}{$_}{http_uri}.' failed: '.$res->status_line;
+#				}
+#
+#				# Extract content
+#				my $content = decode_json($res->content);
+#
+#				# Save status
+#				$self->{challenges}{$_}{status} = $content->{status};
+#
+#				# Add challenge uri to poll
+#				#XXX: in case it is still pending
+#				if ($content->{status} eq 'pending') {
+#					$self->{challenges}{$_}{http_challenge} = $content->{uri};
+#				}
+#			} else {
+#				# Set failed status
+#				$self->{challenges}{$_}{status} = 'invalid';
+#
+#				# Display challenge to fix
+#				print STDERR 'Makes http://'.$_.'/.well-known/acme-challenge/'.$self->{challenges}{$_}{http_token}.' return '.$self->{challenges}{$_}{http_token}.'.'.$self->{account}{thumbprint}."\n";
+#			}
 		}
 	} @{$self->{domains}};
 
+	#XXX: debug
+	exit EXIT_FAILURE;
+
 	# Poll pending
 	while (scalar map { $_->{status} eq 'pending' ? 1 : (); } values %{$self->{challenges}}) {
 		# Sleep