#include <assert.h>
#include <stdlib.h>
#include <apr_lib.h>
#include <apr_strings.h>
#include <apr_buckets.h>
#include <apr_hash.h>
#include <apr_uri.h>
#include "md.h"
#include "md_crypt.h"
#include "md_json.h"
#include "md_jws.h"
#include "md_http.h"
#include "md_log.h"
#include "md_reg.h"
#include "md_store.h"
#include "md_util.h"
#include "md_acme.h"
#include "md_acme_acct.h"
#include "md_acme_authz.h"
typedef struct {
md_proto_driver_t *driver;
const char *phase;
int complete;
md_pkey_t *privkey;
apr_array_header_t *pubcert;
md_cert_t *cert;
apr_array_header_t *chain;
const char *next_up_link;
md_acme_t *acme;
md_t *md;
const md_creds_t *ncreds;
apr_array_header_t *ca_challenges;
md_acme_authz_set_t *authz_set;
apr_interval_time_t authz_monitor_timeout;
const char *csr_der_64;
apr_interval_time_t cert_poll_timeout;
} md_acme_driver_t;
static apr_status_t ad_set_acct(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
md_t *md = ad->md;
apr_status_t rv = APR_SUCCESS;
int update = 0, acct_installed = 0;
ad->phase = "setup acme";
if (!ad->acme
&& APR_SUCCESS != (rv = md_acme_create(&ad->acme, d->p, md->ca_url, d->proxy_url))) {
goto out;
}
ad->phase = "choose account";
if (APR_SUCCESS == (rv = md_acme_use_acct_staged(ad->acme, d->store, md, d->p))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "re-using staged account");
md->ca_account = MD_ACME_ACCT_STAGED;
acct_installed = 1;
}
else if (APR_STATUS_IS_ENOENT(rv)) {
rv = APR_SUCCESS;
}
if (md->ca_account && !acct_installed) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "re-use account '%s'", md->ca_account);
rv = md_acme_use_acct(ad->acme, d->store, d->p, md->ca_account);
if (APR_STATUS_IS_ENOENT(rv) || APR_STATUS_IS_EINVAL(rv)) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "rejected %s", md->ca_account);
md->ca_account = NULL;
update = 1;
rv = APR_SUCCESS;
}
}
if (APR_SUCCESS == rv && !md->ca_account) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: looking at existing accounts",
d->proto->protocol);
if (APR_SUCCESS == md_acme_find_acct(ad->acme, d->store, d->p)) {
md->ca_account = md_acme_get_acct_id(ad->acme);
update = 1;
}
}
if (APR_SUCCESS == rv && !md->ca_account) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: creating new account",
d->proto->protocol);
if (!ad->md->contacts || apr_is_empty_array(md->contacts)) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p,
"no contact information for md %s", md->name);
rv = APR_EINVAL;
goto out;
}
if (APR_SUCCESS == (rv = md_acme_create_acct(ad->acme, d->p, md->contacts,
md->ca_agreement))
&& APR_SUCCESS == (rv = md_acme_acct_save_staged(ad->acme, d->store, md, d->p))) {
md->ca_account = MD_ACME_ACCT_STAGED;
update = 1;
}
}
out:
if (APR_SUCCESS == rv) {
const char *agreement = md_acme_get_agreement(ad->acme);
if (agreement && !md->ca_agreement) {
md->ca_agreement = agreement;
update = 1;
}
if (update) {
rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);
}
}
return rv;
}
static apr_status_t ad_setup_authz(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
md_t *md = ad->md;
md_acme_authz_t *authz;
int i, changed;
assert(ad->md);
assert(ad->acme);
ad->phase = "check authz";
rv = md_acme_authz_set_load(d->store, MD_SG_STAGING, md->name, &ad->authz_set, d->p);
if (!ad->authz_set || APR_STATUS_IS_ENOENT(rv)) {
ad->authz_set = md_acme_authz_set_create(d->p);
rv = APR_SUCCESS;
}
else if (APR_SUCCESS != rv) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: loading authz data", md->name);
md_acme_authz_set_purge(d->store, MD_SG_STAGING, d->p, md->name);
return APR_EAGAIN;
}
for (i = 0; i < ad->authz_set->authzs->nelts; ++i) {
authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);
if (!md_contains(md, authz->domain, 0)) {
md_acme_authz_set_remove(ad->authz_set, authz->domain);
changed = 1;
}
}
for (i = 0; i < md->domains->nelts && APR_SUCCESS == rv; ++i) {
const char *domain = APR_ARRAY_IDX(md->domains, i, const char *);
changed = 0;
authz = md_acme_authz_set_get(ad->authz_set, domain);
if (authz) {
rv = md_acme_authz_update(authz, ad->acme, d->store, d->p);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: updated authz for %s",
md->name, domain);
if (APR_SUCCESS != rv) {
md_acme_authz_set_remove(ad->authz_set, domain);
authz = NULL;
changed = 1;
}
}
if (!authz) {
rv = md_acme_authz_register(&authz, ad->acme, d->store, domain, d->p);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: created authz for %s",
md->name, domain);
if (APR_SUCCESS == rv) {
rv = md_acme_authz_set_add(ad->authz_set, authz);
changed = 1;
}
}
}
if (APR_SUCCESS == rv && changed) {
rv = md_acme_authz_set_save(d->store, d->p, MD_SG_STAGING, md->name, ad->authz_set, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, "%s: saved", md->name);
}
return rv;
}
static apr_status_t ad_start_challenges(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv = APR_SUCCESS;
md_acme_authz_t *authz;
int i, changed = 0;
assert(ad->md);
assert(ad->acme);
assert(ad->authz_set);
ad->phase = "start challenges";
for (i = 0; i < ad->authz_set->authzs->nelts && APR_SUCCESS == rv; ++i) {
authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: check AUTHZ for %s",
ad->md->name, authz->domain);
if (APR_SUCCESS != (rv = md_acme_authz_update(authz, ad->acme, d->store, d->p))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, "%s: check authz for %s",
ad->md->name, authz->domain);
break;
}
switch (authz->state) {
case MD_ACME_AUTHZ_S_VALID:
break;
case MD_ACME_AUTHZ_S_PENDING:
rv = md_acme_authz_respond(authz, ad->acme, d->store, ad->ca_challenges,
d->md->pkey_spec, d->p);
changed = 1;
break;
default:
rv = APR_EINVAL;
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p,
"%s: unexpected AUTHZ state %d at %s",
authz->domain, authz->state, authz->location);
break;
}
}
if (APR_SUCCESS == rv && changed) {
rv = md_acme_authz_set_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->authz_set, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, "%s: saved", ad->md->name);
}
return rv;
}
static apr_status_t check_challenges(void *baton, int attempt)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
md_acme_authz_t *authz;
apr_status_t rv = APR_SUCCESS;
int i;
for (i = 0; i < ad->authz_set->authzs->nelts && APR_SUCCESS == rv; ++i) {
authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: check AUTHZ for %s(%d. attempt)",
ad->md->name, authz->domain, attempt);
if (APR_SUCCESS == (rv = md_acme_authz_update(authz, ad->acme, d->store, d->p))) {
switch (authz->state) {
case MD_ACME_AUTHZ_S_VALID:
break;
case MD_ACME_AUTHZ_S_PENDING:
rv = APR_EAGAIN;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p,
"%s: status pending at %s", authz->domain, authz->location);
break;
default:
rv = APR_EINVAL;
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p,
"%s: unexpected AUTHZ state %d at %s",
authz->domain, authz->state, authz->location);
break;
}
}
}
return rv;
}
static apr_status_t ad_monitor_challenges(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
assert(ad->md);
assert(ad->acme);
assert(ad->authz_set);
ad->phase = "monitor challenges";
rv = md_util_try(check_challenges, d, 0, ad->authz_monitor_timeout, 0, 0, 1);
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, rv, d->p,
"%s: checked all domain authorizations", ad->md->name);
return rv;
}
static void get_up_link(md_proto_driver_t *d, apr_table_t *headers)
{
md_acme_driver_t *ad = d->baton;
ad->next_up_link = md_link_find_relation(headers, d->p, "up");
if (ad->next_up_link) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p,
"server reports up link as %s", ad->next_up_link);
}
}
static apr_status_t read_http_cert(md_cert_t **pcert, apr_pool_t *p,
const md_http_response_t *res)
{
apr_status_t rv = APR_SUCCESS;
if (APR_SUCCESS != (rv = md_cert_read_http(pcert, p, res))
&& APR_STATUS_IS_ENOENT(rv)) {
rv = APR_EAGAIN;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p,
"cert not in response from %s", res->req->url);
}
return rv;
}
static apr_status_t on_got_cert(md_acme_t *acme, const md_http_response_t *res, void *baton)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
apr_status_t rv = APR_SUCCESS;
(void)acme;
if (APR_SUCCESS == (rv = read_http_cert(&ad->cert, d->p, res))) {
rv = md_store_save(d->store, d->p, MD_SG_STAGING, ad->md->name, MD_FN_CERT,
MD_SV_CERT, ad->cert, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "cert parsed and saved");
if (APR_SUCCESS == rv) {
get_up_link(d, res->headers);
}
}
return rv;
}
static apr_status_t get_cert(void *baton, int attempt)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
(void)attempt;
return md_acme_GET(ad->acme, ad->md->cert_url, NULL, NULL, on_got_cert, d);
}
static apr_status_t ad_cert_poll(md_proto_driver_t *d, int only_once)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
assert(ad->md);
assert(ad->acme);
assert(ad->md->cert_url);
ad->phase = "poll certificate";
if (only_once) {
rv = get_cert(d, 0);
}
else {
rv = md_util_try(get_cert, d, 1, ad->cert_poll_timeout, 0, 0, 1);
}
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "poll for cert at %s", ad->md->cert_url);
return rv;
}
static apr_status_t on_init_csr_req(md_acme_req_t *req, void *baton)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
md_json_t *jpayload;
jpayload = md_json_create(req->p);
md_json_sets("new-cert", jpayload, MD_KEY_RESOURCE, NULL);
md_json_sets(ad->csr_der_64, jpayload, MD_KEY_CSR, NULL);
return md_acme_req_body_init(req, jpayload);
}
static apr_status_t csr_req(md_acme_t *acme, const md_http_response_t *res, void *baton)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
apr_status_t rv = APR_SUCCESS;
(void)acme;
ad->md->cert_url = apr_table_get(res->headers, "location");
if (!ad->md->cert_url) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p,
"cert created without giving its location header");
return APR_EINVAL;
}
if (APR_SUCCESS != (rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p,
"%s: saving cert url %s", ad->md->name, ad->md->cert_url);
return rv;
}
ad->next_up_link = NULL;
if (APR_SUCCESS == (rv = md_cert_read_http(&ad->cert, d->p, res))) {
rv = md_cert_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->cert, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "cert parsed and saved");
if (APR_SUCCESS == rv) {
get_up_link(d, res->headers);
}
}
else if (APR_STATUS_IS_ENOENT(rv)) {
rv = APR_SUCCESS;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p,
"cert not in response, need to poll %s", ad->md->cert_url);
}
return rv;
}
static apr_status_t ad_setup_certificate(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
md_pkey_t *privkey;
apr_status_t rv;
ad->phase = "setup cert privkey";
rv = md_pkey_load(d->store, MD_SG_STAGING, ad->md->name, &privkey, d->p);
if (APR_STATUS_IS_ENOENT(rv)) {
if (APR_SUCCESS == (rv = md_pkey_gen(&privkey, d->p, d->md->pkey_spec))) {
rv = md_pkey_save(d->store, d->p, MD_SG_STAGING, ad->md->name, privkey, 1);
}
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: generate privkey", ad->md->name);
}
if (APR_SUCCESS == rv) {
ad->phase = "setup csr";
rv = md_cert_req_create(&ad->csr_der_64, ad->md, privkey, d->p);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: create CSR", ad->md->name);
}
if (APR_SUCCESS == rv) {
ad->phase = "submit csr";
rv = md_acme_POST(ad->acme, ad->acme->new_cert, on_init_csr_req, NULL, csr_req, d);
}
if (APR_SUCCESS == rv) {
if (!ad->cert) {
rv = ad_cert_poll(d, 0);
}
}
return rv;
}
static apr_status_t on_add_chain(md_acme_t *acme, const md_http_response_t *res, void *baton)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
apr_status_t rv = APR_SUCCESS;
md_cert_t *cert;
const char *ct;
(void)acme;
ct = apr_table_get(res->headers, "Content-Type");
if (ct && !strcmp("application/x-pkcs7-mime", ct)) {
return APR_SUCCESS;
}
if (APR_SUCCESS == (rv = read_http_cert(&cert, d->p, res))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "chain cert parsed");
APR_ARRAY_PUSH(ad->chain, md_cert_t *) = cert;
if (APR_SUCCESS == rv) {
get_up_link(d, res->headers);
}
}
return rv;
}
static apr_status_t get_chain(void *baton, int attempt)
{
md_proto_driver_t *d = baton;
md_acme_driver_t *ad = d->baton;
const char *prev_link = NULL;
apr_status_t rv = APR_SUCCESS;
while (APR_SUCCESS == rv && ad->chain->nelts < 10) {
int nelts = ad->chain->nelts;
if (ad->next_up_link && (!prev_link || strcmp(prev_link, ad->next_up_link))) {
prev_link = ad->next_up_link;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p,
"next issuer is %s", ad->next_up_link);
rv = md_acme_GET(ad->acme, ad->next_up_link, NULL, NULL, on_add_chain, d);
if (APR_SUCCESS == rv && nelts == ad->chain->nelts) {
break;
}
}
else {
rv = APR_SUCCESS;
break;
}
}
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p,
"got chain with %d certs (%d. attempt)", ad->chain->nelts, attempt);
return rv;
}
static apr_status_t ad_chain_install(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
if (!ad->next_up_link) {
if (APR_SUCCESS != (rv = ad_cert_poll(d, 0))) {
return rv;
}
if (!ad->next_up_link) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p,
"server reports no link header 'up' for certificate at %s", ad->md->cert_url);
return APR_EINVAL;
}
}
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p,
"chain starts at %s", ad->next_up_link);
ad->chain = apr_array_make(d->p, 5, sizeof(md_cert_t *));
if (APR_SUCCESS == (rv = md_util_try(get_chain, d, 0, ad->cert_poll_timeout, 0, 0, 0))) {
rv = md_store_save(d->store, d->p, MD_SG_STAGING, ad->md->name, MD_FN_CHAIN,
MD_SV_CHAIN, ad->chain, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "chain fetched and saved");
}
return rv;
}
static apr_status_t acme_driver_init(md_proto_driver_t *d)
{
md_acme_driver_t *ad;
apr_status_t rv = APR_SUCCESS;
ad = apr_pcalloc(d->p, sizeof(*ad));
d->baton = ad;
ad->driver = d;
ad->authz_monitor_timeout = apr_time_from_sec(30);
ad->cert_poll_timeout = apr_time_from_sec(30);
ad->ca_challenges = apr_array_make(d->p, 3, sizeof(const char *));
if (d->challenge) {
APR_ARRAY_PUSH(ad->ca_challenges, const char*) = apr_pstrdup(d->p, d->challenge);
}
else if (d->md->ca_challenges && d->md->ca_challenges->nelts > 0) {
apr_array_cat(ad->ca_challenges, d->md->ca_challenges);
}
else {
APR_ARRAY_PUSH(ad->ca_challenges, const char*) = MD_AUTHZ_TYPE_HTTP01;
APR_ARRAY_PUSH(ad->ca_challenges, const char*) = MD_AUTHZ_TYPE_TLSSNI01;
}
if (!d->can_http && !d->can_https) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, d->p, "%s: the server seems neither "
"reachable via http (port 80) nor https (port 443). The ACME protocol "
"needs at least one of those so the CA can talk to the server and verify "
"a domain ownership.", d->md->name);
return APR_EGENERAL;
}
if (!d->can_http) {
ad->ca_challenges = md_array_str_remove(d->p, ad->ca_challenges, MD_AUTHZ_TYPE_HTTP01, 0);
}
if (!d->can_https) {
ad->ca_challenges = md_array_str_remove(d->p, ad->ca_challenges, MD_AUTHZ_TYPE_TLSSNI01, 0);
}
if (apr_is_empty_array(ad->ca_challenges)) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, d->p, "%s: specific CA challenge methods "
"have been configured, but the server is unable to use any of those. "
"For 'http-01' it needs to be reachable on port 80, for 'tls-sni-01'"
" port 443 is needed.", d->md->name);
return APR_EGENERAL;
}
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, 0, d->p, "%s: init driver", d->md->name);
return rv;
}
static apr_status_t acme_stage(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
int reset_staging = d->reset;
apr_status_t rv = APR_SUCCESS;
int renew = 1;
if (md_log_is_level(d->p, MD_LOG_DEBUG)) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, "%s: staging started, "
"state=%d, can_http=%d, can_https=%d, challenges='%s'",
d->md->name, d->md->state, d->can_http, d->can_https,
apr_array_pstrcat(d->p, ad->ca_challenges, ' '));
}
if (!reset_staging) {
rv = md_load(d->store, MD_SG_STAGING, d->md->name, &ad->md, d->p);
if (APR_SUCCESS == rv) {
if (md_is_newer(d->store, MD_SG_DOMAINS, MD_SG_STAGING, d->md->name, d->p)) {
reset_staging = 1;
}
}
else if (APR_STATUS_IS_ENOENT(rv)) {
reset_staging = 1;
rv = APR_SUCCESS;
}
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p,
"%s: checked staging area, will%s reset",
d->md->name, reset_staging? "" : " not");
}
if (reset_staging) {
rv = md_store_purge(d->store, d->p, MD_SG_STAGING, d->md->name);
if (APR_SUCCESS != rv && !APR_STATUS_IS_ENOENT(rv)) {
return rv;
}
rv = APR_SUCCESS;
ad->md = NULL;
}
if (ad->md && ad->md->state == MD_S_MISSING) {
rv = APR_INCOMPLETE;
goto out;
}
if (ad->md) {
rv = md_reg_creds_get(&ad->ncreds, d->reg, MD_SG_STAGING, d->md, d->p);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: checked creds", d->md->name);
if (APR_STATUS_IS_ENOENT(rv)) {
rv = APR_SUCCESS;
}
}
if (ad->ncreds && ad->ncreds->privkey && ad->ncreds->pubcert) {
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: all data staged", d->md->name);
renew = 0;
}
if (renew) {
if (APR_SUCCESS != (rv = md_acme_create(&ad->acme, d->p, d->md->ca_url, d->proxy_url))
|| APR_SUCCESS != (rv = md_acme_setup(ad->acme))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, "%s: setup ACME(%s)",
d->md->name, d->md->ca_url);
return rv;
}
if (!ad->md) {
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: setup staging", d->md->name);
md_store_purge(d->store, d->p, MD_SG_STAGING, d->md->name);
ad->md = md_copy(d->p, d->md);
ad->md->cert_url = NULL;
rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: save staged md",
ad->md->name);
}
if (APR_SUCCESS == rv && !ad->cert) {
md_cert_load(d->store, MD_SG_STAGING, ad->md->name, &ad->cert, d->p);
}
if (APR_SUCCESS == rv && !ad->cert) {
ad->phase = "get certificate";
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: need certificate", d->md->name);
rv = ad_set_acct(d);
if (APR_SUCCESS == rv) {
const char *required;
ad->phase = "check agreement";
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: check Terms-of-Service agreement", d->md->name);
rv = md_acme_check_agreement(ad->acme, d->p, ad->md->ca_agreement, &required);
if (APR_STATUS_IS_INCOMPLETE(rv) && required) {
ad->md->state = MD_S_MISSING;
md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p,
"%s: the CA requires you to accept the terms-of-service "
"as specified in <%s>. "
"Please read the document that you find at that URL and, "
"if you agree to the conditions, configure "
"\"MDCertificateAgreement url\" "
"with exactly that URL in your Apache. "
"Then (graceful) restart the server to activate.",
ad->md->name, required);
goto out;
}
}
if (APR_SUCCESS == rv && ad->md->cert_url) {
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: polling certificate", d->md->name);
rv = ad_cert_poll(d, 1);
if (APR_STATUS_IS_ENOENT(rv)) {
ad->md->cert_url = NULL;
rv = md_reg_update(d->reg, d->p, ad->md->name, ad->md, MD_UPD_CERT_URL);
}
}
if (APR_SUCCESS == rv && !ad->cert) {
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: setup new authorization", d->md->name);
if (APR_SUCCESS != (rv = ad_setup_authz(d))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: setup authz resource",
ad->md->name);
goto out;
}
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: setup new challenges", d->md->name);
if (APR_SUCCESS != (rv = ad_start_challenges(d))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: start challenges",
ad->md->name);
goto out;
}
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: monitoring challenge status", d->md->name);
if (APR_SUCCESS != (rv = ad_monitor_challenges(d))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: monitor challenges",
ad->md->name);
goto out;
}
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: creating certificate request", d->md->name);
if (APR_SUCCESS != (rv = ad_setup_certificate(d))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: setup certificate",
ad->md->name);
goto out;
}
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: received certificate", d->md->name);
}
}
if (APR_SUCCESS == rv && !ad->chain) {
md_chain_load(d->store, MD_SG_STAGING, ad->md->name, &ad->chain, d->p);
}
if (APR_SUCCESS == rv && !ad->chain) {
ad->phase = "install chain";
md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p,
"%s: retrieving certificate chain", d->md->name);
rv = ad_chain_install(d);
}
if (APR_SUCCESS == rv && !ad->pubcert) {
md_pubcert_load(d->store, MD_SG_STAGING, ad->md->name, &ad->pubcert, d->p);
}
if (APR_SUCCESS == rv && !ad->pubcert) {
ad->pubcert = apr_array_make(d->p, ad->chain->nelts + 1, sizeof(md_cert_t*));
APR_ARRAY_PUSH(ad->pubcert, md_cert_t *) = ad->cert;
apr_array_cat(ad->pubcert, ad->chain);
rv = md_pubcert_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->pubcert, 0);
}
if (APR_SUCCESS == rv && ad->cert) {
apr_time_t now = apr_time_now();
apr_interval_time_t max_delay, delay_activation;
d->stage_valid_from = md_cert_get_not_before(ad->cert);
if (d->md->state == MD_S_COMPLETE && d->md->expires > now) {
delay_activation = apr_time_from_sec(MD_SECS_PER_DAY);
if (delay_activation > (max_delay = d->md->expires - now)) {
delay_activation = max_delay;
}
d->stage_valid_from += delay_activation;
}
}
}
out:
return rv;
}
static apr_status_t acme_driver_stage(md_proto_driver_t *d)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
ad->phase = "ACME staging";
if (APR_SUCCESS == (rv = acme_stage(d))) {
ad->phase = "staging done";
}
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: %s, %s",
d->md->name, d->proto->protocol, ad->phase);
return rv;
}
static apr_status_t acme_preload(md_store_t *store, md_store_group_t load_group,
const char *name, const char *proxy_url, apr_pool_t *p)
{
apr_status_t rv;
md_pkey_t *privkey, *acct_key;
md_t *md;
apr_array_header_t *pubcert;
struct md_acme_acct_t *acct;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, p, "%s: preload start", name);
if (APR_SUCCESS != (rv = md_load(store, MD_SG_STAGING, name, &md, p))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, "%s: loading md json", name);
return rv;
}
if (APR_SUCCESS != (rv = md_pkey_load(store, MD_SG_STAGING, name, &privkey, p))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, "%s: loading staging private key", name);
return rv;
}
if (APR_SUCCESS != (rv = md_pubcert_load(store, MD_SG_STAGING, name, &pubcert, p))) {
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, "%s: loading pubcert", name);
return rv;
}
rv = md_acme_acct_load(&acct, &acct_key, store, MD_SG_STAGING, name, p);
if (APR_STATUS_IS_ENOENT(rv)) {
acct = NULL;
acct_key = NULL;
rv = APR_SUCCESS;
}
else if (APR_SUCCESS != rv) {
return rv;
}
md_acme_authz_set_purge(store, MD_SG_STAGING, p, name);
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p,
"%s: staged data load, purging tmp space", name);
rv = md_store_purge(store, p, load_group, name);
if (APR_SUCCESS != rv) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: error purging preload storage", name);
return rv;
}
if (acct) {
md_acme_t *acme;
if (APR_SUCCESS != (rv = md_acme_create(&acme, p, md->ca_url, proxy_url))
|| APR_SUCCESS != (rv = md_acme_acct_save(store, p, acme, acct, acct_key))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: error saving acct", name);
return rv;
}
md->ca_account = acct->id;
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, "%s: saved ACME account %s",
name, acct->id);
}
if (APR_SUCCESS != (rv = md_save(store, p, load_group, md, 1))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: saving md json", name);
return rv;
}
if (APR_SUCCESS != (rv = md_pubcert_save(store, p, load_group, name, pubcert, 1))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: saving cert chain", name);
return rv;
}
if (APR_SUCCESS != (rv = md_pkey_save(store, p, load_group, name, privkey, 1))) {
md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: saving private key", name);
return rv;
}
return rv;
}
static apr_status_t acme_driver_preload(md_proto_driver_t *d, md_store_group_t group)
{
md_acme_driver_t *ad = d->baton;
apr_status_t rv;
ad->phase = "ACME preload";
if (APR_SUCCESS == (rv = acme_preload(d->store, group, d->md->name, d->proxy_url, d->p))) {
ad->phase = "preload done";
}
md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: %s, %s",
d->md->name, d->proto->protocol, ad->phase);
return rv;
}
static md_proto_t ACME_PROTO = {
MD_PROTO_ACME, acme_driver_init, acme_driver_stage, acme_driver_preload
};
apr_status_t md_acme_protos_add(apr_hash_t *protos, apr_pool_t *p)
{
(void)p;
apr_hash_set(protos, MD_PROTO_ACME, sizeof(MD_PROTO_ACME)-1, &ACME_PROTO);
return APR_SUCCESS;
}